{"indicator": "130[.]12[.]180[.]32", "type": "ipv4", "source": "binarydefense_banlist,blocklist_de_ssh,et_compromised,greensnow_blocklist,ipsum_level5,threatfox_export_json", "first_seen": "2026-10-17T15:21:10Z", "last_seen": "2026-10-24T22:12:16Z", "confidence": "high", "score": 96, "sightings": 25, "tags": "aggregated,binarydefense,blocklist,bruteforce,compromised,ddos,elf,emerging-threats,go,greensnow,ipsum,legea,multi-list,scanner,ssh,threatfox", "reference": "https://rules.emergingthreats.net/", "context": "Blocklist entry from et_compromised", "tlp": "CLEAR", "score_factors": {"score": 96, "confidence_base": 80, "source_count": 5, "source_identifiers": ["binarydefense_banlist", "blocklist_de_ssh", "et_compromised", "greensnow_blocklist", "ipsum_level5", "threatfox_export_json"], "reporting_groups": ["abuse.ch", "binarydefense", "blocklist.de", "emerging-threats", "greensnow"], "excluded_sources": [{"source": "ipsum_level5", "role": "aggregate"}], "unmapped_sources": [], "corroboration_bonus": 16, "age_hours": 0.0, "half_life_hours": 168.0, "decay_factor": 1.0}}
{"indicator": "94[.]154[.]43[.]69", "type": "ipv4", "source": "binarydefense_banlist,blocklist_de_ssh,et_compromised,greensnow_blocklist,ipsum_level5,threatfox_export_json", "first_seen": "2026-09-03T05:39:44Z", "last_seen": "2026-10-24T22:12:16Z", "confidence": "high", "score": 96, "sightings": 237, "tags": "AkataruBotnet,aggregated,binarydefense,blocklist,bruteforce,compromised,emerging-threats,greensnow,ipsum,multi-list,scanner,ssh,threatfox", "reference": "https://rules.emergingthreats.net/", "context": "Blocklist entry from et_compromised", "tlp": "CLEAR", "score_factors": {"score": 96, "confidence_base": 80, "source_count": 5, "source_identifiers": ["binarydefense_banlist", "blocklist_de_ssh", "et_compromised", "greensnow_blocklist", "ipsum_level5", "threatfox_export_json"], "reporting_groups": ["abuse.ch", "binarydefense", "blocklist.de", "emerging-threats", "greensnow"], "excluded_sources": [{"source": "ipsum_level5", "role": "aggregate"}], "unmapped_sources": [], "corroboration_bonus": 16, "age_hours": 0.0, "half_life_hours": 168.0, "decay_factor": 1.0}}
{"indicator": "176[.]65[.]139[.]131", "type": "ipv4", "source": "blocklist_de_ssh,et_compromised,ipsum_level5,threatfox_export_json", "first_seen": "2026-10-23T05:26:18Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 96, "sightings": 8, "tags": "aggregated,blocklist,bruteforce,compromised,emerging-threats,honeypot,ipsum,multi-list,ssh,threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "Mirai", "tlp": "CLEAR", "score_factors": {"score": 96, "confidence_base": 80, "source_count": 3, "source_identifiers": ["blocklist_de_ssh", "et_compromised", "ipsum_level5", "threatfox_export_json"], "reporting_groups": ["abuse.ch", "blocklist.de", "emerging-threats"], "excluded_sources": [{"source": "ipsum_level5", "role": "aggregate"}], "unmapped_sources": [], "corroboration_bonus": 16, "age_hours": 0.0, "half_life_hours": 168.0, "decay_factor": 1.0}}
{"indicator": "85[.]215[.]73[.]250", "type": "ipv4", "source": "blocklist_de_ssh,ci_army_list,threatfox_export_json", "first_seen": "2026-10-22T01:18:15Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 96, "sightings": 8, "tags": "Mirai,blocklist,bruteforce,cins,cowrie,elf,honeypot,scanner,ssh,threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "Mirai", "tlp": "CLEAR", "score_factors": {"score": 96, "confidence_base": 80, "source_count": 3, "source_identifiers": ["blocklist_de_ssh", "ci_army_list", "threatfox_export_json"], "reporting_groups": ["abuse.ch", "blocklist.de", "cins"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 16, "age_hours": 0.0, "half_life_hours": 168.0, "decay_factor": 1.0}}
{"indicator": "77[.]239[.]124[.]135", "type": "ipv4", "source": "binarydefense_banlist,ci_army_list,ipsum_level5,threatfox_export_json", "first_seen": "2026-10-21T05:31:44Z", "last_seen": "2026-10-24T22:12:16Z", "confidence": "high", "score": 96, "sightings": 9, "tags": "aggregated,arm,binarydefense,blocklist,cins,elf,ipsum,multi-list,scanner,threatfox,zig", "reference": "https://www.binarydefense.com/", "context": "Blocklist entry from binarydefense_banlist", "tlp": "CLEAR", "score_factors": {"score": 96, "confidence_base": 80, "source_count": 3, "source_identifiers": ["binarydefense_banlist", "ci_army_list", "ipsum_level5", "threatfox_export_json"], "reporting_groups": ["abuse.ch", "binarydefense", "cins"], "excluded_sources": [{"source": "ipsum_level5", "role": "aggregate"}], "unmapped_sources": [], "corroboration_bonus": 16, "age_hours": 0.0, "half_life_hours": 168.0, "decay_factor": 1.0}}
{"indicator": "92[.]249[.]61[.]190", "type": "ipv4", "source": "blocklist_de_ssh,greensnow_blocklist,ipsum_level5,threatfox_export_json", "first_seen": "2026-10-19T09:45:47Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 96, "sightings": 16, "tags": "Adaptix,AdaptixC2,aggregated,blocklist,bruteforce,drb-ra,greensnow,ipsum,multi-list,ssh,threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "AdaptixC2", "tlp": "CLEAR", "score_factors": {"score": 96, "confidence_base": 80, "source_count": 3, "source_identifiers": ["blocklist_de_ssh", "greensnow_blocklist", "ipsum_level5", "threatfox_export_json"], "reporting_groups": ["abuse.ch", "blocklist.de", "greensnow"], "excluded_sources": [{"source": "ipsum_level5", "role": "aggregate"}], "unmapped_sources": [], "corroboration_bonus": 16, "age_hours": 0.0, "half_life_hours": 168.0, "decay_factor": 1.0}}
{"indicator": "91[.]92[.]43[.]221", "type": "ipv4", "source": "blocklist_de_ssh,ci_army_list,ipsum_level5,threatfox_export_json", "first_seen": "2026-10-16T06:10:48Z", "last_seen": "2026-10-24T22:12:16Z", "confidence": "high", "score": 96, "sightings": 28, "tags": "aggregated,blocklist,bruteforce,cins,honeypot,ipsum,mirai,multi-list,scanner,ssh,threatfox", "reference": "https://www.blocklist.de/en/", "context": "Blocklist entry from blocklist_de_ssh", "tlp": "CLEAR", "score_factors": {"score": 96, "confidence_base": 80, "source_count": 3, "source_identifiers": ["blocklist_de_ssh", "ci_army_list", "ipsum_level5", "threatfox_export_json"], "reporting_groups": ["abuse.ch", "blocklist.de", "cins"], "excluded_sources": [{"source": "ipsum_level5", "role": "aggregate"}], "unmapped_sources": [], "corroboration_bonus": 16, "age_hours": 0.0, "half_life_hours": 168.0, "decay_factor": 1.0}}
{"indicator": "31[.]59[.]220[.]26", "type": "ipv4", "source": "binarydefense_banlist,ci_army_list,ipsum_level5,threatfox_export_json", "first_seen": "2026-10-12T06:11:09Z", "last_seen": "2026-10-24T22:12:16Z", "confidence": "high", "score": 96, "sightings": 45, "tags": "aggregated,binarydefense,blocklist,cins,ipsum,multi-list,scanner,threatfox", "reference": "https://cinsscore.com/", "context": "Blocklist entry from ci_army_list", "tlp": "CLEAR", "score_factors": {"score": 96, "confidence_base": 80, "source_count": 3, "source_identifiers": ["binarydefense_banlist", "ci_army_list", "ipsum_level5", "threatfox_export_json"], "reporting_groups": ["abuse.ch", "binarydefense", "cins"], "excluded_sources": [{"source": "ipsum_level5", "role": "aggregate"}], "unmapped_sources": [], "corroboration_bonus": 16, "age_hours": 0.0, "half_life_hours": 168.0, "decay_factor": 1.0}}
{"indicator": "156[.]225[.]17[.]60", "type": "ipv4", "source": "binarydefense_banlist,ci_army_list,threatfox_export_json", "first_seen": "2026-09-23T08:22:50Z", "last_seen": "2026-10-24T22:12:16Z", "confidence": "high", "score": 96, "sightings": 101, "tags": "Gh0stRAT,RAT,binarydefense,blocklist,cins,scanner,threatfox", "reference": "https://cinsscore.com/", "context": "Blocklist entry from ci_army_list", "tlp": "CLEAR", "score_factors": {"score": 96, "confidence_base": 80, "source_count": 3, "source_identifiers": ["binarydefense_banlist", "ci_army_list", "threatfox_export_json"], "reporting_groups": ["abuse.ch", "binarydefense", "cins"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 16, "age_hours": 0.0, "half_life_hours": 168.0, "decay_factor": 1.0}}
{"indicator": "165[.]154[.]227[.]8", "type": "ipv4", "source": "blocklist_de_ssh,greensnow_blocklist,ipsum_level5,threatfox_export_json", "first_seen": "2026-09-21T07:10:53Z", "last_seen": "2026-10-24T22:12:16Z", "confidence": "high", "score": 96, "sightings": 150, "tags": "aggregated,blocklist,bruteforce,greensnow,ipsum,mdrfckr,multi-list,outlaw,ssh,ssh-bruteforce,threatfox", "reference": "https://www.blocklist.de/en/", "context": "Blocklist entry from blocklist_de_ssh", "tlp": "CLEAR", "score_factors": {"score": 96, "confidence_base": 80, "source_count": 3, "source_identifiers": ["blocklist_de_ssh", "greensnow_blocklist", "ipsum_level5", "threatfox_export_json"], "reporting_groups": ["abuse.ch", "blocklist.de", "greensnow"], "excluded_sources": [{"source": "ipsum_level5", "role": "aggregate"}], "unmapped_sources": [], "corroboration_bonus": 16, "age_hours": 0.0, "half_life_hours": 168.0, "decay_factor": 1.0}}
{"indicator": "165[.]154[.]162[.]74", "type": "ipv4", "source": "blocklist_de_ssh,greensnow_blocklist,ipsum_level5,threatfox_export_json", "first_seen": "2026-09-21T07:10:53Z", "last_seen": "2026-10-24T22:12:16Z", "confidence": "high", "score": 96, "sightings": 152, "tags": "aggregated,blocklist,bruteforce,greensnow,ipsum,mdrfckr,multi-list,outlaw,ssh,ssh-bruteforce,threatfox", "reference": "https://www.blocklist.de/en/", "context": "Blocklist entry from blocklist_de_ssh", "tlp": "CLEAR", "score_factors": {"score": 96, "confidence_base": 80, "source_count": 3, "source_identifiers": ["blocklist_de_ssh", "greensnow_blocklist", "ipsum_level5", "threatfox_export_json"], "reporting_groups": ["abuse.ch", "blocklist.de", "greensnow"], "excluded_sources": [{"source": "ipsum_level5", "role": "aggregate"}], "unmapped_sources": [], "corroboration_bonus": 16, "age_hours": 0.0, "half_life_hours": 168.0, "decay_factor": 1.0}}
{"indicator": "45[.]198[.]224[.]184", "type": "ipv4", "source": "blocklist_de_ssh,et_compromised,ipsum_level5,threatfox_export_json", "first_seen": "2026-09-21T07:10:37Z", "last_seen": "2026-10-24T22:12:16Z", "confidence": "high", "score": 96, "sightings": 152, "tags": "aggregated,blocklist,bruteforce,compromised,emerging-threats,honeypot,ipsum,multi-list,shardlure,ssh,threatfox", "reference": "https://rules.emergingthreats.net/", "context": "Blocklist entry from et_compromised", "tlp": "CLEAR", "score_factors": {"score": 96, "confidence_base": 80, "source_count": 3, "source_identifiers": ["blocklist_de_ssh", "et_compromised", "ipsum_level5", "threatfox_export_json"], "reporting_groups": ["abuse.ch", "blocklist.de", "emerging-threats"], "excluded_sources": [{"source": "ipsum_level5", "role": "aggregate"}], "unmapped_sources": [], "corroboration_bonus": 16, "age_hours": 0.0, "half_life_hours": 168.0, "decay_factor": 1.0}}
{"indicator": "114[.]111[.]53[.]214", "type": "ipv4", "source": "blocklist_de_ssh,greensnow_blocklist,ipsum_level5,threatfox_export_json", "first_seen": "2026-09-12T13:44:26Z", "last_seen": "2026-10-24T22:12:16Z", "confidence": "high", "score": 96, "sightings": 192, "tags": "aggregated,blocklist,bruteforce,greensnow,ipsum,mdrfckr,multi-list,outlaw,ssh,ssh-bruteforce,threatfox,xmrig", "reference": "https://www.blocklist.de/en/", "context": "Blocklist entry from blocklist_de_ssh", "tlp": "CLEAR", "score_factors": {"score": 96, "confidence_base": 80, "source_count": 3, "source_identifiers": ["blocklist_de_ssh", "greensnow_blocklist", "ipsum_level5", "threatfox_export_json"], "reporting_groups": ["abuse.ch", "blocklist.de", "greensnow"], "excluded_sources": [{"source": "ipsum_level5", "role": "aggregate"}], "unmapped_sources": [], "corroboration_bonus": 16, "age_hours": 0.0, "half_life_hours": 168.0, "decay_factor": 1.0}}
{"indicator": "45[.]78[.]201[.]248", "type": "ipv4", "source": "blocklist_de_ssh,greensnow_blocklist,ipsum_level5,threatfox_export_json", "first_seen": "2026-09-12T13:44:25Z", "last_seen": "2026-10-24T22:12:16Z", "confidence": "high", "score": 96, "sightings": 192, "tags": "aggregated,blocklist,bruteforce,greensnow,ipsum,mdrfckr,multi-list,outlaw,ssh,ssh-bruteforce,threatfox,xmrig", "reference": "https://www.blocklist.de/en/", "context": "Blocklist entry from blocklist_de_ssh", "tlp": "CLEAR", "score_factors": {"score": 96, "confidence_base": 80, "source_count": 3, "source_identifiers": ["blocklist_de_ssh", "greensnow_blocklist", "ipsum_level5", "threatfox_export_json"], "reporting_groups": ["abuse.ch", "blocklist.de", "greensnow"], "excluded_sources": [{"source": "ipsum_level5", "role": "aggregate"}], "unmapped_sources": [], "corroboration_bonus": 16, "age_hours": 0.0, "half_life_hours": 168.0, "decay_factor": 1.0}}
{"indicator": "130[.]12[.]180[.]51", "type": "ipv4", "source": "blocklist_de_ssh,ipsum_level5,threatfox_export_json", "first_seen": "2026-10-23T16:11:43Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 88, "sightings": 7, "tags": "CVE-2021-41773,CVE-2026-109618,Redtail,aggregated,blocklist,bruteforce,ipsum,multi-list,php2shell,ssh,telnet,threatfox,xmrig", "reference": "https://threatfox.abuse.ch/browse/", "context": "RedTail", "tlp": "CLEAR", "score_factors": {"score": 88, "confidence_base": 80, "source_count": 2, "source_identifiers": ["blocklist_de_ssh", "ipsum_level5", "threatfox_export_json"], "reporting_groups": ["abuse.ch", "blocklist.de"], "excluded_sources": [{"source": "ipsum_level5", "role": "aggregate"}], "unmapped_sources": [], "corroboration_bonus": 8, "age_hours": 0.0, "half_life_hours": 168.0, "decay_factor": 1.0}}
{"indicator": "CVE-2026-114625", "type": "cve", "source": "cisa_kev,nist_nvd_recent", "first_seen": "2026-10-22T21:17:16Z", "last_seen": "2026-10-24T22:12:15Z", "confidence": "high", "score": 88, "sightings": 6, "tags": "critical,cve,exploited-in-the-wild,nvd", "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "context": "Arista VeloCloud Orchestrator on-prem contains a SQL injection vulnerability that may allow a remote attacker to access privileged internal functionality and impact the VCO host. Successful exploitation may compromise the confidentiality, integrity, and availability of the orchestrator and data managed by the orchestrator.", "tlp": "CLEAR", "score_factors": {"score": 88, "confidence_base": 80, "source_count": 2, "source_identifiers": ["cisa_kev", "nist_nvd_recent"], "reporting_groups": ["cisa", "nvd"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 8, "age_hours": 0.0, "half_life_hours": 8760.0, "decay_factor": 1.0}}
{"indicator": "CVE-2026-102764", "type": "cve", "source": "cisa_kev,nist_nvd_recent", "first_seen": "2026-10-15T21:17:00Z", "last_seen": "2026-10-24T22:12:15Z", "confidence": "high", "score": 88, "sightings": 30, "tags": "critical,cve,exploited-in-the-wild,nvd", "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "context": "BeyondTrust Remote Support contains an authentication bypass by spoofing vulnerability that could allow a remote attacker to perform file operations on the appliance.", "tlp": "CLEAR", "score_factors": {"score": 88, "confidence_base": 80, "source_count": 2, "source_identifiers": ["cisa_kev", "nist_nvd_recent"], "reporting_groups": ["cisa", "nvd"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 8, "age_hours": 0.0, "half_life_hours": 8760.0, "decay_factor": 1.0}}
{"indicator": "CVE-2026-110447", "type": "cve", "source": "cisa_kev,nist_nvd_recent", "first_seen": "2026-10-14T03:17:20Z", "last_seen": "2026-10-24T22:12:15Z", "confidence": "high", "score": 88, "sightings": 6, "tags": "cve,exploited-in-the-wild,nvd", "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "context": "Collabora Collabora Online – Built-in CODE Server when used within the NextCloud platform contains an OS command injection vulnerability that allows for remote code execution when the CODE server isn't running.", "tlp": "CLEAR", "score_factors": {"score": 88, "confidence_base": 80, "source_count": 2, "source_identifiers": ["cisa_kev", "nist_nvd_recent"], "reporting_groups": ["cisa", "nvd"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 8, "age_hours": 0.0, "half_life_hours": 8760.0, "decay_factor": 1.0}}
{"indicator": "CVE-2026-76519", "type": "cve", "source": "cisa_kev,nist_nvd_recent", "first_seen": "2026-10-14T00:00:00Z", "last_seen": "2026-10-24T22:12:15Z", "confidence": "high", "score": 88, "sightings": 38, "tags": "critical,cve,exploited-in-the-wild,nvd", "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "context": "Cisco Secure Email Gateway contains a relative path traversal vulnerability that could allow an unauthenticated, remote attacker to write arbitrary files on the underlying operating system.", "tlp": "CLEAR", "score_factors": {"score": 88, "confidence_base": 80, "source_count": 2, "source_identifiers": ["cisa_kev", "nist_nvd_recent"], "reporting_groups": ["cisa", "nvd"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 8, "age_hours": 0.0, "half_life_hours": 8760.0, "decay_factor": 1.0}}
{"indicator": "CVE-2026-0322", "type": "cve", "source": "cisa_kev,nist_nvd_recent", "first_seen": "2026-10-14T00:00:00Z", "last_seen": "2026-10-24T22:12:15Z", "confidence": "high", "score": 88, "sightings": 38, "tags": "cve,exploited-in-the-wild,high,nvd", "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "context": "Palo Alto Networks PAN-OS contains a code injection vulnerability that could allow an authenticated attacker with network access to execute arbitrary code with root privileges on the firewall.", "tlp": "CLEAR", "score_factors": {"score": 88, "confidence_base": 80, "source_count": 2, "source_identifiers": ["cisa_kev", "nist_nvd_recent"], "reporting_groups": ["cisa", "nvd"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 8, "age_hours": 0.0, "half_life_hours": 8760.0, "decay_factor": 1.0}}
{"indicator": "CVE-2026-96951", "type": "cve", "source": "cisa_kev,nist_nvd_recent", "first_seen": "2026-10-13T00:00:00Z", "last_seen": "2026-10-24T22:12:15Z", "confidence": "high", "score": 88, "sightings": 42, "tags": "cve,exploited-in-the-wild,high,nvd", "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "context": "Microsoft Windows Shell contains a command injection vulnerability that allows an unauthorized attacker to bypass a security feature over a network.", "tlp": "CLEAR", "score_factors": {"score": 88, "confidence_base": 80, "source_count": 2, "source_identifiers": ["cisa_kev", "nist_nvd_recent"], "reporting_groups": ["cisa", "nvd"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 8, "age_hours": 0.0, "half_life_hours": 8760.0, "decay_factor": 1.0}}
{"indicator": "CVE-2026-104935", "type": "cve", "source": "cisa_kev,nist_nvd_recent", "first_seen": "2026-10-13T00:00:00Z", "last_seen": "2026-10-24T22:12:15Z", "confidence": "high", "score": 88, "sightings": 43, "tags": "cve,exploited-in-the-wild,high,nvd", "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "context": "Ivanti Connect Secure contains an authentication bypass by spoofing vulnerability that allows a remote unauthenticated attacker to execute arbitrary commands.", "tlp": "CLEAR", "score_factors": {"score": 88, "confidence_base": 80, "source_count": 2, "source_identifiers": ["cisa_kev", "nist_nvd_recent"], "reporting_groups": ["cisa", "nvd"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 8, "age_hours": 0.0, "half_life_hours": 8760.0, "decay_factor": 1.0}}
{"indicator": "45[.]198[.]224[.]34", "type": "ipv4", "source": "et_compromised,ipsum_level5,threatfox_export_json", "first_seen": "2026-10-12T10:46:34Z", "last_seen": "2026-10-24T22:12:16Z", "confidence": "high", "score": 88, "sightings": 46, "tags": "aggregated,blocklist,compromised,emerging-threats,honeypot,ipsum,multi-list,shardlure,threatfox", "reference": "https://rules.emergingthreats.net/", "context": "Blocklist entry from et_compromised", "tlp": "CLEAR", "score_factors": {"score": 88, "confidence_base": 80, "source_count": 2, "source_identifiers": ["et_compromised", "ipsum_level5", "threatfox_export_json"], "reporting_groups": ["abuse.ch", "emerging-threats"], "excluded_sources": [{"source": "ipsum_level5", "role": "aggregate"}], "unmapped_sources": [], "corroboration_bonus": 8, "age_hours": 0.0, "half_life_hours": 168.0, "decay_factor": 1.0}}
{"indicator": "CVE-2026-21589", "type": "cve", "source": "cisa_kev,nist_nvd_recent", "first_seen": "2026-10-05T22:16:58Z", "last_seen": "2026-10-24T22:12:15Z", "confidence": "high", "score": 88, "sightings": 34, "tags": "cve,exploited-in-the-wild,high,nvd", "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "context": "Multiple Atlassian products (Bitbucket Data Center ,Confluence Data Center, Jira Service Management Data Center, Jira Software Data Center, Bamboo Data Center, Crowd Data Center, Crucible and Fisheye) contain a files or directories accessible to external parties vulnerability which could allow an unauthenticated attacker to access specific files within the web application root directory in affected versions.", "tlp": "CLEAR", "score_factors": {"score": 88, "confidence_base": 80, "source_count": 2, "source_identifiers": ["cisa_kev", "nist_nvd_recent"], "reporting_groups": ["cisa", "nvd"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 8, "age_hours": 0.0, "half_life_hours": 8760.0, "decay_factor": 1.0}}
{"indicator": "CVE-2026-105134", "type": "cve", "source": "cisa_kev,nist_nvd_recent", "first_seen": "2026-10-04T07:16:33Z", "last_seen": "2026-10-24T22:12:15Z", "confidence": "high", "score": 88, "sightings": 38, "tags": "critical,cve,exploited-in-the-wild,nvd", "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "context": "Ahsay AhsayCBS contains a command injection vulnerability that could allow a remote attacker to execute operating system commands via manipulation of the random parameter in the Replication Receiver component’s /rps/api/json/UpdateReceivers.do endpoint. This vulnerability can be chained with CVE-2026-105133.", "tlp": "CLEAR", "score_factors": {"score": 88, "confidence_base": 80, "source_count": 2, "source_identifiers": ["cisa_kev", "nist_nvd_recent"], "reporting_groups": ["cisa", "nvd"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 8, "age_hours": 0.0, "half_life_hours": 8760.0, "decay_factor": 1.0}}
{"indicator": "CVE-2026-105133", "type": "cve", "source": "cisa_kev,nist_nvd_recent", "first_seen": "2026-10-04T07:16:33Z", "last_seen": "2026-10-24T22:12:15Z", "confidence": "high", "score": 88, "sightings": 38, "tags": "cve,exploited-in-the-wild,high,nvd", "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "context": "Ahsay AhsayCBS contains an improper authentication vulnerability that could allow a remote attacker to bypass authentication via manipulation of the random parameter in the API component’s checkSysPwd function. This vulnerability can be chained with CVE-2026-105134.", "tlp": "CLEAR", "score_factors": {"score": 88, "confidence_base": 80, "source_count": 2, "source_identifiers": ["cisa_kev", "nist_nvd_recent"], "reporting_groups": ["cisa", "nvd"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 8, "age_hours": 0.0, "half_life_hours": 8760.0, "decay_factor": 1.0}}
{"indicator": "CVE-2026-88779", "type": "cve", "source": "cisa_kev,nist_nvd_recent", "first_seen": "2026-10-04T00:00:00Z", "last_seen": "2026-10-24T22:12:15Z", "confidence": "high", "score": 88, "sightings": 81, "tags": "cve,exploited-in-the-wild,high,nvd", "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "context": "Citrix NetScaler ADC (formerly Citrix ADC) and Citrix NetScaler Gateway (formerly Citrix Gateway) contain an improper restriction of operations within the bounds of a memory buffer vulnerability that could allow for a denial of service.", "tlp": "CLEAR", "score_factors": {"score": 88, "confidence_base": 80, "source_count": 2, "source_identifiers": ["cisa_kev", "nist_nvd_recent"], "reporting_groups": ["cisa", "nvd"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 8, "age_hours": 0.0, "half_life_hours": 8760.0, "decay_factor": 1.0}}
{"indicator": "CVE-2026-104286", "type": "cve", "source": "cisa_kev,nist_nvd_recent", "first_seen": "2026-10-01T00:00:00Z", "last_seen": "2026-10-24T22:12:15Z", "confidence": "high", "score": 88, "sightings": 94, "tags": "critical,cve,exploited-in-the-wild,nvd", "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "context": "Fortinet FortiMail contains a path traversal and an improper neutralization of NULL byte or NULL character vulnerability that may allow an unauthenticated attacker to write arbitrary files on the underlying system via crafted HTTP or HTTPS requests.", "tlp": "CLEAR", "score_factors": {"score": 88, "confidence_base": 80, "source_count": 2, "source_identifiers": ["cisa_kev", "nist_nvd_recent"], "reporting_groups": ["cisa", "nvd"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 8, "age_hours": 0.0, "half_life_hours": 8760.0, "decay_factor": 1.0}}
{"indicator": "CVE-2026-102490", "type": "cve", "source": "cisa_kev,nist_nvd_recent", "first_seen": "2026-09-30T17:16:40Z", "last_seen": "2026-10-24T22:12:15Z", "confidence": "high", "score": 88, "sightings": 90, "tags": "critical,cve,exploited-in-the-wild,high,nvd", "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "context": "Zammad GmbH Zammad contains an improper privilege management vulnerability that can allow the local zammad user to escalate privileges to root. This vulnerability can be chained with CVE-2026-102489.", "tlp": "CLEAR", "score_factors": {"score": 88, "confidence_base": 80, "source_count": 2, "source_identifiers": ["cisa_kev", "nist_nvd_recent"], "reporting_groups": ["cisa", "nvd"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 8, "age_hours": 0.0, "half_life_hours": 8760.0, "decay_factor": 1.0}}
{"indicator": "CVE-2026-102489", "type": "cve", "source": "cisa_kev,nist_nvd_recent", "first_seen": "2026-09-30T17:16:40Z", "last_seen": "2026-10-24T22:12:15Z", "confidence": "high", "score": 88, "sightings": 90, "tags": "critical,cve,exploited-in-the-wild,nvd", "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "context": "Zammad GmbH Zammad contains a session fixation vulnerability that can lead to remote code execution as the zammad user. This vulnerability can be chained with CVE-2026-102490.", "tlp": "CLEAR", "score_factors": {"score": 88, "confidence_base": 80, "source_count": 2, "source_identifiers": ["cisa_kev", "nist_nvd_recent"], "reporting_groups": ["cisa", "nvd"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 8, "age_hours": 0.0, "half_life_hours": 8760.0, "decay_factor": 1.0}}
{"indicator": "CVE-2026-76504", "type": "cve", "source": "cisa_kev,nist_nvd_recent", "first_seen": "2026-09-30T00:00:00Z", "last_seen": "2026-10-24T22:12:15Z", "confidence": "high", "score": 88, "sightings": 99, "tags": "critical,cve,exploited-in-the-wild,nvd", "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "context": "Cisco Catalyst SD-WAN Manager contains a hex encoding vulnerability that could allow an unauthenticated, remote attacker to access an affected system with privileges of the admin user due to improper handling of URI encoding in an HTTP request.", "tlp": "CLEAR", "score_factors": {"score": 88, "confidence_base": 80, "source_count": 2, "source_identifiers": ["cisa_kev", "nist_nvd_recent"], "reporting_groups": ["cisa", "nvd"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 8, "age_hours": 0.0, "half_life_hours": 8760.0, "decay_factor": 1.0}}
