{
  "Event": {
    "analysis": "1",
    "date": "2026-07-13",
    "extends_uuid": "",
    "info": "[Threat Intel] Lucide Proxy: Turning Student Web Proxies into DDoS Bots",
    "protected": false,
    "publish_timestamp": "1784553512",
    "published": true,
    "threat_level_id": "3",
    "timestamp": "1784553511",
    "uuid": "70c7b5c9-7a47-438e-be6d-8da1db1310c1",
    "Orgc": {
      "name": "Rectifyq",
      "uuid": "cd9bd516-61fa-476b-980f-2f8de03992d4"
    },
    "Tag": [
      {
        "colour": "#ffffff",
        "local": false,
        "name": "tlp:clear",
        "relationship_type": ""
      },
      {
        "colour": "#004646",
        "local": false,
        "name": "type:OSINT",
        "relationship_type": ""
      },
      {
        "colour": "#b94b1d",
        "local": false,
        "name": "rectifyq:mitre-att&ck=\"none-from-src\"",
        "relationship_type": ""
      },
      {
        "colour": "#b94b1d",
        "local": false,
        "name": "rectifyq:mitre-att&ck=\"from-OTX\"",
        "relationship_type": ""
      },
      {
        "colour": "#790faf",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Direct Network Flood - T1498.001\"",
        "relationship_type": ""
      },
      {
        "colour": "#d3f567",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"JavaScript - T1059.007\"",
        "relationship_type": ""
      },
      {
        "colour": "#ed66f6",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Steal Web Session Cookie - T1539\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Domain Generation Algorithms - T1568.002\"",
        "relationship_type": ""
      },
      {
        "colour": "#110e53",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"DNS - T1071.004\"",
        "relationship_type": ""
      },
      {
        "colour": "#7da4ad",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Match Legitimate Resource Name or Location - T1036.005\"",
        "relationship_type": ""
      },
      {
        "colour": "#c8f8ef",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"System Binary Proxy Execution - T1218\"",
        "relationship_type": ""
      },
      {
        "colour": "#bf6f24",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Dynamic Resolution - T1568\"",
        "relationship_type": ""
      },
      {
        "colour": "#f07d7c",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Non-Standard Port - T1571\"",
        "relationship_type": ""
      },
      {
        "colour": "#e08bb2",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Obfuscated Files or Information - T1027\"",
        "relationship_type": ""
      },
      {
        "colour": "#356c41",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Encrypted Channel - T1573\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Exfiltration to Cloud Storage - T1567.002\"",
        "relationship_type": ""
      },
      {
        "colour": "#57b2ae",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Resource Hijacking - T1496\"",
        "relationship_type": ""
      },
      {
        "colour": "#a42e64",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Data from Information Repositories - T1213\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Drive-by Compromise - T1189\"",
        "relationship_type": ""
      },
      {
        "colour": "#92e858",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Web Protocols - T1071.001\"",
        "relationship_type": ""
      },
      {
        "colour": "#5884a7",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Malicious Link - T1204.001\"",
        "relationship_type": ""
      },
      {
        "colour": "#8d021b",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Dead Drop Resolver - T1102.001\"",
        "relationship_type": ""
      },
      {
        "colour": "#b8ab01",
        "local": false,
        "name": "misp-galaxy:target-information=\"United States\"",
        "relationship_type": ""
      },
      {
        "colour": "#49a260",
        "local": false,
        "name": "rectifyq:category=\"threat\"",
        "relationship_type": ""
      },
      {
        "colour": "#130049",
        "local": false,
        "name": "rectifyq:sub-category=\"campaign-analysis\"",
        "relationship_type": ""
      },
      {
        "colour": "#ffd12e",
        "local": false,
        "name": "rectifyq:target=\"broad-based\"",
        "relationship_type": ""
      },
      {
        "colour": "#55acee",
        "local": false,
        "name": "rectifyq:MY-relevancy=\"potentially-relevant\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:software-vendor=\"npm\"",
        "relationship_type": ""
      },
      {
        "colour": "#626567",
        "local": false,
        "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
        "relationship_type": ""
      },
      {
        "colour": "#626567",
        "local": false,
        "name": "rectifyq:no-samples-in=\"Tria.ge\"",
        "relationship_type": ""
      },
      {
        "colour": "#3800d9",
        "local": false,
        "name": "rectifyq:action-taken=\"VT-comment\"",
        "relationship_type": ""
      },
      {
        "colour": "#3d00e9",
        "local": false,
        "name": "rectifyq:action-taken=\"telegram\"",
        "relationship_type": ""
      }
    ],
    "Attribute": [
      {
        "category": "External analysis",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784084418",
        "to_ids": false,
        "type": "link",
        "uuid": "17bd982f-c77c-4e10-b738-f6f49ede75f7",
        "value": "https://research.jfrog.com/post/lucide-proxy-npm-malware-campaign"
      },
      {
        "category": "Other",
        "comment": "Description",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784084418",
        "to_ids": false,
        "type": "text",
        "uuid": "797e672b-71c1-4728-bbd5-cf3e28721b10",
        "value": "A sophisticated campaign deployed 148 malicious npm packages disguised as student web proxy applications under brands like Riverbend Tutoring and Northstar Tutoring. Published by accounts terminal3airport and eerikakirk, these packages weaponized visitor browsers into distributed denial-of-service botnets while generating advertising revenue. The applications functioned as working proxies but secretly executed mutable remote code and high-performance WebSocket traffic generators compatible with the Wisp protocol. During a critical two-week period in May 2026, active deployments launched HTTP floods generating 2GB/s aggregate traffic and control-plane attacks establishing 10,240 socket connections per second against target servers. The campaign abused npm as a content delivery network, affecting users who visited proxy instances rather than through traditional dependency infection."
