{
  "Event": {
    "analysis": "1",
    "date": "2026-06-02",
    "extends_uuid": "",
    "info": "[Threat Intel] From Token Bingo to MAX Takeover: Kali365 Operator Expands Operation Across Microsoft Outlook, Okta, Xerox DocuShare, and Other Services",
    "protected": false,
    "publish_timestamp": "1780521485",
    "published": true,
    "threat_level_id": "3",
    "timestamp": "1780521484",
    "uuid": "a5eedd88-5f36-4684-b9fb-799b2eef534b",
    "Orgc": {
      "name": "Rectifyq",
      "uuid": "cd9bd516-61fa-476b-980f-2f8de03992d4"
    },
    "Tag": [
      {
        "colour": "#d2ee74",
        "local": false,
        "name": "misp-galaxy:producer=\"Arctic Wolf\"",
        "relationship_type": ""
      },
      {
        "colour": "#ffffff",
        "local": false,
        "name": "tlp:clear",
        "relationship_type": ""
      },
      {
        "colour": "#004646",
        "local": false,
        "name": "type:OSINT",
        "relationship_type": ""
      },
      {
        "colour": "#b94b1d",
        "local": false,
        "name": "rectifyq:mitre-att&ck=\"from-original-src\"",
        "relationship_type": ""
      },
      {
        "colour": "#b94b1d",
        "local": false,
        "name": "rectifyq:mitre-att&ck=\"from-OTX\"",
        "relationship_type": ""
      },
      {
        "colour": "#ed66f6",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Steal Web Session Cookie - T1539\"",
        "relationship_type": ""
      },
      {
        "colour": "#c202a1",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Spearphishing Link - T1566.002\"",
        "relationship_type": ""
      },
      {
        "colour": "#5539fe",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Spearphishing Attachment - T1566.001\"",
        "relationship_type": ""
      },
      {
        "colour": "#ff841f",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Application Layer Protocol - T1071\"",
        "relationship_type": ""
      },
      {
        "colour": "#a92e1c",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Deobfuscate/Decode Files or Information - T1140\"",
        "relationship_type": ""
      },
      {
        "colour": "#b25e1b",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Use Alternate Authentication Material - T1550\"",
        "relationship_type": ""
      },
      {
        "colour": "#adf1b0",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Proxy - T1090\"",
        "relationship_type": ""
      },
      {
        "colour": "#9e0269",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Web Service - T1102\"",
        "relationship_type": ""
      },
      {
        "colour": "#08221e",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Steal Application Access Token - T1528\"",
        "relationship_type": ""
      },
      {
        "colour": "#3780c6",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"User Execution - T1204\"",
        "relationship_type": ""
      },
      {
        "colour": "#71ecdb",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Account Manipulation - T1098\"",
        "relationship_type": ""
      },
      {
        "colour": "#1b95cd",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Phishing - T1566\"",
        "relationship_type": ""
      },
      {
        "colour": "#59699c",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Valid Accounts - T1078\"",
        "relationship_type": ""
      },
      {
        "colour": "#e08bb2",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Obfuscated Files or Information - T1027\"",
        "relationship_type": ""
      },
      {
        "colour": "#57997c",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Bidirectional Communication - T1102.002\"",
        "relationship_type": ""
      },
      {
        "colour": "#92e858",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Web Protocols - T1071.001\"",
        "relationship_type": ""
      },
      {
        "colour": "#5884a7",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Malicious Link - T1204.001\"",
        "relationship_type": ""
      },
      {
        "colour": "#5300bd",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Application Access Token - T1550.001\"",
        "relationship_type": ""
      },
      {
        "colour": "#37c019",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Cloud Accounts - T1078.004\"",
        "relationship_type": ""
      },
      {
        "colour": "#c60dc9",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Spearphishing via Service - T1566.003\"",
        "relationship_type": ""
      },
      {
        "colour": "#49a260",
