{
  "Event": {
    "analysis": "1",
    "date": "2026-05-13",
    "extends_uuid": "",
    "info": "[Threat Intel] Device Code Phishing is an Evolution in Identity Takeover",
    "protected": false,
    "publish_timestamp": "1779547431",
    "published": true,
    "threat_level_id": "3",
    "timestamp": "1779005110",
    "uuid": "402e1b2f-0ec7-4c71-a016-c3cc30ff9204",
    "Orgc": {
      "name": "Rectifyq",
      "uuid": "cd9bd516-61fa-476b-980f-2f8de03992d4"
    },
    "Tag": [
      {
        "colour": "#2d8ee7",
        "local": false,
        "name": "misp-galaxy:producer=\"Proofpoint\"",
        "relationship_type": ""
      },
      {
        "colour": "#ffffff",
        "local": false,
        "name": "tlp:clear",
        "relationship_type": ""
      },
      {
        "colour": "#004646",
        "local": false,
        "name": "type:OSINT",
        "relationship_type": ""
      },
      {
        "colour": "#b94b1d",
        "local": false,
        "name": "rectifyq:mitre-att&ck=\"none-from-src\"",
        "relationship_type": ""
      },
      {
        "colour": "#b94b1d",
        "local": false,
        "name": "rectifyq:mitre-att&ck=\"from-OTX\"",
        "relationship_type": ""
      },
      {
        "colour": "#ed66f6",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Steal Web Session Cookie - T1539\"",
        "relationship_type": ""
      },
      {
        "colour": "#77a4ec",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Email Collection - T1114\"",
        "relationship_type": ""
      },
      {
        "colour": "#47d9d3",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Malicious File - T1204.002\"",
        "relationship_type": ""
      },
      {
        "colour": "#c202a1",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Spearphishing Link - T1566.002\"",
        "relationship_type": ""
      },
      {
        "colour": "#db2044",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Spearphishing Link - T1598.003\"",
        "relationship_type": ""
      },
      {
        "colour": "#5539fe",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Spearphishing Attachment - T1566.001\"",
        "relationship_type": ""
      },
      {
        "colour": "#62e1b7",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Browser Session Hijacking - T1185\"",
        "relationship_type": ""
      },
      {
        "colour": "#36a9d8",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Account Discovery - T1087\"",
        "relationship_type": ""
      },
      {
        "colour": "#08221e",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Steal Application Access Token - T1528\"",
        "relationship_type": ""
      },
      {
        "colour": "#3780c6",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"User Execution - T1204\"",
        "relationship_type": ""
      },
      {
        "colour": "#3d1dab",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Internal Spearphishing - T1534\"",
        "relationship_type": ""
      },
      {
        "colour": "#1b95cd",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Phishing - T1566\"",
        "relationship_type": ""
      },
      {
        "colour": "#59699c",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Valid Accounts - T1078\"",
        "relationship_type": ""
      },
      {
        "colour": "#36d931",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Data Encrypted for Impact - T1486\"",
        "relationship_type": ""
      },
      {
        "colour": "#a0d02a",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Phishing for Information - T1598\"",
        "relationship_type": ""
      },
      {
        "colour": "#a42e64",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Data from Information Repositories - T1213\"",
        "relationship_type": ""
      },
      {
        "colour": "#5884a7",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Malicious Link - T1204.001\"",
        "relationship_type": ""
      },
      {
        "colour": "#37c019",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Cloud Accounts - T1078.004\"",
        "relationship_type": ""
      },
      {
        "colour": "#c60dc9",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Spearphishing via Service - T1566.003\"",
        "relationship_type": ""
      },
      {
        "colour": "#49a260",
        "local": false,
        "name": "rectifyq:category=\"threat\"",
        "relationship_type": ""
      },
      {
        "colour": "#130049",
        "local": false,