{"indicator": "CVE-2026-86950", "type": "cve", "source": "cisa_kev,nist_nvd_recent", "first_seen": "2026-09-28T20:17:11Z", "last_seen": "2026-10-24T22:12:15Z", "confidence": "high", "score": 88, "sightings": 105, "tags": "cve,exploited-in-the-wild,high,nvd", "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "context": "Apple iOS, macOS, and iPadOS contain an out-of-bounds write vulnerability in CoreGraphics that may lead to arbitrary code execution.", "tlp": "CLEAR", "score_factors": {"score": 88, "confidence_base": 80, "source_count": 2, "source_identifiers": ["cisa_kev", "nist_nvd_recent"], "reporting_groups": ["cisa", "nvd"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 8, "age_hours": 0.0, "half_life_hours": 8760.0, "decay_factor": 1.0}}
{"indicator": "178.20.210.0/24", "type": "ipv4_cidr", "source": "dshield_block,spamhaus_drop", "first_seen": "2026-09-27T15:22:01Z", "last_seen": "2026-10-24T22:12:16Z", "confidence": "high", "score": 88, "sightings": 111, "tags": "drop,dshield,sans-isc,scanning,spamhaus", "reference": "https://www.spamhaus.org/blocklists/do-not-route-or-peer/", "context": "Spamhaus DROP/EDROP network", "tlp": "CLEAR", "score_factors": {"score": 88, "confidence_base": 80, "source_count": 2, "source_identifiers": ["dshield_block", "spamhaus_drop"], "reporting_groups": ["dshield", "spamhaus"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 8, "age_hours": 0.0, "half_life_hours": 720.0, "decay_factor": 1.0}}
{"indicator": "CVE-2026-88772", "type": "cve", "source": "cisa_kev,nist_nvd_recent", "first_seen": "2026-09-27T00:00:00Z", "last_seen": "2026-10-24T22:12:15Z", "confidence": "high", "score": 88, "sightings": 109, "tags": "cve,exploited-in-the-wild,high,nvd", "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "context": "Citrix NetScaler ADC and NetScaler Gateway contain an improper restriction of operations within the bounds of a memory buffer vulnerability that could allow for remote code execution or denial of service", "tlp": "CLEAR", "score_factors": {"score": 88, "confidence_base": 80, "source_count": 2, "source_identifiers": ["cisa_kev", "nist_nvd_recent"], "reporting_groups": ["cisa", "nvd"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 8, "age_hours": 0.0, "half_life_hours": 8760.0, "decay_factor": 1.0}}
{"indicator": "CVE-2026-88771", "type": "cve", "source": "cisa_kev,nist_nvd_recent", "first_seen": "2026-09-27T00:00:00Z", "last_seen": "2026-10-24T22:12:15Z", "confidence": "high", "score": 88, "sightings": 109, "tags": "critical,cve,exploited-in-the-wild,nvd", "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "context": "Citrix NetScaler ADC and NetScaler Gateway contain an improper input validation vulnerability that could allow an unauthenticated attacker to execute arbitrary commands.", "tlp": "CLEAR", "score_factors": {"score": 88, "confidence_base": 80, "source_count": 2, "source_identifiers": ["cisa_kev", "nist_nvd_recent"], "reporting_groups": ["cisa", "nvd"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 8, "age_hours": 0.0, "half_life_hours": 8760.0, "decay_factor": 1.0}}
{"indicator": "CVE-2026-87902", "type": "cve", "source": "cisa_kev,nist_nvd_recent", "first_seen": "2026-09-22T17:17:28Z", "last_seen": "2026-10-24T22:12:15Z", "confidence": "high", "score": 88, "sightings": 119, "tags": "cve,exploited-in-the-wild,high,nvd", "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "context": "WordPress Core contains a remote file inclusion vulnerability which could allow an unauthenticated attacker to make page-template resolution include a chosen readable local `.php` file outside the active theme directories, leading to remote code execution.", "tlp": "CLEAR", "score_factors": {"score": 88, "confidence_base": 80, "source_count": 2, "source_identifiers": ["cisa_kev", "nist_nvd_recent"], "reporting_groups": ["cisa", "nvd"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 8, "age_hours": 0.0, "half_life_hours": 8760.0, "decay_factor": 1.0}}
{"indicator": "CVE-2026-94127", "type": "cve", "source": "cisa_kev,nist_nvd_recent", "first_seen": "2026-09-22T00:00:00Z", "last_seen": "2026-10-24T22:12:15Z", "confidence": "high", "score": 88, "sightings": 139, "tags": "critical,cve,exploited-in-the-wild,nvd", "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "context": "F5 BIG-IP APM contains a heap-based buffer overflow vulnerability when access policy and an OAuth profile are configured on a virtual server. This vulnerability could allow an unauthenticated attacker to perform remote code execution.", "tlp": "CLEAR", "score_factors": {"score": 88, "confidence_base": 80, "source_count": 2, "source_identifiers": ["cisa_kev", "nist_nvd_recent"], "reporting_groups": ["cisa", "nvd"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 8, "age_hours": 0.0, "half_life_hours": 8760.0, "decay_factor": 1.0}}
{"indicator": "CVE-2026-93952", "type": "cve", "source": "cisa_kev,nist_nvd_recent", "first_seen": "2026-09-22T00:00:00Z", "last_seen": "2026-10-24T22:12:15Z", "confidence": "high", "score": 88, "sightings": 142, "tags": "critical,cve,exploited-in-the-wild,nvd", "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "context": "Arista VeloCloud Orchestrator (VCO) on-prem contains an improper input validation vulnerability that may allow a remote attacker to access privileged internal functionality and impact the VCO host. Successful exploitation may compromise the confidentiality, integrity, and availability of the orchestrator and data managed by the orchestrator.", "tlp": "CLEAR", "score_factors": {"score": 88, "confidence_base": 80, "source_count": 2, "source_identifiers": ["cisa_kev", "nist_nvd_recent"], "reporting_groups": ["cisa", "nvd"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 8, "age_hours": 0.0, "half_life_hours": 8760.0, "decay_factor": 1.0}}
{"indicator": "CVE-2026-93616", "type": "cve", "source": "cisa_kev,nist_nvd_recent", "first_seen": "2026-09-22T00:00:00Z", "last_seen": "2026-10-24T22:12:15Z", "confidence": "high", "score": 88, "sightings": 139, "tags": "critical,cve,exploited-in-the-wild,nvd", "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "context": "Check Point Security Management Server, Multi-Domain Security Management Server, Log Server, Multi-Domain Log Server, and SmartEvent contain a path traversal vulnerability that allows an unauthenticated attacker to upload and execute arbitrary scripts.", "tlp": "CLEAR", "score_factors": {"score": 88, "confidence_base": 80, "source_count": 2, "source_identifiers": ["cisa_kev", "nist_nvd_recent"], "reporting_groups": ["cisa", "nvd"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 8, "age_hours": 0.0, "half_life_hours": 8760.0, "decay_factor": 1.0}}
{"indicator": "CVE-2026-87886", "type": "cve", "source": "cisa_kev,nist_nvd_recent", "first_seen": "2026-09-16T00:00:00Z", "last_seen": "2026-10-24T22:12:15Z", "confidence": "high", "score": 88, "sightings": 176, "tags": "cve,exploited-in-the-wild,high,nvd", "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "context": "Acronis Backup plugin for cPanel & WHM and extension for Plesk contains an incorrect default permissions vulnerability that could allow for privilege escalation.", "tlp": "CLEAR", "score_factors": {"score": 88, "confidence_base": 80, "source_count": 2, "source_identifiers": ["cisa_kev", "nist_nvd_recent"], "reporting_groups": ["cisa", "nvd"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 8, "age_hours": 0.0, "half_life_hours": 8760.0, "decay_factor": 1.0}}
{"indicator": "CVE-2026-76460", "type": "cve", "source": "cisa_kev,nist_nvd_recent", "first_seen": "2026-09-16T00:00:00Z", "last_seen": "2026-10-24T22:12:15Z", "confidence": "high", "score": 88, "sightings": 176, "tags": "critical,cve,exploited-in-the-wild,nvd", "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "context": "Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC) contain an incorrect use of privileged APIs vulnerability that could allow an unauthenticated, remote attacker to gain unauthorized access to the affected device by bypassing the web-based management interface.", "tlp": "CLEAR", "score_factors": {"score": 88, "confidence_base": 80, "source_count": 2, "source_identifiers": ["cisa_kev", "nist_nvd_recent"], "reporting_groups": ["cisa", "nvd"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 8, "age_hours": 0.0, "half_life_hours": 8760.0, "decay_factor": 1.0}}
{"indicator": "CVE-2026-58704", "type": "cve", "source": "cisa_kev,nist_nvd_recent", "first_seen": "2026-09-15T19:17:32Z", "last_seen": "2026-10-24T22:12:15Z", "confidence": "high", "score": 88, "sightings": 178, "tags": "cve,exploited-in-the-wild,high,nvd", "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "context": "Google Pixel devices contain an improper authorization vulnerability in the cellular modem. A logic error may allow an attacker to bypass permission checks and escalate privileges.", "tlp": "CLEAR", "score_factors": {"score": 88, "confidence_base": 80, "source_count": 2, "source_identifiers": ["cisa_kev", "nist_nvd_recent"], "reporting_groups": ["cisa", "nvd"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 8, "age_hours": 0.0, "half_life_hours": 8760.0, "decay_factor": 1.0}}
{"indicator": "CVE-2026-76461", "type": "cve", "source": "cisa_kev,nist_nvd_recent", "first_seen": "2026-09-14T00:00:00Z", "last_seen": "2026-10-24T22:12:15Z", "confidence": "high", "score": 88, "sightings": 185, "tags": "critical,cve,exploited-in-the-wild,nvd", "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "context": "Cisco AsyncOS software for Cisco Secure Email Gateway (SEG) contains a SQL injection vulnerability that could allow an unauthenticated, remote attacker to execute arbitrary commands with root privileges on the underlying operating system.", "tlp": "CLEAR", "score_factors": {"score": 88, "confidence_base": 80, "source_count": 2, "source_identifiers": ["cisa_kev", "nist_nvd_recent"], "reporting_groups": ["cisa", "nvd"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 8, "age_hours": 0.0, "half_life_hours": 8760.0, "decay_factor": 1.0}}
{"indicator": "94.154.43.0/24", "type": "ipv4_cidr", "source": "dshield_block,spamhaus_drop", "first_seen": "2026-09-11T02:39:29Z", "last_seen": "2026-10-24T22:12:16Z", "confidence": "high", "score": 88, "sightings": 204, "tags": "drop,dshield,sans-isc,scanning,spamhaus", "reference": "https://www.spamhaus.org/blocklists/do-not-route-or-peer/", "context": "Spamhaus DROP/EDROP network", "tlp": "CLEAR", "score_factors": {"score": 88, "confidence_base": 80, "source_count": 2, "source_identifiers": ["dshield_block", "spamhaus_drop"], "reporting_groups": ["dshield", "spamhaus"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 8, "age_hours": 0.0, "half_life_hours": 720.0, "decay_factor": 1.0}}
{"indicator": "CVE-2026-85706", "type": "cve", "source": "cisa_kev,nist_nvd_recent", "first_seen": "2026-09-11T00:00:00Z", "last_seen": "2026-10-24T22:12:15Z", "confidence": "high", "score": 88, "sightings": 198, "tags": "critical,cve,exploited-in-the-wild,nvd", "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "context": "GitLab Community Edition and Enterprise Edition contains a path traversal vulnerability that allows an unauthenticated user to read arbitrary files due to an improper path confinement and missing authentication enforcement in the repository commits API.", "tlp": "CLEAR", "score_factors": {"score": 88, "confidence_base": 80, "source_count": 2, "source_identifiers": ["cisa_kev", "nist_nvd_recent"], "reporting_groups": ["cisa", "nvd"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 8, "age_hours": 0.0, "half_life_hours": 8760.0, "decay_factor": 1.0}}
{"indicator": "CVE-2026-85102", "type": "cve", "source": "cisa_kev,nist_nvd_recent", "first_seen": "2026-09-09T13:20:43Z", "last_seen": "2026-10-24T22:12:15Z", "confidence": "high", "score": 88, "sightings": 138, "tags": "critical,cve,exploited-in-the-wild,nvd", "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "context": "Check Point Security Gateway and Check Point Spark Firewall using Site to Site VPN or Remote Access VPN contain an improper certificate validation vulnerability which could allow an unauthenticated remote attacker to execute arbitrary code on the Gateway.", "tlp": "CLEAR", "score_factors": {"score": 88, "confidence_base": 80, "source_count": 2, "source_identifiers": ["cisa_kev", "nist_nvd_recent"], "reporting_groups": ["cisa", "nvd"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 8, "age_hours": 0.0, "half_life_hours": 8760.0, "decay_factor": 1.0}}
{"indicator": "45.135.193.0/24", "type": "ipv4_cidr", "source": "dshield_block,spamhaus_drop", "first_seen": "2026-09-09T02:44:17Z", "last_seen": "2026-10-24T22:12:16Z", "confidence": "high", "score": 88, "sightings": 217, "tags": "drop,dshield,sans-isc,scanning,spamhaus", "reference": "https://www.spamhaus.org/blocklists/do-not-route-or-peer/", "context": "Spamhaus DROP/EDROP network", "tlp": "CLEAR", "score_factors": {"score": 88, "confidence_base": 80, "source_count": 2, "source_identifiers": ["dshield_block", "spamhaus_drop"], "reporting_groups": ["dshield", "spamhaus"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 8, "age_hours": 0.0, "half_life_hours": 720.0, "decay_factor": 1.0}}
{"indicator": "CVE-2026-87491", "type": "cve", "source": "cisa_kev,nist_nvd_recent", "first_seen": "2026-09-09T00:00:00Z", "last_seen": "2026-10-24T22:12:15Z", "confidence": "high", "score": 88, "sightings": 213, "tags": "cve,exploited-in-the-wild,high,nvd", "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "context": "Google Chromium V8 contains an out of bounds write vulnerability that allows a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.", "tlp": "CLEAR", "score_factors": {"score": 88, "confidence_base": 80, "source_count": 2, "source_identifiers": ["cisa_kev", "nist_nvd_recent"], "reporting_groups": ["cisa", "nvd"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 8, "age_hours": 0.0, "half_life_hours": 8760.0, "decay_factor": 1.0}}
{"indicator": "CVE-2026-84869", "type": "cve", "source": "cisa_kev,nist_nvd_recent", "first_seen": "2026-09-08T20:18:51Z", "last_seen": "2026-10-24T22:12:15Z", "confidence": "high", "score": 88, "sightings": 199, "tags": "critical,cve,exploited-in-the-wild,nvd", "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "context": "ConnectWise ScreenConnect contains both an improper privilege management and missing authorization vulnerability that may allow an attacker to transfer and execute files through an active remote session without authorization or host confirmation.", "tlp": "CLEAR", "score_factors": {"score": 88, "confidence_base": 80, "source_count": 2, "source_identifiers": ["cisa_kev", "nist_nvd_recent"], "reporting_groups": ["cisa", "nvd"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 8, "age_hours": 0.0, "half_life_hours": 8760.0, "decay_factor": 1.0}}
{"indicator": "CVE-2026-85880", "type": "cve", "source": "cisa_kev,nist_nvd_recent", "first_seen": "2026-09-08T00:00:00Z", "last_seen": "2026-10-24T22:12:15Z", "confidence": "high", "score": 88, "sightings": 219, "tags": "cve,exploited-in-the-wild,high,nvd", "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "context": "Microsoft Windows Advanced Local Procedure Call contains a heap-based buffer overflow vulnerability that allows an attacker to elevate privileges locally.", "tlp": "CLEAR", "score_factors": {"score": 88, "confidence_base": 80, "source_count": 2, "source_identifiers": ["cisa_kev", "nist_nvd_recent"], "reporting_groups": ["cisa", "nvd"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 8, "age_hours": 0.0, "half_life_hours": 8760.0, "decay_factor": 1.0}}
{"indicator": "CVE-2026-81963", "type": "cve", "source": "cisa_kev,nist_nvd_recent", "first_seen": "2026-09-08T00:00:00Z", "last_seen": "2026-10-24T22:12:15Z", "confidence": "high", "score": 88, "sightings": 219, "tags": "cve,exploited-in-the-wild,high,nvd", "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "context": "Microsoft Windows Update Stack contains a link following vulnerability that allows a local attacker to escalate privileges locally up to SYSTEM.", "tlp": "CLEAR", "score_factors": {"score": 88, "confidence_base": 80, "source_count": 2, "source_identifiers": ["cisa_kev", "nist_nvd_recent"], "reporting_groups": ["cisa", "nvd"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 8, "age_hours": 0.0, "half_life_hours": 8760.0, "decay_factor": 1.0}}
{"indicator": "CVE-2026-75650", "type": "cve", "source": "cisa_kev,nist_nvd_recent", "first_seen": "2026-09-07T21:17:30Z", "last_seen": "2026-10-24T22:12:15Z", "confidence": "high", "score": 88, "sightings": 225, "tags": "critical,cve,exploited-in-the-wild,nvd", "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "context": "Adobe Commerce and Magento Open Source contain an improper neutralization of special elements used in a template engine vulnerability that could allow an attacker to execute arbitrary code.", "tlp": "CLEAR", "score_factors": {"score": 88, "confidence_base": 80, "source_count": 2, "source_identifiers": ["cisa_kev", "nist_nvd_recent"], "reporting_groups": ["cisa", "nvd"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 8, "age_hours": 0.0, "half_life_hours": 8760.0, "decay_factor": 1.0}}
{"indicator": "CVE-2026-86218", "type": "cve", "source": "cisa_kev,nist_nvd_recent", "first_seen": "2026-09-06T03:17:17Z", "last_seen": "2026-10-24T22:12:15Z", "confidence": "high", "score": 88, "sightings": 227, "tags": "critical,cve,exploited-in-the-wild,nvd", "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "context": "N-able N-central contains a static code injection vulnerability that could allow for pre-authentication remote code execution.", "tlp": "CLEAR", "score_factors": {"score": 88, "confidence_base": 80, "source_count": 2, "source_identifiers": ["cisa_kev", "nist_nvd_recent"], "reporting_groups": ["cisa", "nvd"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 8, "age_hours": 0.0, "half_life_hours": 8760.0, "decay_factor": 1.0}}
{"indicator": "CVE-2026-86060", "type": "cve", "source": "cisa_kev,nist_nvd_recent", "first_seen": "2026-09-05T20:17:18Z", "last_seen": "2026-10-24T22:12:15Z", "confidence": "high", "score": 88, "sightings": 205, "tags": "critical,cve,exploited-in-the-wild,nvd", "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "context": "MikroTik RouterOS contains an improper neutralization of argument delimiters in a command vulnerability which allows an attacker to change the trusted RouterOS policy mask, leading to privilege escalation.", "tlp": "CLEAR", "score_factors": {"score": 88, "confidence_base": 80, "source_count": 2, "source_identifiers": ["cisa_kev", "nist_nvd_recent"], "reporting_groups": ["cisa", "nvd"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 8, "age_hours": 0.0, "half_life_hours": 8760.0, "decay_factor": 1.0}}
{"indicator": "CVE-2026-67279", "type": "cve", "source": "cisa_kev,nist_nvd_recent", "first_seen": "2026-09-05T20:17:18Z", "last_seen": "2026-10-24T22:12:15Z", "confidence": "high", "score": 88, "sightings": 120, "tags": "cve,exploited-in-the-wild,medium,nvd", "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "context": "Mikrotik RouterOS contains an improper enforcement of behavioral workflow vulnerability that could allow an unauthenticated client to open a session channel and send an exec request. This vulnerability can be chained to achieve unauthenticated exploitation of CVE-2026-86060.", "tlp": "CLEAR", "score_factors": {"score": 88, "confidence_base": 80, "source_count": 2, "source_identifiers": ["cisa_kev", "nist_nvd_recent"], "reporting_groups": ["cisa", "nvd"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 8, "age_hours": 0.0, "half_life_hours": 8760.0, "decay_factor": 1.0}}
{"indicator": "CVE-2026-67277", "type": "cve", "source": "cisa_kev,nist_nvd_recent", "first_seen": "2026-09-05T20:17:18Z", "last_seen": "2026-10-24T22:12:15Z", "confidence": "high", "score": 88, "sightings": 205, "tags": "cve,exploited-in-the-wild,high,nvd", "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "context": "MikroTik RouterOS contains a missing authentication for critical function vulnerability which allows kernel memory disclosure and denial of service in the btest service.", "tlp": "CLEAR", "score_factors": {"score": 88, "confidence_base": 80, "source_count": 2, "source_identifiers": ["cisa_kev", "nist_nvd_recent"], "reporting_groups": ["cisa", "nvd"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 8, "age_hours": 0.0, "half_life_hours": 8760.0, "decay_factor": 1.0}}
{"indicator": "CVE-2026-85046", "type": "cve", "source": "cisa_kev,nist_nvd_recent", "first_seen": "2026-09-03T20:17:24Z", "last_seen": "2026-10-24T22:12:15Z", "confidence": "high", "score": 88, "sightings": 241, "tags": "cve,exploited-in-the-wild,high,nvd", "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "context": "Google Chromium V8 contains a type confusion vulnerability that allows a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.", "tlp": "CLEAR", "score_factors": {"score": 88, "confidence_base": 80, "source_count": 2, "source_identifiers": ["cisa_kev", "nist_nvd_recent"], "reporting_groups": ["cisa", "nvd"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 8, "age_hours": 0.0, "half_life_hours": 8760.0, "decay_factor": 1.0}}
{"indicator": "CVE-2026-49869", "type": "cve", "source": "cisa_kev,nist_nvd_recent", "first_seen": "2026-09-02T00:00:00Z", "last_seen": "2026-10-24T22:12:15Z", "confidence": "high", "score": 88, "sightings": 251, "tags": "critical,cve,exploited-in-the-wild,nvd", "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "context": "Kestra OSS contains an OS command injection vulnerability that could allow an unauthenticated remote attacker to create and execute arbitrary workflows without credentials.", "tlp": "CLEAR", "score_factors": {"score": 88, "confidence_base": 80, "source_count": 2, "source_identifiers": ["cisa_kev", "nist_nvd_recent"], "reporting_groups": ["cisa", "nvd"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 8, "age_hours": 0.0, "half_life_hours": 8760.0, "decay_factor": 1.0}}
{"indicator": "CVE-2026-83549", "type": "cve", "source": "cisa_kev,nist_nvd_recent", "first_seen": "2026-09-01T22:17:13Z", "last_seen": "2026-10-24T22:12:15Z", "confidence": "high", "score": 88, "sightings": 251, "tags": "cve,exploited-in-the-wild,high,nvd", "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "context": "SonicWall SMA1000 Appliances contains an OS command injection vulnerability that could enable a remote authenticated attacker as administrator to execute arbitrary OS commands, resulting in remote code execution.", "tlp": "CLEAR", "score_factors": {"score": 88, "confidence_base": 80, "source_count": 2, "source_identifiers": ["cisa_kev", "nist_nvd_recent"], "reporting_groups": ["cisa", "nvd"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 8, "age_hours": 0.0, "half_life_hours": 8760.0, "decay_factor": 1.0}}
{"indicator": "91.92.47.0/24", "type": "ipv4_cidr", "source": "dshield_block,spamhaus_drop", "first_seen": "2026-08-31T18:39:04Z", "last_seen": "2026-10-24T22:12:16Z", "confidence": "high", "score": 88, "sightings": 261, "tags": "drop,dshield,sans-isc,scanning,spamhaus", "reference": "https://www.spamhaus.org/blocklists/do-not-route-or-peer/", "context": "Spamhaus DROP/EDROP network", "tlp": "CLEAR", "score_factors": {"score": 88, "confidence_base": 80, "source_count": 2, "source_identifiers": ["dshield_block", "spamhaus_drop"], "reporting_groups": ["dshield", "spamhaus"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 8, "age_hours": 0.0, "half_life_hours": 720.0, "decay_factor": 1.0}}
{"indicator": "CVE-2026-82078", "type": "cve", "source": "cisa_kev,nist_nvd_recent", "first_seen": "2026-08-28T16:18:31Z", "last_seen": "2026-10-24T22:12:15Z", "confidence": "high", "score": 88, "sightings": 262, "tags": "critical,cve,exploited-in-the-wild,nvd", "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "context": "PaperCut NG/MF contains an unsafe reflection vulnerability that allows an attacker to manipulate system configuration parameters and execute arbitrary Java bytecode residing on the application classpath under the security context of the PaperCut server process. This vulnerability can be chained with CVE-2026-81578.", "tlp": "CLEAR", "score_factors": {"score": 88, "confidence_base": 80, "source_count": 2, "source_identifiers": ["cisa_kev", "nist_nvd_recent"], "reporting_groups": ["cisa", "nvd"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 8, "age_hours": 0.0, "half_life_hours": 8760.0, "decay_factor": 1.0}}
{"indicator": "CVE-2026-81578", "type": "cve", "source": "cisa_kev,nist_nvd_recent", "first_seen": "2026-08-28T16:18:29Z", "last_seen": "2026-10-24T22:12:15Z", "confidence": "high", "score": 88, "sightings": 262, "tags": "critical,cve,exploited-in-the-wild,nvd", "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "context": "PaperCut NG/MF contains a missing authentication for critical function vulnerability which allows an unauthenticated remote attacker to modify certain system configurations. This vulnerability can be chained with CVE-2026-82078.", "tlp": "CLEAR", "score_factors": {"score": 88, "confidence_base": 80, "source_count": 2, "source_identifiers": ["cisa_kev", "nist_nvd_recent"], "reporting_groups": ["cisa", "nvd"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 8, "age_hours": 0.0, "half_life_hours": 8760.0, "decay_factor": 1.0}}
{"indicator": "CVE-2023-49105", "type": "cve", "source": "cisa_kev,nist_nvd_recent", "first_seen": "2026-08-27T00:00:00Z", "last_seen": "2026-10-24T22:12:15Z", "confidence": "high", "score": 88, "sightings": 275, "tags": "critical,cve,exploited-in-the-wild,nvd", "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "context": "ownCloud contains an improper authentication vulnerability that allows an attacker to access, modify, or delete any file without authentication if the username of a victim is known, and the victim has no signing-key configured.", "tlp": "CLEAR", "score_factors": {"score": 88, "confidence_base": 80, "source_count": 2, "source_identifiers": ["cisa_kev", "nist_nvd_recent"], "reporting_groups": ["cisa", "nvd"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 8, "age_hours": 0.0, "half_life_hours": 8760.0, "decay_factor": 1.0}}