        "local": false,
        "name": "rectifyq:category=\"threat\"",
        "relationship_type": ""
      },
      {
        "colour": "#10003f",
        "local": false,
        "name": "rectifyq:sub-category=\"tool-profile\"",
        "relationship_type": ""
      },
      {
        "colour": "#f1dfed",
        "local": false,
        "name": "rectifyq:TA-category=\"Cybercrime\"",
        "relationship_type": ""
      },
      {
        "colour": "#ffd12e",
        "local": false,
        "name": "rectifyq:target=\"broad-based\"",
        "relationship_type": ""
      },
      {
        "colour": "#55acee",
        "local": false,
        "name": "rectifyq:MY-relevancy=\"potentially-relevant\"",
        "relationship_type": ""
      },
      {
        "colour": "#1b0068",
        "local": false,
        "name": "rectifyq:topic=\"cloud\"",
        "relationship_type": ""
      },
      {
        "colour": "#82eae0",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Domains - T1583.001\"",
        "relationship_type": ""
      },
      {
        "colour": "#a9f8b1",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Exfiltration Over C2 Channel - T1041\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Web Portal Capture - T1056.003\"",
        "relationship_type": ""
      },
      {
        "colour": "#4a5d84",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Web Services - T1583.006\"",
        "relationship_type": ""
      },
      {
        "colour": "#626567",
        "local": false,
        "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
        "relationship_type": ""
      },
      {
        "colour": "#626567",
        "local": false,
        "name": "rectifyq:no-samples-in=\"Tria.ge\"",
        "relationship_type": ""
      },
      {
        "colour": "#3800d9",
        "local": false,
        "name": "rectifyq:action-taken=\"VT-comment\"",
        "relationship_type": ""
      },
      {
        "colour": "#3d00e9",
        "local": false,
        "name": "rectifyq:action-taken=\"telegram\"",
        "relationship_type": ""
      }
    ],
    "Attribute": [
      {
        "category": "External analysis",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780484414",
        "to_ids": false,
        "type": "link",
        "uuid": "9bdf1fed-8643-4bea-be3d-9460c3f0435d",
        "value": "https://arcticwolf.com/resources/blog/kali365-expands-into-aws-microsoft-okta-xerox-max-messenger/"
      },
      {
        "category": "Other",
        "comment": "Description",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780484414",
        "to_ids": false,
        "type": "text",
        "uuid": "a216ce25-246d-4258-a5c7-0bb8fefe1ba2",
        "value": "A significant expansion of the Kali365 phishing-as-a-service operation has been observed, now targeting multiple platforms beyond Microsoft 365. The operator abuses OAuth 2.0 device authorization flows to bypass MFA and steal authentication tokens. Key discoveries include a live command-and-control panel infrastructure, a phishing campaign impersonating MAX Messenger (Russia's state-backed messaging platform with 110 million users) through fake prize-claim flows, and a cluster of 126 malicious hosts impersonating services including Microsoft Outlook, Okta SSO, Xerox DocuShare, Mail.ru, Yandex Disk, and Odnoklassniki. The operation demonstrates a deliberate focus on Russian consumer platforms alongside Western enterprise targets, utilizing Telegram bots for credential exfiltration and employing a multi-tenant phishing platform distributed through Telegram channels."
      },
      {
        "category": "Other",
        "comment": "Summary",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780484414",
        "to_ids": false,
        "type": "text",
        "uuid": "2e02faab-ae7b-45b7-83a3-5945f51fd99e",
        "value": "Name: From Token Bingo to MAX Takeover: Kali365 Operator Expands Operation Across Microsoft Outlook, Okta, Xerox DocuShare, and Other Services\nAuthor: AlienVault\nAdversary: \nTags: [\"max messenger\", \"ekz infostealer\", \"device code phishing\", \"oauth 2.0 abuse\", \"phishing-as-a-service\", \"russian platforms\", \"kali365\", \"mfa bypass\", \"token theft\"]\nTgtd countries: []\nMlwr families: [\"EKZ Infostealer\"]\nAttack_ids: [\"T1539\", \"T1566.002\", \"T1566.001\", \"T1071\", \"T1140\", \"T1550\", \"T1090\", \"T1102\", \"T1528\", \"T1204\", \"T1098\", \"T1566\", \"T1078\", \"T1027\", \"T1102.002\", \"T1071.001\", \"T1204.001\", \"T1550.001\", \"T1078.004\", \"T1566.003\"]\nIndustries: []"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780502048",
        "to_ids": true,