        "name": "rectifyq:sub-category=\"campaign-analysis\"",
        "relationship_type": ""
      },
      {
        "colour": "#ffd12e",
        "local": false,
        "name": "rectifyq:target=\"broad-based\"",
        "relationship_type": ""
      },
      {
        "colour": "#55acee",
        "local": false,
        "name": "rectifyq:MY-relevancy=\"potentially-relevant\"",
        "relationship_type": ""
      },
      {
        "colour": "#626567",
        "local": false,
        "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
        "relationship_type": ""
      },
      {
        "colour": "#626567",
        "local": false,
        "name": "rectifyq:no-samples-in=\"Tria.ge\"",
        "relationship_type": ""
      },
      {
        "colour": "#3800d9",
        "local": false,
        "name": "rectifyq:action-taken=\"VT-comment\"",
        "relationship_type": ""
      },
      {
        "colour": "#3d00e9",
        "local": false,
        "name": "rectifyq:action-taken=\"telegram\"",
        "relationship_type": ""
      }
    ],
    "Attribute": [
      {
        "category": "External analysis",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1778814013",
        "to_ids": false,
        "type": "link",
        "uuid": "bf8111b1-aafd-4277-a1ba-398d7e49a690",
        "value": "https://www.proofpoint.com/us/blog/threat-insight/device-code-phishing-evolution-identity-takeover"
      },
      {
        "category": "Other",
        "comment": "Description",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1778814013",
        "to_ids": false,
        "type": "text",
        "uuid": "95843ca0-1a89-4899-b8f0-07b040d47d40",
        "value": "Device code phishing attacks have exploded across the threat landscape, with new toolkits emerging weekly. This surge coincides with publicly released criminal toolkits and multiple phishing-as-a-service offerings like EvilTokens and Tycoon. Threat actors abuse the OAuth 2.0 device authorization grant flow to compromise Microsoft 365 and other enterprise accounts by tricking users into authorizing malicious applications. Current implementations use on-demand code generation, addressing the 15-minute expiration limitation of previous techniques. Most activity appears to be generated using AI-based coding techniques. Successful attacks lead to full account takeover, data theft, business email compromise, and potential ransomware deployment. The technique represents the natural evolution of credential phishing as organizations improve their defenses against traditional multifactor authentication bypass methods."
      },
      {
        "category": "Other",
        "comment": "Summary",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1778814013",
        "to_ids": false,
        "type": "text",
        "uuid": "5837bc84-094f-42a1-aed8-76054ee224c1",
        "value": "Name: Device Code Phishing is an Evolution in Identity Takeover\nAuthor: AlienVault\nAdversary: TA4903\nTags: [\"phishing-as-a-service\", \"account takeover\", \"clickfix\", \"artokens\", \"tycoon 2fa\", \"credential theft\", \"oauth abuse\", \"microsoft 365\", \"eviltokens\", \"odx\", \"kali365\", \"identity compromise\", \"device code phishing\"]\nTgtd countries: []\nMlwr families: [\"EvilTokens\", \"Tycoon 2FA\", \"ODx\", \"Kali365\", \"ARTokens\", \"ClickFix\"]\nAttack_ids: [\"T1539\", \"T1114\", \"T1204.002\", \"T1566.002\", \"T1598.003\", \"T1566.001\", \"T1185\", \"T1087\", \"T1528\", \"T1204\", \"T1534\", \"T1566\", \"T1078\", \"T1486\", \"T1598\", \"T1213\", \"T1204.001\", \"T1078.004\", \"T1566.003\"]\nIndustries: []"
      },
      {
        "category": "Attribution",
        "comment": "Adversary",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1778814013",
        "to_ids": false,
        "type": "threat-actor",
        "uuid": "c9834897-2955-435b-ad0c-cb2ef62e6bd6",
        "value": "TA4903"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1779003821",
        "to_ids": true,
        "type": "domain",
        "uuid": "08cc3149-5b02-414c-be3f-887829c86380",
        "value": "marktkarree-langenfeld.de",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1779003843",
        "to_ids": true,
        "type": "domain",
        "uuid": "1a3b4038-6fa2-4feb-b07d-c656d6a536f9",
        "value": "jo2c9ada427c6-endpoint.com",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1779003864",
        "to_ids": true,
        "type": "domain",
        "uuid": "d04ecf41-b11d-4174-b388-e37719ec7ac4",
        "value": "019d442a-endpoint.com",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1779003885",