{"indicator": "CVE-2022-0995", "type": "cve", "source": "cisa_kev,nist_nvd_recent", "first_seen": "2026-08-26T00:00:00Z", "last_seen": "2026-10-24T22:12:15Z", "confidence": "high", "score": 88, "sightings": 277, "tags": "cve,exploited-in-the-wild,high,nvd", "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "context": "Linux Kernel contains an out-of-bounds memory write vulnerability which could allow a local user to gain privileged access or cause a denial of service on the system.", "tlp": "CLEAR", "score_factors": {"score": 88, "confidence_base": 80, "source_count": 2, "source_identifiers": ["cisa_kev", "nist_nvd_recent"], "reporting_groups": ["cisa", "nvd"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 8, "age_hours": 0.0, "half_life_hours": 8760.0, "decay_factor": 1.0}}
{"indicator": "CVE-2021-23758", "type": "cve", "source": "cisa_kev,nist_nvd_recent", "first_seen": "2026-08-26T00:00:00Z", "last_seen": "2026-10-24T22:12:15Z", "confidence": "high", "score": 88, "sightings": 277, "tags": "cve,exploited-in-the-wild,high,nvd", "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "context": "Ajax.NET Professional (AjaxPro) contains a deserialization of untrusted data vulnerability that could allow for remote code execution via arbitrary .NET classes. The impacted product(s) could be end-of-life (EoL) and/or end-of-service (EoS). Users are advised to discontinue use and/or transition to a supported version.", "tlp": "CLEAR", "score_factors": {"score": 88, "confidence_base": 80, "source_count": 2, "source_identifiers": ["cisa_kev", "nist_nvd_recent"], "reporting_groups": ["cisa", "nvd"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 8, "age_hours": 0.0, "half_life_hours": 8760.0, "decay_factor": 1.0}}
{"indicator": "CVE-2015-5287", "type": "cve", "source": "cisa_kev,nist_nvd_recent", "first_seen": "2026-08-26T00:00:00Z", "last_seen": "2026-10-24T22:12:15Z", "confidence": "high", "score": 88, "sightings": 277, "tags": "cve,exploited-in-the-wild,high,nvd", "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "context": "Red Hat Automatic Bug Reporting Tool (ABRT) contains a privilege escalation vulnerability that could allow local users with certain permissions to gain privileges via a symlink attack on a file with a predictable name. The impacted product(s) could be end-of-life (EoL) and/or end-of-service (EoS). Users are advised to discontinue use and/or transition to a supported version.", "tlp": "CLEAR", "score_factors": {"score": 88, "confidence_base": 80, "source_count": 2, "source_identifiers": ["cisa_kev", "nist_nvd_recent"], "reporting_groups": ["cisa", "nvd"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 8, "age_hours": 0.0, "half_life_hours": 8760.0, "decay_factor": 1.0}}
{"indicator": "CVE-2026-21962", "type": "cve", "source": "cisa_kev,nist_nvd_recent", "first_seen": "2026-08-24T00:00:00Z", "last_seen": "2026-10-24T22:12:15Z", "confidence": "high", "score": 88, "sightings": 289, "tags": "critical,cve,exploited-in-the-wild,nvd", "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "context": "Oracle HTTP Server and Oracle Weblogic Server Proxy Plug-in contain an improper access control vulnerability that can result in unauthorized creation, deletion or modification access to critical data as well as unauthorized access to critical data or complete access to all Oracle HTTP Server and Oracle Weblogic Server Proxy Plug-in accessible data.", "tlp": "CLEAR", "score_factors": {"score": 88, "confidence_base": 80, "source_count": 2, "source_identifiers": ["cisa_kev", "nist_nvd_recent"], "reporting_groups": ["cisa", "nvd"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 8, "age_hours": 0.0, "half_life_hours": 8760.0, "decay_factor": 1.0}}
{"indicator": "CVE-2026-73570", "type": "cve", "source": "cisa_kev,nist_nvd_recent", "first_seen": "2026-08-21T00:00:00Z", "last_seen": "2026-10-24T22:12:15Z", "confidence": "high", "score": 88, "sightings": 307, "tags": "cve,exploited-in-the-wild,high,nvd", "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "context": "Zimbra Collaboration Suite (ZCS) contains an OS command injection vulnerability which could allow an unauthenticated attacker to send specially crafted SMTP requests that may result in execution of arbitrary operating system commands as the Zimbra user.", "tlp": "CLEAR", "score_factors": {"score": 88, "confidence_base": 80, "source_count": 2, "source_identifiers": ["cisa_kev", "nist_nvd_recent"], "reporting_groups": ["cisa", "nvd"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 8, "age_hours": 0.0, "half_life_hours": 8760.0, "decay_factor": 1.0}}
{"indicator": "CVE-2026-19490", "type": "cve", "source": "cisa_kev,nist_nvd_recent", "first_seen": "2026-08-19T13:17:45Z", "last_seen": "2026-10-24T22:12:15Z", "confidence": "high", "score": 88, "sightings": 211, "tags": "critical,cve,exploited-in-the-wild,nvd", "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "context": "Citrix NetScaler ADC and NetScaler Gateway contain an authentication-bypass vulnerability involving an alternate path or channel. When the NetScaler appliance is configured as an AAA virtual server or as a Gateway (SSL VPN, ICA Proxy, CVPN, or RDP Proxy), an unauthenticated remote threat actor may be able to bypass authentication.", "tlp": "CLEAR", "score_factors": {"score": 88, "confidence_base": 80, "source_count": 2, "source_identifiers": ["cisa_kev", "nist_nvd_recent"], "reporting_groups": ["cisa", "nvd"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 8, "age_hours": 0.0, "half_life_hours": 8760.0, "decay_factor": 1.0}}
{"indicator": "CVE-2026-64849", "type": "cve", "source": "cisa_kev,nist_nvd_recent", "first_seen": "2026-08-17T22:17:23Z", "last_seen": "2026-10-24T22:12:15Z", "confidence": "high", "score": 88, "sightings": 319, "tags": "critical,cve,exploited-in-the-wild,nvd", "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "context": "MLflow contains a server-side request forgery vulnerability that can allow attackers to reach internal or cloud metadata services and receive response_status and response_body.", "tlp": "CLEAR", "score_factors": {"score": 88, "confidence_base": 80, "source_count": 2, "source_identifiers": ["cisa_kev", "nist_nvd_recent"], "reporting_groups": ["cisa", "nvd"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 8, "age_hours": 0.0, "half_life_hours": 8760.0, "decay_factor": 1.0}}
{"indicator": "CVE-2026-42018", "type": "cve", "source": "cisa_kev,nist_nvd_recent", "first_seen": "2026-08-12T18:17:29Z", "last_seen": "2026-10-24T22:12:15Z", "confidence": "high", "score": 88, "sightings": 199, "tags": "cve,exploited-in-the-wild,high,nvd", "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "context": "JFrog Artifactory contains an improper authentication vulnerability that could return an internal anonymous-user token to an unauthenticated caller when anonymous access is disabled, potentially exposing sensitive resources.", "tlp": "CLEAR", "score_factors": {"score": 88, "confidence_base": 80, "source_count": 2, "source_identifiers": ["cisa_kev", "nist_nvd_recent"], "reporting_groups": ["cisa", "nvd"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 8, "age_hours": 0.0, "half_life_hours": 8760.0, "decay_factor": 1.0}}
{"indicator": "CVE-2026-66384", "type": "cve", "source": "cisa_kev,nist_nvd_recent", "first_seen": "2026-08-12T16:17:14Z", "last_seen": "2026-10-24T22:12:15Z", "confidence": "high", "score": 88, "sightings": 275, "tags": "cve,exploited-in-the-wild,medium,nvd", "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "context": "JFrog Artifactory contains an improper limitation of a pathname to a restricted directory vulnerability. This can allow an authenticated user to write data outside the intended Docker cache path under specific remote-repository conditions.", "tlp": "CLEAR", "score_factors": {"score": 88, "confidence_base": 80, "source_count": 2, "source_identifiers": ["cisa_kev", "nist_nvd_recent"], "reporting_groups": ["cisa", "nvd"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 8, "age_hours": 0.0, "half_life_hours": 8760.0, "decay_factor": 1.0}}
{"indicator": "CVE-2026-71362", "type": "cve", "source": "cisa_kev,nist_nvd_recent", "first_seen": "2026-08-11T18:18:21Z", "last_seen": "2026-10-24T22:12:15Z", "confidence": "high", "score": 88, "sightings": 123, "tags": "critical,cve,exploited-in-the-wild,nvd", "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "context": "Adobe Commerce and Magento contains an incorrect authorization vulnerability that could allow an attacker to leverage this vulnerability to gain elevated access to sensitive resources without any user interaction. ", "tlp": "CLEAR", "score_factors": {"score": 88, "confidence_base": 80, "source_count": 2, "source_identifiers": ["cisa_kev", "nist_nvd_recent"], "reporting_groups": ["cisa", "nvd"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 8, "age_hours": 0.0, "half_life_hours": 8760.0, "decay_factor": 1.0}}
{"indicator": "CVE-2026-65660", "type": "cve", "source": "cisa_kev,nist_nvd_recent", "first_seen": "2026-08-11T17:18:54Z", "last_seen": "2026-10-24T22:12:15Z", "confidence": "high", "score": 88, "sightings": 120, "tags": "cve,exploited-in-the-wild,high,nvd", "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "context": "Microsoft SharePoint contains a code injection vulnerability which could allow an authorized attacker to execute code over a network.", "tlp": "CLEAR", "score_factors": {"score": 88, "confidence_base": 80, "source_count": 2, "source_identifiers": ["cisa_kev", "nist_nvd_recent"], "reporting_groups": ["cisa", "nvd"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 8, "age_hours": 0.0, "half_life_hours": 8760.0, "decay_factor": 1.0}}
{"indicator": "CVE-2026-20349", "type": "cve", "source": "cisa_kev,nist_nvd_recent", "first_seen": "2026-08-11T00:00:00Z", "last_seen": "2026-10-24T22:12:15Z", "confidence": "high", "score": 88, "sightings": 367, "tags": "cve,exploited-in-the-wild,high,nvd", "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "context": "Cisco Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) contain a heap inspection vulnerability that could allow an unauthenticated, remote attacker to cause the device to reload unexpectedly, resulting in a denial of service (DoS) condition.", "tlp": "CLEAR", "score_factors": {"score": 88, "confidence_base": 80, "source_count": 2, "source_identifiers": ["cisa_kev", "nist_nvd_recent"], "reporting_groups": ["cisa", "nvd"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 8, "age_hours": 0.0, "half_life_hours": 8760.0, "decay_factor": 1.0}}
{"indicator": "CVE-2026-65400", "type": "cve", "source": "cisa_kev,nist_nvd_recent", "first_seen": "2026-08-06T22:18:14Z", "last_seen": "2026-10-24T22:12:15Z", "confidence": "high", "score": 88, "sightings": 325, "tags": "critical,cve,exploited-in-the-wild,nvd", "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "context": "Apple macOS contains an improper authentication vulnerability that could allow an attacker on the network to authenticate to Screen Sharing without valid credentials.", "tlp": "CLEAR", "score_factors": {"score": 88, "confidence_base": 80, "source_count": 2, "source_identifiers": ["cisa_kev", "nist_nvd_recent"], "reporting_groups": ["cisa", "nvd"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 8, "age_hours": 0.0, "half_life_hours": 8760.0, "decay_factor": 1.0}}
{"indicator": "91.92.40.0/24", "type": "ipv4_cidr", "source": "dshield_block,spamhaus_drop", "first_seen": "2026-08-06T13:53:27Z", "last_seen": "2026-10-24T22:12:16Z", "confidence": "high", "score": 88, "sightings": 397, "tags": "drop,dshield,sans-isc,scanning,spamhaus", "reference": "https://www.spamhaus.org/blocklists/do-not-route-or-peer/", "context": "Spamhaus DROP/EDROP network", "tlp": "CLEAR", "score_factors": {"score": 88, "confidence_base": 80, "source_count": 2, "source_identifiers": ["dshield_block", "spamhaus_drop"], "reporting_groups": ["dshield", "spamhaus"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 8, "age_hours": 0.0, "half_life_hours": 720.0, "decay_factor": 1.0}}
{"indicator": "CVE-2026-5430", "type": "cve", "source": "cisa_kev,nist_nvd_recent", "first_seen": "2026-08-06T08:16:33Z", "last_seen": "2026-10-24T22:12:15Z", "confidence": "high", "score": 88, "sightings": 123, "tags": "critical,cve,exploited-in-the-wild,nvd", "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "context": "WSO2 API Control Plane, API Manager, Traffic Manager & Universal Gateway contain a path traversal vulnerability that could allow for unrestricted file upload and lead to remote code execution. ", "tlp": "CLEAR", "score_factors": {"score": 88, "confidence_base": 80, "source_count": 2, "source_identifiers": ["cisa_kev", "nist_nvd_recent"], "reporting_groups": ["cisa", "nvd"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 8, "age_hours": 0.0, "half_life_hours": 8760.0, "decay_factor": 1.0}}
{"indicator": "CVE-2026-18577", "type": "cve", "source": "cisa_kev,nist_nvd_recent", "first_seen": "2026-08-02T23:16:26Z", "last_seen": "2026-10-24T22:12:15Z", "confidence": "high", "score": 88, "sightings": 414, "tags": "cve,exploited-in-the-wild,high,nvd", "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "context": "N-able N-central contains an authentication bypass using an alternate path or channel allows for authentication bypass and account takeover in N-central. This vulnerability is the result of an incomplete patch for CVE-2026-18556.", "tlp": "CLEAR", "score_factors": {"score": 88, "confidence_base": 80, "source_count": 2, "source_identifiers": ["cisa_kev", "nist_nvd_recent"], "reporting_groups": ["cisa", "nvd"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 8, "age_hours": 0.0, "half_life_hours": 8760.0, "decay_factor": 1.0}}
{"indicator": "CVE-2026-18556", "type": "cve", "source": "cisa_kev,nist_nvd_recent", "first_seen": "2026-08-01T20:16:37Z", "last_seen": "2026-10-24T22:12:15Z", "confidence": "high", "score": 88, "sightings": 410, "tags": "cve,exploited-in-the-wild,high,nvd", "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "context": "N-able N-central contains an authentication bypass using an alternate path or channel that allows for authentication bypass.", "tlp": "CLEAR", "score_factors": {"score": 88, "confidence_base": 80, "source_count": 2, "source_identifiers": ["cisa_kev", "nist_nvd_recent"], "reporting_groups": ["cisa", "nvd"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 8, "age_hours": 0.0, "half_life_hours": 8760.0, "decay_factor": 1.0}}
{"indicator": "CVE-2026-20316", "type": "cve", "source": "cisa_kev,nist_nvd_recent", "first_seen": "2026-07-29T00:00:00Z", "last_seen": "2026-10-24T22:12:15Z", "confidence": "high", "score": 88, "sightings": 443, "tags": "cve,exploited-in-the-wild,medium,nvd", "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "context": "Cisco Secure Firewall Management Center (FMC) formerly known as Firepower Management Center contains a use of hard-coded password vulnerability that could allow an unauthenticated, remote attacker to log in to an affected device using a low-privileged account to access sensitive data within the impacted systems.", "tlp": "CLEAR", "score_factors": {"score": 88, "confidence_base": 80, "source_count": 2, "source_identifiers": ["cisa_kev", "nist_nvd_recent"], "reporting_groups": ["cisa", "nvd"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 8, "age_hours": 0.0, "half_life_hours": 8760.0, "decay_factor": 1.0}}
{"indicator": "CVE-2026-42016", "type": "cve", "source": "cisa_kev,nist_nvd_recent", "first_seen": "2026-07-27T20:16:39Z", "last_seen": "2026-10-24T22:12:15Z", "confidence": "high", "score": 88, "sightings": 199, "tags": "cve,exploited-in-the-wild,high,nvd", "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "context": "JFrog Artifactory contains an incorrect authorization vulnerability that leads to a privilege escalation attack due to a validation check of the token signature/issuer and not the token’s scope.", "tlp": "CLEAR", "score_factors": {"score": 88, "confidence_base": 80, "source_count": 2, "source_identifiers": ["cisa_kev", "nist_nvd_recent"], "reporting_groups": ["cisa", "nvd"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 8, "age_hours": 0.0, "half_life_hours": 8760.0, "decay_factor": 1.0}}
{"indicator": "CVE-2026-63077", "type": "cve", "source": "cisa_kev,nist_nvd_recent", "first_seen": "2026-07-27T17:16:38Z", "last_seen": "2026-10-24T22:12:15Z", "confidence": "high", "score": 88, "sightings": 402, "tags": "critical,cve,exploited-in-the-wild,nvd", "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "context": "JetBrains TeamCity contains a deserialization of untrusted data vulnerability that could allow unauthenticated remote code execution via the agent polling protocol.", "tlp": "CLEAR", "score_factors": {"score": 88, "confidence_base": 80, "source_count": 2, "source_identifiers": ["cisa_kev", "nist_nvd_recent"], "reporting_groups": ["cisa", "nvd"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 8, "age_hours": 0.0, "half_life_hours": 8760.0, "decay_factor": 1.0}}
{"indicator": "CVE-2026-16812", "type": "cve", "source": "cisa_kev,nist_nvd_recent", "first_seen": "2026-07-27T00:00:00Z", "last_seen": "2026-10-24T22:12:15Z", "confidence": "high", "score": 88, "sightings": 455, "tags": "critical,cve,exploited-in-the-wild,nvd", "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "context": "Arista VeloCloud Orchestrator On-Prem contains an OS command injection vulnerability that may allow a remote attacker to access privileged internal functionality and impact the VCO host. Successful exploitation may compromise the confidentiality, integrity, and availability of the orchestrator and data managed by the orchestrator.", "tlp": "CLEAR", "score_factors": {"score": 88, "confidence_base": 80, "source_count": 2, "source_identifiers": ["cisa_kev", "nist_nvd_recent"], "reporting_groups": ["cisa", "nvd"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 8, "age_hours": 0.0, "half_life_hours": 8760.0, "decay_factor": 1.0}}
{"indicator": "CVE-2025-68686", "type": "cve", "source": "cisa_kev,nist_nvd_recent", "first_seen": "2026-07-27T00:00:00Z", "last_seen": "2026-10-24T22:12:15Z", "confidence": "high", "score": 88, "sightings": 456, "tags": "cve,exploited-in-the-wild,medium,nvd", "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "context": "Fortinet FortiOS contains an exposure of sensitive information to an unauthorized actor vulnerability. This may allow a remote unauthenticated attacker to bypass the patch developed for the symbolic link persistency mechanism observed in some post-exploit cases, via crafted HTTP requests. An attacker would need first to have compromised the product via another vulnerability, at filesystem level.", "tlp": "CLEAR", "score_factors": {"score": 88, "confidence_base": 80, "source_count": 2, "source_identifiers": ["cisa_kev", "nist_nvd_recent"], "reporting_groups": ["cisa", "nvd"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 8, "age_hours": 0.0, "half_life_hours": 8760.0, "decay_factor": 1.0}}
{"indicator": "CVE-2026-16232", "type": "cve", "source": "cisa_kev,nist_nvd_recent", "first_seen": "2026-07-22T00:00:00Z", "last_seen": "2026-10-24T22:12:15Z", "confidence": "high", "score": 88, "sightings": 485, "tags": "critical,cve,exploited-in-the-wild,nvd", "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "context": "Check Point SmartConsole contains an improper authentication vulnerability which could allow an unauthenticated remote attacker to obtain an application login token and use it to authenticate with full administrative privileges.", "tlp": "CLEAR", "score_factors": {"score": 88, "confidence_base": 80, "source_count": 2, "source_identifiers": ["cisa_kev", "nist_nvd_recent"], "reporting_groups": ["cisa", "nvd"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 8, "age_hours": 0.0, "half_life_hours": 8760.0, "decay_factor": 1.0}}
{"indicator": "CVE-2026-0770", "type": "cve", "source": "cisa_kev,nist_nvd_recent", "first_seen": "2026-07-21T00:00:00Z", "last_seen": "2026-10-24T22:12:15Z", "confidence": "high", "score": 88, "sightings": 493, "tags": "critical,cve,exploited-in-the-wild,nvd", "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "context": "Langflow contains an inclusion of functionality from untrusted control sphere vulnerability that allows remote attackers to execute arbitrary code on affected installations. ", "tlp": "CLEAR", "score_factors": {"score": 88, "confidence_base": 80, "source_count": 2, "source_identifiers": ["cisa_kev", "nist_nvd_recent"], "reporting_groups": ["cisa", "nvd"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 8, "age_hours": 0.0, "half_life_hours": 8760.0, "decay_factor": 1.0}}
{"indicator": "77.90.185.0/24", "type": "ipv4_cidr", "source": "dshield_block,spamhaus_drop", "first_seen": "2026-07-19T02:11:45Z", "last_seen": "2026-10-24T22:12:16Z", "confidence": "high", "score": 88, "sightings": 509, "tags": "drop,dshield,sans-isc,scanning,spamhaus", "reference": "https://www.spamhaus.org/blocklists/do-not-route-or-peer/", "context": "Spamhaus DROP/EDROP network", "tlp": "CLEAR", "score_factors": {"score": 88, "confidence_base": 80, "source_count": 2, "source_identifiers": ["dshield_block", "spamhaus_drop"], "reporting_groups": ["dshield", "spamhaus"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 8, "age_hours": 0.0, "half_life_hours": 720.0, "decay_factor": 1.0}}
{"indicator": "45.194.92.0/24", "type": "ipv4_cidr", "source": "dshield_block,spamhaus_drop", "first_seen": "2026-07-19T02:11:45Z", "last_seen": "2026-10-24T22:12:16Z", "confidence": "high", "score": 88, "sightings": 509, "tags": "drop,dshield,sans-isc,scanning,spamhaus", "reference": "https://www.spamhaus.org/blocklists/do-not-route-or-peer/", "context": "Spamhaus DROP/EDROP network", "tlp": "CLEAR", "score_factors": {"score": 88, "confidence_base": 80, "source_count": 2, "source_identifiers": ["dshield_block", "spamhaus_drop"], "reporting_groups": ["dshield", "spamhaus"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 8, "age_hours": 0.0, "half_life_hours": 720.0, "decay_factor": 1.0}}
{"indicator": "45.148.10.0/24", "type": "ipv4_cidr", "source": "dshield_block,spamhaus_drop", "first_seen": "2026-07-19T02:11:45Z", "last_seen": "2026-10-24T22:12:16Z", "confidence": "high", "score": 88, "sightings": 509, "tags": "drop,dshield,sans-isc,scanning,spamhaus", "reference": "https://www.spamhaus.org/blocklists/do-not-route-or-peer/", "context": "Spamhaus DROP/EDROP network", "tlp": "CLEAR", "score_factors": {"score": 88, "confidence_base": 80, "source_count": 2, "source_identifiers": ["dshield_block", "spamhaus_drop"], "reporting_groups": ["dshield", "spamhaus"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 8, "age_hours": 0.0, "half_life_hours": 720.0, "decay_factor": 1.0}}
{"indicator": "45.142.193.0/24", "type": "ipv4_cidr", "source": "dshield_block,spamhaus_drop", "first_seen": "2026-07-19T02:11:45Z", "last_seen": "2026-10-24T22:12:16Z", "confidence": "high", "score": 88, "sightings": 509, "tags": "drop,dshield,sans-isc,scanning,spamhaus", "reference": "https://www.spamhaus.org/blocklists/do-not-route-or-peer/", "context": "Spamhaus DROP/EDROP network", "tlp": "CLEAR", "score_factors": {"score": 88, "confidence_base": 80, "source_count": 2, "source_identifiers": ["dshield_block", "spamhaus_drop"], "reporting_groups": ["dshield", "spamhaus"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 8, "age_hours": 0.0, "half_life_hours": 720.0, "decay_factor": 1.0}}
{"indicator": "43.228.157.0/24", "type": "ipv4_cidr", "source": "dshield_block,spamhaus_drop", "first_seen": "2026-07-19T02:11:45Z", "last_seen": "2026-10-24T22:12:16Z", "confidence": "high", "score": 88, "sightings": 509, "tags": "drop,dshield,sans-isc,scanning,spamhaus", "reference": "https://www.spamhaus.org/blocklists/do-not-route-or-peer/", "context": "Spamhaus DROP/EDROP network", "tlp": "CLEAR", "score_factors": {"score": 88, "confidence_base": 80, "source_count": 2, "source_identifiers": ["dshield_block", "spamhaus_drop"], "reporting_groups": ["dshield", "spamhaus"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 8, "age_hours": 0.0, "half_life_hours": 720.0, "decay_factor": 1.0}}
{"indicator": "213.209.159.0/24", "type": "ipv4_cidr", "source": "dshield_block,spamhaus_drop", "first_seen": "2026-07-19T02:11:45Z", "last_seen": "2026-10-24T22:12:16Z", "confidence": "high", "score": 88, "sightings": 509, "tags": "drop,dshield,sans-isc,scanning,spamhaus", "reference": "https://www.spamhaus.org/blocklists/do-not-route-or-peer/", "context": "Spamhaus DROP/EDROP network", "tlp": "CLEAR", "score_factors": {"score": 88, "confidence_base": 80, "source_count": 2, "source_identifiers": ["dshield_block", "spamhaus_drop"], "reporting_groups": ["dshield", "spamhaus"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 8, "age_hours": 0.0, "half_life_hours": 720.0, "decay_factor": 1.0}}
{"indicator": "204.76.203.0/24", "type": "ipv4_cidr", "source": "dshield_block,spamhaus_drop", "first_seen": "2026-07-19T02:11:45Z", "last_seen": "2026-10-24T22:12:16Z", "confidence": "high", "score": 88, "sightings": 509, "tags": "drop,dshield,sans-isc,scanning,spamhaus", "reference": "https://www.spamhaus.org/blocklists/do-not-route-or-peer/", "context": "Spamhaus DROP/EDROP network", "tlp": "CLEAR", "score_factors": {"score": 88, "confidence_base": 80, "source_count": 2, "source_identifiers": ["dshield_block", "spamhaus_drop"], "reporting_groups": ["dshield", "spamhaus"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 8, "age_hours": 0.0, "half_life_hours": 720.0, "decay_factor": 1.0}}
{"indicator": "195.178.110.0/24", "type": "ipv4_cidr", "source": "dshield_block,spamhaus_drop", "first_seen": "2026-07-19T02:11:45Z", "last_seen": "2026-10-24T22:12:16Z", "confidence": "high", "score": 88, "sightings": 509, "tags": "drop,dshield,sans-isc,scanning,spamhaus", "reference": "https://www.spamhaus.org/blocklists/do-not-route-or-peer/", "context": "Spamhaus DROP/EDROP network", "tlp": "CLEAR", "score_factors": {"score": 88, "confidence_base": 80, "source_count": 2, "source_identifiers": ["dshield_block", "spamhaus_drop"], "reporting_groups": ["dshield", "spamhaus"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 8, "age_hours": 0.0, "half_life_hours": 720.0, "decay_factor": 1.0}}
{"indicator": "CVE-2026-63030", "type": "cve", "source": "cisa_kev,nist_nvd_recent", "first_seen": "2026-07-17T20:17:28Z", "last_seen": "2026-10-24T22:12:15Z", "confidence": "high", "score": 88, "sightings": 494, "tags": "critical,cve,exploited-in-the-wild,nvd", "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "context": "WordPress Core contains an interpretation conflict vulnerability that could allow an attacker to perform SQL Injection and achieve Remote Code Execution. This vulnerability can be chained with CVE-2026-60137.", "tlp": "CLEAR", "score_factors": {"score": 88, "confidence_base": 80, "source_count": 2, "source_identifiers": ["cisa_kev", "nist_nvd_recent"], "reporting_groups": ["cisa", "nvd"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 8, "age_hours": 0.0, "half_life_hours": 8760.0, "decay_factor": 1.0}}