      },
      {
        "category": "Other",
        "comment": "Summary",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784084418",
        "to_ids": false,
        "type": "text",
        "uuid": "48e961f0-5c7b-4202-b8eb-54d1414161db",
        "value": "Name: Lucide Proxy: Turning Student Web Proxies into DDoS Bots\nAuthor: AlienVault\nAdversary: \nTags: [\"http flood\", \"ddos botnet\", \"student targeting\", \"browser-based attack\", \"npm campaign\", \"websocket flood\", \"web proxy\", \"adware\", \"wisp protocol\", \"supply chain abuse\"]\nTgtd countries: [\"United States of America\"]\nMlwr families: []\nAttack_ids: [\"T1498.001\", \"T1059.007\", \"T1539\", \"T1568.002\", \"T1071.004\", \"T1036.005\", \"T1218\", \"T1568\", \"T1571\", \"T1027\", \"T1573\", \"T1567.002\", \"T1496\", \"T1213\", \"T1189\", \"T1071.001\", \"T1204.001\", \"T1102.001\"]\nIndustries: [\"Education\"]"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784463813",
        "to_ids": true,
        "type": "domain",
        "uuid": "4a8b0ad3-38c0-4b35-a62b-099edce4ee16",
        "value": "21baseballacademy.com",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check: 19/07/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784463649",
        "to_ids": true,
        "type": "md5",
        "uuid": "92173a8d-563d-4907-a0c3-bcdef49b628e",
        "value": "0a913561831bdf2c26dcf18b852b5cc1",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check: 19/07/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784463650",
        "to_ids": true,
        "type": "md5",
        "uuid": "3ac441b5-7568-43db-880c-fb1b87395796",
        "value": "c6851a038da578a80eeb201e0588c84c",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check: 19/07/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784463651",
        "to_ids": true,
        "type": "sha256",
        "uuid": "f37fc41b-aec9-4c4e-82f6-f896b696b163",
        "value": "10ddbbae0070267b8d15888b09a3cdb19fa74d861315b71f21c9ace8b9f85c75",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check: 19/07/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784463652",
        "to_ids": true,
        "type": "sha256",
        "uuid": "a71fa6c2-40e7-4c12-902e-3f74ca16de21",
        "value": "4b188d179e50e8208a6efec85e273e88d8fc390c836f299ba12915e0840408fd",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check: 19/07/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784463653",
        "to_ids": true,
        "type": "sha256",
        "uuid": "10deceb1-0fa7-4c93-b913-fc5217442157",
        "value": "eb4e1394d537d8eba509dd5c57e7aaf4c1df57715c7161330012a11f6202af84",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784463834",
        "to_ids": true,
        "type": "domain",
        "uuid": "eca073f9-623a-4612-91bb-15721f86e337",
        "value": "lucideon.top",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784463855",
        "to_ids": true,
        "type": "hostname",
        "uuid": "22e8d850-6775-4dba-9127-81a1216a3e75",
        "value": "c.vipersfutbol.com",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784463877",
        "to_ids": true,
        "type": "hostname",
        "uuid": "c718125a-b346-48bf-a51e-cebfc5d92351",
        "value": "cdn.caan.edu",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784463898",
        "to_ids": true,
        "type": "hostname",
        "uuid": "a38dad92-cd30-42c6-95f9-7be9802d026c",
        "value": "cdn.conditionfuneral.com",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784463919",
        "to_ids": true,
        "type": "domain",
        "uuid": "e2ce86f6-a044-4200-92ec-84ee03f49087",
        "value": "woofbeginner.com",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784463940",
        "to_ids": true,
        "type": "domain",
        "uuid": "413edd74-f7e6-4593-adba-21a5336c4424",
        "value": "realizationnewestfangs.com",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784463961",
        "to_ids": true,
        "type": "domain",
        "uuid": "7e4b61db-014d-48ad-a4f4-181838694a2f",
        "value": "protrafficinspector.com",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784463983",
        "to_ids": true,
        "type": "domain",
        "uuid": "eef475ba-3f4a-4365-9677-f5aaef1606d7",
        "value": "preferencenail.com",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784464004",
        "to_ids": true,
        "type": "domain",
        "uuid": "40daca5d-ede0-4185-ae49-0e45e8c38769",
        "value": "skinnycrawlinglax.com",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784464025",
        "to_ids": true,
        "type": "hostname",
