{
  "Event": {
    "analysis": "1",
    "date": "2026-07-13",
    "extends_uuid": "",
    "info": "[Threat Intel] Tomorrowland 2026, Belgium: People of Tomorrow, Targets of Today",
    "protected": false,
    "publish_timestamp": "1784437687",
    "published": true,
    "threat_level_id": "3",
    "timestamp": "1784437686",
    "uuid": "2d4e8613-ff77-4298-8758-1cb722bb21e0",
    "Orgc": {
      "name": "Rectifyq",
      "uuid": "cd9bd516-61fa-476b-980f-2f8de03992d4"
    },
    "Tag": [
      {
        "colour": "#7bf409",
        "local": false,
        "name": "misp-galaxy:producer=\"CloudSEK\"",
        "relationship_type": ""
      },
      {
        "colour": "#ffffff",
        "local": false,
        "name": "tlp:clear",
        "relationship_type": ""
      },
      {
        "colour": "#004646",
        "local": false,
        "name": "type:OSINT",
        "relationship_type": ""
      },
      {
        "colour": "#b94b1d",
        "local": false,
        "name": "rectifyq:mitre-att&ck=\"none-from-src\"",
        "relationship_type": ""
      },
      {
        "colour": "#b94b1d",
        "local": false,
        "name": "rectifyq:mitre-att&ck=\"from-OTX\"",
        "relationship_type": ""
      },
      {
        "colour": "#77a4ec",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Email Collection - T1114\"",
        "relationship_type": ""
      },
      {
        "colour": "#cb74ba",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Search Victim-Owned Websites - T1594\"",
        "relationship_type": ""
      },
      {
        "colour": "#47d9d3",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Malicious File - T1204.002\"",
        "relationship_type": ""
      },
      {
        "colour": "#68f2ff",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Data from Local System - T1005\"",
        "relationship_type": ""
      },
      {
        "colour": "#5c59c9",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Email Accounts - T1586.002\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Upload Malware - T1608.001\"",
        "relationship_type": ""
      },
      {
        "colour": "#bce57a",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Exfiltration Over Web Service - T1567\"",
        "relationship_type": ""
      },
      {
        "colour": "#82eae0",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Domains - T1583.001\"",
        "relationship_type": ""
      },
      {
        "colour": "#65d24c",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Gather Victim Identity Information - T1589\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Web Portal Capture - T1056.003\"",
        "relationship_type": ""
      },
      {
        "colour": "#2da3e8",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Gather Victim Network Information - T1590\"",
        "relationship_type": ""
      },
      {
        "colour": "#1b95cd",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Phishing - T1566\"",
        "relationship_type": ""
      },
      {
        "colour": "#efb098",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Social Media Accounts - T1585.001\"",
        "relationship_type": ""
      },
      {
        "colour": "#356c41",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Encrypted Channel - T1573\"",
        "relationship_type": ""
      },
      {
        "colour": "#07a4a1",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Data Encoding - T1132\"",
        "relationship_type": ""
      },
      {
        "colour": "#a0d02a",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Phishing for Information - T1598\"",
        "relationship_type": ""
      },
      {
        "colour": "#92e858",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Web Protocols - T1071.001\"",
        "relationship_type": ""
      },
      {
        "colour": "#a7b0e0",
        "local": false,
        "name": "misp-galaxy:target-information=\"Belgium\"",
        "relationship_type": ""
      },
      {
        "colour": "#74d147",
        "local": false,
        "name": "misp-galaxy:target-information=\"Czech Republic\"",
        "relationship_type": ""
      },
      {
        "colour": "#15ccfd",
        "local": false,
        "name": "misp-galaxy:target-information=\"France\"",
        "relationship_type": ""
      },
      {
        "colour": "#63bd05",
        "local": false,
        "name": "misp-galaxy:target-information=\"Sweden\"",
        "relationship_type": ""
      },
      {
        "colour": "#49a260",
        "local": false,
        "name": "rectifyq:category=\"threat\"",
        "relationship_type": ""
      },
      {
        "colour": "#130049",
        "local": false,
        "name": "rectifyq:sub-category=\"campaign-analysis\"",
        "relationship_type": ""
      },
      {
        "colour": "#ffd12e",
        "local": false,
        "name": "rectifyq:target=\"broad-based\"",
        "relationship_type": ""
      },
      {
        "colour": "#55acee",
        "local": false,
        "name": "rectifyq:MY-relevancy=\"potentially-relevant\"",
        "relationship_type": ""
      },
      {
        "colour": "#626567",
        "local": false,
        "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
        "relationship_type": ""
      },
      {
        "colour": "#626567",
