{"type":"bundle","id":"bundle--b7d0acd5-198f-5562-880c-86a9bf2b0eae","objects":[{"type":"identity","spec_version":"2.1","id":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","created":"2020-12-08T00:00:00.000Z","modified":"2020-12-08T00:00:00.000Z","name":"TweetFeed","description":"Community-sourced Threat Intelligence feed aggregating IOCs (URLs, domains, IPs, hashes) from infosec researchers on Twitter/X. Refreshed every 15 minutes.","identity_class":"organization","contact_information":"https://tweetfeed.live"},{"type":"indicator","spec_version":"2.1","id":"indicator--36a07678-6b71-5595-8109-c26c75cf7ddc","created":"2026-05-14T00:00:00.000Z","modified":"2026-05-14T00:00:00.000Z","valid_from":"2026-05-14T00:00:00.000Z","name":"biglobemailservice.weebly.com","description":"IOC reported by @urldna_bot on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'biglobemailservice.weebly.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/urldna_bot/status/2054713353105244205"}],"labels":["phishing","scam"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d9cea1be-6b4b-5a45-a415-66ca70ddd034","created":"2026-05-14T00:00:00.000Z","modified":"2026-05-14T00:00:00.000Z","valid_from":"2026-05-14T00:00:00.000Z","name":"https://biglobemailservice.weebly.com","description":"IOC reported by @urldna_bot on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://biglobemailservice.weebly.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/urldna_bot/status/2054713353105244205"}],"labels":["phishing","scam"]},{"type":"indicator","spec_version":"2.1","id":"indicator--84a3ecf8-8b0a-5ca5-b0b4-13fa8b495302","created":"2026-05-14T00:36:00.000Z","modified":"2026-05-14T00:36:00.000Z","valid_from":"2026-05-14T00:36:00.000Z","name":"hhxpvpo.bond","description":"IOC reported by @masaomi346 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'hhxpvpo.bond']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/masaomi346/status/2054722396893122799"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7b5bcd34-5be0-5e0c-83ad-618803d92f40","created":"2026-05-14T00:36:00.000Z","modified":"2026-05-14T00:36:00.000Z","valid_from":"2026-05-14T00:36:00.000Z","name":"https://hhxpvpo.bond/source/A9QLGXnyX47T","description":"IOC reported by @masaomi346 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://hhxpvpo.bond/source/A9QLGXnyX47T']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/masaomi346/status/2054722396893122799"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3bc9ec7c-3378-5b53-8fa1-5f4c8ca807ce","created":"2026-05-14T00:44:00.000Z","modified":"2026-05-14T00:44:00.000Z","valid_from":"2026-05-14T00:44:00.000Z","name":"d08b9af78ec25b65523967d2517d4d9d8dcd1068fca605288462cfd968ef5aee","description":"IOC reported by @masaomi346 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[file:hashes.'SHA-256' = 'd08b9af78ec25b65523967d2517d4d9d8dcd1068fca605288462cfd968ef5aee']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/masaomi346/status/2054724510319079833"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--1f796f6a-57b4-5f5c-bac5-d33cfdc51403","created":"2026-05-14T02:42:00.000Z","modified":"2026-05-14T02:42:00.000Z","valid_from":"2026-05-14T02:42:00.000Z","name":"http://github.com/happydream9028","description":"IOC reported by @MalforsHQ on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://github.com/happydream9028']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/MalforsHQ/status/2054578037438517524"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--d1a41da7-c51b-5dca-a5cd-4426574038f6","created":"2026-05-14T03:43:00.000Z","modified":"2026-05-14T03:43:00.000Z","valid_from":"2026-05-14T03:43:00.000Z","name":"beachjiujitsu.com","description":"IOC reported by @masaomi346 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'beachjiujitsu.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/masaomi346/status/2054769662580379837"}],"labels":["infostealer","malware"]},{"type":"indicator","spec_version":"2.1","id":"indicator--cd04462f-c234-5aba-9fdb-c77e05655944","created":"2026-05-14T03:43:00.000Z","modified":"2026-05-14T03:43:00.000Z","valid_from":"2026-05-14T03:43:00.000Z","name":"http://beachjiujitsu.com","description":"IOC reported by @masaomi346 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://beachjiujitsu.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/masaomi346/status/2054769662580379837"}],"labels":["infostealer","malware"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9d72e7ba-2e92-5e36-9e6d-d6ee85ef4357","created":"2026-05-14T04:18:00.000Z","modified":"2026-05-14T04:18:00.000Z","valid_from":"2026-05-14T04:18:00.000Z","name":"cherepahanataha.com","description":"IOC reported by @masaomi346 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'cherepahanataha.