{"indicator": "CVE-2026-60137", "type": "cve", "source": "cisa_kev,nist_nvd_recent", "first_seen": "2026-07-17T20:17:27Z", "last_seen": "2026-10-24T22:12:15Z", "confidence": "high", "score": 88, "sightings": 494, "tags": "cve,exploited-in-the-wild,medium,nvd", "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "context": "WordPress Core contains a SQL injection vulnerability when a plugin or theme passes untrusted input to the parameter. This vulnerability can be chained with CVE-2026-63030 to allow an unauthenticated attacker to gain remote code execution on default WordPress installations.", "tlp": "CLEAR", "score_factors": {"score": 88, "confidence_base": 80, "source_count": 2, "source_identifiers": ["cisa_kev", "nist_nvd_recent"], "reporting_groups": ["cisa", "nvd"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 8, "age_hours": 0.0, "half_life_hours": 8760.0, "decay_factor": 1.0}}
{"indicator": "CVE-2026-9198", "type": "cve", "source": "cisa_kev,nist_nvd_recent", "first_seen": "2026-07-17T18:17:17Z", "last_seen": "2026-10-24T22:12:15Z", "confidence": "high", "score": 88, "sightings": 408, "tags": "critical,cve,exploited-in-the-wild,nvd", "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "context": "Langflow contains a code injection vulnerability that allows unauthenticated attackers to achieve full remote code execution on default Langflow deployments.", "tlp": "CLEAR", "score_factors": {"score": 88, "confidence_base": 80, "source_count": 2, "source_identifiers": ["cisa_kev", "nist_nvd_recent"], "reporting_groups": ["cisa", "nvd"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 8, "age_hours": 0.0, "half_life_hours": 8760.0, "decay_factor": 1.0}}
{"indicator": "CVE-2026-9586", "type": "cve", "source": "cisa_kev,nist_nvd_recent", "first_seen": "2026-07-17T17:17:18Z", "last_seen": "2026-10-24T22:12:15Z", "confidence": "high", "score": 88, "sightings": 251, "tags": "critical,cve,exploited-in-the-wild,nvd", "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "context": "Sangoma Switchvox contains a SQL injection vulnerability which allows an unauthenticated remote attacker to execute arbitrary SQL statements against the backend PostgreSQL database using a single crafted request, including database operations and remote code execution.", "tlp": "CLEAR", "score_factors": {"score": 88, "confidence_base": 80, "source_count": 2, "source_identifiers": ["cisa_kev", "nist_nvd_recent"], "reporting_groups": ["cisa", "nvd"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 8, "age_hours": 0.0, "half_life_hours": 8760.0, "decay_factor": 1.0}}
{"indicator": "CVE-2026-15410", "type": "cve", "source": "cisa_kev,nist_nvd_recent", "first_seen": "2026-07-14T00:00:00Z", "last_seen": "2026-10-24T22:12:15Z", "confidence": "high", "score": 88, "sightings": 518, "tags": "cve,exploited-in-the-wild,high,nvd", "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "context": "SonicWall SMA1000 Appliances contain a code injection vulnerability which in specific conditions could potentially enable a remote authenticated attacker as administrator to execute arbitrary OS commands.", "tlp": "CLEAR", "score_factors": {"score": 88, "confidence_base": 80, "source_count": 2, "source_identifiers": ["cisa_kev", "nist_nvd_recent"], "reporting_groups": ["cisa", "nvd"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 8, "age_hours": 0.0, "half_life_hours": 8760.0, "decay_factor": 1.0}}
{"indicator": "CVE-2026-15409", "type": "cve", "source": "cisa_kev,nist_nvd_recent", "first_seen": "2026-07-14T00:00:00Z", "last_seen": "2026-10-24T22:12:15Z", "confidence": "high", "score": 88, "sightings": 518, "tags": "critical,cve,exploited-in-the-wild,nvd", "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "context": "SonicWall SMA1000 Appliances contain a server-side request forgery vulnerability that could allow a remote unauthenticated attacker to potentially cause the appliance to make requests to unintended location.", "tlp": "CLEAR", "score_factors": {"score": 88, "confidence_base": 80, "source_count": 2, "source_identifiers": ["cisa_kev", "nist_nvd_recent"], "reporting_groups": ["cisa", "nvd"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 8, "age_hours": 0.0, "half_life_hours": 8760.0, "decay_factor": 1.0}}
{"indicator": "CVE-2026-59822", "type": "cve", "source": "cisa_kev,nist_nvd_recent", "first_seen": "2026-07-08T20:16:57Z", "last_seen": "2026-10-24T22:12:15Z", "confidence": "high", "score": 88, "sightings": 255, "tags": "cve,exploited-in-the-wild,high,nvd", "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "context": "BerriAI LiteLLM contains an improper authentication vulnerability in the MCP Streamable HTTP endpoint that could allow an unauthenticated attacker to establish an authenticated MCP session using an arbitrary Bearer token.", "tlp": "CLEAR", "score_factors": {"score": 88, "confidence_base": 80, "source_count": 2, "source_identifiers": ["cisa_kev", "nist_nvd_recent"], "reporting_groups": ["cisa", "nvd"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 8, "age_hours": 0.0, "half_life_hours": 8760.0, "decay_factor": 1.0}}
{"indicator": "CVE-2026-53362", "type": "cve", "source": "cisa_kev,nist_nvd_recent", "first_seen": "2026-07-04T12:17:02Z", "last_seen": "2026-10-24T22:12:15Z", "confidence": "high", "score": 88, "sightings": 275, "tags": "cve,exploited-in-the-wild,high,nvd", "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "context": "Linux Kernel contains an unspecified vulnerability that can allow for privilege escalation via IPv6 networking subsystem. This vulnerability can impact multiple products, including but not limited to Suse, Red Hat, and other products using Linux. ", "tlp": "CLEAR", "score_factors": {"score": 88, "confidence_base": 80, "source_count": 2, "source_identifiers": ["cisa_kev", "nist_nvd_recent"], "reporting_groups": ["cisa", "nvd"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 8, "age_hours": 0.0, "half_life_hours": 8760.0, "decay_factor": 1.0}}
{"indicator": "CVE-2026-48282", "type": "cve", "source": "cisa_kev,nist_nvd_recent", "first_seen": "2026-06-30T16:16:54Z", "last_seen": "2026-10-24T22:12:15Z", "confidence": "high", "score": 88, "sightings": 519, "tags": "critical,cve,exploited-in-the-wild,nvd", "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "context": "Adobe ColdFusion contains a path traversal vulnerability that could lead to arbitrary code execution in the context of the current user.", "tlp": "CLEAR", "score_factors": {"score": 88, "confidence_base": 80, "source_count": 2, "source_identifiers": ["cisa_kev", "nist_nvd_recent"], "reporting_groups": ["cisa", "nvd"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 8, "age_hours": 0.0, "half_life_hours": 8760.0, "decay_factor": 1.0}}
{"indicator": "CVE-2026-56290", "type": "cve", "source": "cisa_kev,nist_nvd_recent", "first_seen": "2026-06-29T15:16:42Z", "last_seen": "2026-10-24T22:12:15Z", "confidence": "high", "score": 88, "sightings": 519, "tags": "critical,cve,exploited-in-the-wild,nvd", "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "context": "Joomlack Page Builder contains an improper access control vulnerability that could allow for remote code execution via unauthenticated arbitrary file upload.", "tlp": "CLEAR", "score_factors": {"score": 88, "confidence_base": 80, "source_count": 2, "source_identifiers": ["cisa_kev", "nist_nvd_recent"], "reporting_groups": ["cisa", "nvd"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 8, "age_hours": 0.0, "half_life_hours": 8760.0, "decay_factor": 1.0}}
{"indicator": "CVE-2026-53266", "type": "cve", "source": "cisa_kev,nist_nvd_recent", "first_seen": "2026-06-25T09:16:44Z", "last_seen": "2026-10-24T22:12:15Z", "confidence": "high", "score": 88, "sightings": 168, "tags": "cve,exploited-in-the-wild,high,nvd", "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "context": "Linux Kernel contains an out-of-bounds write vulnerability in the ebtables SNAT target which allows an ARP sender hardware address rewrite to write directly into a nonlinear socket-buffer fragment backed by a splice-imported file page. The impacted product(s) could be end-of-life (EoL) and/or end-of-service (EoS). Users are advised to discontinue use and/or transition to a supported version.", "tlp": "CLEAR", "score_factors": {"score": 88, "confidence_base": 80, "source_count": 2, "source_identifiers": ["cisa_kev", "nist_nvd_recent"], "reporting_groups": ["cisa", "nvd"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 8, "age_hours": 0.0, "half_life_hours": 8760.0, "decay_factor": 1.0}}
{"indicator": "CVE-2026-12569", "type": "cve", "source": "cisa_kev,nist_nvd_recent", "first_seen": "2026-06-25T00:00:00Z", "last_seen": "2026-10-24T22:12:15Z", "confidence": "high", "score": 88, "sightings": 519, "tags": "critical,cve,exploited-in-the-wild,nvd", "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "context": "PTC Windchill and FlexPLM contains an improper input validation vulnerability allowing an unauthenticated, remote attacker to execute arbitrary code by sending a malicious request to the network.", "tlp": "CLEAR", "score_factors": {"score": 88, "confidence_base": 80, "source_count": 2, "source_identifiers": ["cisa_kev", "nist_nvd_recent"], "reporting_groups": ["cisa", "nvd"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 8, "age_hours": 0.0, "half_life_hours": 8760.0, "decay_factor": 1.0}}
{"indicator": "CVE-2026-55255", "type": "cve", "source": "cisa_kev,nist_nvd_recent", "first_seen": "2026-06-23T17:17:08Z", "last_seen": "2026-10-24T22:12:15Z", "confidence": "high", "score": 88, "sightings": 519, "tags": "cve,exploited-in-the-wild,high,nvd", "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "context": "Langflow contains an authorization bypass through user-controlled key vulnerability which allows an authenticated attacker to execute any flow belonging to another user by specifying the victim's flow ID in the request.", "tlp": "CLEAR", "score_factors": {"score": 88, "confidence_base": 80, "source_count": 2, "source_identifiers": ["cisa_kev", "nist_nvd_recent"], "reporting_groups": ["cisa", "nvd"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 8, "age_hours": 0.0, "half_life_hours": 8760.0, "decay_factor": 1.0}}
{"indicator": "CVE-2026-48908", "type": "cve", "source": "cisa_kev,nist_nvd_recent", "first_seen": "2026-06-20T13:16:42Z", "last_seen": "2026-10-24T22:12:15Z", "confidence": "high", "score": 88, "sightings": 519, "tags": "critical,cve,exploited-in-the-wild,nvd", "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "context": "JoomShaper SP Page Builder contains an unrestricted upload of file with dangerous type vulnerability that allows unauthenticated users to upload arbitrary files, ultimately resulting in the upload and execution of PHP code.", "tlp": "CLEAR", "score_factors": {"score": 88, "confidence_base": 80, "source_count": 2, "source_identifiers": ["cisa_kev", "nist_nvd_recent"], "reporting_groups": ["cisa", "nvd"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 8, "age_hours": 0.0, "half_life_hours": 8760.0, "decay_factor": 1.0}}
{"indicator": "CVE-2026-7273", "type": "cve", "source": "cisa_kev,nist_nvd_recent", "first_seen": "2026-06-16T03:16:13Z", "last_seen": "2026-10-24T22:12:15Z", "confidence": "high", "score": 88, "sightings": 150, "tags": "cve,exploited-in-the-wild,high,nvd", "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "context": "Zyxel GS1900 series switches contain a stack-based buffer overflow vulnerability in the CGI program which could allow a LAN-based, unauthenticated attacker to exploit the flaw and potentially execute OS commands via a crafted HTTP request.", "tlp": "CLEAR", "score_factors": {"score": 88, "confidence_base": 80, "source_count": 2, "source_identifiers": ["cisa_kev", "nist_nvd_recent"], "reporting_groups": ["cisa", "nvd"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 8, "age_hours": 0.0, "half_life_hours": 8760.0, "decay_factor": 1.0}}
{"indicator": "CVE-2026-48558", "type": "cve", "source": "cisa_kev,nist_nvd_recent", "first_seen": "2026-06-12T18:16:35Z", "last_seen": "2026-10-24T22:12:15Z", "confidence": "high", "score": 88, "sightings": 519, "tags": "critical,cve,exploited-in-the-wild,nvd", "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "context": "SimpleHelp contains an authentication bypass vulnerability in the OIDC authentication flow. When OIDC authentication is configured, identity tokens submitted during login are accepted without verifying their cryptographic signature. In a vulnerable configuration, a remote, unauthenticated attacker can submit a forged token containing arbitrary identity claims to obtain a fully authenticated technician session. In some configurations, this may also allow bypass of multi-factor authentication.", "tlp": "CLEAR", "score_factors": {"score": 88, "confidence_base": 80, "source_count": 2, "source_identifiers": ["cisa_kev", "nist_nvd_recent"], "reporting_groups": ["cisa", "nvd"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 8, "age_hours": 0.0, "half_life_hours": 8760.0, "decay_factor": 1.0}}
{"indicator": "CVE-2026-10520", "type": "cve", "source": "cisa_kev,nist_nvd_recent", "first_seen": "2026-06-09T16:16:35Z", "last_seen": "2026-10-24T22:12:15Z", "confidence": "high", "score": 88, "sightings": 519, "tags": "critical,cve,exploited-in-the-wild,nvd", "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "context": "Ivanti Sentry (formerly known as MobileIron Sentry) contains an OS command injection vulnerability which could allow a remote unauthenticated user to achieve root-level remote code execution. This vulnerability can be successfully exploited in cases where the Sentry appliance is in an unmanaged state with its endpoints externally reachable. The use of mTLS with EPMM or restricted HTTPS access through Neurons for MDM makes interfaces inaccessible to external actors.", "tlp": "CLEAR", "score_factors": {"score": 88, "confidence_base": 80, "source_count": 2, "source_identifiers": ["cisa_kev", "nist_nvd_recent"], "reporting_groups": ["cisa", "nvd"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 8, "age_hours": 0.0, "half_life_hours": 8760.0, "decay_factor": 1.0}}
{"indicator": "CVE-2026-50751", "type": "cve", "source": "cisa_kev,nist_nvd_recent", "first_seen": "2026-06-08T00:00:00Z", "last_seen": "2026-10-24T22:12:15Z", "confidence": "high", "score": 88, "sightings": 519, "tags": "critical,cve,exploited-in-the-wild,nvd", "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "context": "Check Point Security Gateway contains an improper authentication vulnerability in IKEv1 key exchange that could allow an unauthenticated remote attacker to bypass user authentication and establish a remote access VPN connection without a valid user password.", "tlp": "CLEAR", "score_factors": {"score": 88, "confidence_base": 80, "source_count": 2, "source_identifiers": ["cisa_kev", "nist_nvd_recent"], "reporting_groups": ["cisa", "nvd"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 8, "age_hours": 0.0, "half_life_hours": 8760.0, "decay_factor": 1.0}}
{"indicator": "CVE-2026-7473", "type": "cve", "source": "cisa_kev,nist_nvd_recent", "first_seen": "2026-06-05T17:17:02Z", "last_seen": "2026-10-24T22:12:15Z", "confidence": "high", "score": 88, "sightings": 519, "tags": "cve,exploited-in-the-wild,medium,nvd", "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "context": "Arista Extensible Operating System (EOS) contains an incomplete comparison with missing factors vulnerability when the switch incorrectly decapsulate and forwards other unexpected tunneled packet with a destination IP matching its configured decapsulation IP.", "tlp": "CLEAR", "score_factors": {"score": 88, "confidence_base": 80, "source_count": 2, "source_identifiers": ["cisa_kev", "nist_nvd_recent"], "reporting_groups": ["cisa", "nvd"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 8, "age_hours": 0.0, "half_life_hours": 8760.0, "decay_factor": 1.0}}
{"indicator": "CVE-2026-28318", "type": "cve", "source": "cisa_kev,nist_nvd_recent", "first_seen": "2026-06-04T15:16:50Z", "last_seen": "2026-10-24T22:12:15Z", "confidence": "high", "score": 88, "sightings": 519, "tags": "cve,exploited-in-the-wild,high,nvd", "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "context": "SolarWinds Serv-U contains an uncontrolled resource consumption vulnerability that allows specially crafted POST requests using the Content-Encoding: deflate header to crash the Serv-U service without authentication.", "tlp": "CLEAR", "score_factors": {"score": 88, "confidence_base": 80, "source_count": 2, "source_identifiers": ["cisa_kev", "nist_nvd_recent"], "reporting_groups": ["cisa", "nvd"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 8, "age_hours": 0.0, "half_life_hours": 8760.0, "decay_factor": 1.0}}
{"indicator": "CVE-2026-8037", "type": "cve", "source": "cisa_kev,nist_nvd_recent", "first_seen": "2026-06-04T14:16:45Z", "last_seen": "2026-10-24T22:12:15Z", "confidence": "high", "score": 88, "sightings": 391, "tags": "critical,cve,exploited-in-the-wild,nvd", "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "context": "Progress LoadMaster contains a command injection vulnerability that allows an un-authenticated attacker to execute arbitrary commands on the LoadMaster appliance by exploiting unsanitized input in multiple command endpoints.", "tlp": "CLEAR", "score_factors": {"score": 88, "confidence_base": 80, "source_count": 2, "source_identifiers": ["cisa_kev", "nist_nvd_recent"], "reporting_groups": ["cisa", "nvd"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 8, "age_hours": 0.0, "half_life_hours": 8760.0, "decay_factor": 1.0}}
{"indicator": "CVE-2026-20230", "type": "cve", "source": "cisa_kev,nist_nvd_recent", "first_seen": "2026-06-03T18:16:20Z", "last_seen": "2026-10-24T22:12:15Z", "confidence": "high", "score": 88, "sightings": 519, "tags": "cve,exploited-in-the-wild,high,nvd", "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "context": "Cisco Unified Communications Manager (Unified CM) and Cisco Unified Communications Manager Session Management Edition (Unified CM SME) contain a server-side request forgery (SSRF) Vulnerability that could allow an unauthenticated, remote attacker to write files to the underlying operating system that could be used later to elevate to root.", "tlp": "CLEAR", "score_factors": {"score": 88, "confidence_base": 80, "source_count": 2, "source_identifiers": ["cisa_kev", "nist_nvd_recent"], "reporting_groups": ["cisa", "nvd"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 8, "age_hours": 0.0, "half_life_hours": 8760.0, "decay_factor": 1.0}}
{"indicator": "CVE-2026-48027", "type": "cve", "source": "cisa_kev,nist_nvd_recent", "first_seen": "2026-05-27T00:00:00Z", "last_seen": "2026-10-24T22:12:15Z", "confidence": "high", "score": 88, "sightings": 519, "tags": "critical,cve,exploited-in-the-wild,nvd", "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "context": "Nx Console contains an embedded malicious code vulnerability that allowed a malicious version of Nx Console to be published. The compromised extension fetched an obfuscated payload that could harvested credentials from multiple sources on disk and in memory.", "tlp": "CLEAR", "score_factors": {"score": 88, "confidence_base": 80, "source_count": 2, "source_identifiers": ["cisa_kev", "nist_nvd_recent"], "reporting_groups": ["cisa", "nvd"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 8, "age_hours": 0.0, "half_life_hours": 8760.0, "decay_factor": 1.0}}
{"indicator": "CVE-2026-48710", "type": "cve", "source": "cisa_kev,nist_nvd_recent", "first_seen": "2026-05-26T22:16:44Z", "last_seen": "2026-10-24T22:12:15Z", "confidence": "high", "score": 88, "sightings": 254, "tags": "cve,exploited-in-the-wild,medium,nvd", "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "context": "Kludex Starlette contains a HTTP request/response smuggling vulnerability that could allow attackers to inject paths into the host part, prepending the actual path leading to issues such as authentication bypass when the authentication depends on the reconstructed URL’s path. This vulnerability could be chaned with CVE-2026-42271.", "tlp": "CLEAR", "score_factors": {"score": 88, "confidence_base": 80, "source_count": 2, "source_identifiers": ["cisa_kev", "nist_nvd_recent"], "reporting_groups": ["cisa", "nvd"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 8, "age_hours": 0.0, "half_life_hours": 8760.0, "decay_factor": 1.0}}
{"indicator": "CVE-2026-48172", "type": "cve", "source": "cisa_kev,nist_nvd_recent", "first_seen": "2026-05-21T02:16:33Z", "last_seen": "2026-10-24T22:12:15Z", "confidence": "high", "score": 88, "sightings": 519, "tags": "critical,cve,exploited-in-the-wild,nvd", "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "context": "LiteSpeed cPanel Plugin contains privilege escalation vulnerability that is exposed via the user-end cPanel plugin, which can be abused by any cPanel user account to execute arbitrary scripts with root privileges.", "tlp": "CLEAR", "score_factors": {"score": 88, "confidence_base": 80, "source_count": 2, "source_identifiers": ["cisa_kev", "nist_nvd_recent"], "reporting_groups": ["cisa", "nvd"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 8, "age_hours": 0.0, "half_life_hours": 8760.0, "decay_factor": 1.0}}
{"indicator": "CVE-2026-9082", "type": "cve", "source": "cisa_kev,nist_nvd_recent", "first_seen": "2026-05-20T20:16:41Z", "last_seen": "2026-10-24T22:12:15Z", "confidence": "high", "score": 88, "sightings": 519, "tags": "critical,cve,exploited-in-the-wild,nvd", "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "context": "Drupal Core contains a SQL injection vulnerability that could allow for privilege escalation and remote code execution via specially crafted requests sent with the database abstraction API.", "tlp": "CLEAR", "score_factors": {"score": 88, "confidence_base": 80, "source_count": 2, "source_identifiers": ["cisa_kev", "nist_nvd_recent"], "reporting_groups": ["cisa", "nvd"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 8, "age_hours": 0.0, "half_life_hours": 8760.0, "decay_factor": 1.0}}
{"indicator": "CVE-2026-45498", "type": "cve", "source": "cisa_kev,nist_nvd_recent", "first_seen": "2026-05-20T00:00:00Z", "last_seen": "2026-10-24T22:12:15Z", "confidence": "high", "score": 88, "sightings": 519, "tags": "cve,exploited-in-the-wild,medium,nvd", "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "context": "Microsoft Defender contains an unspecified vulnerability that allows for denial of service.", "tlp": "CLEAR", "score_factors": {"score": 88, "confidence_base": 80, "source_count": 2, "source_identifiers": ["cisa_kev", "nist_nvd_recent"], "reporting_groups": ["cisa", "nvd"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 8, "age_hours": 0.0, "half_life_hours": 8760.0, "decay_factor": 1.0}}
{"indicator": "CVE-2026-41940", "type": "cve", "source": "cisa_kev,nist_nvd_recent", "first_seen": "2026-04-29T16:16:25Z", "last_seen": "2026-10-24T22:12:15Z", "confidence": "high", "score": 88, "sightings": 519, "tags": "critical,cve,exploited-in-the-wild,nvd", "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "context": "WebPros cPanel & WHM (WebHost Manager) and WP2 (WordPress Squared) contain an authentication bypass vulnerability in the login flow that allows unauthenticated remote attackers to gain unauthorized access to the control panel.", "tlp": "CLEAR", "score_factors": {"score": 88, "confidence_base": 80, "source_count": 2, "source_identifiers": ["cisa_kev", "nist_nvd_recent"], "reporting_groups": ["cisa", "nvd"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 8, "age_hours": 0.0, "half_life_hours": 8760.0, "decay_factor": 1.0}}
{"indicator": "CVE-2026-32202", "type": "cve", "source": "cisa_kev,nist_nvd_recent", "first_seen": "2026-04-28T00:00:00Z", "last_seen": "2026-10-24T22:12:15Z", "confidence": "high", "score": 88, "sightings": 519, "tags": "cve,exploited-in-the-wild,medium,nvd", "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "context": "Microsoft Windows Shell contains a protection mechanism failure vulnerability that allows an unauthorized attacker to perform spoofing over a network.", "tlp": "CLEAR", "score_factors": {"score": 88, "confidence_base": 80, "source_count": 2, "source_identifiers": ["cisa_kev", "nist_nvd_recent"], "reporting_groups": ["cisa", "nvd"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 8, "age_hours": 0.0, "half_life_hours": 8760.0, "decay_factor": 1.0}}
{"indicator": "CVE-2026-31431", "type": "cve", "source": "cisa_kev,nist_nvd_recent", "first_seen": "2026-04-22T09:16:21Z", "last_seen": "2026-10-24T22:12:15Z", "confidence": "high", "score": 88, "sightings": 519, "tags": "cve,exploited-in-the-wild,high,nvd", "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "context": "Linux Kernel contains an incorrect resource transfer between spheres vulnerability that could allow for privilege escalation.", "tlp": "CLEAR", "score_factors": {"score": 88, "confidence_base": 80, "source_count": 2, "source_identifiers": ["cisa_kev", "nist_nvd_recent"], "reporting_groups": ["cisa", "nvd"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 8, "age_hours": 0.0, "half_life_hours": 8760.0, "decay_factor": 1.0}}
{"indicator": "CVE-2026-33824", "type": "cve", "source": "cisa_kev,nist_nvd_recent", "first_seen": "2026-04-14T18:17:34Z", "last_seen": "2026-10-24T22:12:15Z", "confidence": "high", "score": 88, "sightings": 325, "tags": "critical,cve,exploited-in-the-wild,nvd", "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "context": "Microsoft Internet Key Exchange (IKE) Service Extensions contains a double free vulnerability that could enable remote code execution.", "tlp": "CLEAR", "score_factors": {"score": 88, "confidence_base": 80, "source_count": 2, "source_identifiers": ["cisa_kev", "nist_nvd_recent"], "reporting_groups": ["cisa", "nvd"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 8, "age_hours": 0.0, "half_life_hours": 8760.0, "decay_factor": 1.0}}
{"indicator": "CVE-2025-61624", "type": "cve", "source": "cisa_kev,nist_nvd_recent", "first_seen": "2026-04-14T16:16:31Z", "last_seen": "2026-10-24T22:12:15Z", "confidence": "high", "score": 88, "sightings": 30, "tags": "cve,exploited-in-the-wild,medium,nvd", "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "context": "FortiOS, FortiPAM, FortiProxy, and FortiSwitchManager contain a path traversal vulnerability that may allow an authenticated attacker with admin profile and at least read-write permissions to write or delete arbitrary files via specific CLI commands.", "tlp": "CLEAR", "score_factors": {"score": 88, "confidence_base": 80, "source_count": 2, "source_identifiers": ["cisa_kev", "nist_nvd_recent"], "reporting_groups": ["cisa", "nvd"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 8, "age_hours": 0.0, "half_life_hours": 8760.0, "decay_factor": 1.0}}