        "local": false,
        "name": "rectifyq:no-samples-in=\"Tria.ge\"",
        "relationship_type": ""
      },
      {
        "colour": "#3800d9",
        "local": false,
        "name": "rectifyq:action-taken=\"VT-comment\"",
        "relationship_type": ""
      },
      {
        "colour": "#3d00e9",
        "local": false,
        "name": "rectifyq:action-taken=\"telegram\"",
        "relationship_type": ""
      }
    ],
    "Attribute": [
      {
        "category": "External analysis",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784026813",
        "to_ids": false,
        "type": "link",
        "uuid": "8da04920-b428-4d1e-895e-76ac78c8cf92",
        "value": "https://www.cloudsek.com/blog/tomorrowland-2026-fake-ticket-scams-belgium"
      },
      {
        "category": "Other",
        "comment": "Description",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784026813",
        "to_ids": false,
        "type": "text",
        "uuid": "f016a933-7409-41ed-b8a4-930374568439",
        "value": "Tomorrowland Belgium 2026, spanning two weekends in July at De Schorre in Boom, sold out rapidly, creating opportunities for cybercriminals. Investigation uncovered approximately a dozen fraudulent websites impersonating the festival brand to target ticket seekers and travellers. These scams include fake ticket shops mimicking official sales with countdown timers and fraudulent biometric checks, travel sites offering bogus accommodation and transport packages, and affiliate schemes. The operations harvest complete identity data, payment credentials, and personal information through sophisticated social engineering. Victims lose money with no recourse, face identity theft risks, and ultimately receive invalid or non-existent tickets. The scammers exploit high demand, tight supply, and rushed purchasing decisions, with sites registered weeks in advance and pushed hardest when official tickets are sold out."
      },
      {
        "category": "Other",
        "comment": "Summary",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784026813",
        "to_ids": false,
        "type": "text",
        "uuid": "faaae3a7-320f-4c76-8dd9-3207669747d4",
        "value": "Name: Tomorrowland 2026, Belgium: People of Tomorrow, Targets of Today\nAuthor: AlienVault\nAdversary: \nTags: [\"social-engineering\", \"payment-fraud\", \"phishing\", \"festival-scam\", \"tomorrowland\", \"fake-ticket-shops\"]\nTgtd countries: [\"Belgium\", \"Czechia\", \"France\", \"Sweden\"]\nMlwr families: []\nAttack_ids: [\"T1114\", \"T1594\", \"T1204.002\", \"T1005\", \"T1586.002\", \"T1608.001\", \"T1567\", \"T1583.001\", \"T1589\", \"T1056.003\", \"T1590\", \"T1566\", \"T1585.001\", \"T1573\", \"T1132\", \"T1598\", \"T1071.001\"]\nIndustries: [\"Hospitality\", \"Entertainment\"]"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784436496",
        "to_ids": true,
        "type": "domain",
        "uuid": "c31e3c05-a19c-446b-b559-5cc826916827",
        "value": "tomorrowland-booking.com",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784436517",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "4205e554-d184-4620-8210-8c5e5d562b50",
        "value": "45.131.214.47",
        "Tag": [
          {
            "colour": "#d5c573",
            "local": false,
            "name": "asn:asn=\"60781\"",
            "relationship_type": ""
          },
          {
            "colour": "#c0ef26",
            "local": false,
            "name": "asn:as-owner=\"LEASEWEB-NL-AMS-01 Netherlands\"",
            "relationship_type": ""
          },
          {
            "colour": "#3ae32e",
            "local": false,
            "name": "asn:as-country=\"NL\"",
            "relationship_type": ""
          },
          {
            "colour": "#768323",
            "local": false,
            "name": "misp-galaxy:country=\"netherlands\"",
            "relationship_type": ""
          },
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784436538",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "941b5525-d40d-4f37-91e5-db1b1dca2c5c",
        "value": "45.142.140.75",
        "Tag": [
          {
            "colour": "#adcd24",
            "local": false,
            "name": "asn:asn=\"39287\"",
            "relationship_type": ""
          },
          {
            "colour": "#25bbbf",
            "local": false,
            "name": "asn:as-owner=\"ABSTRACT\"",
            "relationship_type": ""
          },
          {
            "colour": "#afab0d",
            "local": false,
            "name": "asn:as-country=\"FI\"",
            "relationship_type": ""
          },
          {
            "colour": "#ea6657",
            "local": false,
            "name": "misp-galaxy:country=\"finland\"",
            "relationship_type": ""
          },
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784436559",
        "to_ids": true,
        "type": "domain",
        "uuid": "b2a31a04-0db4-458b-a9bd-55bb7c910362",
        "value": "belgium-tomorrowlland.com",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784436580",
        "to_ids": true,
        "type": "domain",
        "uuid": "bcd59a85-78ef-4a1b-bbcc-7984237b08f4",
        "value": "belgium-tomorrowlland.info",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784436602",
        "to_ids": true,
