{
  "Event": {
    "analysis": "1",
    "date": "2026-06-17",
    "extends_uuid": "",
    "info": "[Threat Intel] Threat Actors Abuse claude.ai Shared Chat for ClickFix Malvertising Campaign",
    "protected": false,
    "publish_timestamp": "1782538713",
    "published": true,
    "threat_level_id": "3",
    "timestamp": "1782537566",
    "uuid": "f66d7792-44c8-4b5a-8f0e-7357bd8352cb",
    "Orgc": {
      "name": "Rectifyq",
      "uuid": "cd9bd516-61fa-476b-980f-2f8de03992d4"
    },
    "Tag": [
      {
        "colour": "#717bc3",
        "local": false,
        "name": "misp-galaxy:producer=\"Trend Micro\"",
        "relationship_type": ""
      },
      {
        "colour": "#ffffff",
        "local": false,
        "name": "tlp:clear",
        "relationship_type": ""
      },
      {
        "colour": "#004646",
        "local": false,
        "name": "type:OSINT",
        "relationship_type": ""
      },
      {
        "colour": "#b94b1d",
        "local": false,
        "name": "rectifyq:mitre-att&ck=\"none-from-src\"",
        "relationship_type": ""
      },
      {
        "colour": "#b94b1d",
        "local": false,
        "name": "rectifyq:mitre-att&ck=\"from-OTX\"",
        "relationship_type": ""
      },
      {
        "colour": "#e7d48a",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"System Owner/User Discovery - T1033\"",
        "relationship_type": ""
      },
      {
        "colour": "#ed66f6",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Steal Web Session Cookie - T1539\"",
        "relationship_type": ""
      },
      {
        "colour": "#7da4ad",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Match Legitimate Resource Name or Location - T1036.005\"",
        "relationship_type": ""
      },
      {
        "colour": "#2c1d2e",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"System Checks - T1497.001\"",
        "relationship_type": ""
      },
      {
        "colour": "#c202a1",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Spearphishing Link - T1566.002\"",
        "relationship_type": ""
      },
      {
        "colour": "#7d7034",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"System Information Discovery - T1082\"",
        "relationship_type": ""
      },
      {
        "colour": "#68f2ff",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Data from Local System - T1005\"",
        "relationship_type": ""
      },
      {
        "colour": "#a92e1c",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Deobfuscate/Decode Files or Information - T1140\"",
        "relationship_type": ""
      },
      {
        "colour": "#a9bb6d",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Credentials from Password Stores - T1555\"",
        "relationship_type": ""
      },
      {
        "colour": "#8ed4a7",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Credentials from Web Browsers - T1555.003\"",
        "relationship_type": ""
      },
      {
        "colour": "#0c0051",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"File and Directory Discovery - T1083\"",
        "relationship_type": ""
      },
      {
        "colour": "#f95f85",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Credentials In Files - T1552.001\"",
        "relationship_type": ""
      },
      {
        "colour": "#4a5d84",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Web Services - T1583.006\"",
        "relationship_type": ""
      },
      {
        "colour": "#a9f8b1",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Exfiltration Over C2 Channel - T1041\"",
        "relationship_type": ""
      },
      {
        "colour": "#7628f7",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Unix Shell - T1059.004\"",
        "relationship_type": ""
      },
      {
        "colour": "#4a87cb",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Malicious Image - T1204.003\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Drive-by Compromise - T1189\"",
        "relationship_type": ""
      },
      {
        "colour": "#4c0fbb",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Ingress Tool Transfer - T1105\"",
        "relationship_type": ""
      },
      {
        "colour": "#8d021b",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Dead Drop Resolver - T1102.001\"",
        "relationship_type": ""
      },
      {
        "colour": "#098efb",
        "local": false,
        "name": "misp-galaxy:target-information=\"British Indian Ocean Territory\"",
        "relationship_type": ""
      },
      {
        "colour": "#15ccfd",
        "local": false,
        "name": "misp-galaxy:target-information=\"France\"",
        "relationship_type": ""
      },
      {
        "colour": "#e459c3",
        "local": false,
        "name": "misp-galaxy:target-information=\"Hong Kong\"",
        "relationship_type": ""
      },
      {
        "colour": "#013748",
        "local": false,
        "name": "misp-galaxy:target-information=\"India\"",
        "relationship_type": ""
      },
      {
        "colour": "#4cea11",
        "local": false,
        "name": "misp-galaxy:target-information=\"Italy\"",
        "relationship_type": ""
      },
      {
        "colour": "#5887a6",
        "local": false,
        "name": "misp-galaxy:target-information=\"Japan\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:target-information=\"Malaysia\"",