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/masaomi346/status/2054778413232353488"}],"labels":["infostealer","malware"]},{"type":"indicator","spec_version":"2.1","id":"indicator--46b5db09-66b3-5a4d-bdc8-b07143967404","created":"2026-05-14T04:18:00.000Z","modified":"2026-05-14T04:18:00.000Z","valid_from":"2026-05-14T04:18:00.000Z","name":"http://cherepahanataha.com","description":"IOC reported by @masaomi346 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://cherepahanataha.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/masaomi346/status/2054778413232353488"}],"labels":["infostealer","malware"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e96f6fd1-a07d-50d0-a760-f9291277ab94","created":"2026-05-14T05:00:00.000Z","modified":"2026-05-14T05:00:00.000Z","valid_from":"2026-05-14T05:00:00.000Z","name":"mem.calcuttaswimmingclub.com","description":"IOC reported by @AddressIntel on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'mem.calcuttaswimmingclub.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/AddressIntel/status/2054788822571815004"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d15352cd-2491-5d50-9ef1-de2c316bfc07","created":"2026-05-14T05:00:00.000Z","modified":"2026-05-14T05:00:00.000Z","valid_from":"2026-05-14T05:00:00.000Z","name":"https://mem.calcuttaswimmingclub.com/it/pagopa/log/msdpweb/","description":"IOC reported by @AddressIntel on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://mem.calcuttaswimmingclub.com/it/pagopa/log/msdpweb/']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/AddressIntel/status/2054788822571815004"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8eec0043-844a-55e3-8129-41238ea20650","created":"2026-05-14T05:15:00.000Z","modified":"2026-05-14T05:15:00.000Z","valid_from":"2026-05-14T05:15:00.000Z","name":"ntc-firewall.safeurl-content.online","description":"IOC reported by @__0XYC__ on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'ntc-firewall.safeurl-content.online']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/__0XYC__/status/2054792675887382660"}],"labels":["APT"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c325afa4-7bb7-56ad-98ac-ac46f99d60be","created":"2026-05-14T05:15:00.000Z","modified":"2026-05-14T05:15:00.000Z","valid_from":"2026-05-14T05:15:00.000Z","name":"https://ntc-firewall.safeurl-content.online/opx/mailflair/r/EZ6n6FMhSh","description":"IOC reported by @__0XYC__ on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://ntc-firewall.safeurl-content.online/opx/mailflair/r/EZ6n6FMhSh']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/__0XYC__/status/2054792675887382660"}],"labels":["APT"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a7c2c796-db9a-5ab7-a427-bff692eba675","created":"2026-05-14T05:49:00.000Z","modified":"2026-05-14T05:49:00.000Z","valid_from":"2026-05-14T05:49:00.000Z","name":"login.lbbacx.com","description":"IOC reported by @Yurinoki_Yurin on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'login.lbbacx.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/Yurinoki_Yurin/status/2054801373880066388"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--7ab1e309-aac0-532a-87d7-3d79ed7f0423","created":"2026-05-14T05:49:00.000Z","modified":"2026-05-14T05:49:00.000Z","valid_from":"2026-05-14T05:49:00.000Z","name":"https://login.lbbacx.com","description":"IOC reported by @Yurinoki_Yurin on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://login.lbbacx.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/Yurinoki_Yurin/status/2054801373880066388"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--873a7e6d-25f0-5690-8ad6-b315090b4c79","created":"2026-05-14T05:49:00.000Z","modified":"2026-05-14T05:49:00.000Z","valid_from":"2026-05-14T05:49:00.000Z","name":"35.219.189.153","description":"IOC reported by @Yurinoki_Yurin on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[ipv4-addr:value = '35.219.189.153']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/Yurinoki_Yurin/status/2054801373880066388"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--d7661862-fa29-5f74-8fbb-4a75ad442c72","created":"2026-05-14T06:00:00.000Z","modified":"2026-05-14T06:00:00.000Z","valid_from":"2026-05-14T06:00:00.000Z","name":"wemailacmontpellierfristatic0110nalldomainlayoutoginbleg.weebly.com","description":"IOC reported by @urldna_bot on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'wemailacmontpellierfristatic0110nalldomainlayoutoginbleg.weebly.