{
  "Event": {
    "analysis": "1",
    "date": "2026-06-10",
    "extends_uuid": "",
    "info": "[Threat Intel] Phantom Casino",
    "protected": false,
    "publish_timestamp": "1782536285",
    "published": true,
    "threat_level_id": "2",
    "timestamp": "1782536241",
    "uuid": "2603f2d2-024d-4874-a26c-074a965ff561",
    "Orgc": {
      "name": "Rectifyq",
      "uuid": "cd9bd516-61fa-476b-980f-2f8de03992d4"
    },
    "Tag": [
      {
        "colour": "#ffffff",
        "local": false,
        "name": "tlp:clear",
        "relationship_type": ""
      },
      {
        "colour": "#004646",
        "local": false,
        "name": "type:OSINT",
        "relationship_type": ""
      },
      {
        "colour": "#49a260",
        "local": false,
        "name": "rectifyq:category=\"threat\"",
        "relationship_type": ""
      },
      {
        "colour": "#120046",
        "local": false,
        "name": "rectifyq:sub-category=\"infra-profile\"",
        "relationship_type": ""
      },
      {
        "colour": "#130049",
        "local": false,
        "name": "rectifyq:sub-category=\"campaign-analysis\"",
        "relationship_type": ""
      },
      {
        "colour": "#ffd12e",
        "local": false,
        "name": "rectifyq:target=\"broad-based\"",
        "relationship_type": ""
      },
      {
        "colour": "#dd2e44",
        "local": false,
        "name": "rectifyq:MY-relevancy=\"relevant\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:target-information=\"Malaysia\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:sector=\"Education\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:sector=\"Government, Administration\"",
        "relationship_type": ""
      },
      {
        "colour": "#f1dfed",
        "local": false,
        "name": "rectifyq:TA-category=\"Cybercrime\"",
        "relationship_type": ""
      },
      {
        "colour": "#9feaf0",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Exploit Public-Facing Application - T1190\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"SEO Poisoning - T1608.006\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Drive-by Compromise - T1189\"",
        "relationship_type": ""
      },
      {
        "colour": "#454726",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Compromise Infrastructure - T1584\"",
        "relationship_type": ""
      },
      {
        "colour": "#626567",
        "local": false,
        "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
        "relationship_type": ""
      },
      {
        "colour": "#626567",
        "local": false,
        "name": "rectifyq:no-samples-in=\"Tria.ge\"",
        "relationship_type": ""
      },
      {
        "colour": "#3800d9",
        "local": false,
        "name": "rectifyq:action-taken=\"VT-comment\"",
        "relationship_type": ""
      },
      {
        "colour": "#3d00e9",
        "local": false,
        "name": "rectifyq:action-taken=\"telegram\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:software-vendor=\"WhatsApp\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:software-vendor=\"alibaba\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:software-vendor=\"cloudflare\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:software-vendor=\"facebook\"",
        "relationship_type": ""
      }
    ],
    "Attribute": [
      {
        "category": "External analysis",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782397166",
        "to_ids": false,
        "type": "link",
        "uuid": "5dc31eb0-344c-4c00-8365-29ad1996eae7",
        "value": "https://www.syntx.com.my/blog/phantom-casino"
      },
      {
        "category": "Attribution",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782397178",
        "to_ids": false,
        "type": "threat-actor",
        "uuid": "c0c5243c-628e-4737-ba30-5f880439fe2e",
        "value": "Golden Wheel"
      },
      {
        "category": "Network activity",
        "comment": "wallet, merchant 50703",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782533084",
        "to_ids": true,
        "type": "domain",
        "uuid": "c44d3140-4d79-4943-bef6-8f6964f0333c",
        "value": "axas888.net",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "second axas888 domain",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782533105",
        "to_ids": true,
        "type": "domain",
        "uuid": "58d8d435-8ea9-48e6-b81e-540019660c90",
        "value": "axas888.com",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "wallet, merchant 60569",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782533126",
        "to_ids": true,
        "type": "domain",
        "uuid": "e025680b-fef0-4e12-abd5-e24eb9dcd397",