{"indicator": "CVE-2026-34621", "type": "cve", "source": "cisa_kev,nist_nvd_recent", "first_seen": "2026-04-13T00:00:00Z", "last_seen": "2026-10-24T22:12:15Z", "confidence": "high", "score": 88, "sightings": 519, "tags": "cve,exploited-in-the-wild,high,nvd", "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "context": "Adobe Acrobat and Reader contain a prototype pollution vulnerability that allows for arbitrary code execution.", "tlp": "CLEAR", "score_factors": {"score": 88, "confidence_base": 80, "source_count": 2, "source_identifiers": ["cisa_kev", "nist_nvd_recent"], "reporting_groups": ["cisa", "nvd"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 8, "age_hours": 0.0, "half_life_hours": 8760.0, "decay_factor": 1.0}}
{"indicator": "CVE-2026-34486", "type": "cve", "source": "cisa_kev,nist_nvd_recent", "first_seen": "2026-04-09T20:16:25Z", "last_seen": "2026-10-24T22:12:15Z", "confidence": "high", "score": 88, "sightings": 408, "tags": "critical,cve,exploited-in-the-wild,high,nvd", "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "context": "Apache Tomcat contains a missing encryption of sensitive data vulnerability that allows the bypass of the EncryptInterceptor. This vulnerability can be chained with CVE‑2025‑24813.", "tlp": "CLEAR", "score_factors": {"score": 88, "confidence_base": 80, "source_count": 2, "source_identifiers": ["cisa_kev", "nist_nvd_recent"], "reporting_groups": ["cisa", "nvd"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 8, "age_hours": 0.0, "half_life_hours": 8760.0, "decay_factor": 1.0}}
{"indicator": "CVE-2026-5281", "type": "cve", "source": "cisa_kev,nist_nvd_recent", "first_seen": "2026-04-01T00:00:00Z", "last_seen": "2026-10-24T22:12:15Z", "confidence": "high", "score": 88, "sightings": 519, "tags": "cve,exploited-in-the-wild,high,nvd", "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "context": "Google Dawn contains an use-after-free vulnerability that could allow a remote attacker who had compromised the renderer process to execute arbitrary code via a crafted HTML page. This vulnerability could affect multiple Chromium-based products including, but not limited to, Google Chrome, Microsoft Edge, and Opera.", "tlp": "CLEAR", "score_factors": {"score": 88, "confidence_base": 80, "source_count": 2, "source_identifiers": ["cisa_kev", "nist_nvd_recent"], "reporting_groups": ["cisa", "nvd"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 8, "age_hours": 0.0, "half_life_hours": 8760.0, "decay_factor": 1.0}}
{"indicator": "CVE-2025-67038", "type": "cve", "source": "cisa_kev,nist_nvd_recent", "first_seen": "2026-03-11T17:16:52Z", "last_seen": "2026-10-24T22:12:15Z", "confidence": "high", "score": 88, "sightings": 519, "tags": "critical,cve,exploited-in-the-wild,nvd", "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "context": "Lantronix EDS5000 contains a code injection vulnerability that could allow attackers to inject arbitrary OS commands into the username parameter. Injected commands are executed with root privileges.", "tlp": "CLEAR", "score_factors": {"score": 88, "confidence_base": 80, "source_count": 2, "source_identifiers": ["cisa_kev", "nist_nvd_recent"], "reporting_groups": ["cisa", "nvd"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 8, "age_hours": 0.0, "half_life_hours": 8760.0, "decay_factor": 1.0}}
{"indicator": "CVE-2026-20079", "type": "cve", "source": "cisa_kev,nist_nvd_recent", "first_seen": "2026-03-04T18:16:24Z", "last_seen": "2026-10-24T22:12:15Z", "confidence": "high", "score": 88, "sightings": 211, "tags": "critical,cve,exploited-in-the-wild,nvd", "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "context": "Cisco Secure Firewall Management Center (FMC) Software and Cisco Security Cloud Control (SCC) Firewall Management contain an authentication Bypass using an alternate path or channel vulnerability that could allow an unauthenticated, remote attacker to bypass authentication and execute script files on an affected device to obtain root access to the underlying operating system.", "tlp": "CLEAR", "score_factors": {"score": 88, "confidence_base": 80, "source_count": 2, "source_identifiers": ["cisa_kev", "nist_nvd_recent"], "reporting_groups": ["cisa", "nvd"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 8, "age_hours": 0.0, "half_life_hours": 8760.0, "decay_factor": 1.0}}
{"indicator": "CVE-2026-24423", "type": "cve", "source": "cisa_kev,nist_nvd_recent", "first_seen": "2026-02-05T00:00:00Z", "last_seen": "2026-10-24T22:12:15Z", "confidence": "high", "score": 88, "sightings": 519, "tags": "critical,cve,exploited-in-the-wild,nvd", "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "context": "SmarterTools SmarterMail contains a missing authentication for critical function vulnerability in the ConnectToHub API method. This could allow the attacker to point the SmarterMail instance to a malicious HTTP server which serves the malicious OS command and could lead to command execution. ", "tlp": "CLEAR", "score_factors": {"score": 88, "confidence_base": 80, "source_count": 2, "source_identifiers": ["cisa_kev", "nist_nvd_recent"], "reporting_groups": ["cisa", "nvd"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 8, "age_hours": 0.0, "half_life_hours": 8760.0, "decay_factor": 1.0}}
{"indicator": "CVE-2026-23760", "type": "cve", "source": "cisa_kev,nist_nvd_recent", "first_seen": "2026-01-26T00:00:00Z", "last_seen": "2026-10-24T22:12:15Z", "confidence": "high", "score": 88, "sightings": 519, "tags": "critical,cve,exploited-in-the-wild,nvd", "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "context": "SmarterTools SmarterMail contains an authentication bypass using an alternate path or channel vulnerability in the password reset API. The force-reset-password endpoint permits anonymous requests and fails to verify the existing password or a reset token when resetting system administrator accounts. This could allow an unauthenticated attacker to supply a target administrator username and a new password to reset the account, resulting in full administrative compromise of the SmarterMail instance.", "tlp": "CLEAR", "score_factors": {"score": 88, "confidence_base": 80, "source_count": 2, "source_identifiers": ["cisa_kev", "nist_nvd_recent"], "reporting_groups": ["cisa", "nvd"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 8, "age_hours": 0.0, "half_life_hours": 8760.0, "decay_factor": 1.0}}
{"indicator": "CVE-2026-24061", "type": "cve", "source": "cisa_kev,nist_nvd_recent", "first_seen": "2026-01-21T07:16:01Z", "last_seen": "2026-10-24T22:12:15Z", "confidence": "high", "score": 88, "sightings": 519, "tags": "critical,cve,exploited-in-the-wild,nvd", "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "context": "GNU InetUtils contains an argument injection vulnerability in telnetd that could allow for remote authentication bypass via a \"-f root\" value for the USER environment variable.", "tlp": "CLEAR", "score_factors": {"score": 88, "confidence_base": 80, "source_count": 2, "source_identifiers": ["cisa_kev", "nist_nvd_recent"], "reporting_groups": ["cisa", "nvd"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 8, "age_hours": 0.0, "half_life_hours": 8760.0, "decay_factor": 1.0}}
{"indicator": "CVE-2025-25249", "type": "cve", "source": "cisa_kev,nist_nvd_recent", "first_seen": "2026-01-13T17:15:56Z", "last_seen": "2026-10-24T22:12:15Z", "confidence": "high", "score": 88, "sightings": 211, "tags": "cve,exploited-in-the-wild,high,nvd", "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "context": "Fortinet FortiOS, FortiSwitchManager, and FortiSASE contain a heap-based buffer overflow vulnerability that allows an attacker to execute unauthorized code or commands via specially crafted packets.", "tlp": "CLEAR", "score_factors": {"score": 88, "confidence_base": 80, "source_count": 2, "source_identifiers": ["cisa_kev", "nist_nvd_recent"], "reporting_groups": ["cisa", "nvd"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 8, "age_hours": 0.0, "half_life_hours": 8760.0, "decay_factor": 1.0}}
{"indicator": "CVE-2026-20805", "type": "cve", "source": "cisa_kev,nist_nvd_recent", "first_seen": "2026-01-13T00:00:00Z", "last_seen": "2026-10-24T22:12:15Z", "confidence": "high", "score": 88, "sightings": 519, "tags": "cve,exploited-in-the-wild,medium,nvd", "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "context": "Microsoft Windows Desktop Windows Manager contains an information disclosure vulnerability that allows an authorized attacker to disclose information locally.", "tlp": "CLEAR", "score_factors": {"score": 88, "confidence_base": 80, "source_count": 2, "source_identifiers": ["cisa_kev", "nist_nvd_recent"], "reporting_groups": ["cisa", "nvd"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 8, "age_hours": 0.0, "half_life_hours": 8760.0, "decay_factor": 1.0}}
{"indicator": "CVE-2025-66376", "type": "cve", "source": "cisa_kev,nist_nvd_recent", "first_seen": "2026-01-05T15:15:44Z", "last_seen": "2026-10-24T22:12:15Z", "confidence": "high", "score": 88, "sightings": 519, "tags": "cve,exploited-in-the-wild,high,nvd", "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "context": "Synacor Zimbra Collaboration Suite (ZCS) contains a cross-site scripting vulnerability in the Classic UI where attackers could abuse Cascading Style Sheets (CSS) @import directives in email HTML.", "tlp": "CLEAR", "score_factors": {"score": 88, "confidence_base": 80, "source_count": 2, "source_identifiers": ["cisa_kev", "nist_nvd_recent"], "reporting_groups": ["cisa", "nvd"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 8, "age_hours": 0.0, "half_life_hours": 8760.0, "decay_factor": 1.0}}
{"indicator": "CVE-2025-52691", "type": "cve", "source": "cisa_kev,nist_nvd_recent", "first_seen": "2025-12-29T03:15:42Z", "last_seen": "2026-10-24T22:12:15Z", "confidence": "high", "score": 88, "sightings": 519, "tags": "critical,cve,exploited-in-the-wild,nvd", "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "context": "SmarterTools SmarterMail contains an unrestricted upload of file with dangerous type vulnerability that could allow an unauthenticated attacker to upload arbitrary files to any location on the mail server, potentially enabling remote code execution.", "tlp": "CLEAR", "score_factors": {"score": 88, "confidence_base": 80, "source_count": 2, "source_identifiers": ["cisa_kev", "nist_nvd_recent"], "reporting_groups": ["cisa", "nvd"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 8, "age_hours": 0.0, "half_life_hours": 8760.0, "decay_factor": 1.0}}
{"indicator": "CVE-2025-68613", "type": "cve", "source": "cisa_kev,nist_nvd_recent", "first_seen": "2025-12-19T23:15:52Z", "last_seen": "2026-10-24T22:12:15Z", "confidence": "high", "score": 88, "sightings": 519, "tags": "critical,cve,exploited-in-the-wild,nvd", "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "context": "n8n contains an improper control of dynamically managed code resources vulnerability in its workflow expression evaluation system that allows for remote code execution.", "tlp": "CLEAR", "score_factors": {"score": 88, "confidence_base": 80, "source_count": 2, "source_identifiers": ["cisa_kev", "nist_nvd_recent"], "reporting_groups": ["cisa", "nvd"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 8, "age_hours": 0.0, "half_life_hours": 8760.0, "decay_factor": 1.0}}
{"indicator": "CVE-2025-14733", "type": "cve", "source": "cisa_kev,nist_nvd_recent", "first_seen": "2025-12-19T00:00:00Z", "last_seen": "2026-10-24T22:12:15Z", "confidence": "high", "score": 88, "sightings": 519, "tags": "critical,cve,exploited-in-the-wild,nvd", "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "context": "WatchGuard Fireware OS iked process contains an out of bounds write vulnerability in the OS iked process. This vulnerability may allow a remote unauthenticated attacker to execute arbitrary code and affects both the mobile user VPN with IKEv2 and the branch office VPN using IKEv2 when configured with a dynamic gateway peer.", "tlp": "CLEAR", "score_factors": {"score": 88, "confidence_base": 80, "source_count": 2, "source_identifiers": ["cisa_kev", "nist_nvd_recent"], "reporting_groups": ["cisa", "nvd"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 8, "age_hours": 0.0, "half_life_hours": 8760.0, "decay_factor": 1.0}}
{"indicator": "CVE-2025-59374", "type": "cve", "source": "cisa_kev,nist_nvd_recent", "first_seen": "2025-12-17T00:00:00Z", "last_seen": "2026-10-24T22:12:15Z", "confidence": "high", "score": 88, "sightings": 519, "tags": "critical,cve,exploited-in-the-wild,nvd", "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "context": "ASUS Live Update contains an embedded malicious code vulnerability client were distributed with unauthorized modifications introduced through a supply chain compromise. The modified builds could cause devices meeting specific targeting conditions to perform unintended actions. The impacted product could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization.", "tlp": "CLEAR", "score_factors": {"score": 88, "confidence_base": 80, "source_count": 2, "source_identifiers": ["cisa_kev", "nist_nvd_recent"], "reporting_groups": ["cisa", "nvd"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 8, "age_hours": 0.0, "half_life_hours": 8760.0, "decay_factor": 1.0}}
{"indicator": "CVE-2025-43529", "type": "cve", "source": "cisa_kev,nist_nvd_recent", "first_seen": "2025-12-15T00:00:00Z", "last_seen": "2026-10-24T22:12:15Z", "confidence": "high", "score": 88, "sightings": 519, "tags": "cve,exploited-in-the-wild,high,nvd", "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "context": "Apple iOS, iPadOS, macOS, and other Apple products contain a use-after-free vulnerability in WebKit. Processing maliciously crafted web content may lead to memory corruption. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing.", "tlp": "CLEAR", "score_factors": {"score": 88, "confidence_base": 80, "source_count": 2, "source_identifiers": ["cisa_kev", "nist_nvd_recent"], "reporting_groups": ["cisa", "nvd"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 8, "age_hours": 0.0, "half_life_hours": 8760.0, "decay_factor": 1.0}}
{"indicator": "CVE-2025-43520", "type": "cve", "source": "cisa_kev,nist_nvd_recent", "first_seen": "2025-12-12T21:15:56Z", "last_seen": "2026-10-24T22:12:15Z", "confidence": "high", "score": 88, "sightings": 519, "tags": "cve,exploited-in-the-wild,medium,nvd", "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "context": "Apple watchOS, iOS, iPadOS, macOS, visionOS, and tvOS contain a classic buffer overflow vulnerability which could allow a malicious application to cause unexpected system termination or write kernel memory.", "tlp": "CLEAR", "score_factors": {"score": 88, "confidence_base": 80, "source_count": 2, "source_identifiers": ["cisa_kev", "nist_nvd_recent"], "reporting_groups": ["cisa", "nvd"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 8, "age_hours": 0.0, "half_life_hours": 8760.0, "decay_factor": 1.0}}
{"indicator": "CVE-2025-43510", "type": "cve", "source": "cisa_kev,nist_nvd_recent", "first_seen": "2025-12-12T21:15:55Z", "last_seen": "2026-10-24T22:12:15Z", "confidence": "high", "score": 88, "sightings": 519, "tags": "cve,exploited-in-the-wild,high,nvd", "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "context": "Apple watchOS, iOS, iPadOS, macOS, visionOS, and tvOS contain an improper locking vulnerability that could allow a malicious application to cause unexpected changes in memory shared between processes.", "tlp": "CLEAR", "score_factors": {"score": 88, "confidence_base": 80, "source_count": 2, "source_identifiers": ["cisa_kev", "nist_nvd_recent"], "reporting_groups": ["cisa", "nvd"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 8, "age_hours": 0.0, "half_life_hours": 8760.0, "decay_factor": 1.0}}
{"indicator": "CVE-2025-14611", "type": "cve", "source": "cisa_kev,nist_nvd_recent", "first_seen": "2025-12-12T21:15:53Z", "last_seen": "2026-10-24T22:12:15Z", "confidence": "high", "score": 88, "sightings": 519, "tags": "critical,cve,exploited-in-the-wild,nvd", "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "context": "Gladinet CentreStack and TrioFox contain a hardcoded cryptographic keys vulnerability for their implementation of the AES cryptoscheme. This vulnerability degrades security for public exposed endpoints that may make use of it and may offer arbitrary local file inclusion when provided a specially crafted request without authentication.", "tlp": "CLEAR", "score_factors": {"score": 88, "confidence_base": 80, "source_count": 2, "source_identifiers": ["cisa_kev", "nist_nvd_recent"], "reporting_groups": ["cisa", "nvd"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 8, "age_hours": 0.0, "half_life_hours": 8760.0, "decay_factor": 1.0}}
{"indicator": "CVE-2025-14174", "type": "cve", "source": "cisa_kev,nist_nvd_recent", "first_seen": "2025-12-12T00:00:00Z", "last_seen": "2026-10-24T22:12:15Z", "confidence": "high", "score": 88, "sightings": 519, "tags": "cve,exploited-in-the-wild,high,nvd", "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "context": "Google Chromium contains an out of bounds memory access vulnerability in ANGLE that could allow a remote attacker to perform out of bounds memory access via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.", "tlp": "CLEAR", "score_factors": {"score": 88, "confidence_base": 80, "source_count": 2, "source_identifiers": ["cisa_kev", "nist_nvd_recent"], "reporting_groups": ["cisa", "nvd"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 8, "age_hours": 0.0, "half_life_hours": 8760.0, "decay_factor": 1.0}}
{"indicator": "CVE-2025-8110", "type": "cve", "source": "cisa_kev,nist_nvd_recent", "first_seen": "2025-12-10T14:16:19Z", "last_seen": "2026-10-24T22:12:15Z", "confidence": "high", "score": 88, "sightings": 519, "tags": "cve,exploited-in-the-wild,high,nvd", "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "context": "Gogs contains a path traversal vulnerability affecting improper Symbolic link handling in the PutContents API that could allow for code execution.", "tlp": "CLEAR", "score_factors": {"score": 88, "confidence_base": 80, "source_count": 2, "source_identifiers": ["cisa_kev", "nist_nvd_recent"], "reporting_groups": ["cisa", "nvd"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 8, "age_hours": 0.0, "half_life_hours": 8760.0, "decay_factor": 1.0}}
{"indicator": "CVE-2025-62221", "type": "cve", "source": "cisa_kev,nist_nvd_recent", "first_seen": "2025-12-09T00:00:00Z", "last_seen": "2026-10-24T22:12:15Z", "confidence": "high", "score": 88, "sightings": 519, "tags": "cve,exploited-in-the-wild,high,nvd", "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "context": "Microsoft Windows Cloud Files Mini Filter Driver contains a use after free vulnerability that can allow an authorized attacker to elevate privileges locally.", "tlp": "CLEAR", "score_factors": {"score": 88, "confidence_base": 80, "source_count": 2, "source_identifiers": ["cisa_kev", "nist_nvd_recent"], "reporting_groups": ["cisa", "nvd"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 8, "age_hours": 0.0, "half_life_hours": 8760.0, "decay_factor": 1.0}}
{"indicator": "CVE-2025-34291", "type": "cve", "source": "cisa_kev,nist_nvd_recent", "first_seen": "2025-12-05T23:15:47Z", "last_seen": "2026-10-24T22:12:15Z", "confidence": "high", "score": 88, "sightings": 519, "tags": "cve,exploited-in-the-wild,high,nvd", "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "context": "Langflow contains an origin validation error vulnerability in which an overly permissive CORS configuration combined with a refresh token cookie configured as SameSite=None allows a malicious webpage to perform cross-origin requests that include credentials and successfully call the refresh endpoint. This could allow the attacker to execute arbitrary code and achieve full system compromise via obtained tokens that permit access to authenticated endpoints.", "tlp": "CLEAR", "score_factors": {"score": 88, "confidence_base": 80, "source_count": 2, "source_identifiers": ["cisa_kev", "nist_nvd_recent"], "reporting_groups": ["cisa", "nvd"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 8, "age_hours": 0.0, "half_life_hours": 8760.0, "decay_factor": 1.0}}
{"indicator": "CVE-2025-55182", "type": "cve", "source": "cisa_kev,nist_nvd_recent", "first_seen": "2025-12-03T16:15:56Z", "last_seen": "2026-10-24T22:12:15Z", "confidence": "high", "score": 88, "sightings": 519, "tags": "critical,cve,exploited-in-the-wild,nvd", "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "context": "Meta React Server Components contains a remote code execution vulnerability that could allow unauthenticated remote code execution by exploiting a flaw in how React decodes payloads sent to React Server Function endpoints. Please note CVE-2025-66478 has been rejected, but it is associated with CVE-2025- 55182.", "tlp": "CLEAR", "score_factors": {"score": 88, "confidence_base": 80, "source_count": 2, "source_identifiers": ["cisa_kev", "nist_nvd_recent"], "reporting_groups": ["cisa", "nvd"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 8, "age_hours": 0.0, "half_life_hours": 8760.0, "decay_factor": 1.0}}
{"indicator": "CVE-2025-48633", "type": "cve", "source": "cisa_kev,nist_nvd_recent", "first_seen": "2025-12-02T00:00:00Z", "last_seen": "2026-10-24T22:12:15Z", "confidence": "high", "score": 88, "sightings": 519, "tags": "cve,exploited-in-the-wild,medium,nvd", "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "context": "Android Framework contains an unspecified vulnerability that allows for information disclosure.", "tlp": "CLEAR", "score_factors": {"score": 88, "confidence_base": 80, "source_count": 2, "source_identifiers": ["cisa_kev", "nist_nvd_recent"], "reporting_groups": ["cisa", "nvd"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 8, "age_hours": 0.0, "half_life_hours": 8760.0, "decay_factor": 1.0}}
{"indicator": "CVE-2025-48572", "type": "cve", "source": "cisa_kev,nist_nvd_recent", "first_seen": "2025-12-02T00:00:00Z", "last_seen": "2026-10-24T22:12:15Z", "confidence": "high", "score": 88, "sightings": 519, "tags": "cve,exploited-in-the-wild,high,nvd", "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "context": "Android Framework contains an unspecified vulnerability that allows for privilege escalation.", "tlp": "CLEAR", "score_factors": {"score": 88, "confidence_base": 80, "source_count": 2, "source_identifiers": ["cisa_kev", "nist_nvd_recent"], "reporting_groups": ["cisa", "nvd"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 8, "age_hours": 0.0, "half_life_hours": 8760.0, "decay_factor": 1.0}}
{"indicator": "CVE-2025-62593", "type": "cve", "source": "cisa_kev,nist_nvd_recent", "first_seen": "2025-11-26T23:15:47Z", "last_seen": "2026-10-24T22:12:15Z", "confidence": "high", "score": 88, "sightings": 332, "tags": "cve,exploited-in-the-wild,high,nvd", "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "context": "Ray-Project Ray contains a code injection vulnerability that could allow remote code execution. Developers using Ray as a development tool may be exposed to this vulnerability exploitable through Firefox and Safari.", "tlp": "CLEAR", "score_factors": {"score": 88, "confidence_base": 80, "source_count": 2, "source_identifiers": ["cisa_kev", "nist_nvd_recent"], "reporting_groups": ["cisa", "nvd"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 8, "age_hours": 0.0, "half_life_hours": 8760.0, "decay_factor": 1.0}}
{"indicator": "CVE-2025-58360", "type": "cve", "source": "cisa_kev,nist_nvd_recent", "first_seen": "2025-11-25T21:15:56Z", "last_seen": "2026-10-24T22:12:15Z", "confidence": "high", "score": 88, "sightings": 519, "tags": "cve,exploited-in-the-wild,high,nvd", "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "context": "OSGeo GeoServer contains an improper restriction of XML external entity reference vulnerability that occurs when the application accepts XML input through a specific endpoint /geoserver/wms operation GetMap and could allow an attacker to define external entities within the XML request.", "tlp": "CLEAR", "score_factors": {"score": 88, "confidence_base": 80, "source_count": 2, "source_identifiers": ["cisa_kev", "nist_nvd_recent"], "reporting_groups": ["cisa", "nvd"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 8, "age_hours": 0.0, "half_life_hours": 8760.0, "decay_factor": 1.0}}
{"indicator": "CVE-2025-58034", "type": "cve", "source": "cisa_kev,nist_nvd_recent", "first_seen": "2025-11-18T00:00:00Z", "last_seen": "2026-10-24T22:12:15Z", "confidence": "high", "score": 88, "sightings": 519, "tags": "cve,exploited-in-the-wild,high,nvd", "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "context": "Fortinet FortiWeb contains an OS command Injection vulnerability that may allow an authenticated attacker to execute unauthorized code on the underlying system via crafted HTTP requests or CLI commands.", "tlp": "CLEAR", "score_factors": {"score": 88, "confidence_base": 80, "source_count": 2, "source_identifiers": ["cisa_kev", "nist_nvd_recent"], "reporting_groups": ["cisa", "nvd"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 8, "age_hours": 0.0, "half_life_hours": 8760.0, "decay_factor": 1.0}}
{"indicator": "CVE-2025-64446", "type": "cve", "source": "cisa_kev,nist_nvd_recent", "first_seen": "2025-11-14T00:00:00Z", "last_seen": "2026-10-24T22:12:15Z", "confidence": "high", "score": 88, "sightings": 519, "tags": "critical,cve,exploited-in-the-wild,nvd", "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "context": "Fortinet FortiWeb contains a relative path traversal vulnerability that may allow an unauthenticated attacker to execute administrative commands on the system via crafted HTTP or HTTPS requests.", "tlp": "CLEAR", "score_factors": {"score": 88, "confidence_base": 80, "source_count": 2, "source_identifiers": ["cisa_kev", "nist_nvd_recent"], "reporting_groups": ["cisa", "nvd"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 8, "age_hours": 0.0, "half_life_hours": 8760.0, "decay_factor": 1.0}}
{"indicator": "CVE-2025-60710", "type": "cve", "source": "cisa_kev,nist_nvd_recent", "first_seen": "2025-11-11T18:15:39Z", "last_seen": "2026-10-24T22:12:15Z", "confidence": "high", "score": 88, "sightings": 519, "tags": "cve,exploited-in-the-wild,high,nvd", "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "context": "Microsoft Windows contains a link following vulnerability that allows for privilege escalation", "tlp": "CLEAR", "score_factors": {"score": 88, "confidence_base": 80, "source_count": 2, "source_identifiers": ["cisa_kev", "nist_nvd_recent"], "reporting_groups": ["cisa", "nvd"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 8, "age_hours": 0.0, "half_life_hours": 8760.0, "decay_factor": 1.0}}
