{
  "Event": {
    "analysis": "1",
    "date": "2026-03-17",
    "extends_uuid": "",
    "info": "[Threat Intel] Iranian Botnet Exposed via Open Directory: 15-Node Relay Network and Active C2",
    "protected": false,
    "publish_timestamp": "1774245785",
    "published": true,
    "threat_level_id": "2",
    "timestamp": "1774245785",
    "uuid": "03f49eb5-40bb-4288-8dcf-bed5d6ada45b",
    "Orgc": {
      "name": "Rectifyq",
      "uuid": "cd9bd516-61fa-476b-980f-2f8de03992d4"
    },
    "Tag": [
      {
        "colour": "#cf6788",
        "local": false,
        "name": "misp-galaxy:producer=\"Hunt.io\"",
        "relationship_type": ""
      },
      {
        "colour": "#ffffff",
        "local": false,
        "name": "tlp:clear",
        "relationship_type": ""
      },
      {
        "colour": "#004646",
        "local": false,
        "name": "type:OSINT",
        "relationship_type": ""
      },
      {
        "colour": "#b94b1d",
        "local": false,
        "name": "rectifyq:mitre-att&ck=\"none-from-src\"",
        "relationship_type": ""
      },
      {
        "colour": "#b94b1d",
        "local": false,
        "name": "rectifyq:mitre-att&ck=\"from-OTX\"",
        "relationship_type": ""
      },
      {
        "colour": "#7773ac",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"External Remote Services - T1133\"",
        "relationship_type": ""
      },
      {
        "colour": "#aad818",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"SSH - T1021.004\"",
        "relationship_type": ""
      },
      {
        "colour": "#e00500",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Remote Access Tools - T1219\"",
        "relationship_type": ""
      },
      {
        "colour": "#9f6bd9",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"System Network Configuration Discovery - T1016\"",
        "relationship_type": ""
      },
      {
        "colour": "#8ee4ab",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Software Deployment Tools - T1072\"",
        "relationship_type": ""
      },
      {
        "colour": "#f07d7c",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Non-Standard Port - T1571\"",
        "relationship_type": ""
      },
      {
        "colour": "#7d37d8",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Python - T1059.006\"",
        "relationship_type": ""
      },
      {
        "colour": "#37ffb5",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Network Denial of Service - T1498\"",
        "relationship_type": ""
      },
      {
        "colour": "#4c0fbb",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Ingress Tool Transfer - T1105\"",
        "relationship_type": ""
      },
      {
        "colour": "#20962d",
        "local": false,
        "name": "misp-galaxy:target-information=\"Finland\"",
        "relationship_type": ""
      },
      {
        "colour": "#20a667",
        "local": false,
        "name": "misp-galaxy:target-information=\"Iran\"",
        "relationship_type": ""
      },
      {
        "colour": "#49a260",
        "local": false,
        "name": "rectifyq:category=\"threat\"",
        "relationship_type": ""
      },
      {
        "colour": "#120046",
        "local": false,
        "name": "rectifyq:sub-category=\"infra-profile\"",
        "relationship_type": ""
      },
      {
        "colour": "#1c006d",
        "local": false,
        "name": "rectifyq:topic=\"geopolitical\"",
        "relationship_type": ""
      },
      {
        "colour": "#ffd12e",
        "local": false,
        "name": "rectifyq:target=\"broad-based\"",
        "relationship_type": ""
      },
      {
        "colour": "#55acee",
        "local": false,
        "name": "rectifyq:MY-relevancy=\"potentially-relevant\"",
        "relationship_type": ""
      },
      {
        "colour": "#626567",
        "local": false,
        "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
        "relationship_type": ""
      },
      {
        "colour": "#626567",
        "local": false,
        "name": "rectifyq:no-samples-in=\"Tria.ge\"",
        "relationship_type": ""
      },
      {
        "colour": "#3800d9",
        "local": false,
        "name": "rectifyq:action-taken=\"VT-comment\"",
        "relationship_type": ""
      },
      {
        "colour": "#3d00e9",
        "local": false,
        "name": "rectifyq:action-taken=\"telegram\"",
        "relationship_type": ""
      }
    ],
    "Attribute": [
      {
        "category": "External analysis",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1773802807",
        "to_ids": false,
        "type": "link",
        "uuid": "ef1e00c1-9160-4524-aafe-22576d64503a",
        "value": "https://hunt.io/blog/iran-botnet-operation-open-directory"
      },
      {
        "category": "Other",
        "comment": "Description",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1773802807",
        "to_ids": false,
        "type": "text",
        "uuid": "1212ba09-6ef6-4d41-a587-93d09e1e7096",
        "value": "An Iranian threat actor's operational infrastructure was exposed through an open directory, revealing a 15-node relay network spanning Finland and Iran, an SSH-based botnet framework, and an active command and control server. The exposed bash history documented the full operation, including tunnel deployment, DDoS tooling development, and botnet creation. The actor used on-host compilation to evade detection and leveraged a Python script for mass SSH deployment. The botnet client, compiled and renamed 'hex' on infected hosts, showed automatic reconnection capabilities. This operation appears to be financially or personally motivated rather than state-directed, with infrastructure dual-purposed for censorship bypass and attack operations."