        "relationship_type": ""
      },
      {
        "colour": "#7dbb86",
        "local": false,
        "name": "misp-galaxy:target-information=\"Singapore\"",
        "relationship_type": ""
      },
      {
        "colour": "#2613b0",
        "local": false,
        "name": "misp-galaxy:target-information=\"Taiwan\"",
        "relationship_type": ""
      },
      {
        "colour": "#49a260",
        "local": false,
        "name": "rectifyq:category=\"threat\"",
        "relationship_type": ""
      },
      {
        "colour": "#120046",
        "local": false,
        "name": "rectifyq:sub-category=\"infra-profile\"",
        "relationship_type": ""
      },
      {
        "colour": "#18005c",
        "local": false,
        "name": "rectifyq:topic=\"ai\"",
        "relationship_type": ""
      },
      {
        "colour": "#ffd12e",
        "local": false,
        "name": "rectifyq:target=\"broad-based\"",
        "relationship_type": ""
      },
      {
        "colour": "#dd2e44",
        "local": false,
        "name": "rectifyq:MY-relevancy=\"relevant\"",
        "relationship_type": ""
      },
      {
        "colour": "#626567",
        "local": false,
        "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
        "relationship_type": ""
      },
      {
        "colour": "#626567",
        "local": false,
        "name": "rectifyq:no-samples-in=\"Tria.ge\"",
        "relationship_type": ""
      },
      {
        "colour": "#3800d9",
        "local": false,
        "name": "rectifyq:action-taken=\"VT-comment\"",
        "relationship_type": ""
      },
      {
        "colour": "#3d00e9",
        "local": false,
        "name": "rectifyq:action-taken=\"telegram\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:operating-system=\"macOS\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:software-vendor=\"JetBrains\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:software-vendor=\"cursor\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:software-vendor=\"openai\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:software-vendor=\"apple\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:software-vendor=\"google\"",
        "relationship_type": ""
      }
    ],
    "Attribute": [
      {
        "category": "External analysis",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1781838022",
        "to_ids": false,
        "type": "link",
        "uuid": "cde14dfb-8385-422e-b4d8-f1f5ac0ff65a",
        "value": "https://www.trendmicro.com/en_us/research/26/f/claudeai-shared-chat-abused-in-malvertising.html"
      },
      {
        "category": "Other",
        "comment": "Description",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1781838022",
        "to_ids": false,
        "type": "text",
        "uuid": "8f5b75ab-d2af-40cc-adf2-e4c9b745490f",
        "value": "Cybercriminals orchestrated a sophisticated malvertising operation leveraging Google Ads to impersonate popular AI developer tools including Claude AI, ChatGPT Codex, Perplexity, Cursor IDE, and JetBrains. Over seven weeks spanning April to June 2026, attackers deployed 106 unique malicious hostnames across six distinct waves, initially hosting ClickFix social engineering pages on GitLab infrastructure before pivoting to weaponize claude.ai's legitimate shared chat feature. The campaign targeted technically proficient users searching for AI development tools, tricking them into executing terminal commands that deployed the MacSync infostealer. This credential-harvesting malware collected browser data, SSH keys, and cryptocurrency wallets. The Asia-Pacific region sustained the heaviest impact with 67.2% of over 2,000 victims, particularly concentrated in Taiwan. Anthropic responded by banning malicious accounts and implementing additional abuse mitigations."
      },
      {
        "category": "Other",
        "comment": "Summary",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1781838022",
        "to_ids": false,
        "type": "text",
        "uuid": "262e55d6-5730-464a-b455-060c647a0809",
        "value": "Name: Threat Actors Abuse claude.ai Shared Chat for ClickFix Malvertising Campaign\nAuthor: AlienVault\nAdversary: \nTags: [\"gitlab pages abuse\", \"macsync\", \"ai impersonation\", \"macsync infostealer\", \"social engineering\", \"apac targeting\", \"google ads abuse\", \"clickfix\", \"malvertising\"]\nTgtd countries: [\"British Indian Ocean Territory\", \"France\", \"Hong Kong\", \"India\", \"Italy\", \"Japan\", \"Malaysia\", \"Singapore\", \"Taiwan\"]\nMlwr families: [\"MacSync\"]\nAttack_ids: [\"T1033\", \"T1539\", \"T1036.005\", \"T1497.001\", \"T1566.002\", \"T1082\", \"T1005\", \"T1140\", \"T1555\", \"T1555.003\", \"T1083\", \"T1552.001\", \"T1583.006\", \"T1041\", \"T1059.004\", \"T1204.003\", \"T1189\", \"T1105\", \"T1102.001\"]\nIndustries: [\"Technology\"]"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782355593",
        "to_ids": true,
        "type": "domain",
        "uuid": "f901487d-f179-4a84-839f-887b0b84e5c7",
        "value": "jerryshvac.com",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782355615",
        "to_ids": true,
        "type": "domain",
        "uuid": "c3266fba-2ca7-47df-9177-dbc775e77504",
        "value": "customroofingcontractors.com",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782355636",
        "to_ids": true,