        "type": "domain",
        "uuid": "9de05179-a560-47b2-bc5f-3e4c363984fb",
        "value": "belgiumtomoorrowland.com",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784436623",
        "to_ids": true,
        "type": "domain",
        "uuid": "ec339275-3c70-4e3a-ad17-1e25216b095a",
        "value": "festreisen.com",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784436644",
        "to_ids": true,
        "type": "domain",
        "uuid": "372664f6-c92c-467a-a166-0ab89c38f215",
        "value": "jedemenatomorrowland.cz",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784436665",
        "to_ids": true,
        "type": "domain",
        "uuid": "8453ab32-171d-476d-9cb0-3627083a01a2",
        "value": "mcsdirect.tech",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784436686",
        "to_ids": true,
        "type": "domain",
        "uuid": "c01f52cb-7115-4ce3-8f30-11fc62189b31",
        "value": "tmrlnd.shop",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784436707",
        "to_ids": true,
        "type": "domain",
        "uuid": "1a99c998-78a4-402d-9a64-b7e26f828009",
        "value": "tomorrowland-2026.com",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784436728",
        "to_ids": true,
        "type": "domain",
        "uuid": "174ffec5-1c34-4458-ab9e-589609adbefe",
        "value": "tomorrowland-book.com",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784436749",
        "to_ids": true,
        "type": "domain",
        "uuid": "74cd623c-2ef9-4970-8ed6-20d7eb998f06",
        "value": "tomorrowlandbuytickets.com",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784436770",
        "to_ids": true,
        "type": "domain",
        "uuid": "3e4c2efe-0254-46a1-9197-6c5311ae0e68",
        "value": "tomorrowlandtickets.org",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784436791",
        "to_ids": true,
        "type": "domain",
        "uuid": "12f22f54-db99-4885-8d61-f1b4ccd0369c",
        "value": "tomorrowlland.com",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784436812",
        "to_ids": true,
        "type": "domain",
        "uuid": "aa83c478-5acd-4947-bb12-e46a926f1d13",
        "value": "winter-tomorrowlland.com",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784436833",
        "to_ids": true,
        "type": "hostname",
        "uuid": "4bafc67d-8933-4dd7-b26c-b5b5f24def09",
        "value": "belgium.tomorrowland.now",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784436854",
        "to_ids": true,
        "type": "hostname",
        "uuid": "1e13435d-c40f-4f60-8d0c-d4add77db413",
        "value": "tomorrowland.events.cryptonexum.com",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784436876",
        "to_ids": true,
        "type": "hostname",
        "uuid": "5452c966-2f6f-4467-82de-dfb314daa2f1",
        "value": "www.vvipevent.com",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784436897",
        "to_ids": true,
        "type": "domain",
        "uuid": "fbaaaada-7a31-4ae1-bc59-a5ce85b51d08",
        "value": "billetterie-tomorrowland.com",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784436918",
        "to_ids": true,
        "type": "hostname",
        "uuid": "9863704d-960f-41c6-bf79-210ae868effb",
        "value": "tomorrowland-airbnb.pages.dev",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784436939",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "458aab8e-d996-45f6-9dca-c9ddccdcc105",
        "value": "72.62.191.8",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784436960",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "1f7c6d7a-febf-451c-bbe6-ef507be872bb",
        "value": "5.39.23.174",
        "Tag": [
          {
            "colour": "#21ca95",
            "local": false,
            "name": "asn:asn=\"16276\"",
            "relationship_type": ""
          },
          {
            "colour": "#983aa5",
            "local": false,
            "name": "asn:as-owner=\"OVH\"",
            "relationship_type": ""
          },
          {
            "colour": "#93736f",
            "local": false,
            "name": "asn:as-country=\"FR\"",
            "relationship_type": ""
          },
          {
            "colour": "#f6cea1",
            "local": false,
            "name": "misp-galaxy:country=\"france\"",
            "relationship_type": ""
          },
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784436982",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "ba422985-09ff-45f4-a5dd-65ec4c8d9932",
        "value": "135.181.132.114",
        "Tag": [
          {
            "colour": "#d17f93",
            "local": false,
            "name": "asn:asn=\"24940\"",
            "relationship_type": ""
          },
          {
            "colour": "#18e065",
            "local": false,
            "name": "asn:as-owner=\"HETZNER-AS\"",
            "relationship_type": ""
          },
          {
            "colour": "#141680",
            "local": false,
            "name": "asn:as-country=\"DE\"",
            "relationship_type": ""
          },
          {
            "colour": "#0088cc",
            "local": false,
            "name": "misp-galaxy:country=\"germany\"",
            "relationship_type": ""
          },
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      }
    ]
  }
}