        "to_ids": true,
        "type": "domain",
        "uuid": "a7b6bc15-b500-45b5-b75b-1576831562c7",
        "value": "019d442e-endpoint.com",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1779003907",
        "to_ids": true,
        "type": "domain",
        "uuid": "f66987cd-4dd5-471b-a18a-5aab5b6408a3",
        "value": "019d6860-endpoint.com",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1779003929",
        "to_ids": true,
        "type": "domain",
        "uuid": "fd35982f-04bb-422d-97ba-c1e6d7ae5be8",
        "value": "0fdba029e6a5-endpoint.com",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1779003950",
        "to_ids": true,
        "type": "domain",
        "uuid": "3f1126e8-c013-46ee-bbd8-e61590d497e9",
        "value": "2dc62559e005-endpoint.com",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1779003971",
        "to_ids": true,
        "type": "domain",
        "uuid": "792917f8-b37c-4e89-9573-953072debc51",
        "value": "4daa2aea93db-endpoint.com",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1779003992",
        "to_ids": true,
        "type": "domain",
        "uuid": "3a998972-4174-4e3c-91b7-a608c0186c29",
        "value": "6dd5fd945b34-endpoint.com",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1779004013",
        "to_ids": true,
        "type": "domain",
        "uuid": "2c053389-ac01-4574-929c-ad084c4e3912",
        "value": "7806d4cf9366-endpoint.com",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1779004034",
        "to_ids": true,
        "type": "domain",
        "uuid": "14290820-63c2-4108-93e1-c4211f860adb",
        "value": "consistentdigital.de",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1779004055",
        "to_ids": true,
        "type": "domain",
        "uuid": "c15a5beb-b317-4a55-ab40-d9e01dc49f07",
        "value": "crediblebizextension.de",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1779004076",
        "to_ids": true,
        "type": "domain",
        "uuid": "e84bc2a4-50f7-4607-a972-4e5cbad58169",
        "value": "digitalcontinuity.de",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1779004097",
        "to_ids": true,
        "type": "domain",
        "uuid": "896d6105-ae1f-469e-b36c-a6bca75c547e",
        "value": "digitalreliability.de",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1779004119",
        "to_ids": true,
        "type": "domain",
        "uuid": "9b72f948-dc19-4901-af3f-5284156e8eb1",
        "value": "ed5ce47d835f-endpoint.com",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1779004140",
        "to_ids": true,
        "type": "domain",
        "uuid": "2ed614b4-9151-495b-9068-97728f0e4c0c",
        "value": "ee10bbf6c689-endpoint.com",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1779004161",
        "to_ids": true,
        "type": "domain",
        "uuid": "ed884785-03cd-4624-8356-343b66a883e8",
        "value": "euromarketsignal.de",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1779004182",
        "to_ids": true,
        "type": "domain",
        "uuid": "d402869d-aae2-41c0-a99b-b638210037f3",
        "value": "europesignaltrust.de",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1779004203",
        "to_ids": true,
        "type": "domain",
        "uuid": "25a037a2-f5f8-4cb5-b7e2-542d2995351b",
        "value": "europetrustwave.de",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1779004224",
        "to_ids": true,
        "type": "domain",
        "uuid": "14bde06b-d32d-427e-94a9-8f0ffb1e719e",
        "value": "extendyourcredibility.de",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1779004245",
        "to_ids": true,
        "type": "domain",
        "uuid": "fe7aea2a-db37-45d0-8ed7-cb270c6906bb",
        "value": "f36c2774f013-endpoint.com",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1779004267",
        "to_ids": true,
        "type": "domain",
        "uuid": "9b15cf82-b4e1-442a-b2c8-0f54c2112d6c",
        "value": "heilbronner-fruehlingssymposium.de",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1779004288",
        "to_ids": true,
        "type": "domain",
        "uuid": "bd20546d-98db-4cc7-9f02-cc38f521402e",
        "value": "kohlhoff-edelstahlverarbeitung.de",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1779004309",
        "to_ids": true,
        "type": "domain",
        "uuid": "f6c9ecf0-eb1a-436a-823a-5be7b4558b5c",
        "value": "marketcredibilitysignals.de",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1779004330",