        "type": "domain",
        "uuid": "9880d8ce-ea25-4d77-8715-866546070836",
        "value": "a2abotnet.com",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782355656",
        "to_ids": true,
        "type": "hostname",
        "uuid": "21721baf-8817-4b98-8d4c-de9f072bc972",
        "value": "claude-code.official-version.com",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782355677",
        "to_ids": true,
        "type": "domain",
        "uuid": "7ea299f5-e24a-45d5-adf5-11ec19c57e83",
        "value": "isgilan.com",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782355698",
        "to_ids": true,
        "type": "domain",
        "uuid": "e68ac5f5-39f5-425c-b55a-6ca46048cb50",
        "value": "plirepsijr74.com",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782355719",
        "to_ids": true,
        "type": "domain",
        "uuid": "3a17b5c7-749c-4882-a59e-e4ea99698bcd",
        "value": "thnikagent.com",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782355740",
        "to_ids": true,
        "type": "domain",
        "uuid": "6523815d-bbc3-46e4-98c0-426c36ddefac",
        "value": "babulikinet.com",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782355761",
        "to_ids": true,
        "type": "domain",
        "uuid": "3029beea-362f-4baa-a3ff-f7f91b2596b2",
        "value": "loserrq0j1sha8.com",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782355782",
        "to_ids": true,
        "type": "domain",
        "uuid": "377e6251-1d25-4a20-899c-59198267324a",
        "value": "bernasibutuwqu2.com",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782355803",
        "to_ids": true,
        "type": "domain",
        "uuid": "9ee79308-ca03-4b51-a40e-39c121ff0399",
        "value": "briskinternet.com",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782355824",
        "to_ids": true,
        "type": "domain",
        "uuid": "8c04db8a-2d3f-4385-945b-bdd110d0c3d5",
        "value": "touristprogram.com",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782355845",
        "to_ids": true,
        "type": "domain",
        "uuid": "1ef5936f-4dee-4f2a-a6a4-6845bb0b20dc",
        "value": "homeinspectionnaperville.com",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782355867",
        "to_ids": true,
        "type": "domain",
        "uuid": "a7cce7b1-29fd-4b1d-8143-78813175d428",
        "value": "yoauction.com",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782355888",
        "to_ids": true,
        "type": "domain",
        "uuid": "a330b513-b1ca-46c0-b3c7-808f8cd05312",
        "value": "alabamarecoverycenter.com",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782355910",
        "to_ids": true,
        "type": "domain",
        "uuid": "64df6944-87f8-4f49-a0b5-80a2b613db79",
        "value": "5x5web.com",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782355931",
        "to_ids": true,
        "type": "domain",
        "uuid": "5d0b0242-839e-46fb-a1b4-aabea27fc73c",
        "value": "bewqslkslikrtjinfg9.com",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782355952",
        "to_ids": true,
        "type": "domain",
        "uuid": "4eed69e9-679f-4c0b-8d13-181dc1d7f764",
        "value": "oaklandwaterdamage.com",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782355973",
        "to_ids": true,
        "type": "domain",
        "uuid": "11fe2385-4b32-40dd-a913-1da2895d3abd",
        "value": "peowqlauoshau8.com",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782355994",
        "to_ids": true,
        "type": "url",
        "uuid": "502785e2-a34e-4d0a-8388-7dbcd1ced672",
        "value": "https://loserrq0j1sha8.com/debug/loader.sh?build=a39427f9d5bfda11277f1a58c89b7c2d",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782356016",
        "to_ids": true,
        "type": "domain",
        "uuid": "42a1b699-63f7-4e6b-9436-28cebb9f723a",
        "value": "20claude.ai",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "Notable Malicious Hostnames (GitLab Pages)",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782356037",
        "to_ids": true,
        "type": "hostname",
        "uuid": "2d05b39d-6f42-4897-9226-849304b52251",
        "value": "claude-code-app.gitlab.io",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "Notable Malicious Hostnames (GitLab Pages)",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782356057",
        "to_ids": true,
        "type": "hostname",
        "uuid": "ecb4b563-9614-4f2e-8f48-55f363500012",
        "value": "claude-desktop-lm.gitlab.io",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "Notable Malicious Hostnames (GitLab Pages)",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782356078",
        "to_ids": true,
        "type": "hostname",
        "uuid": "8c62a334-98f8-4b38-800f-91de9807170e",
        "value": "cladesktop.gitlab.io",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "Notable Malicious Hostnames (GitLab Pages)",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782356099",
        "to_ids": true,
        "type": "hostname",
        "uuid": "dbe3dfd2-23c8-4e6c-b2f1-5efb7dbeb481",
        "value": "claudecode-desktop.gitlab.io",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "Notable Malicious Hostnames (GitLab Pages)",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782356121",
        "to_ids": true,