        "uuid": "91cd1619-4d67-49ac-9091-9f833ef796ff",
        "value": "wisp.breadarchive.dpdns.org",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784464046",
        "to_ids": true,
        "type": "url",
        "uuid": "b295cc11-4e9d-4512-a24d-14731e52eda2",
        "value": "https://cdn.jsdelivr.net/gh/canyoupleasesaysomething/cdn@main/cdn.js",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784464068",
        "to_ids": true,
        "type": "url",
        "uuid": "ee85c7c0-21b3-4d3b-b102-837d9141746d",
        "value": "https://cdn.jsdelivr.net/gh/canyoupleasesaysomething/cdn@main/websocket.txt",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784464089",
        "to_ids": true,
        "type": "url",
        "uuid": "d170cad6-847e-4997-adc3-d06526fef768",
        "value": "https://cdn.caan.edu/-/?v=",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784464110",
        "to_ids": true,
        "type": "url",
        "uuid": "63e796e1-1e3d-41bd-ab45-8debd47100b2",
        "value": "https://woofbeginner.com/jivd2xu8",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784464131",
        "to_ids": true,
        "type": "url",
        "uuid": "889a48c6-f7ca-413f-aa44-f59a97ad685a",
        "value": "https://woofbeginner.com/0a/91/35/0a913561831bdf2c26dcf18b852b5cc1.js",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784464152",
        "to_ids": true,
        "type": "url",
        "uuid": "040b40f6-66f2-40cf-9ac4-80c1b917a61e",
        "value": "https://wisp.breadarchive.dpdns.org",
        "Tag": [
          {
            "colour": "#f08989",
            "local": false,
            "name": "NotFoundError",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784464173",
        "to_ids": true,
        "type": "url",
        "uuid": "944f7bb3-1a1d-48d7-867c-daeeb607a834",
        "value": "https://21baseballacademy.com",
        "Tag": [
          {
            "colour": "#f08989",
            "local": false,
            "name": "NotFoundError",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784464194",
        "to_ids": true,
        "type": "url",
        "uuid": "2235bb21-9bad-43f9-a67f-75e049ebf057",
        "value": "https://lucideon.top",
        "Tag": [
          {
            "colour": "#f08989",
            "local": false,
            "name": "NotFoundError",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784464215",
        "to_ids": true,
        "type": "url",
        "uuid": "c5af7b8e-7600-4e11-8d4b-d1dc4b38c59b",
        "value": "https://c.vipersfutbol.com/script.js",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784464236",
        "to_ids": true,
        "type": "url",
        "uuid": "cba430af-fbf6-4bfd-b4b1-83b66bb035ff",
        "value": "https://realizationnewestfangs.com",
        "Tag": [
          {
            "colour": "#f08989",
            "local": false,
            "name": "NotFoundError",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784464258",
        "to_ids": true,
        "type": "url",
        "uuid": "1d93186c-3dab-4cfc-a908-dfbcf2322ee9",
        "value": "https://protrafficinspector.com/stats",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784464279",
        "to_ids": true,
        "type": "url",
        "uuid": "358f41ee-d51b-47c6-894f-3038c5f3b456",
        "value": "https://preferencenail.com/sfp.js",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784464300",
        "to_ids": true,
        "type": "url",
        "uuid": "b039e5a9-9827-4f1a-9295-7fd061d3d1ac",
        "value": "https://skinnycrawlinglax.com/dnn2hkn8",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784464321",
        "to_ids": true,
        "type": "url",
        "uuid": "be8f40a7-8eae-4c83-8090-c7dbc09d405c",
        "value": "https://cdn.conditionfuneral.com",
        "Tag": [
          {
            "colour": "#f08989",
            "local": false,
            "name": "NotFoundError",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784464344",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "bfa9b3d1-4068-4400-ab3e-76186272f042",
        "value": "92.38.177.17",
        "Tag": [
          {
            "colour": "#932b43",
            "local": false,
            "name": "asn:asn=\"199524\"",
            "relationship_type": ""
          },
          {
            "colour": "#568d89",
            "local": false,
            "name": "asn:as-owner=\"GCORE\"",
            "relationship_type": ""
          },
          {
            "colour": "#830a90",
            "local": false,
            "name": "asn:as-country=\"LU\"",
            "relationship_type": ""
          },
          {