        "type": "domain",
        "uuid": "e510c448-6675-451d-9b2f-576a9b345110",
        "value": "attachedfile.com",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check:03/06/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780498080",
        "to_ids": true,
        "type": "md5",
        "uuid": "5cd71b72-407e-4fa2-830a-5ea46e8230c7",
        "value": "febb622cd9eeb5c8860dcef4cbfd4b74",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check:03/06/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780498082",
        "to_ids": true,
        "type": "sha1",
        "uuid": "b39fcca2-82f2-48d7-b2d0-69d7edeffe7c",
        "value": "6894a51278ec89118276c2dd2dc36e6f9ea2790a",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780502069",
        "to_ids": true,
        "type": "url",
        "uuid": "16a49eb1-85ad-4b1f-a59f-1d4b411d6005",
        "value": "http://panel.securehubcloud.com/login",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780502091",
        "to_ids": true,
        "type": "domain",
        "uuid": "135d5450-61b8-4e61-bb65-54451381500c",
        "value": "greatness-marketing.top",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780502112",
        "to_ids": true,
        "type": "domain",
        "uuid": "37ab2986-9bed-4fd1-ab5d-a3dcc5e9405f",
        "value": "securehubcloud.com",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780502133",
        "to_ids": true,
        "type": "hostname",
        "uuid": "232bac95-4eb6-4b0c-84e6-863813614161",
        "value": "api.securehubcloud.com",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780502155",
        "to_ids": true,
        "type": "hostname",
        "uuid": "0a936b02-b288-4911-8ac4-8eea47b48119",
        "value": "boss.securehubcloud.com",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780502176",
        "to_ids": true,
        "type": "hostname",
        "uuid": "8b694ed3-b072-40ff-8097-bff99b737ab1",
        "value": "panel.securehubcloud.com",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780502197",
        "to_ids": true,
        "type": "hostname",
        "uuid": "fd29e4fe-1031-42bf-85ed-07abd37edf71",
        "value": "8r.attachedfile.com",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780502218",
        "to_ids": true,
        "type": "hostname",
        "uuid": "8a844d49-c161-4942-b195-87d41dda6cfb",
        "value": "acc.attachedfile.com",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780502239",
        "to_ids": true,
        "type": "hostname",
        "uuid": "95f52289-3757-4549-9314-3cb29f80ddc5",
        "value": "account.attachedfile.com",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780502260",
        "to_ids": true,
        "type": "hostname",
        "uuid": "068a6e81-7cb5-4a18-bb2e-8c3f37de9e7f",
        "value": "api.attachedfile.com",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780502282",
        "to_ids": true,
        "type": "hostname",
        "uuid": "1161489f-8c51-4332-ba18-8c544ab262bb",
        "value": "auth.mail.ru.attachedfile.com",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780502303",
        "to_ids": true,
        "type": "hostname",
        "uuid": "536d9b98-2df2-4417-9413-5d3485fa8b28",
        "value": "blog.attachedfile.com",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780502324",
        "to_ids": true,
        "type": "hostname",
        "uuid": "bed127de-9029-413a-88c6-9953139bb663",
        "value": "cpanel.attachedfile.com",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780502345",
        "to_ids": true,
        "type": "hostname",
        "uuid": "0989c4a2-91c2-4519-958c-d70af0c47430",
        "value": "cpcalendars.attachedfile.com",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780502366",
        "to_ids": true,
        "type": "hostname",
        "uuid": "fa1d33bb-967b-41d4-8a6b-8b3ceef5aab8",
        "value": "cpcontacts.attachedfile.com",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780502388",
        "to_ids": true,
        "type": "hostname",
        "uuid": "878eceaf-4d8b-469f-8ab9-44939afcda5d",
        "value": "csp.attachedfile.com",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780502409",
        "to_ids": true,
        "type": "hostname",
        "uuid": "c9c56d19-1eef-4ec3-ada2-d6a56086bb7f",
        "value": "disk.attachedfile.com",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780502431",
        "to_ids": true,
        "type": "hostname",
        "uuid": "563dd763-7c6a-4653-b530-94357b60e70a",
        "value": "g.sst.attachedfile.com",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780502452",
        "to_ids": true,