{"indicator": "CVE-2025-12480", "type": "cve", "source": "cisa_kev,nist_nvd_recent", "first_seen": "2025-11-10T15:15:36Z", "last_seen": "2026-10-24T22:12:15Z", "confidence": "high", "score": 88, "sightings": 519, "tags": "critical,cve,exploited-in-the-wild,nvd", "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "context": "Gladinet Triofox contains an improper access control vulnerability that allows access to initial setup pages even after setup is complete.", "tlp": "CLEAR", "score_factors": {"score": 88, "confidence_base": 80, "source_count": 2, "source_identifiers": ["cisa_kev", "nist_nvd_recent"], "reporting_groups": ["cisa", "nvd"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 8, "age_hours": 0.0, "half_life_hours": 8760.0, "decay_factor": 1.0}}
{"indicator": "CVE-2023-43000", "type": "cve", "source": "cisa_kev,nist_nvd_recent", "first_seen": "2025-11-05T19:15:47Z", "last_seen": "2026-10-24T22:12:15Z", "confidence": "high", "score": 88, "sightings": 519, "tags": "cve,exploited-in-the-wild,high,nvd", "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "context": "Apple macOS, iOS, iPadOS, and Safari 16.6 contain a use-after-free vulnerability due to the processing of maliciously crafted web content that may lead to memory corruption.", "tlp": "CLEAR", "score_factors": {"score": 88, "confidence_base": 80, "source_count": 2, "source_identifiers": ["cisa_kev", "nist_nvd_recent"], "reporting_groups": ["cisa", "nvd"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 8, "age_hours": 0.0, "half_life_hours": 8760.0, "decay_factor": 1.0}}
{"indicator": "CVE-2025-61757", "type": "cve", "source": "cisa_kev,nist_nvd_recent", "first_seen": "2025-10-21T20:20:52Z", "last_seen": "2026-10-24T22:12:15Z", "confidence": "high", "score": 88, "sightings": 519, "tags": "critical,cve,exploited-in-the-wild,nvd", "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "context": "Oracle Fusion Middleware contains a missing authentication for critical function vulnerability, allowing unauthenticated remote attackers to take over Identity Manager.", "tlp": "CLEAR", "score_factors": {"score": 88, "confidence_base": 80, "source_count": 2, "source_identifiers": ["cisa_kev", "nist_nvd_recent"], "reporting_groups": ["cisa", "nvd"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 8, "age_hours": 0.0, "half_life_hours": 8760.0, "decay_factor": 1.0}}
{"indicator": "CVE-2025-61932", "type": "cve", "source": "cisa_kev,nist_nvd_recent", "first_seen": "2025-10-20T08:15:33Z", "last_seen": "2026-10-24T22:12:15Z", "confidence": "high", "score": 88, "sightings": 519, "tags": "critical,cve,exploited-in-the-wild,nvd", "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "context": "Motex LANSCOPE Endpoint Manager contains an improper verification of source of a communication channel vulnerability allowing an attacker to execute arbitrary code by sending specially crafted packets.", "tlp": "CLEAR", "score_factors": {"score": 88, "confidence_base": 80, "source_count": 2, "source_identifiers": ["cisa_kev", "nist_nvd_recent"], "reporting_groups": ["cisa", "nvd"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 8, "age_hours": 0.0, "half_life_hours": 8760.0, "decay_factor": 1.0}}
{"indicator": "CVE-2025-53521", "type": "cve", "source": "cisa_kev,nist_nvd_recent", "first_seen": "2025-10-15T14:15:48Z", "last_seen": "2026-10-24T22:12:15Z", "confidence": "high", "score": 88, "sightings": 519, "tags": "critical,cve,exploited-in-the-wild,nvd", "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "context": "F5 BIG-IP APM contains a stack-based buffer overflow vulnerability that could allow a threat actor to achieve remote code execution.", "tlp": "CLEAR", "score_factors": {"score": 88, "confidence_base": 80, "source_count": 2, "source_identifiers": ["cisa_kev", "nist_nvd_recent"], "reporting_groups": ["cisa", "nvd"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 8, "age_hours": 0.0, "half_life_hours": 8760.0, "decay_factor": 1.0}}
{"indicator": "CVE-2025-39964", "type": "cve", "source": "cisa_kev,nist_nvd_recent", "first_seen": "2025-10-13T14:15:34Z", "last_seen": "2026-10-24T22:12:15Z", "confidence": "high", "score": 88, "sightings": 168, "tags": "cve,exploited-in-the-wild,high,nvd", "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "context": "Linux Kernel contains a race condition vulnerability which allows concurrent writes to the same AF_ALG socket causing data to be unpredictably interleaved and creating inconsistencies in the socket's internal state.", "tlp": "CLEAR", "score_factors": {"score": 88, "confidence_base": 80, "source_count": 2, "source_identifiers": ["cisa_kev", "nist_nvd_recent"], "reporting_groups": ["cisa", "nvd"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 8, "age_hours": 0.0, "half_life_hours": 8760.0, "decay_factor": 1.0}}
{"indicator": "CVE-2025-61884", "type": "cve", "source": "cisa_kev,nist_nvd_recent", "first_seen": "2025-10-12T03:15:34Z", "last_seen": "2026-10-24T22:12:15Z", "confidence": "high", "score": 88, "sightings": 519, "tags": "cve,exploited-in-the-wild,high,nvd", "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "context": "Oracle E-Business Suite contains a server-side request forgery (SSRF) vulnerability in the Runtime component of Oracle Configurator. This vulnerability is remotely exploitable without authentication.", "tlp": "CLEAR", "score_factors": {"score": 88, "confidence_base": 80, "source_count": 2, "source_identifiers": ["cisa_kev", "nist_nvd_recent"], "reporting_groups": ["cisa", "nvd"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 8, "age_hours": 0.0, "half_life_hours": 8760.0, "decay_factor": 1.0}}
{"indicator": "CVE-2025-11371", "type": "cve", "source": "cisa_kev,nist_nvd_recent", "first_seen": "2025-10-09T17:15:58Z", "last_seen": "2026-10-24T22:12:15Z", "confidence": "high", "score": 88, "sightings": 519, "tags": "cve,exploited-in-the-wild,high,nvd", "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "context": "Gladinet CentreStack and Triofox contains a files or directories accessible to external parties vulnerability that allows unintended disclosure of system files.", "tlp": "CLEAR", "score_factors": {"score": 88, "confidence_base": 80, "source_count": 2, "source_identifiers": ["cisa_kev", "nist_nvd_recent"], "reporting_groups": ["cisa", "nvd"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 8, "age_hours": 0.0, "half_life_hours": 8760.0, "decay_factor": 1.0}}
{"indicator": "CVE-2021-43226", "type": "cve", "source": "cisa_kev,nist_nvd_recent", "first_seen": "2025-10-06T00:00:00Z", "last_seen": "2026-10-24T22:12:15Z", "confidence": "high", "score": 88, "sightings": 519, "tags": "cve,exploited-in-the-wild,high,nvd", "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "context": "Microsoft Windows Common Log File System Driver contains a privilege escalation vulnerability that could allow a local, privileged attacker to bypass certain security mechanisms.", "tlp": "CLEAR", "score_factors": {"score": 88, "confidence_base": 80, "source_count": 2, "source_identifiers": ["cisa_kev", "nist_nvd_recent"], "reporting_groups": ["cisa", "nvd"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 8, "age_hours": 0.0, "half_life_hours": 8760.0, "decay_factor": 1.0}}
{"indicator": "CVE-2025-61882", "type": "cve", "source": "cisa_kev,nist_nvd_recent", "first_seen": "2025-10-05T04:15:40Z", "last_seen": "2026-10-24T22:12:15Z", "confidence": "high", "score": 88, "sightings": 519, "tags": "critical,cve,exploited-in-the-wild,nvd", "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "context": "Oracle E-Business Suite contains an unspecified vulnerability in the BI Publisher Integration component. The vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Concurrent Processing. Successful attacks can result in takeover of Oracle Concurrent Processing.", "tlp": "CLEAR", "score_factors": {"score": 88, "confidence_base": 80, "source_count": 2, "source_identifiers": ["cisa_kev", "nist_nvd_recent"], "reporting_groups": ["cisa", "nvd"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 8, "age_hours": 0.0, "half_life_hours": 8760.0, "decay_factor": 1.0}}
{"indicator": "CVE-2025-41244", "type": "cve", "source": "cisa_kev,nist_nvd_recent", "first_seen": "2025-09-29T17:15:30Z", "last_seen": "2026-10-24T22:12:15Z", "confidence": "high", "score": 88, "sightings": 519, "tags": "cve,exploited-in-the-wild,high,nvd", "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "context": "Broadcom VMware Aria Operations and VMware Tools contain a privilege defined with unsafe actions vulnerability. A malicious local actor with non-administrative privileges having access to a VM with VMware Tools installed and managed by Aria Operations with SDMP enabled may exploit this vulnerability to escalate privileges to root on the same VM.", "tlp": "CLEAR", "score_factors": {"score": 88, "confidence_base": 80, "source_count": 2, "source_identifiers": ["cisa_kev", "nist_nvd_recent"], "reporting_groups": ["cisa", "nvd"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 8, "age_hours": 0.0, "half_life_hours": 8760.0, "decay_factor": 1.0}}
{"indicator": "CVE-2025-20362", "type": "cve", "source": "cisa_kev,nist_nvd_recent", "first_seen": "2025-09-25T00:00:00Z", "last_seen": "2026-10-24T22:12:15Z", "confidence": "high", "score": 88, "sightings": 519, "tags": "cve,exploited-in-the-wild,medium,nvd", "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "context": "Cisco Secure Firewall Adaptive Security (ASA) Appliance and Secure Firewall Threat Defense (FTD) Software VPN Web Server contain a missing authorization vulnerability. This vulnerability could be chained with CVE-2025-20333.", "tlp": "CLEAR", "score_factors": {"score": 88, "confidence_base": 80, "source_count": 2, "source_identifiers": ["cisa_kev", "nist_nvd_recent"], "reporting_groups": ["cisa", "nvd"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 8, "age_hours": 0.0, "half_life_hours": 8760.0, "decay_factor": 1.0}}
{"indicator": "CVE-2025-20333", "type": "cve", "source": "cisa_kev,nist_nvd_recent", "first_seen": "2025-09-25T00:00:00Z", "last_seen": "2026-10-24T22:12:15Z", "confidence": "high", "score": 88, "sightings": 519, "tags": "critical,cve,exploited-in-the-wild,nvd", "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "context": "Cisco Secure Firewall Adaptive Security (ASA) Appliance and Secure Firewall Threat Defense (FTD) Software VPN Web Server contain a buffer overflow vulnerability that allows for remote code execution. This vulnerability could be chained with CVE-2025-20362.", "tlp": "CLEAR", "score_factors": {"score": 88, "confidence_base": 80, "source_count": 2, "source_identifiers": ["cisa_kev", "nist_nvd_recent"], "reporting_groups": ["cisa", "nvd"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 8, "age_hours": 0.0, "half_life_hours": 8760.0, "decay_factor": 1.0}}
{"indicator": "CVE-2025-20352", "type": "cve", "source": "cisa_kev,nist_nvd_recent", "first_seen": "2025-09-24T18:15:36Z", "last_seen": "2026-10-24T22:12:15Z", "confidence": "high", "score": 88, "sightings": 519, "tags": "cve,exploited-in-the-wild,high,nvd", "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "context": "Cisco IOS and IOS XE contains a stack-based buffer overflow vulnerability in the Simple Network Management Protocol (SNMP) subsystem that could allow for denial of service or remote code execution. A successful exploit could allow a low-privileged attacker to cause the affected system to reload, resulting in a DoS condition, or allow a high-privileged attacker to execute arbitrary code as the root user and obtain full control of the affected system.", "tlp": "CLEAR", "score_factors": {"score": 88, "confidence_base": 80, "source_count": 2, "source_identifiers": ["cisa_kev", "nist_nvd_recent"], "reporting_groups": ["cisa", "nvd"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 8, "age_hours": 0.0, "half_life_hours": 8760.0, "decay_factor": 1.0}}
{"indicator": "CVE-2025-26399", "type": "cve", "source": "cisa_kev,nist_nvd_recent", "first_seen": "2025-09-23T05:15:35Z", "last_seen": "2026-10-24T22:12:15Z", "confidence": "high", "score": 88, "sightings": 519, "tags": "critical,cve,exploited-in-the-wild,nvd", "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "context": "SolarWinds Web Help Desk contain a deserialization of untrusted data vulnerability in AjaxProxy that could allow an attacker to run commands on the host machine.", "tlp": "CLEAR", "score_factors": {"score": 88, "confidence_base": 80, "source_count": 2, "source_identifiers": ["cisa_kev", "nist_nvd_recent"], "reporting_groups": ["cisa", "nvd"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 8, "age_hours": 0.0, "half_life_hours": 8760.0, "decay_factor": 1.0}}
{"indicator": "CVE-2025-10035", "type": "cve", "source": "cisa_kev,nist_nvd_recent", "first_seen": "2025-09-18T22:15:41Z", "last_seen": "2026-10-24T22:12:15Z", "confidence": "high", "score": 88, "sightings": 519, "tags": "critical,cve,exploited-in-the-wild,nvd", "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "context": "Fortra GoAnywhere MFT contains a deserialization of untrusted data vulnerability allows an actor with a validly forged license response signature to deserialize an arbitrary actor-controlled object, possibly leading to command injection.", "tlp": "CLEAR", "score_factors": {"score": 88, "confidence_base": 80, "source_count": 2, "source_identifiers": ["cisa_kev", "nist_nvd_recent"], "reporting_groups": ["cisa", "nvd"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 8, "age_hours": 0.0, "half_life_hours": 8760.0, "decay_factor": 1.0}}
{"indicator": "CVE-2025-21043", "type": "cve", "source": "cisa_kev,nist_nvd_recent", "first_seen": "2025-09-12T08:15:44Z", "last_seen": "2026-10-24T22:12:15Z", "confidence": "high", "score": 88, "sightings": 519, "tags": "cve,exploited-in-the-wild,high,nvd", "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "context": "Samsung mobile devices contain an out-of-bounds write vulnerability in libimagecodec.quram.so which allows remote attackers to execute arbitrary code.", "tlp": "CLEAR", "score_factors": {"score": 88, "confidence_base": 80, "source_count": 2, "source_identifiers": ["cisa_kev", "nist_nvd_recent"], "reporting_groups": ["cisa", "nvd"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 8, "age_hours": 0.0, "half_life_hours": 8760.0, "decay_factor": 1.0}}
{"indicator": "CVE-2025-21042", "type": "cve", "source": "cisa_kev,nist_nvd_recent", "first_seen": "2025-09-12T08:15:44Z", "last_seen": "2026-10-24T22:12:15Z", "confidence": "high", "score": 88, "sightings": 519, "tags": "cve,exploited-in-the-wild,high,nvd", "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "context": "Samsung mobile devices contain an out-of-bounds write vulnerability in libimagecodec.quram.so. This vulnerability could allow remote attackers to execute arbitrary code.", "tlp": "CLEAR", "score_factors": {"score": 88, "confidence_base": 80, "source_count": 2, "source_identifiers": ["cisa_kev", "nist_nvd_recent"], "reporting_groups": ["cisa", "nvd"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 8, "age_hours": 0.0, "half_life_hours": 8760.0, "decay_factor": 1.0}}
{"indicator": "CVE-2025-39682", "type": "cve", "source": "cisa_kev,nist_nvd_recent", "first_seen": "2025-09-05T18:15:44Z", "last_seen": "2026-10-24T22:12:15Z", "confidence": "high", "score": 88, "sightings": 166, "tags": "critical,cve,exploited-in-the-wild,nvd", "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "context": "Linux Kernel contains an improper check for unusual or exceptional conditions vulnerability in the TLS receive path which allows a zero-length record retrieved from the rx_list to bypass the intended recvmsg() record-type handling, potentially causing subsequent TLS records to be processed using incorrect zero-copy and queuing assumptions. The impacted product(s) could be end-of-life (EoL) and/or end-of-service (EoS). Users are advised to discontinue use and/or transition to a supported version.", "tlp": "CLEAR", "score_factors": {"score": 88, "confidence_base": 80, "source_count": 2, "source_identifiers": ["cisa_kev", "nist_nvd_recent"], "reporting_groups": ["cisa", "nvd"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 8, "age_hours": 0.0, "half_life_hours": 8760.0, "decay_factor": 1.0}}
{"indicator": "CVE-2025-53690", "type": "cve", "source": "cisa_kev,nist_nvd_recent", "first_seen": "2025-09-03T20:15:33Z", "last_seen": "2026-10-24T22:12:15Z", "confidence": "high", "score": 88, "sightings": 519, "tags": "critical,cve,exploited-in-the-wild,nvd", "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "context": "Sitecore Experience Manager (XM), Experience Platform (XP), Experience Commerce (XC), and Managed Cloud contain a deserialization of untrusted data vulnerability involving the use of default machine keys. This flaw allows attackers to exploit exposed ASP.NET machine keys to achieve remote code execution. ", "tlp": "CLEAR", "score_factors": {"score": 88, "confidence_base": 80, "source_count": 2, "source_identifiers": ["cisa_kev", "nist_nvd_recent"], "reporting_groups": ["cisa", "nvd"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 8, "age_hours": 0.0, "half_life_hours": 8760.0, "decay_factor": 1.0}}
{"indicator": "CVE-2023-50224", "type": "cve", "source": "cisa_kev,nist_nvd_recent", "first_seen": "2025-09-03T00:00:00Z", "last_seen": "2026-10-24T22:12:15Z", "confidence": "high", "score": 88, "sightings": 519, "tags": "cve,exploited-in-the-wild,medium,nvd", "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "context": "TP-Link TL-WR841N contains an authentication bypass by spoofing vulnerability within the httpd service, which listens on TCP port 80 by default, leading to the disclose of stored credentials. The impacted products could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization.", "tlp": "CLEAR", "score_factors": {"score": 88, "confidence_base": 80, "source_count": 2, "source_identifiers": ["cisa_kev", "nist_nvd_recent"], "reporting_groups": ["cisa", "nvd"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 8, "age_hours": 0.0, "half_life_hours": 8760.0, "decay_factor": 1.0}}
{"indicator": "CVE-2025-9377", "type": "cve", "source": "cisa_kev,nist_nvd_recent", "first_seen": "2025-08-29T18:15:43Z", "last_seen": "2026-10-24T22:12:15Z", "confidence": "high", "score": 88, "sightings": 519, "tags": "cve,exploited-in-the-wild,high,nvd", "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "context": "TP-Link Archer C7(EU) and TL-WR841N/ND(MS) contain an OS command injection vulnerability that exists in the Parental Control page. The impacted products could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization.", "tlp": "CLEAR", "score_factors": {"score": 88, "confidence_base": 80, "source_count": 2, "source_identifiers": ["cisa_kev", "nist_nvd_recent"], "reporting_groups": ["cisa", "nvd"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 8, "age_hours": 0.0, "half_life_hours": 8760.0, "decay_factor": 1.0}}
{"indicator": "CVE-2025-55177", "type": "cve", "source": "cisa_kev,nist_nvd_recent", "first_seen": "2025-08-29T16:15:36Z", "last_seen": "2026-10-24T22:12:15Z", "confidence": "high", "score": 88, "sightings": 519, "tags": "cve,exploited-in-the-wild,medium,nvd", "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "context": "Meta Platforms WhatsApp contains an incorrect authorization vulnerability due to an incomplete authorization of linked device synchronization messages. This vulnerability could allow an unrelated user to trigger processing of content from an arbitrary URL on a target’s device.", "tlp": "CLEAR", "score_factors": {"score": 88, "confidence_base": 80, "source_count": 2, "source_identifiers": ["cisa_kev", "nist_nvd_recent"], "reporting_groups": ["cisa", "nvd"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 8, "age_hours": 0.0, "half_life_hours": 8760.0, "decay_factor": 1.0}}
{"indicator": "CVE-2025-57819", "type": "cve", "source": "cisa_kev,nist_nvd_recent", "first_seen": "2025-08-28T17:15:36Z", "last_seen": "2026-10-24T22:12:15Z", "confidence": "high", "score": 88, "sightings": 519, "tags": "critical,cve,exploited-in-the-wild,nvd", "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "context": "Sangoma FreePBX contains an authentication bypass vulnerability due to insufficiently sanitized user-supplied data allows unauthenticated access to FreePBX Administrator leading to arbitrary database manipulation and remote code execution.", "tlp": "CLEAR", "score_factors": {"score": 88, "confidence_base": 80, "source_count": 2, "source_identifiers": ["cisa_kev", "nist_nvd_recent"], "reporting_groups": ["cisa", "nvd"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 8, "age_hours": 0.0, "half_life_hours": 8760.0, "decay_factor": 1.0}}
{"indicator": "CVE-2025-8875", "type": "cve", "source": "cisa_kev,nist_nvd_recent", "first_seen": "2025-08-13T00:00:00Z", "last_seen": "2026-10-24T22:12:15Z", "confidence": "high", "score": 88, "sightings": 519, "tags": "cve,exploited-in-the-wild,high,nvd", "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "context": "N-able N-Central contains an insecure deserialization vulnerability that could lead to command execution.", "tlp": "CLEAR", "score_factors": {"score": 88, "confidence_base": 80, "source_count": 2, "source_identifiers": ["cisa_kev", "nist_nvd_recent"], "reporting_groups": ["cisa", "nvd"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 8, "age_hours": 0.0, "half_life_hours": 8760.0, "decay_factor": 1.0}}
{"indicator": "CVE-2025-31277", "type": "cve", "source": "cisa_kev,nist_nvd_recent", "first_seen": "2025-07-30T00:15:30Z", "last_seen": "2026-10-24T22:12:15Z", "confidence": "high", "score": 88, "sightings": 519, "tags": "cve,exploited-in-the-wild,high,nvd", "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "context": "Apple Safari, iOS, watchOS, visionOS, iPadOS, macOS, and tvOS contain a buffer overflow vulnerability that could allow the processing of maliciously crafted web content which may lead to memory corruption.", "tlp": "CLEAR", "score_factors": {"score": 88, "confidence_base": 80, "source_count": 2, "source_identifiers": ["cisa_kev", "nist_nvd_recent"], "reporting_groups": ["cisa", "nvd"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 8, "age_hours": 0.0, "half_life_hours": 8760.0, "decay_factor": 1.0}}
{"indicator": "CVE-2025-38352", "type": "cve", "source": "cisa_kev,nist_nvd_recent", "first_seen": "2025-07-22T08:15:23Z", "last_seen": "2026-10-24T22:12:15Z", "confidence": "high", "score": 88, "sightings": 519, "tags": "cve,exploited-in-the-wild,high,nvd", "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "context": "Linux kernel contains a time-of-check time-of-use (TOCTOU) race condition vulnerability that has a high impact on confidentiality, integrity, and availability.", "tlp": "CLEAR", "score_factors": {"score": 88, "confidence_base": 80, "source_count": 2, "source_identifiers": ["cisa_kev", "nist_nvd_recent"], "reporting_groups": ["cisa", "nvd"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 8, "age_hours": 0.0, "half_life_hours": 8760.0, "decay_factor": 1.0}}
{"indicator": "CVE-2025-49706", "type": "cve", "source": "cisa_kev,nist_nvd_recent", "first_seen": "2025-07-22T00:00:00Z", "last_seen": "2026-10-24T22:12:15Z", "confidence": "high", "score": 88, "sightings": 519, "tags": "cve,exploited-in-the-wild,medium,nvd", "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "context": "Microsoft SharePoint contains an improper authentication vulnerability that allows an authorized attacker to perform spoofing over a network. Successfully exploitation could allow an attacker to view sensitive information and make some changes to disclosed information. This vulnerability could be chained with CVE-2025-49704. CVE-2025-53771 is a patch bypass for CVE-2025-49706, and the updates for CVE-2025-53771 include more robust protection than those for CVE-2025-49706.", "tlp": "CLEAR", "score_factors": {"score": 88, "confidence_base": 80, "source_count": 2, "source_identifiers": ["cisa_kev", "nist_nvd_recent"], "reporting_groups": ["cisa", "nvd"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 8, "age_hours": 0.0, "half_life_hours": 8760.0, "decay_factor": 1.0}}
{"indicator": "CVE-2025-53770", "type": "cve", "source": "cisa_kev,nist_nvd_recent", "first_seen": "2025-07-20T00:00:00Z", "last_seen": "2026-10-24T22:12:15Z", "confidence": "high", "score": 88, "sightings": 519, "tags": "critical,cve,exploited-in-the-wild,nvd", "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "context": "Microsoft SharePoint Server on-premises contains a deserialization of untrusted data vulnerability that could allow an unauthorized attacker to execute code over a network. This vulnerability could be chained with CVE-2025-53771. CVE-2025-53770 is a patch bypass for CVE-2025-49704, and the updates for CVE-2025-53770 include more robust protection than those for CVE-2025-49704.", "tlp": "CLEAR", "score_factors": {"score": 88, "confidence_base": 80, "source_count": 2, "source_identifiers": ["cisa_kev", "nist_nvd_recent"], "reporting_groups": ["cisa", "nvd"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 8, "age_hours": 0.0, "half_life_hours": 8760.0, "decay_factor": 1.0}}
{"indicator": "CVE-2025-6558", "type": "cve", "source": "cisa_kev,nist_nvd_recent", "first_seen": "2025-07-15T18:15:24Z", "last_seen": "2026-10-24T22:12:15Z", "confidence": "high", "score": 88, "sightings": 519, "tags": "cve,exploited-in-the-wild,high,nvd", "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "context": "Google Chromium contains an improper input validation vulnerability in ANGLE and GPU. This vulnerability could allow a remote attacker to potentially perform a sandbox escape via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.", "tlp": "CLEAR", "score_factors": {"score": 88, "confidence_base": 80, "source_count": 2, "source_identifiers": ["cisa_kev", "nist_nvd_recent"], "reporting_groups": ["cisa", "nvd"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 8, "age_hours": 0.0, "half_life_hours": 8760.0, "decay_factor": 1.0}}
{"indicator": "CVE-2025-48384", "type": "cve", "source": "cisa_kev,nist_nvd_recent", "first_seen": "2025-07-08T19:15:42Z", "last_seen": "2026-10-24T22:12:15Z", "confidence": "high", "score": 88, "sightings": 519, "tags": "cve,exploited-in-the-wild,high,nvd", "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "context": "Git contains a link following vulnerability that stems from Git’s inconsistent handling of carriage return characters in configuration files.", "tlp": "CLEAR", "score_factors": {"score": 88, "confidence_base": 80, "source_count": 2, "source_identifiers": ["cisa_kev", "nist_nvd_recent"], "reporting_groups": ["cisa", "nvd"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 8, "age_hours": 0.0, "half_life_hours": 8760.0, "decay_factor": 1.0}}