        "value": "cikgu88.com",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "operator-controlled CDN serving the wallet platform",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782533147",
        "to_ids": true,
        "type": "hostname",
        "uuid": "5e56a307-3bfd-4731-a8eb-96c4b5897e03",
        "value": "cdn.vefrop.com",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "Alibaba Cloud SG, AS45102",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782533168",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "9b3100f1-b38f-43f4-a83f-84b57642ab52",
        "value": "47.84.198.177",
        "Tag": [
          {
            "colour": "#836891",
            "local": false,
            "name": "asn:asn=\"45102\"",
            "relationship_type": ""
          },
          {
            "colour": "#692b04",
            "local": false,
            "name": "asn:as-owner=\"ALIBABA-CN-NET Alibaba US Technology Co., Ltd.\"",
            "relationship_type": ""
          },
          {
            "colour": "#9256df",
            "local": false,
            "name": "asn:as-country=\"CN\"",
            "relationship_type": ""
          },
          {
            "colour": "#0088cc",
            "local": false,
            "name": "misp-galaxy:country=\"china\"",
            "relationship_type": ""
          },
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "Alibaba Cloud SG, AS45102",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782533189",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "6ad53294-f7a9-4b36-b946-b807b4de29e1",
        "value": "47.237.119.71",
        "Tag": [
          {
            "colour": "#836891",
            "local": false,
            "name": "asn:asn=\"45102\"",
            "relationship_type": ""
          },
          {
            "colour": "#692b04",
            "local": false,
            "name": "asn:as-owner=\"ALIBABA-CN-NET Alibaba US Technology Co., Ltd.\"",
            "relationship_type": ""
          },
          {
            "colour": "#9256df",
            "local": false,
            "name": "asn:as-country=\"CN\"",
            "relationship_type": ""
          },
          {
            "colour": "#0088cc",
            "local": false,
            "name": "misp-galaxy:country=\"china\"",
            "relationship_type": ""
          },
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "Cloudflare Pages mirror (one of many, rotates)",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782533210",
        "to_ids": true,
        "type": "hostname",
        "uuid": "5cd44140-4380-4668-af10-88d52ede08bb",
        "value": "max-cv4.pages.dev",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "cloaking gate (now dead)",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782533231",
        "to_ids": true,
        "type": "domain",
        "uuid": "8a04cac5-6f76-45c7-8d95-ba63c6f8b623",
        "value": "hljnx.com",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "operator bio-link, 301s to the WhatsApp agent",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782533252",
        "to_ids": true,
        "type": "url",
        "uuid": "f390d4af-715a-4e57-875b-eb1dd3222bbe",
        "value": "https://linkmy.pro/mega888",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "External analysis",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782397323",
        "to_ids": false,
        "type": "link",
        "uuid": "58ccf3da-50be-414b-8041-b244e5a75d44",
        "value": "https://soyacincau.com/2023/12/13/malaysia-jakim-halal-portal-hacked-last-saturday/"
      },
      {
        "category": "External analysis",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782397323",
        "to_ids": false,
        "type": "link",
        "uuid": "1d57c0fd-d2f5-4148-9a5d-0c3c416e16fb",
        "value": "https://webcare.co/malaysian-government-website-hacked-sept-2024/"
      },
      {
        "category": "External analysis",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782397323",
        "to_ids": false,
        "type": "link",
        "uuid": "51e0701f-527a-434a-a248-dceb44eb698b",
        "value": "https://www.facebook.com/groups/developerkaki/posts/2428075947538304/"
      },
      {
        "category": "External analysis",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782397323",
        "to_ids": false,
        "type": "link",
        "uuid": "6a032ac4-fce5-4399-9501-6c20ff078d73",
        "value": "https://www.reddit.com/r/malaysia/comments/1li7dl2/i_found_a_govmy_link_that_is_redirecting_to_sport/"
      },
      {
        "category": "External analysis",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782397341",
        "to_ids": false,
        "type": "link",
        "uuid": "08305793-b92e-46ad-9b77-be59e6c66656",
        "value": "https://pokde.net/system/software/web-application/my-halal-website-hack"
      }
    ]
  }
}