      },
      {
        "category": "Other",
        "comment": "Summary",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1773802807",
        "to_ids": false,
        "type": "text",
        "uuid": "d0e4e333-e270-4447-b3d7-02172687f8b5",
        "value": "Name: Iranian Botnet Exposed via Open Directory: 15-Node Relay Network and Active C2\nAuthor: AlienVault\nAdversary: \nTags: [\"ssh\", \"open directory\", \"mhddos\", \"ddos\", \"botnet\", \"iranian\", \"censorship bypass\", \"relay network\", \"c2\"]\nTgtd countries: [\"Finland\", \"Iran, Islamic Republic of\"]\nMlwr families: [\"MHDDOS\"]\nAttack_ids: [\"T1133\", \"T1021.004\", \"T1219\", \"T1016\", \"T1072\", \"T1571\", \"T1059.006\", \"T1498\", \"T1105\"]\nIndustries: []"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1774235193",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "6a53e387-78b2-43c5-9931-d63c91978a56",
        "value": "185.221.239.121",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check:23/03/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1774234959",
        "to_ids": true,
        "type": "sha256",
        "uuid": "a6c0f1ce-f030-4aac-80bb-369cb7f9eb55",
        "value": "1e3a7e978953bbe040cc5e0743b926fe3407ab949370b791d2de6655a704ef73",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check:23/03/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1774234960",
        "to_ids": true,
        "type": "sha256",
        "uuid": "4fc0a99f-72b2-44aa-b89b-230fb1f31928",
        "value": "5c41c075bfb1fcb85095b539e0c97a07c62379518ae1289677b118c550afb5d0",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check:23/03/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1774234961",
        "to_ids": true,
        "type": "sha256",
        "uuid": "f48f1bb5-b2bf-4096-8319-b56a3a8360b2",
        "value": "73048cb6506443e482935586edb2af3f6a0c8ca44b061172b5be826a0f1e92f6",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check:23/03/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1774234963",
        "to_ids": true,
        "type": "sha256",
        "uuid": "a6fd9721-76de-42f5-8a34-838a2b71125f",
        "value": "acfd59afbb50331925cc3980e7c40044807e0a8bf44e0c38f9f0af9988ea060e",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check:23/03/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1774234965",
        "to_ids": true,
        "type": "sha256",
        "uuid": "75da8641-9249-4ddc-afac-3255dccbd1bc",
        "value": "ba318b710978c277a1ad6f2de81d7d2402607036d0c0e777ec75bc6b6e428974",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1774235215",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "a800088f-1a69-48e4-b5ef-49c8af8bc02b",
        "value": "185.221.239.160",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1774235238",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "db7d6033-7743-45e8-901b-c47452d2df0b",
        "value": "185.221.239.162",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1774235260",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "f22c05d5-fcd1-474a-8880-179b88f680d1",
        "value": "185.221.239.188",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1774235282",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "aee00810-d932-4c5c-bc24-f578cb3ce76a",
        "value": "185.221.239.198",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1774235304",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "d5d874b1-9b86-465c-9249-e233024c77ea",
        "value": "185.221.239.84",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1774235326",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "cb53e8a0-d613-45d2-ac22-c46e84c101ae",
        "value": "185.236.38.79",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1774235349",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "43ff4251-b49d-41a8-ad91-df54addf9015",
        "value": "185.236.38.81",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1774235371",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "76002943-b47f-40ab-b780-6ac448ec4ce0",
        "value": "194.147.222.151",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1774235393",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "91a97c0f-b37b-42fb-a21a-ad373c0b7139",
        "value": "194.147.222.183",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1774235415",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "3d38a829-6c68-4293-b8e0-4a635cee483f",