{"indicator": "CVE-2019-6693", "type": "cve", "source": "cisa_kev,nist_nvd_recent", "first_seen": "2025-06-25T00:00:00Z", "last_seen": "2026-10-24T22:12:15Z", "confidence": "high", "score": 88, "sightings": 519, "tags": "cve,exploited-in-the-wild,medium,nvd", "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "context": "Fortinet FortiOS contains a use of hard-coded credentials vulnerability that could allow an attacker to cipher sensitive data in FortiOS configuration backup file via knowledge of the hard-coded key. ", "tlp": "CLEAR", "score_factors": {"score": 88, "confidence_base": 80, "source_count": 2, "source_identifiers": ["cisa_kev", "nist_nvd_recent"], "reporting_groups": ["cisa", "nvd"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 8, "age_hours": 0.0, "half_life_hours": 8760.0, "decay_factor": 1.0}}
{"indicator": "CVE-2025-5777", "type": "cve", "source": "cisa_kev,nist_nvd_recent", "first_seen": "2025-06-17T13:15:21Z", "last_seen": "2026-10-24T22:12:15Z", "confidence": "high", "score": 88, "sightings": 519, "tags": "cve,exploited-in-the-wild,high,nvd", "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "context": "Citrix NetScaler ADC and Gateway contain an out-of-bounds read vulnerability due to insufficient input validation. This vulnerability can lead to memory overread when the NetScaler is configured as a Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) OR AAA virtual server.", "tlp": "CLEAR", "score_factors": {"score": 88, "confidence_base": 80, "source_count": 2, "source_identifiers": ["cisa_kev", "nist_nvd_recent"], "reporting_groups": ["cisa", "nvd"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 8, "age_hours": 0.0, "half_life_hours": 8760.0, "decay_factor": 1.0}}
{"indicator": "CVE-2025-43200", "type": "cve", "source": "cisa_kev,nist_nvd_recent", "first_seen": "2025-06-16T00:00:00Z", "last_seen": "2026-10-24T22:12:15Z", "confidence": "high", "score": 88, "sightings": 519, "tags": "cve,exploited-in-the-wild,medium,nvd", "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "context": "Apple iOS, iPadOS, macOS, watchOS, and visionOS, contain an unspecified vulnerability when processing a maliciously crafted photo or video shared via an iCloud Link.", "tlp": "CLEAR", "score_factors": {"score": 88, "confidence_base": 80, "source_count": 2, "source_identifiers": ["cisa_kev", "nist_nvd_recent"], "reporting_groups": ["cisa", "nvd"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 8, "age_hours": 0.0, "half_life_hours": 8760.0, "decay_factor": 1.0}}
{"indicator": "CVE-2025-31324", "type": "cve", "source": "cisa_kev,nist_nvd_recent", "first_seen": "2025-04-29T00:00:00Z", "last_seen": "2026-10-24T22:12:15Z", "confidence": "high", "score": 88, "sightings": 519, "tags": "critical,cve,exploited-in-the-wild,nvd", "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "context": "SAP NetWeaver Visual Composer Metadata Uploader contains an unrestricted file upload vulnerability that allows an unauthenticated agent to upload potentially malicious executable binaries.", "tlp": "CLEAR", "score_factors": {"score": 88, "confidence_base": 80, "source_count": 2, "source_identifiers": ["cisa_kev", "nist_nvd_recent"], "reporting_groups": ["cisa", "nvd"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 8, "age_hours": 0.0, "half_life_hours": 8760.0, "decay_factor": 1.0}}
{"indicator": "CVE-2025-3928", "type": "cve", "source": "cisa_kev,nist_nvd_recent", "first_seen": "2025-04-25T16:15:27Z", "last_seen": "2026-10-24T22:12:15Z", "confidence": "high", "score": 88, "sightings": 519, "tags": "cve,exploited-in-the-wild,high,nvd", "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "context": "Commvault Web Server contains an unspecified vulnerability that allows a remote, authenticated attacker to create and execute webshells.", "tlp": "CLEAR", "score_factors": {"score": 88, "confidence_base": 80, "source_count": 2, "source_identifiers": ["cisa_kev", "nist_nvd_recent"], "reporting_groups": ["cisa", "nvd"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 8, "age_hours": 0.0, "half_life_hours": 8760.0, "decay_factor": 1.0}}
{"indicator": "CVE-2025-32432", "type": "cve", "source": "cisa_kev,nist_nvd_recent", "first_seen": "2025-04-25T15:15:36Z", "last_seen": "2026-10-24T22:12:15Z", "confidence": "high", "score": 88, "sightings": 519, "tags": "critical,cve,exploited-in-the-wild,nvd", "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "context": "Craft CMS contains a code injection vulnerability that allows a remote attacker to execute arbitrary code.", "tlp": "CLEAR", "score_factors": {"score": 88, "confidence_base": 80, "source_count": 2, "source_identifiers": ["cisa_kev", "nist_nvd_recent"], "reporting_groups": ["cisa", "nvd"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 8, "age_hours": 0.0, "half_life_hours": 8760.0, "decay_factor": 1.0}}
{"indicator": "CVE-2025-42599", "type": "cve", "source": "cisa_kev,nist_nvd_recent", "first_seen": "2025-04-18T04:15:30Z", "last_seen": "2026-10-24T22:12:15Z", "confidence": "high", "score": 88, "sightings": 519, "tags": "critical,cve,exploited-in-the-wild,nvd", "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "context": "Qualitia Active! Mail contains a stack-based buffer overflow vulnerability that allows a remote, unauthenticated attacker to execute arbitrary or trigger a denial-of-service via a specially crafted request.", "tlp": "CLEAR", "score_factors": {"score": 88, "confidence_base": 80, "source_count": 2, "source_identifiers": ["cisa_kev", "nist_nvd_recent"], "reporting_groups": ["cisa", "nvd"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 8, "age_hours": 0.0, "half_life_hours": 8760.0, "decay_factor": 1.0}}
{"indicator": "CVE-2025-3248", "type": "cve", "source": "cisa_kev,nist_nvd_recent", "first_seen": "2025-04-07T15:15:44Z", "last_seen": "2026-10-24T22:12:15Z", "confidence": "high", "score": 88, "sightings": 519, "tags": "critical,cve,exploited-in-the-wild,nvd", "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "context": "Langflow contains a missing authentication vulnerability in the /api/v1/validate/code endpoint that allows a remote, unauthenticated attacker to execute arbitrary code via crafted HTTP requests.", "tlp": "CLEAR", "score_factors": {"score": 88, "confidence_base": 80, "source_count": 2, "source_identifiers": ["cisa_kev", "nist_nvd_recent"], "reporting_groups": ["cisa", "nvd"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 8, "age_hours": 0.0, "half_life_hours": 8760.0, "decay_factor": 1.0}}
{"indicator": "CVE-2025-22457", "type": "cve", "source": "cisa_kev,nist_nvd_recent", "first_seen": "2025-04-04T00:00:00Z", "last_seen": "2026-10-24T22:12:15Z", "confidence": "high", "score": 88, "sightings": 519, "tags": "critical,cve,exploited-in-the-wild,nvd", "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "context": "Ivanti Connect Secure, Policy Secure, and ZTA Gateways contains a stack-based buffer overflow vulnerability that allows a remote unauthenticated attacker to achieve remote code execution. ", "tlp": "CLEAR", "score_factors": {"score": 88, "confidence_base": 80, "source_count": 2, "source_identifiers": ["cisa_kev", "nist_nvd_recent"], "reporting_groups": ["cisa", "nvd"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 8, "age_hours": 0.0, "half_life_hours": 8760.0, "decay_factor": 1.0}}
{"indicator": "CVE-2025-24472", "type": "cve", "source": "cisa_kev,nist_nvd_recent", "first_seen": "2025-03-18T00:00:00Z", "last_seen": "2026-10-24T22:12:15Z", "confidence": "high", "score": 88, "sightings": 519, "tags": "cve,exploited-in-the-wild,high,nvd", "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "context": " Fortinet FortiOS and FortiProxy contain an authentication bypass vulnerability that allows a remote attacker to gain super-admin privileges via crafted CSF proxy requests.", "tlp": "CLEAR", "score_factors": {"score": 88, "confidence_base": 80, "source_count": 2, "source_identifiers": ["cisa_kev", "nist_nvd_recent"], "reporting_groups": ["cisa", "nvd"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 8, "age_hours": 0.0, "half_life_hours": 8760.0, "decay_factor": 1.0}}
{"indicator": "CVE-2025-30066", "type": "cve", "source": "cisa_kev,nist_nvd_recent", "first_seen": "2025-03-15T06:15:12Z", "last_seen": "2026-10-24T22:12:15Z", "confidence": "high", "score": 88, "sightings": 519, "tags": "cve,exploited-in-the-wild,high,nvd", "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "context": "tj-actions/changed-files GitHub Action contains an embedded malicious code vulnerability that allows a remote attacker to discover secrets by reading Github Actions Workflow Logs. These secrets may include, but are not limited to, valid AWS access keys, GitHub personal access tokens (PATs), npm tokens, and private RSA keys.", "tlp": "CLEAR", "score_factors": {"score": 88, "confidence_base": 80, "source_count": 2, "source_identifiers": ["cisa_kev", "nist_nvd_recent"], "reporting_groups": ["cisa", "nvd"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 8, "age_hours": 0.0, "half_life_hours": 8760.0, "decay_factor": 1.0}}
{"indicator": "CVE-2025-21590", "type": "cve", "source": "cisa_kev,nist_nvd_recent", "first_seen": "2025-03-12T14:15:15Z", "last_seen": "2026-10-24T22:12:15Z", "confidence": "high", "score": 88, "sightings": 519, "tags": "cve,exploited-in-the-wild,medium,nvd", "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "context": "Juniper Junos OS contains an improper isolation or compartmentalization vulnerability. This vulnerability could allows a local attacker with high privileges to inject arbitrary code.", "tlp": "CLEAR", "score_factors": {"score": 88, "confidence_base": 80, "source_count": 2, "source_identifiers": ["cisa_kev", "nist_nvd_recent"], "reporting_groups": ["cisa", "nvd"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 8, "age_hours": 0.0, "half_life_hours": 8760.0, "decay_factor": 1.0}}
{"indicator": "CVE-2025-26633", "type": "cve", "source": "cisa_kev,nist_nvd_recent", "first_seen": "2025-03-11T00:00:00Z", "last_seen": "2026-10-24T22:12:15Z", "confidence": "high", "score": 88, "sightings": 519, "tags": "cve,exploited-in-the-wild,high,nvd", "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "context": "Microsoft Windows Management Console (MMC) contains an improper neutralization vulnerability that allows an unauthorized attacker to bypass a security feature locally.", "tlp": "CLEAR", "score_factors": {"score": 88, "confidence_base": 80, "source_count": 2, "source_identifiers": ["cisa_kev", "nist_nvd_recent"], "reporting_groups": ["cisa", "nvd"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 8, "age_hours": 0.0, "half_life_hours": 8760.0, "decay_factor": 1.0}}
{"indicator": "CVE-2025-24993", "type": "cve", "source": "cisa_kev,nist_nvd_recent", "first_seen": "2025-03-11T00:00:00Z", "last_seen": "2026-10-24T22:12:15Z", "confidence": "high", "score": 88, "sightings": 519, "tags": "cve,exploited-in-the-wild,high,nvd", "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "context": "Microsoft Windows New Technology File System (NTFS) contains a heap-based buffer overflow vulnerability that allows an unauthorized attacker to execute code locally.", "tlp": "CLEAR", "score_factors": {"score": 88, "confidence_base": 80, "source_count": 2, "source_identifiers": ["cisa_kev", "nist_nvd_recent"], "reporting_groups": ["cisa", "nvd"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 8, "age_hours": 0.0, "half_life_hours": 8760.0, "decay_factor": 1.0}}
{"indicator": "CVE-2024-48248", "type": "cve", "source": "cisa_kev,nist_nvd_recent", "first_seen": "2025-03-04T08:15:33Z", "last_seen": "2026-10-24T22:12:15Z", "confidence": "high", "score": 88, "sightings": 519, "tags": "cve,exploited-in-the-wild,high,nvd", "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "context": "NAKIVO Backup and Replication contains an absolute path traversal vulnerability that enables an attacker to read arbitrary files.", "tlp": "CLEAR", "score_factors": {"score": 88, "confidence_base": 80, "source_count": 2, "source_identifiers": ["cisa_kev", "nist_nvd_recent"], "reporting_groups": ["cisa", "nvd"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 8, "age_hours": 0.0, "half_life_hours": 8760.0, "decay_factor": 1.0}}
{"indicator": "CVE-2025-22225", "type": "cve", "source": "cisa_kev,nist_nvd_recent", "first_seen": "2025-03-04T00:00:00Z", "last_seen": "2026-10-24T22:12:15Z", "confidence": "high", "score": 88, "sightings": 519, "tags": "cve,exploited-in-the-wild,high,nvd", "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "context": "VMware ESXi contains an arbitrary write vulnerability. Successful exploitation allows an attacker with privileges within the VMX process to trigger an arbitrary kernel write leading to an escape of the sandbox.", "tlp": "CLEAR", "score_factors": {"score": 88, "confidence_base": 80, "source_count": 2, "source_identifiers": ["cisa_kev", "nist_nvd_recent"], "reporting_groups": ["cisa", "nvd"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 8, "age_hours": 0.0, "half_life_hours": 8760.0, "decay_factor": 1.0}}
{"indicator": "CVE-2024-53704", "type": "cve", "source": "cisa_kev,nist_nvd_recent", "first_seen": "2025-02-18T00:00:00Z", "last_seen": "2026-10-24T22:12:15Z", "confidence": "high", "score": 88, "sightings": 519, "tags": "critical,cve,exploited-in-the-wild,nvd", "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "context": "SonicWall SonicOS contains an improper authentication vulnerability in the SSLVPN authentication mechanism that allows a remote attacker to bypass authentication.", "tlp": "CLEAR", "score_factors": {"score": 88, "confidence_base": 80, "source_count": 2, "source_identifiers": ["cisa_kev", "nist_nvd_recent"], "reporting_groups": ["cisa", "nvd"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 8, "age_hours": 0.0, "half_life_hours": 8760.0, "decay_factor": 1.0}}
{"indicator": "CVE-2024-57727", "type": "cve", "source": "cisa_kev,nist_nvd_recent", "first_seen": "2025-02-13T00:00:00Z", "last_seen": "2026-10-24T22:12:15Z", "confidence": "high", "score": 88, "sightings": 519, "tags": "cve,exploited-in-the-wild,high,nvd", "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "context": "SimpleHelp remote support software contains multiple path traversal vulnerabilities that allow unauthenticated remote attackers to download arbitrary files from the SimpleHelp host via crafted HTTP requests. These files may include server configuration files and hashed user passwords.", "tlp": "CLEAR", "score_factors": {"score": 88, "confidence_base": 80, "source_count": 2, "source_identifiers": ["cisa_kev", "nist_nvd_recent"], "reporting_groups": ["cisa", "nvd"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 8, "age_hours": 0.0, "half_life_hours": 8760.0, "decay_factor": 1.0}}
{"indicator": "CVE-2025-0108", "type": "cve", "source": "cisa_kev,nist_nvd_recent", "first_seen": "2025-02-12T21:15:16Z", "last_seen": "2026-10-24T22:12:15Z", "confidence": "high", "score": 88, "sightings": 519, "tags": "critical,cve,exploited-in-the-wild,nvd", "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "context": "Palo Alto Networks PAN-OS contains an authentication bypass vulnerability in its management web interface. This vulnerability allows an unauthenticated attacker with network access to the management web interface to bypass the authentication normally required and invoke certain PHP scripts.", "tlp": "CLEAR", "score_factors": {"score": 88, "confidence_base": 80, "source_count": 2, "source_identifiers": ["cisa_kev", "nist_nvd_recent"], "reporting_groups": ["cisa", "nvd"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 8, "age_hours": 0.0, "half_life_hours": 8760.0, "decay_factor": 1.0}}
{"indicator": "CVE-2025-21391", "type": "cve", "source": "cisa_kev,nist_nvd_recent", "first_seen": "2025-02-11T00:00:00Z", "last_seen": "2026-10-24T22:12:15Z", "confidence": "high", "score": 88, "sightings": 519, "tags": "cve,exploited-in-the-wild,high,nvd", "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "context": "Microsoft Windows Storage contains a link following vulnerability that could allow for privilege escalation. This vulnerability could allow an attacker to delete data including data that results in the service being unavailable.", "tlp": "CLEAR", "score_factors": {"score": 88, "confidence_base": 80, "source_count": 2, "source_identifiers": ["cisa_kev", "nist_nvd_recent"], "reporting_groups": ["cisa", "nvd"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 8, "age_hours": 0.0, "half_life_hours": 8760.0, "decay_factor": 1.0}}
{"indicator": "CVE-2020-29574", "type": "cve", "source": "cisa_kev,nist_nvd_recent", "first_seen": "2025-02-06T00:00:00Z", "last_seen": "2026-10-24T22:12:15Z", "confidence": "high", "score": 88, "sightings": 519, "tags": "critical,cve,exploited-in-the-wild,nvd", "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "context": "CyberoamOS (CROS) contains a SQL injection vulnerability in the WebAdmin that allows an unauthenticated attacker to execute arbitrary SQL statements remotely.", "tlp": "CLEAR", "score_factors": {"score": 88, "confidence_base": 80, "source_count": 2, "source_identifiers": ["cisa_kev", "nist_nvd_recent"], "reporting_groups": ["cisa", "nvd"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 8, "age_hours": 0.0, "half_life_hours": 8760.0, "decay_factor": 1.0}}
{"indicator": "CVE-2025-23006", "type": "cve", "source": "cisa_kev,nist_nvd_recent", "first_seen": "2025-01-23T12:15:28Z", "last_seen": "2026-10-24T22:12:15Z", "confidence": "high", "score": 88, "sightings": 519, "tags": "critical,cve,exploited-in-the-wild,nvd", "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "context": "SonicWall SMA1000 Appliance Management Console (AMC) and Central Management Console (CMC) contain a deserialization of untrusted data vulnerability, which can enable a remote, unauthenticated attacker to execute arbitrary OS commands.", "tlp": "CLEAR", "score_factors": {"score": 88, "confidence_base": 80, "source_count": 2, "source_identifiers": ["cisa_kev", "nist_nvd_recent"], "reporting_groups": ["cisa", "nvd"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 8, "age_hours": 0.0, "half_life_hours": 8760.0, "decay_factor": 1.0}}
{"indicator": "CVE-2025-21335", "type": "cve", "source": "cisa_kev,nist_nvd_recent", "first_seen": "2025-01-14T00:00:00Z", "last_seen": "2026-10-24T22:12:15Z", "confidence": "high", "score": 88, "sightings": 519, "tags": "cve,exploited-in-the-wild,high,nvd", "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "context": "Microsoft Windows Hyper-V NT Kernel Integration VSP contains a use-after-free vulnerability that allows a local attacker to gain SYSTEM privileges.", "tlp": "CLEAR", "score_factors": {"score": 88, "confidence_base": 80, "source_count": 2, "source_identifiers": ["cisa_kev", "nist_nvd_recent"], "reporting_groups": ["cisa", "nvd"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 8, "age_hours": 0.0, "half_life_hours": 8760.0, "decay_factor": 1.0}}
{"indicator": "CVE-2024-55591", "type": "cve", "source": "cisa_kev,nist_nvd_recent", "first_seen": "2025-01-14T00:00:00Z", "last_seen": "2026-10-24T22:12:15Z", "confidence": "high", "score": 88, "sightings": 519, "tags": "critical,cve,exploited-in-the-wild,nvd", "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "context": "Fortinet FortiOS and FortiProxy contain an authentication bypass vulnerability that may allow an unauthenticated, remote attacker to gain super-admin privileges via crafted requests to Node.js websocket module.", "tlp": "CLEAR", "score_factors": {"score": 88, "confidence_base": 80, "source_count": 2, "source_identifiers": ["cisa_kev", "nist_nvd_recent"], "reporting_groups": ["cisa", "nvd"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 8, "age_hours": 0.0, "half_life_hours": 8760.0, "decay_factor": 1.0}}
{"indicator": "CVE-2025-0282", "type": "cve", "source": "cisa_kev,nist_nvd_recent", "first_seen": "2025-01-08T00:00:00Z", "last_seen": "2026-10-24T22:12:15Z", "confidence": "high", "score": 88, "sightings": 519, "tags": "critical,cve,exploited-in-the-wild,nvd", "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "context": "Ivanti Connect Secure, Policy Secure, and ZTA Gateways contain a stack-based buffer overflow which can lead to unauthenticated remote code execution.", "tlp": "CLEAR", "score_factors": {"score": 88, "confidence_base": 80, "source_count": 2, "source_identifiers": ["cisa_kev", "nist_nvd_recent"], "reporting_groups": ["cisa", "nvd"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 8, "age_hours": 0.0, "half_life_hours": 8760.0, "decay_factor": 1.0}}
{"indicator": "CVE-2024-55550", "type": "cve", "source": "cisa_kev,nist_nvd_recent", "first_seen": "2025-01-07T00:00:00Z", "last_seen": "2026-10-24T22:12:15Z", "confidence": "high", "score": 88, "sightings": 519, "tags": "cve,exploited-in-the-wild,low,nvd", "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "context": "Mitel MiCollab contains a path traversal vulnerability that could allow an authenticated attacker with administrative privileges to read local files within the system due to insufficient input sanitization. This vulnerability can be chained with CVE-2024-41713, which allows an unauthenticated, remote attacker to read arbitrary files on the server.", "tlp": "CLEAR", "score_factors": {"score": 88, "confidence_base": 80, "source_count": 2, "source_identifiers": ["cisa_kev", "nist_nvd_recent"], "reporting_groups": ["cisa", "nvd"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 8, "age_hours": 0.0, "half_life_hours": 8760.0, "decay_factor": 1.0}}
{"indicator": "CVE-2024-41713", "type": "cve", "source": "cisa_kev,nist_nvd_recent", "first_seen": "2025-01-07T00:00:00Z", "last_seen": "2026-10-24T22:12:15Z", "confidence": "high", "score": 88, "sightings": 519, "tags": "critical,cve,exploited-in-the-wild,nvd", "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "context": "Mitel MiCollab contains a path traversal vulnerability that could allow an attacker to gain unauthorized and unauthenticated access. This vulnerability can be chained with CVE-2024-55550, which allows an unauthenticated, remote attacker to read arbitrary files on the server.", "tlp": "CLEAR", "score_factors": {"score": 88, "confidence_base": 80, "source_count": 2, "source_identifiers": ["cisa_kev", "nist_nvd_recent"], "reporting_groups": ["cisa", "nvd"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 8, "age_hours": 0.0, "half_life_hours": 8760.0, "decay_factor": 1.0}}
{"indicator": "CVE-2024-55956", "type": "cve", "source": "cisa_kev,nist_nvd_recent", "first_seen": "2024-12-17T00:00:00Z", "last_seen": "2026-10-24T22:12:15Z", "confidence": "high", "score": 88, "sightings": 519, "tags": "critical,cve,exploited-in-the-wild,nvd", "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "context": "Cleo Harmony, VLTrader, and LexiCom, which are managed file transfer products, contain an unrestricted file upload vulnerability that could allow an unauthenticated user to import and execute arbitrary bash or PowerShell commands on the host system by leveraging the default settings of the Autorun directory.", "tlp": "CLEAR", "score_factors": {"score": 88, "confidence_base": 80, "source_count": 2, "source_identifiers": ["cisa_kev", "nist_nvd_recent"], "reporting_groups": ["cisa", "nvd"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 8, "age_hours": 0.0, "half_life_hours": 8760.0, "decay_factor": 1.0}}
{"indicator": "CVE-2024-35250", "type": "cve", "source": "cisa_kev,nist_nvd_recent", "first_seen": "2024-12-16T00:00:00Z", "last_seen": "2026-10-24T22:12:15Z", "confidence": "high", "score": 88, "sightings": 519, "tags": "cve,exploited-in-the-wild,high,nvd", "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "context": "Microsoft Windows Kernel-Mode Driver contains an untrusted pointer dereference vulnerability that allows a local attacker to escalate privileges.", "tlp": "CLEAR", "score_factors": {"score": 88, "confidence_base": 80, "source_count": 2, "source_identifiers": ["cisa_kev", "nist_nvd_recent"], "reporting_groups": ["cisa", "nvd"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 8, "age_hours": 0.0, "half_life_hours": 8760.0, "decay_factor": 1.0}}
{"indicator": "CVE-2024-51378", "type": "cve", "source": "cisa_kev,nist_nvd_recent", "first_seen": "2024-12-04T00:00:00Z", "last_seen": "2026-10-24T22:12:15Z", "confidence": "high", "score": 88, "sightings": 519, "tags": "critical,cve,exploited-in-the-wild,nvd", "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "context": "CyberPanel contains an incorrect default permissions vulnerability that allows for authentication bypass and the execution of arbitrary commands using shell metacharacters in the statusfile property.", "tlp": "CLEAR", "score_factors": {"score": 88, "confidence_base": 80, "source_count": 2, "source_identifiers": ["cisa_kev", "nist_nvd_recent"], "reporting_groups": ["cisa", "nvd"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 8, "age_hours": 0.0, "half_life_hours": 8760.0, "decay_factor": 1.0}}
{"indicator": "CVE-2024-11667", "type": "cve", "source": "cisa_kev,nist_nvd_recent", "first_seen": "2024-12-03T00:00:00Z", "last_seen": "2026-10-24T22:12:15Z", "confidence": "high", "score": 88, "sightings": 519, "tags": "cve,exploited-in-the-wild,high,nvd", "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "context": "Multiple Zyxel firewalls contain a path traversal vulnerability in the web management interface that could allow an attacker to download or upload files via a crafted URL.", "tlp": "CLEAR", "score_factors": {"score": 88, "confidence_base": 80, "source_count": 2, "source_identifiers": ["cisa_kev", "nist_nvd_recent"], "reporting_groups": ["cisa", "nvd"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 8, "age_hours": 0.0, "half_life_hours": 8760.0, "decay_factor": 1.0}}
{"indicator": "CVE-2023-28461", "type": "cve", "source": "cisa_kev,nist_nvd_recent", "first_seen": "2024-11-25T00:00:00Z", "last_seen": "2026-10-24T22:12:15Z", "confidence": "high", "score": 88, "sightings": 519, "tags": "critical,cve,exploited-in-the-wild,nvd", "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "context": "Array Networks AG and vxAG ArrayOS contain a missing authentication for critical function vulnerability that allows an attacker to read local files and execute code on the SSL VPN gateway.", "tlp": "CLEAR", "score_factors": {"score": 88, "confidence_base": 80, "source_count": 2, "source_identifiers": ["cisa_kev", "nist_nvd_recent"], "reporting_groups": ["cisa", "nvd"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 8, "age_hours": 0.0, "half_life_hours": 8760.0, "decay_factor": 1.0}}
{"indicator": "CVE-2024-50302", "type": "cve", "source": "cisa_kev,nist_nvd_recent", "first_seen": "2024-11-19T02:16:32Z", "last_seen": "2026-10-24T22:12:15Z", "confidence": "high", "score": 88, "sightings": 519, "tags": "cve,exploited-in-the-wild,medium,nvd", "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "context": "The Linux kernel contains a use of uninitialized resource vulnerability that allows an attacker to leak kernel memory via a specially crafted HID report.", "tlp": "CLEAR", "score_factors": {"score": 88, "confidence_base": 80, "source_count": 2, "source_identifiers": ["cisa_kev", "nist_nvd_recent"], "reporting_groups": ["cisa", "nvd"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 8, "age_hours": 0.0, "half_life_hours": 8760.0, "decay_factor": 1.0}}