        "to_ids": true,
        "type": "domain",
        "uuid": "51358c1b-0794-447e-87c4-dfa4799a9f5e",
        "value": "methodicalness.de",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1779004351",
        "to_ids": true,
        "type": "domain",
        "uuid": "4e463bae-755c-4470-81f4-82be92dc2478",
        "value": "reliableinteractions.de",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1779004372",
        "to_ids": true,
        "type": "domain",
        "uuid": "8bad100e-07c2-450b-845e-adf0eee4783b",
        "value": "reliablesupport.de",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1779004393",
        "to_ids": true,
        "type": "domain",
        "uuid": "af929b34-8e07-47e8-8734-b1ee57170692",
        "value": "servicewithoutinterruption.de",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1779004415",
        "to_ids": true,
        "type": "domain",
        "uuid": "7c1ff1f0-4af0-4300-8e07-01917c5f5e4c",
        "value": "stablewebsystems.de",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1779004436",
        "to_ids": true,
        "type": "domain",
        "uuid": "a4cfd982-4e1e-4c16-af50-dfd6e1409307",
        "value": "trustedengagement.de",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1779004457",
        "to_ids": true,
        "type": "domain",
        "uuid": "8f217d62-0dfe-4024-bb36-3fd095e3c0f8",
        "value": "uninterruptedperformance.de",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1779004478",
        "to_ids": true,
        "type": "domain",
        "uuid": "51bbcb62-bd2b-4bc1-886e-4ba46edc7067",
        "value": "yaga9b286ae2c101-endpoint.com",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1779004499",
        "to_ids": true,
        "type": "domain",
        "uuid": "7ad5bf13-f518-49a5-9c49-36d588bc5867",
        "value": "z6e43e5886fe-endpoint.com",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1779004521",
        "to_ids": true,
        "type": "hostname",
        "uuid": "1e8b2a39-641b-411d-b4aa-17f104dadbfe",
        "value": "hti-245401512.hs-sites-na2.com",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1779004542",
        "to_ids": true,
        "type": "hostname",
        "uuid": "374fc9c8-b19e-45b4-b5e4-ce1780ddb9b8",
        "value": "panel.hewktree.net",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1779004563",
        "to_ids": true,
        "type": "hostname",
        "uuid": "1dc283f3-067e-4747-887c-faa78bfba761",
        "value": "onedrive-7tu.techroboticslabmade-techie-com-s-account.workers.dev",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1779004584",
        "to_ids": true,
        "type": "hostname",
        "uuid": "ad400223-ec7a-4975-a746-6aa8d82b18be",
        "value": "voicemail-59f.admin-treyripple-com-s-account.workers.dev",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1779004605",
        "to_ids": true,
        "type": "hostname",
        "uuid": "15697f2d-9fe0-4d69-b91b-d1895fe7c5d0",
        "value": "voicemail-wx7.mark-squires-expressrancnes-com-s-account.workers.dev",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1779004626",
        "to_ids": true,
        "type": "hostname",
        "uuid": "3a13207e-3eeb-441e-8eb2-b09e552b6960",
        "value": "voicemail-lyr.nbuckley-cambek-com-s-account.workers.dev",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1779004647",
        "to_ids": true,
        "type": "hostname",
        "uuid": "1090424b-2699-4936-a5c2-851e8448547f",
        "value": "f8uh-dwam-j4l5.pvasquez-princetonpartners-com-s-account.workers.dev",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1779004668",
        "to_ids": true,
        "type": "hostname",
        "uuid": "0c866587-5c48-4f8f-a447-e0f917b2a69f",
        "value": "ytgw-9n30-xlwd.pvasquez-princetonpartners-com-s-account.workers.dev",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1779004690",
        "to_ids": true,
        "type": "hostname",
        "uuid": "b41c9d80-9077-42d1-9ea6-7aa44eb478d9",
        "value": "audit-report-9767d3.fullerjp09.workers.dev",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1779004710",
        "to_ids": true,
        "type": "hostname",
        "uuid": "5bc83098-b414-4d5e-957b-73e0b89e11c9",
        "value": "7740f766-8d1d-46ad-a6bc-onedrive.p-9jluifuu.workers.dev",
        "Tag": [
          {
            "colour": "#81bddc",
            "local": false,
            "name": "QuotaExceededError",
            "relationship_type": ""
          }
        ]
      }
    ]
  }
}