        "type": "hostname",
        "uuid": "73b37d0a-8e9c-40d8-8621-35d2da1dbf7e",
        "value": "claude-app-new.gitlab.io",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "Notable Malicious Hostnames (GitLab Pages)",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782356142",
        "to_ids": true,
        "type": "hostname",
        "uuid": "d19a957d-6fcb-40d3-ae4c-2547b68825a1",
        "value": "claude-desktop.gitlab.io",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "Notable Malicious Hostnames (GitLab Pages)",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782356163",
        "to_ids": true,
        "type": "hostname",
        "uuid": "f8adf721-fc66-4822-b050-46a3ceb3b184",
        "value": "claudeapp.gitlab.io",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "Notable Malicious Hostnames (GitLab Pages)",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782356184",
        "to_ids": true,
        "type": "hostname",
        "uuid": "e2aa6449-75bb-4155-a53a-462081dac77a",
        "value": "claudesktop.gitlab.io",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "Notable Malicious Hostnames (GitLab Pages)",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782356205",
        "to_ids": true,
        "type": "hostname",
        "uuid": "2978ece6-ad35-4922-bb17-f02df07f6335",
        "value": "claudesktop-app.gitlab.io",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "Notable Malicious Hostnames (GitLab Pages)",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782356226",
        "to_ids": true,
        "type": "hostname",
        "uuid": "229dc204-e8f0-485f-9358-7ca1b15c7134",
        "value": "perplexity-platform.gitlab.io",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "Notable Malicious Hostnames (GitLab Pages)",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782356248",
        "to_ids": true,
        "type": "hostname",
        "uuid": "5446a0f1-ab3e-4ea1-81a6-e7e34bb4ac82",
        "value": "codexgpt.gitlab.io",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "Notable Malicious Hostnames (GitLab Pages)",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782356269",
        "to_ids": true,
        "type": "hostname",
        "uuid": "c599021d-6e57-4591-b1af-f9fac9782ee2",
        "value": "chatgpt-codex-app.gitlab.io",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "Notable Malicious Hostnames (GitLab Pages)",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782356290",
        "to_ids": true,
        "type": "hostname",
        "uuid": "4a1f41aa-36b5-4109-a4de-2c4e8fdd67b4",
        "value": "chatgpt-codex-lm.gitlab.io",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "Notable Malicious Hostnames (GitLab Pages)",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782356311",
        "to_ids": true,
        "type": "hostname",
        "uuid": "8dc34e55-6cde-4172-8965-d4ade60a579b",
        "value": "cursor-8ced8a.gitlab.io",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "Notable Malicious Hostnames (GitLab Pages)",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782356332",
        "to_ids": true,
        "type": "hostname",
        "uuid": "8aa371ae-a878-4448-924d-b334a8977f6b",
        "value": "jetbrains-apps-group.gitlab.io",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "Notable Malicious Hostnames (GitLab Pages)",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782356353",
        "to_ids": true,
        "type": "domain",
        "uuid": "c43958d0-e546-45d1-9fa8-e3b5474b03f1",
        "value": "claude.ai",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "Claude.ai Abused Share IDs (Top 5 by Traffic)",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782537481",
        "to_ids": true,
        "type": "url",
        "uuid": "860b4b6d-934e-470e-be33-80872ceb5003",
        "value": "https://claude.ai/share/498818d9-1ddc-4fbb-9fa7-56dfb84840b0",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "Claude.ai Abused Share IDs (Top 5 by Traffic)",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782537502",
        "to_ids": true,
        "type": "url",
        "uuid": "2d7d18f6-a890-47af-b8be-23b828ce9d71",
        "value": "https://claude.ai/share/cfc70dcd-779c-4f4a-966c-ec12b7ea166f",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "Claude.ai Abused Share IDs (Top 5 by Traffic)",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782537523",
        "to_ids": true,
        "type": "url",
        "uuid": "a9b39673-058b-462b-8763-eb42578d2cd9",
        "value": "https://claude.ai/share/b2699c2e-1260-4a3f-b312-e5288a43fd11",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "Claude.ai Abused Share IDs (Top 5 by Traffic)",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782537544",
        "to_ids": true,
        "type": "url",
        "uuid": "013b22f1-62a0-4c45-bb11-327008da9038",
        "value": "https://claude.ai/share/41b11dc2-ac83-4cb4-8f38-ac63b75e9e62",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "Claude.ai Abused Share IDs (Top 5 by Traffic)",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782537566",
        "to_ids": true,
        "type": "url",
        "uuid": "db163933-8710-4870-9e72-fff4cd4b57d0",
        "value": "https://claude.ai/share/b81a4375-1d0d-43cc-ad89-6a1007b4e7e5",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      }
    ]
  }
}