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/urldna_bot/status/2054803961001939254"}],"labels":["phishing","scam"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f72bc547-4d0a-5e78-86d2-b025286f8b51","created":"2026-05-14T06:00:00.000Z","modified":"2026-05-14T06:00:00.000Z","valid_from":"2026-05-14T06:00:00.000Z","name":"https://wemailacmontpellierfristatic0110nalldomainlayoutoginbleg.weebly.com","description":"IOC reported by @urldna_bot on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://wemailacmontpellierfristatic0110nalldomainlayoutoginbleg.weebly.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/urldna_bot/status/2054803961001939254"}],"labels":["phishing","scam"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3c974e11-2703-50fe-8a25-33b449c49d9e","created":"2026-05-14T06:06:00.000Z","modified":"2026-05-14T06:06:00.000Z","valid_from":"2026-05-14T06:06:00.000Z","name":"194.163.148.133","description":"IOC reported by @Fact_Finder03 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[ipv4-addr:value = '194.163.148.133']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/Fact_Finder03/status/2054805615269298684"}],"labels":["stealer"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2d5336b3-34a5-5c72-b96a-b12aa197562f","created":"2026-05-14T06:06:00.000Z","modified":"2026-05-14T06:06:00.000Z","valid_from":"2026-05-14T06:06:00.000Z","name":"892aa7559852a22b8bc7a38df7c2f2cdd866e4c28a8177d80df6190d2eb6a78b","description":"IOC reported by @Fact_Finder03 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[file:hashes.'SHA-256' = '892aa7559852a22b8bc7a38df7c2f2cdd866e4c28a8177d80df6190d2eb6a78b']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/Fact_Finder03/status/2054805615269298684"}],"labels":["stealer"]},{"type":"indicator","spec_version":"2.1","id":"indicator--44da8abc-989e-5b37-9f57-f2cf025a62dd","created":"2026-05-14T06:11:00.000Z","modified":"2026-05-14T06:11:00.000Z","valid_from":"2026-05-14T06:11:00.000Z","name":"rqvzkqb.shbllgs.cn","description":"IOC reported by @Metemcyber on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'rqvzkqb.shbllgs.cn']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/Metemcyber/status/2054806822914232688"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--90b621dc-1602-50ed-ac69-2fd26b0a16fe","created":"2026-05-14T06:11:00.000Z","modified":"2026-05-14T06:11:00.000Z","valid_from":"2026-05-14T06:11:00.000Z","name":"https://rqvzkqb.shbllgs.cn/pkkjp/aenop/potyunde/","description":"IOC reported by @Metemcyber on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://rqvzkqb.shbllgs.cn/pkkjp/aenop/potyunde/']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/Metemcyber/status/2054806822914232688"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8d4f3048-0623-5cf8-9c7f-c2e6b826f4ac","created":"2026-05-14T06:11:00.000Z","modified":"2026-05-14T06:11:00.000Z","valid_from":"2026-05-14T06:11:00.000Z","name":"login.ztjbbx.com","description":"IOC reported by @Yurinoki_Yurin on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'login.ztjbbx.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/Yurinoki_Yurin/status/2054806913192542562"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--479de88d-3bc2-58d9-9258-a5dbe57191dd","created":"2026-05-14T06:11:00.000Z","modified":"2026-05-14T06:11:00.000Z","valid_from":"2026-05-14T06:11:00.000Z","name":"https://login.ztjbbx.com","description":"IOC reported by @Yurinoki_Yurin on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://login.ztjbbx.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/Yurinoki_Yurin/status/2054806913192542562"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--a552f54c-fb54-55f6-8b82-a96e78ba67bf","created":"2026-05-14T06:11:00.000Z","modified":"2026-05-14T06:11:00.000Z","valid_from":"2026-05-14T06:11:00.000Z","name":"35.219.141.232","description":"IOC reported by @Yurinoki_Yurin on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[ipv4-addr:value = '35.219.141.232']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/Yurinoki_Yurin/status/2054806913192542562"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--b5d838f9-3389-54c6-8aff-6e732460c86b","created":"2026-05-14T06:14:00.000Z","modified":"2026-05-14T06:14:00.000Z","valid_from":"2026-05-14T06:14:00.000Z","name":"172.239.129.158","description":"IOC reported by @Fact_Finder03 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[ipv4-addr:value = '172.239.129.158']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/Fact_Finder03/status/2054807559404732926"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--c8996fe5-fdd0-5d2a-bd66-d670f6c74fbb","created":"2026-05-14T06:14:00.000Z","modified":"2026-05-14T06:14:00.000Z","valid_from":"2026-05-14T06:14:00.000Z","name":"8a24907655a03f0f8b4991cb22a07c4f9e16626260f6dbcc748fbb4dc4720508","description":"IOC reported by @Fact_Finder03 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[file:hashes.'SHA-256' = '8a24907655a03f0f8b4991cb22a07c4f9e16626260f6dbcc748fbb4dc4720508']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/Fact_Finder03/status/2054807559404732926"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--4e0d2148-eb2c-55fb-ba5a-c97f048e0820","created":"2026-05-14T06:14:00.000Z","modified":"2026-05-14T06:14:00.000Z","valid_from":"2026-05-14T06:14:00.000Z","name":"8f2e5ee9a87752e1b0626dd2bb754aaa2f9d8ef19d3ae448a06d3c38e647b6d0","description":"IOC reported by @Fact_Finder03 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[file:hashes.'SHA-256' = '8f2e5ee9a87752e1b0626dd2bb754aaa2f9d8ef19d3ae448a06d3c38e647b6d0']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/Fact_Finder03/status/2054807559404732926"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--7035da5c-f6f9-506f-89d8-292de6ca828c","created":"2026-05-14T06:19:00.000Z","modified":"2026-05-14T06:19:00.000Z","valid_from":"2026-05-14T06:19:00.000Z","name":"dsrzzi.jetgq.cn","description":"IOC reported by @Metemcyber on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'dsrzzi.jetgq.cn']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/Metemcyber/status/2054808764763734451"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d7695193-008b-5d2c-a0a1-5d33f68909be","created":"2026-05-14T06:19:00.000Z","modified":"2026-05-14T06:19:00.000Z","valid_from":"2026-05-14T06:19:00.000Z","name":"https://dsrzzi.jetgq.cn/jkautixtf/londut/","description":"IOC reported by @Metemcyber on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://dsrzzi.jetgq.cn/jkautixtf/londut/']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/Metemcyber/status/2054808764763734451"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--14646d38-f535-505d-9544-5d0ec6d3ce49","created":"2026-05-14T06:19:00.000Z","modified":"2026-05-14T06:19:00.000Z","valid_from":"2026-05-14T06:19:00.000Z","name":"165.154.231.146","description":"IOC reported by @Metemcyber on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[ipv4-addr:value = '165.154.231.146']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/Metemcyber/status/2054808764763734451"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a5c850a1-fcd9-5097-8622-b61d7d7d450c","created":"2026-05-14T06:27:00.000Z","modified":"2026-05-14T06:27:00.000Z","valid_from":"2026-05-14T06:27:00.000Z","name":"sufesuzu.z7.web.core.windows.net","description":"IOC reported by @Yurinoki_Yurin on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'sufesuzu.z7.web.core.windows.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/Yurinoki_Yurin/status/2054810788477768053"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--53dc60b1-b4d7-5274-a01f-ab1049a0487b","created":"2026-05-14T06:27:00.000Z","modified":"2026-05-14T06:27:00.000Z","valid_from":"2026-05-14T06:27:00.000Z","name":"https://sufesuzu.z7.web.core.windows.net","description":"IOC reported by @Yurinoki_Yurin on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://sufesuzu.z7.web.core.windows.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/Yurinoki_Yurin/status/2054810788477768053"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--16422871-509b-5764-a4a7-f4193e37c81e","created":"2026-05-14T06:27:00.000Z","modified":"2026-05-14T06:27:00.000Z","valid_from":"2026-05-14T06:27:00.000Z","name":"171.252.225.139","description":"IOC reported by @Yurinoki_Yurin on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[ipv4-addr:value = '171.252.225.139']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/Yurinoki_Yurin/status/2054810788477768053"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--162040b9-a741-534c-af77-e7389df9757c","created":"2026-05-14T06:27:00.000Z","modified":"2026-05-14T06:27:00.000Z","valid_from":"2026-05-14T06:27:00.000Z","name":"20.60.131.1","description":"IOC reported by @Yurinoki_Yurin on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[ipv4-addr:value = '20.60.131.1']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/Yurinoki_Yurin/status/2054810788477768053"}]}]}