        "type": "hostname",
        "uuid": "876d3a5f-0f21-42d9-9015-3506521d6a85",
        "value": "gdw55e.attachedfile.com",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780502474",
        "to_ids": true,
        "type": "hostname",
        "uuid": "312bbc67-8bec-4085-98bc-ba713e9621f1",
        "value": "gui.attachedfile.com",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780502495",
        "to_ids": true,
        "type": "hostname",
        "uuid": "ee4fb832-5c14-4714-8087-3151bd942a73",
        "value": "live.attachedfile.com",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780502516",
        "to_ids": true,
        "type": "hostname",
        "uuid": "d1ad6e76-d77d-4574-a3d9-abc2c6158ece",
        "value": "login.attachedfile.com",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780502537",
        "to_ids": true,
        "type": "hostname",
        "uuid": "2894afd9-493d-4288-9954-eec67cf3979d",
        "value": "mail.attachedfile.com",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780502558",
        "to_ids": true,
        "type": "hostname",
        "uuid": "66a4af13-b14b-47d7-9324-2b89e0d4d1c8",
        "value": "mail.ru.attachedfile.com",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780502580",
        "to_ids": true,
        "type": "hostname",
        "uuid": "7016ea43-6375-436e-953f-b91f678ca976",
        "value": "mta-sts.mail.attachedfile.com",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780502601",
        "to_ids": true,
        "type": "hostname",
        "uuid": "3942bb76-24e5-4b73-85c9-66a05bd0db53",
        "value": "ok.attachedfile.com",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780502622",
        "to_ids": true,
        "type": "hostname",
        "uuid": "5859a558-19a0-4f32-81a6-6d7ace029444",
        "value": "okta.attachedfile.com",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780502644",
        "to_ids": true,
        "type": "hostname",
        "uuid": "ca7f095e-0a9a-4b77-a441-c11a7ae3507d",
        "value": "outlook.attachedfile.com",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780502665",
        "to_ids": true,
        "type": "hostname",
        "uuid": "d886e352-89d9-4f5c-9f58-aec0afce0be1",
        "value": "reporting.attachedfile.com",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780502686",
        "to_ids": true,
        "type": "hostname",
        "uuid": "3bd14106-4ec9-4a9c-a196-e47aad6a0330",
        "value": "ru.attachedfile.com",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780502707",
        "to_ids": true,
        "type": "hostname",
        "uuid": "a1ae40f5-1d6c-4f3b-8c79-ceb19f15da4f",
        "value": "sk.attachedfile.com",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780502728",
        "to_ids": true,
        "type": "hostname",
        "uuid": "a999c514-7e25-4dad-a080-5cbf87bdad2e",
        "value": "sso.attachedfile.com",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780502749",
        "to_ids": true,
        "type": "hostname",
        "uuid": "45869093-3745-4d16-8cf8-51c3cfe0b18c",
        "value": "ssl.attachedfile.com",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780502771",
        "to_ids": true,
        "type": "hostname",
        "uuid": "13b2cee3-537d-4434-acae-01ae7b5eb1dd",
        "value": "sst.attachedfile.com",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780502792",
        "to_ids": true,
        "type": "hostname",
        "uuid": "c6f9ec4d-6392-49a7-bd81-3fd0ed38d6ed",
        "value": "vpce.gdw55e.attachedfile.com",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780502814",
        "to_ids": true,
        "type": "hostname",
        "uuid": "9caaebe2-bcba-4bea-bedd-2de8d2d683d7",
        "value": "apm.vpce.gdw55e.attachedfile.com",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780502835",
        "to_ids": true,
        "type": "hostname",
        "uuid": "073c9dd0-d641-4bcf-8d40-44cbed57e3e6",
        "value": "webdisk.attachedfile.com",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780502856",
        "to_ids": true,
        "type": "hostname",
        "uuid": "afd0f107-f5c7-4726-955a-28d14406079a",
        "value": "webmail.attachedfile.com",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780502878",
        "to_ids": true,
        "type": "hostname",
        "uuid": "8aacc858-7342-4f30-a575-7c2a03aaa29d",
        "value": "www.attachedfile.com",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780502899",
        "to_ids": true,
        "type": "hostname",
        "uuid": "5acec150-2643-4d82-8295-785b6862cf24",