        "value": "5.42.223.60",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1774235437",
        "to_ids": true,
        "type": "domain",
        "uuid": "7b5cceed-ca2a-461f-9637-02fb4c524858",
        "value": "hzf09853311.xyz",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1774235459",
        "to_ids": true,
        "type": "domain",
        "uuid": "c3d41c06-c385-4c16-91f9-795703351f8e",
        "value": "parsashonam-sub.blog",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1774235481",
        "to_ids": true,
        "type": "domain",
        "uuid": "58ef56fc-7370-4538-acd6-9068dc134c0d",
        "value": "server21.org",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1774235503",
        "to_ids": true,
        "type": "hostname",
        "uuid": "c7ef876b-0715-4483-9ace-2efa02e28123",
        "value": "bot.kilashin.info",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1774235525",
        "to_ids": true,
        "type": "hostname",
        "uuid": "8b135b4e-a08d-43eb-981a-8aedbc4ed9fc",
        "value": "down.celltoocall.com",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1774235548",
        "to_ids": true,
        "type": "hostname",
        "uuid": "e2675b58-11dc-46a4-935b-5e9e8c88a9be",
        "value": "finland1.server21.org",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1774235570",
        "to_ids": true,
        "type": "hostname",
        "uuid": "132a80df-47d3-405e-9ecf-4a7320b7aa6f",
        "value": "finland2.server21.org",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1774235592",
        "to_ids": true,
        "type": "hostname",
        "uuid": "4e1b613c-5975-4b60-bf72-b79aa1103772",
        "value": "finland4.server21.org",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1774235614",
        "to_ids": true,
        "type": "hostname",
        "uuid": "3bcf620a-0aad-4064-a583-79d0d799d53c",
        "value": "finland5.server21.org",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1774235636",
        "to_ids": true,
        "type": "hostname",
        "uuid": "19ef1b26-f390-4c84-9960-2c1400b4d635",
        "value": "finland6.server21.org",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1774235659",
        "to_ids": true,
        "type": "hostname",
        "uuid": "292509fe-0003-4ed3-9341-7f727a62f723",
        "value": "re.dangidog.site",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1774235681",
        "to_ids": true,
        "type": "hostname",
        "uuid": "c1f22362-2a0f-482e-8c7f-9cd288cc1e56",
        "value": "robot5.server21.org",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1774235703",
        "to_ids": true,
        "type": "hostname",
        "uuid": "ee4b5690-63e0-4bbf-9719-5616da6e1133",
        "value": "sir.ffakhar.ir",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1774235725",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "c5e6dc47-78df-40d7-86d1-f295b8aa1de9",
        "value": "65.109.187.102",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1774235747",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "671ebb23-662f-42f5-865d-35b4a8f4e467",
        "value": "65.109.184.58",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1774235769",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "75f9da98-247a-46a9-95e4-1261bc910f85",
        "value": "65.109.196.138",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1774235791",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "df1c42ed-478e-4e66-827b-f4e7d50e13bc",
        "value": "65.109.204.0",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1774235813",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "2fb56d34-244d-4ccc-9b21-217dffef3eb1",
        "value": "65.109.209.147",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1774235835",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "028d3841-7ff7-4d72-978c-7338a8cc9984",
        "value": "65.109.213.131",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1774235857",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "bd37e1ea-acf3-4fd8-bf7a-6803396d34f1",
        "value": "65.109.214.203",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1774235879",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "4a0d83a5-b73d-4488-986a-8f161d251733",
        "value": "212.74.39.128",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      }
    ]
  }
}