            "colour": "#49384d",
            "local": false,
            "name": "misp-galaxy:country=\"luxembourg\"",
            "relationship_type": ""
          },
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784464365",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "dc622435-37d7-499d-881a-94eb557d5173",
        "value": "92.38.177.10",
        "Tag": [
          {
            "colour": "#932b43",
            "local": false,
            "name": "asn:asn=\"199524\"",
            "relationship_type": ""
          },
          {
            "colour": "#568d89",
            "local": false,
            "name": "asn:as-owner=\"GCORE\"",
            "relationship_type": ""
          },
          {
            "colour": "#830a90",
            "local": false,
            "name": "asn:as-country=\"LU\"",
            "relationship_type": ""
          },
          {
            "colour": "#49384d",
            "local": false,
            "name": "misp-galaxy:country=\"luxembourg\"",
            "relationship_type": ""
          },
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784464387",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "459eec90-149c-4bbe-897b-ec71f5d852ad",
        "value": "153.75.225.178",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784464408",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "7176e0ba-e78e-4711-8e25-fb646661d070",
        "value": "5.188.124.67",
        "Tag": [
          {
            "colour": "#011259",
            "local": false,
            "name": "asn:asn=\"202422\"",
            "relationship_type": ""
          },
          {
            "colour": "#91ccfe",
            "local": false,
            "name": "asn:as-owner=\"GHOST\"",
            "relationship_type": ""
          },
          {
            "colour": "#830a90",
            "local": false,
            "name": "asn:as-country=\"LU\"",
            "relationship_type": ""
          },
          {
            "colour": "#49384d",
            "local": false,
            "name": "misp-galaxy:country=\"luxembourg\"",
            "relationship_type": ""
          },
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784464429",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "04750bfa-cc7e-449f-be06-3ba4428bb13c",
        "value": "92.38.177.16",
        "Tag": [
          {
            "colour": "#932b43",
            "local": false,
            "name": "asn:asn=\"199524\"",
            "relationship_type": ""
          },
          {
            "colour": "#568d89",
            "local": false,
            "name": "asn:as-owner=\"GCORE\"",
            "relationship_type": ""
          },
          {
            "colour": "#830a90",
            "local": false,
            "name": "asn:as-country=\"LU\"",
            "relationship_type": ""
          },
          {
            "colour": "#49384d",
            "local": false,
            "name": "misp-galaxy:country=\"luxembourg\"",
            "relationship_type": ""
          },
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784464450",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "7a76e9c1-bd50-436b-b8f8-bace864a0f79",
        "value": "92.38.177.37",
        "Tag": [
          {
            "colour": "#932b43",
            "local": false,
            "name": "asn:asn=\"199524\"",
            "relationship_type": ""
          },
          {
            "colour": "#568d89",
            "local": false,
            "name": "asn:as-owner=\"GCORE\"",
            "relationship_type": ""
          },
          {
            "colour": "#830a90",
            "local": false,
            "name": "asn:as-country=\"LU\"",
            "relationship_type": ""
          },
          {
            "colour": "#49384d",
            "local": false,
            "name": "misp-galaxy:country=\"luxembourg\"",
            "relationship_type": ""
          },
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784450672",
        "to_ids": true,
        "type": "email-src",
        "uuid": "c45b0a64-9617-4f4b-af9d-af3bdcb57c74",
        "value": "main@geeked.wtf"
      },
      {
        "category": "Payload delivery",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784450672",
        "to_ids": true,
        "type": "email-src",
        "uuid": "a9fb2c9e-1e5f-4093-ad43-040dea739dc6",
        "value": "me@geeked.wtf"
      },
      {
        "category": "Payload delivery",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784450672",
        "to_ids": true,
        "type": "email-src",
        "uuid": "c8886f27-af03-4653-b28c-fc6feb78e810",
        "value": "stefanvangetson54@gmail.com"
      }
    ]
  }
}