        "value": "www.auth.mail.ru.attachedfile.com",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780502920",
        "to_ids": true,
        "type": "hostname",
        "uuid": "79aeadaa-caba-44d7-8856-82ab5702c3bf",
        "value": "www.cloud.mail.ru.attachedfile.com",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780502941",
        "to_ids": true,
        "type": "hostname",
        "uuid": "d774a563-7bf8-42b3-af5b-404894301fc7",
        "value": "www.disk.attachedfile.com",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780502962",
        "to_ids": true,
        "type": "hostname",
        "uuid": "95057e1c-feb2-4086-8b92-1aedfe4aa638",
        "value": "www.yadi.sk.attachedfile.com",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780502984",
        "to_ids": true,
        "type": "hostname",
        "uuid": "2303026b-d34f-40ff-9038-af0f9e4384a3",
        "value": "yadi.sk.attachedfile.com",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780503005",
        "to_ids": true,
        "type": "hostname",
        "uuid": "0d8a8859-ea95-4a6c-8155-7498623a17ef",
        "value": "tk.mowell.tech",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780503026",
        "to_ids": true,
        "type": "hostname",
        "uuid": "eb6b2209-b4bb-4223-9849-2b39c92f369d",
        "value": "app.aermfq.com",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780503047",
        "to_ids": true,
        "type": "domain",
        "uuid": "a707869c-43c1-4a92-8517-ff4abe2657d7",
        "value": "hallttechav.com",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780503069",
        "to_ids": true,
        "type": "domain",
        "uuid": "f5abc86f-9c74-495d-a8b7-a0ad099a2c1f",
        "value": "trimedlting.com",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780503090",
        "to_ids": true,
        "type": "domain",
        "uuid": "1d177404-5d4f-4ada-9309-6bd37ca3c87a",
        "value": "beatsynash.com",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780503112",
        "to_ids": true,
        "type": "domain",
        "uuid": "627338d5-17d0-493a-a882-8e1256c38708",
        "value": "hendersonscr.com",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780503134",
        "to_ids": true,
        "type": "domain",
        "uuid": "3d1c5fad-4cf1-40cb-ae35-f4e6767a0191",
        "value": "venturrascv.com",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780503157",
        "to_ids": true,
        "type": "domain",
        "uuid": "ed4ace93-3da0-4747-bae9-bb75e1e489ad",
        "value": "cousinpackaging.com",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780503178",
        "to_ids": true,
        "type": "domain",
        "uuid": "b8c77300-d7aa-4c59-aa05-2ddd889797de",
        "value": "lineinvestments.info",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780503200",
        "to_ids": true,
        "type": "domain",
        "uuid": "7f0f3d4b-1360-4a53-ae4f-7e25e60732c7",
        "value": "xzjkmh.icu",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780503221",
        "to_ids": true,
        "type": "domain",
        "uuid": "44e6359d-a4d2-4e49-a02f-d72ecce7a815",
        "value": "creativelives.org",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780503242",
        "to_ids": true,
        "type": "domain",
        "uuid": "1f708d57-773a-471e-9358-b9faed549088",
        "value": "livedrivecdn.co",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780503263",
        "to_ids": true,
        "type": "domain",
        "uuid": "443155bd-4208-485c-9745-407f265963c4",
        "value": "yxfrdv.icu",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780503284",
        "to_ids": true,
        "type": "domain",
        "uuid": "185209a7-54bd-45d4-ab12-57a8b6acd08c",
        "value": "data-secured.org",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780503306",
        "to_ids": true,
        "type": "domain",
        "uuid": "bb3445bc-ac48-4c57-b79f-ef118c643303",
        "value": "remoska-cz.com",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780503327",
        "to_ids": true,
        "type": "domain",
        "uuid": "dc8aea6b-29ab-4425-ab06-3d63f4d47c99",
        "value": "zuccainc.com",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780503350",
        "to_ids": true,
        "type": "domain",
        "uuid": "6dc48a46-45af-46dc-8af6-8b0ae4d5c98a",
        "value": "documentsystems.net",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780503371",
        "to_ids": true,
        "type": "domain",
        "uuid": "302bf511-0740-4f5b-8e9f-217a27e0b8ee",
        "value": "reviewpdf.site",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      }
    ]
  }
}