{"indicator": "CVE-2024-9474", "type": "cve", "source": "cisa_kev,nist_nvd_recent", "first_seen": "2024-11-18T00:00:00Z", "last_seen": "2026-10-24T22:12:15Z", "confidence": "high", "score": 88, "sightings": 519, "tags": "cve,exploited-in-the-wild,high,nvd", "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "context": "Palo Alto Networks PAN-OS contains an OS command injection vulnerability that allows for privilege escalation through the web-based management interface for several PAN products, including firewalls and VPN concentrators.", "tlp": "CLEAR", "score_factors": {"score": 88, "confidence_base": 80, "source_count": 2, "source_identifiers": ["cisa_kev", "nist_nvd_recent"], "reporting_groups": ["cisa", "nvd"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 8, "age_hours": 0.0, "half_life_hours": 8760.0, "decay_factor": 1.0}}
{"indicator": "CVE-2024-0012", "type": "cve", "source": "cisa_kev,nist_nvd_recent", "first_seen": "2024-11-18T00:00:00Z", "last_seen": "2026-10-24T22:12:15Z", "confidence": "high", "score": 88, "sightings": 519, "tags": "critical,cve,exploited-in-the-wild,nvd", "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "context": "Palo Alto Networks PAN-OS contains an authentication bypass vulnerability in the web-based management interface for several PAN-OS products, including firewalls and VPN concentrators.", "tlp": "CLEAR", "score_factors": {"score": 88, "confidence_base": 80, "source_count": 2, "source_identifiers": ["cisa_kev", "nist_nvd_recent"], "reporting_groups": ["cisa", "nvd"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 8, "age_hours": 0.0, "half_life_hours": 8760.0, "decay_factor": 1.0}}
{"indicator": "CVE-2024-49039", "type": "cve", "source": "cisa_kev,nist_nvd_recent", "first_seen": "2024-11-12T00:00:00Z", "last_seen": "2026-10-24T22:12:15Z", "confidence": "high", "score": 88, "sightings": 519, "tags": "cve,exploited-in-the-wild,high,nvd", "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "context": "Microsoft Windows Task Scheduler contains a privilege escalation vulnerability that can allow an attacker-provided, local application to escalate privileges outside of its AppContainer, and access privileged RPC functions.", "tlp": "CLEAR", "score_factors": {"score": 88, "confidence_base": 80, "source_count": 2, "source_identifiers": ["cisa_kev", "nist_nvd_recent"], "reporting_groups": ["cisa", "nvd"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 8, "age_hours": 0.0, "half_life_hours": 8760.0, "decay_factor": 1.0}}
{"indicator": "CVE-2024-51567", "type": "cve", "source": "cisa_kev,nist_nvd_recent", "first_seen": "2024-11-07T00:00:00Z", "last_seen": "2026-10-24T22:12:15Z", "confidence": "high", "score": 88, "sightings": 519, "tags": "critical,cve,exploited-in-the-wild,nvd", "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "context": "CyberPanel contains an incorrect default permissions vulnerability that allows a remote, unauthenticated attacker to execute commands as root.", "tlp": "CLEAR", "score_factors": {"score": 88, "confidence_base": 80, "source_count": 2, "source_identifiers": ["cisa_kev", "nist_nvd_recent"], "reporting_groups": ["cisa", "nvd"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 8, "age_hours": 0.0, "half_life_hours": 8760.0, "decay_factor": 1.0}}
{"indicator": "CVE-2024-50623", "type": "cve", "source": "cisa_kev,nist_nvd_recent", "first_seen": "2024-10-28T00:15:03Z", "last_seen": "2026-10-24T22:12:15Z", "confidence": "high", "score": 88, "sightings": 519, "tags": "critical,cve,exploited-in-the-wild,nvd", "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "context": "Cleo Harmony, VLTrader, and LexiCom, which are managed file transfer products, contain an unrestricted file upload and download vulnerability that can lead to remote code execution with elevated privileges.", "tlp": "CLEAR", "score_factors": {"score": 88, "confidence_base": 80, "source_count": 2, "source_identifiers": ["cisa_kev", "nist_nvd_recent"], "reporting_groups": ["cisa", "nvd"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 8, "age_hours": 0.0, "half_life_hours": 8760.0, "decay_factor": 1.0}}
{"indicator": "CVE-2024-9680", "type": "cve", "source": "cisa_kev,nist_nvd_recent", "first_seen": "2024-10-15T00:00:00Z", "last_seen": "2026-10-24T22:12:15Z", "confidence": "high", "score": 88, "sightings": 519, "tags": "critical,cve,exploited-in-the-wild,nvd", "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "context": "Mozilla Firefox and Firefox ESR contain a use-after-free vulnerability in Animation timelines that allows for code execution in the content process.", "tlp": "CLEAR", "score_factors": {"score": 88, "confidence_base": 80, "source_count": 2, "source_identifiers": ["cisa_kev", "nist_nvd_recent"], "reporting_groups": ["cisa", "nvd"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 8, "age_hours": 0.0, "half_life_hours": 8760.0, "decay_factor": 1.0}}
{"indicator": "CVE-2024-30088", "type": "cve", "source": "cisa_kev,nist_nvd_recent", "first_seen": "2024-10-15T00:00:00Z", "last_seen": "2026-10-24T22:12:15Z", "confidence": "high", "score": 88, "sightings": 519, "tags": "cve,exploited-in-the-wild,high,nvd", "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "context": "Microsoft Windows Kernel contains a time-of-check to time-of-use (TOCTOU) race condition vulnerability that could allow for privilege escalation. ", "tlp": "CLEAR", "score_factors": {"score": 88, "confidence_base": 80, "source_count": 2, "source_identifiers": ["cisa_kev", "nist_nvd_recent"], "reporting_groups": ["cisa", "nvd"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 8, "age_hours": 0.0, "half_life_hours": 8760.0, "decay_factor": 1.0}}
{"indicator": "CVE-2024-9379", "type": "cve", "source": "cisa_kev,nist_nvd_recent", "first_seen": "2024-10-08T17:15:56Z", "last_seen": "2026-10-24T22:12:15Z", "confidence": "high", "score": 88, "sightings": 519, "tags": "cve,exploited-in-the-wild,medium,nvd", "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "context": "Ivanti Cloud Services Appliance (CSA) contains a SQL injection vulnerability in the admin web console in versions prior to 5.0.2, which can allow a remote attacker authenticated as administrator to run arbitrary SQL statements.", "tlp": "CLEAR", "score_factors": {"score": 88, "confidence_base": 80, "source_count": 2, "source_identifiers": ["cisa_kev", "nist_nvd_recent"], "reporting_groups": ["cisa", "nvd"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 8, "age_hours": 0.0, "half_life_hours": 8760.0, "decay_factor": 1.0}}
{"indicator": "CVE-2020-0618", "type": "cve", "source": "cisa_kev,nist_nvd_recent", "first_seen": "2024-09-18T00:00:00Z", "last_seen": "2026-10-24T22:12:15Z", "confidence": "high", "score": 88, "sightings": 519, "tags": "cve,exploited-in-the-wild,high,nvd", "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "context": "Microsoft SQL Server Reporting Services contains a deserialization vulnerability when handling page requests incorrectly. An authenticated attacker can exploit this vulnerability to execute code in the context of the Report Server service account.", "tlp": "CLEAR", "score_factors": {"score": 88, "confidence_base": 80, "source_count": 2, "source_identifiers": ["cisa_kev", "nist_nvd_recent"], "reporting_groups": ["cisa", "nvd"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 8, "age_hours": 0.0, "half_life_hours": 8760.0, "decay_factor": 1.0}}
{"indicator": "CVE-2024-40766", "type": "cve", "source": "cisa_kev,nist_nvd_recent", "first_seen": "2024-08-23T07:15:03Z", "last_seen": "2026-10-24T22:12:15Z", "confidence": "high", "score": 88, "sightings": 519, "tags": "critical,cve,exploited-in-the-wild,nvd", "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "context": "SonicWall SonicOS contains an improper access control vulnerability that could lead to unauthorized resource access and, under certain conditions, may cause the firewall to crash.", "tlp": "CLEAR", "score_factors": {"score": 88, "confidence_base": 80, "source_count": 2, "source_identifiers": ["cisa_kev", "nist_nvd_recent"], "reporting_groups": ["cisa", "nvd"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 8, "age_hours": 0.0, "half_life_hours": 8760.0, "decay_factor": 1.0}}
{"indicator": "CVE-2021-31196", "type": "cve", "source": "cisa_kev,nist_nvd_recent", "first_seen": "2024-08-21T00:00:00Z", "last_seen": "2026-10-24T22:12:15Z", "confidence": "high", "score": 88, "sightings": 519, "tags": "cve,exploited-in-the-wild,high,nvd", "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "context": "Microsoft Exchange Server contains an information disclosure vulnerability that allows for remote code execution.", "tlp": "CLEAR", "score_factors": {"score": 88, "confidence_base": 80, "source_count": 2, "source_identifiers": ["cisa_kev", "nist_nvd_recent"], "reporting_groups": ["cisa", "nvd"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 8, "age_hours": 0.0, "half_life_hours": 8760.0, "decay_factor": 1.0}}
{"indicator": "CVE-2024-7399", "type": "cve", "source": "cisa_kev,nist_nvd_recent", "first_seen": "2024-08-12T13:38:41Z", "last_seen": "2026-10-24T22:12:15Z", "confidence": "high", "score": 88, "sightings": 519, "tags": "cve,exploited-in-the-wild,high,nvd", "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "context": "Samsung MagicINFO 9 Server contains a path traversal vulnerability that could allow an attacker to write arbitrary files as system authority.", "tlp": "CLEAR", "score_factors": {"score": 88, "confidence_base": 80, "source_count": 2, "source_identifiers": ["cisa_kev", "nist_nvd_recent"], "reporting_groups": ["cisa", "nvd"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 8, "age_hours": 0.0, "half_life_hours": 8760.0, "decay_factor": 1.0}}
{"indicator": "CVE-2024-24919", "type": "cve", "source": "cisa_kev,nist_nvd_recent", "first_seen": "2024-05-30T00:00:00Z", "last_seen": "2026-10-24T22:12:15Z", "confidence": "high", "score": 88, "sightings": 519, "tags": "cve,exploited-in-the-wild,high,nvd", "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "context": "Check Point Quantum Security Gateways contain an unspecified information disclosure vulnerability. The vulnerability potentially allows an attacker to access information on Gateways connected to the internet, with IPSec VPN, Remote Access VPN or Mobile Access enabled. This issue affects several product lines from Check Point, including CloudGuard Network, Quantum Scalable Chassis, Quantum Security Gateways, and Quantum Spark Appliances.", "tlp": "CLEAR", "score_factors": {"score": 88, "confidence_base": 80, "source_count": 2, "source_identifiers": ["cisa_kev", "nist_nvd_recent"], "reporting_groups": ["cisa", "nvd"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 8, "age_hours": 0.0, "half_life_hours": 8760.0, "decay_factor": 1.0}}
{"indicator": "CVE-2024-1086", "type": "cve", "source": "cisa_kev,nist_nvd_recent", "first_seen": "2024-05-30T00:00:00Z", "last_seen": "2026-10-24T22:12:15Z", "confidence": "high", "score": 88, "sightings": 519, "tags": "cve,exploited-in-the-wild,high,nvd", "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "context": "Linux kernel contains a use-after-free vulnerability in the netfilter: nf_tables component that allows an attacker to achieve local privilege escalation.", "tlp": "CLEAR", "score_factors": {"score": 88, "confidence_base": 80, "source_count": 2, "source_identifiers": ["cisa_kev", "nist_nvd_recent"], "reporting_groups": ["cisa", "nvd"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 8, "age_hours": 0.0, "half_life_hours": 8760.0, "decay_factor": 1.0}}
{"indicator": "CVE-2021-44529", "type": "cve", "source": "cisa_kev,nist_nvd_recent", "first_seen": "2024-03-25T00:00:00Z", "last_seen": "2026-10-24T22:12:15Z", "confidence": "high", "score": 88, "sightings": 519, "tags": "critical,cve,exploited-in-the-wild,nvd", "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "context": "Ivanti Endpoint Manager Cloud Service Appliance (EPM CSA) contains a code injection vulnerability that allows an unauthenticated user to execute malicious code with limited permissions (nobody).", "tlp": "CLEAR", "score_factors": {"score": 88, "confidence_base": 80, "source_count": 2, "source_identifiers": ["cisa_kev", "nist_nvd_recent"], "reporting_groups": ["cisa", "nvd"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 8, "age_hours": 0.0, "half_life_hours": 8760.0, "decay_factor": 1.0}}
{"indicator": "CVE-2024-21338", "type": "cve", "source": "cisa_kev,nist_nvd_recent", "first_seen": "2024-03-04T00:00:00Z", "last_seen": "2026-10-24T22:12:15Z", "confidence": "high", "score": 88, "sightings": 519, "tags": "cve,exploited-in-the-wild,high,nvd", "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "context": "Microsoft Windows Kernel contains an exposed IOCTL with insufficient access control vulnerability within the IOCTL (input and output control) dispatcher in appid.sys that allows a local attacker to achieve privilege escalation.", "tlp": "CLEAR", "score_factors": {"score": 88, "confidence_base": 80, "source_count": 2, "source_identifiers": ["cisa_kev", "nist_nvd_recent"], "reporting_groups": ["cisa", "nvd"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 8, "age_hours": 0.0, "half_life_hours": 8760.0, "decay_factor": 1.0}}
{"indicator": "CVE-2020-3259", "type": "cve", "source": "cisa_kev,nist_nvd_recent", "first_seen": "2024-02-15T00:00:00Z", "last_seen": "2026-10-24T22:12:15Z", "confidence": "high", "score": 88, "sightings": 519, "tags": "cve,exploited-in-the-wild,high,nvd", "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "context": "Cisco Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) contain an information disclosure vulnerability. An attacker could retrieve memory contents on an affected device, which could lead to the disclosure of confidential information due to a buffer tracking issue when the software parses invalid URLs that are requested from the web services interface. This vulnerability affects only specific AnyConnect and WebVPN configurations.", "tlp": "CLEAR", "score_factors": {"score": 88, "confidence_base": 80, "source_count": 2, "source_identifiers": ["cisa_kev", "nist_nvd_recent"], "reporting_groups": ["cisa", "nvd"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 8, "age_hours": 0.0, "half_life_hours": 8760.0, "decay_factor": 1.0}}
{"indicator": "CVE-2024-21762", "type": "cve", "source": "cisa_kev,nist_nvd_recent", "first_seen": "2024-02-09T00:00:00Z", "last_seen": "2026-10-24T22:12:15Z", "confidence": "high", "score": 88, "sightings": 519, "tags": "critical,cve,exploited-in-the-wild,nvd", "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "context": "Fortinet FortiOS contains an out-of-bound write vulnerability that allows a remote unauthenticated attacker to execute code or commands via specially crafted HTTP requests.", "tlp": "CLEAR", "score_factors": {"score": 88, "confidence_base": 80, "source_count": 2, "source_identifiers": ["cisa_kev", "nist_nvd_recent"], "reporting_groups": ["cisa", "nvd"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 8, "age_hours": 0.0, "half_life_hours": 8760.0, "decay_factor": 1.0}}
{"indicator": "CVE-2024-21893", "type": "cve", "source": "cisa_kev,nist_nvd_recent", "first_seen": "2024-01-31T00:00:00Z", "last_seen": "2026-10-24T22:12:15Z", "confidence": "high", "score": 88, "sightings": 519, "tags": "cve,exploited-in-the-wild,high,nvd", "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "context": "Ivanti Connect Secure (ICS, formerly known as Pulse Connect Secure), Ivanti Policy Secure, and Ivanti Neurons contain a server-side request forgery (SSRF) vulnerability in the SAML component that allows an attacker to access certain restricted resources without authentication.", "tlp": "CLEAR", "score_factors": {"score": 88, "confidence_base": 80, "source_count": 2, "source_identifiers": ["cisa_kev", "nist_nvd_recent"], "reporting_groups": ["cisa", "nvd"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 8, "age_hours": 0.0, "half_life_hours": 8760.0, "decay_factor": 1.0}}
{"indicator": "CVE-2024-21887", "type": "cve", "source": "cisa_kev,nist_nvd_recent", "first_seen": "2024-01-10T00:00:00Z", "last_seen": "2026-10-24T22:12:15Z", "confidence": "high", "score": 88, "sightings": 519, "tags": "critical,cve,exploited-in-the-wild,nvd", "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "context": "Ivanti Connect Secure (ICS, formerly known as Pulse Connect Secure) and Ivanti Policy Secure contain a command injection vulnerability in the web components of these products, which can allow an authenticated administrator to send crafted requests to execute code on affected appliances. This vulnerability can be leveraged in conjunction with CVE-2023-46805, an authenticated bypass issue.", "tlp": "CLEAR", "score_factors": {"score": 88, "confidence_base": 80, "source_count": 2, "source_identifiers": ["cisa_kev", "nist_nvd_recent"], "reporting_groups": ["cisa", "nvd"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 8, "age_hours": 0.0, "half_life_hours": 8760.0, "decay_factor": 1.0}}
{"indicator": "CVE-2023-46805", "type": "cve", "source": "cisa_kev,nist_nvd_recent", "first_seen": "2024-01-10T00:00:00Z", "last_seen": "2026-10-24T22:12:15Z", "confidence": "high", "score": 88, "sightings": 519, "tags": "cve,exploited-in-the-wild,high,nvd", "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "context": "Ivanti Connect Secure (ICS, formerly known as Pulse Connect Secure) and Ivanti Policy Secure gateways contain an authentication bypass vulnerability in the web component that allows an attacker to access restricted resources by bypassing control checks. This vulnerability can be leveraged in conjunction with CVE-2024-21887, a command injection vulnerability.", "tlp": "CLEAR", "score_factors": {"score": 88, "confidence_base": 80, "source_count": 2, "source_identifiers": ["cisa_kev", "nist_nvd_recent"], "reporting_groups": ["cisa", "nvd"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 8, "age_hours": 0.0, "half_life_hours": 8760.0, "decay_factor": 1.0}}
{"indicator": "CVE-2022-2586", "type": "cve", "source": "cisa_kev,nist_nvd_recent", "first_seen": "2024-01-08T18:15:44Z", "last_seen": "2026-10-24T22:12:15Z", "confidence": "high", "score": 88, "sightings": 519, "tags": "cve,exploited-in-the-wild,medium,nvd", "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "context": "Linux Kernel contains a use-after-free vulnerability in the nft_object, allowing local attackers to escalate privileges. ", "tlp": "CLEAR", "score_factors": {"score": 88, "confidence_base": 80, "source_count": 2, "source_identifiers": ["cisa_kev", "nist_nvd_recent"], "reporting_groups": ["cisa", "nvd"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 8, "age_hours": 0.0, "half_life_hours": 8760.0, "decay_factor": 1.0}}
{"indicator": "CVE-2023-41266", "type": "cve", "source": "cisa_kev,nist_nvd_recent", "first_seen": "2023-12-07T00:00:00Z", "last_seen": "2026-10-24T22:12:15Z", "confidence": "high", "score": 88, "sightings": 519, "tags": "cve,exploited-in-the-wild,high,nvd", "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "context": "Qlik Sense contains a path traversal vulnerability that allows a remote, unauthenticated attacker to create an anonymous session by sending maliciously crafted HTTP requests. This anonymous session could allow the attacker to send further requests to unauthorized endpoints.", "tlp": "CLEAR", "score_factors": {"score": 88, "confidence_base": 80, "source_count": 2, "source_identifiers": ["cisa_kev", "nist_nvd_recent"], "reporting_groups": ["cisa", "nvd"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 8, "age_hours": 0.0, "half_life_hours": 8760.0, "decay_factor": 1.0}}
{"indicator": "CVE-2023-41265", "type": "cve", "source": "cisa_kev,nist_nvd_recent", "first_seen": "2023-12-07T00:00:00Z", "last_seen": "2026-10-24T22:12:15Z", "confidence": "high", "score": 88, "sightings": 519, "tags": "critical,cve,exploited-in-the-wild,nvd", "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "context": "Qlik Sense contains an HTTP tunneling vulnerability that allows an attacker to escalate privileges and execute HTTP requests on the backend server hosting the software.", "tlp": "CLEAR", "score_factors": {"score": 88, "confidence_base": 80, "source_count": 2, "source_identifiers": ["cisa_kev", "nist_nvd_recent"], "reporting_groups": ["cisa", "nvd"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 8, "age_hours": 0.0, "half_life_hours": 8760.0, "decay_factor": 1.0}}
{"indicator": "CVE-2023-47246", "type": "cve", "source": "cisa_kev,nist_nvd_recent", "first_seen": "2023-11-13T00:00:00Z", "last_seen": "2026-10-24T22:12:15Z", "confidence": "high", "score": 88, "sightings": 519, "tags": "critical,cve,exploited-in-the-wild,nvd", "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "context": "SysAid Server (on-premises version) contains a path traversal vulnerability that leads to code execution.", "tlp": "CLEAR", "score_factors": {"score": 88, "confidence_base": 80, "source_count": 2, "source_identifiers": ["cisa_kev", "nist_nvd_recent"], "reporting_groups": ["cisa", "nvd"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 8, "age_hours": 0.0, "half_life_hours": 8760.0, "decay_factor": 1.0}}
{"indicator": "CVE-2023-4966", "type": "cve", "source": "cisa_kev,nist_nvd_recent", "first_seen": "2023-10-18T00:00:00Z", "last_seen": "2026-10-24T22:12:15Z", "confidence": "high", "score": 88, "sightings": 519, "tags": "critical,cve,exploited-in-the-wild,nvd", "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "context": "Citrix NetScaler ADC and NetScaler Gateway contain a buffer overflow vulnerability that allows for sensitive information disclosure when configured as a Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) or AAA virtual server.", "tlp": "CLEAR", "score_factors": {"score": 88, "confidence_base": 80, "source_count": 2, "source_identifiers": ["cisa_kev", "nist_nvd_recent"], "reporting_groups": ["cisa", "nvd"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 8, "age_hours": 0.0, "half_life_hours": 8760.0, "decay_factor": 1.0}}
{"indicator": "CVE-2023-4911", "type": "cve", "source": "cisa_kev,nist_nvd_recent", "first_seen": "2023-10-03T18:15:10Z", "last_seen": "2026-10-24T22:12:15Z", "confidence": "high", "score": 88, "sightings": 519, "tags": "cve,exploited-in-the-wild,high,nvd", "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "context": "GNU C Library's dynamic loader ld.so contains a buffer overflow vulnerability when processing the GLIBC_TUNABLES environment variable, allowing a local attacker to execute code with elevated privileges.", "tlp": "CLEAR", "score_factors": {"score": 88, "confidence_base": 80, "source_count": 2, "source_identifiers": ["cisa_kev", "nist_nvd_recent"], "reporting_groups": ["cisa", "nvd"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 8, "age_hours": 0.0, "half_life_hours": 8760.0, "decay_factor": 1.0}}
{"indicator": "CVE-2023-20269", "type": "cve", "source": "cisa_kev,nist_nvd_recent", "first_seen": "2023-09-13T00:00:00Z", "last_seen": "2026-10-24T22:12:15Z", "confidence": "high", "score": 88, "sightings": 519, "tags": "cve,exploited-in-the-wild,medium,nvd", "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "context": "Cisco Adaptive Security Appliance and Firepower Threat Defense contain an unauthorized access vulnerability that could allow an unauthenticated, remote attacker to conduct a brute force attack in an attempt to identify valid username and password combinations or establish a clientless SSL VPN session with an unauthorized user.", "tlp": "CLEAR", "score_factors": {"score": 88, "confidence_base": 80, "source_count": 2, "source_identifiers": ["cisa_kev", "nist_nvd_recent"], "reporting_groups": ["cisa", "nvd"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 8, "age_hours": 0.0, "half_life_hours": 8760.0, "decay_factor": 1.0}}
{"indicator": "CVE-2023-38831", "type": "cve", "source": "cisa_kev,nist_nvd_recent", "first_seen": "2023-08-24T00:00:00Z", "last_seen": "2026-10-24T22:12:15Z", "confidence": "high", "score": 88, "sightings": 519, "tags": "cve,exploited-in-the-wild,high,nvd", "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "context": "RARLAB WinRAR contains an unspecified vulnerability that allows an attacker to execute code when a user attempts to view a benign file within a ZIP archive.", "tlp": "CLEAR", "score_factors": {"score": 88, "confidence_base": 80, "source_count": 2, "source_identifiers": ["cisa_kev", "nist_nvd_recent"], "reporting_groups": ["cisa", "nvd"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 8, "age_hours": 0.0, "half_life_hours": 8760.0, "decay_factor": 1.0}}
{"indicator": "CVE-2023-35078", "type": "cve", "source": "cisa_kev,nist_nvd_recent", "first_seen": "2023-07-25T00:00:00Z", "last_seen": "2026-10-24T22:12:15Z", "confidence": "high", "score": 88, "sightings": 519, "tags": "critical,cve,exploited-in-the-wild,nvd", "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "context": "Ivanti Endpoint Manager Mobile (EPMM, previously branded MobileIron Core) contains an authentication bypass vulnerability that allows unauthenticated access to specific API paths. An attacker with access to these API paths can access personally identifiable information (PII) such as names, phone numbers, and other mobile device details for users on a vulnerable system. An attacker can also make other configuration changes including installing software and modifying security profiles on registered devices.", "tlp": "CLEAR", "score_factors": {"score": 88, "confidence_base": 80, "source_count": 2, "source_identifiers": ["cisa_kev", "nist_nvd_recent"], "reporting_groups": ["cisa", "nvd"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 8, "age_hours": 0.0, "half_life_hours": 8760.0, "decay_factor": 1.0}}
{"indicator": "CVE-2023-3519", "type": "cve", "source": "cisa_kev,nist_nvd_recent", "first_seen": "2023-07-19T00:00:00Z", "last_seen": "2026-10-24T22:12:15Z", "confidence": "high", "score": 88, "sightings": 519, "tags": "critical,cve,exploited-in-the-wild,nvd", "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "context": "Citrix NetScaler ADC and NetScaler Gateway contains a code injection vulnerability that allows for unauthenticated remote code execution.", "tlp": "CLEAR", "score_factors": {"score": 88, "confidence_base": 80, "source_count": 2, "source_identifiers": ["cisa_kev", "nist_nvd_recent"], "reporting_groups": ["cisa", "nvd"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 8, "age_hours": 0.0, "half_life_hours": 8760.0, "decay_factor": 1.0}}
{"indicator": "CVE-2023-35311", "type": "cve", "source": "cisa_kev,nist_nvd_recent", "first_seen": "2023-07-11T00:00:00Z", "last_seen": "2026-10-24T22:12:15Z", "confidence": "high", "score": 88, "sightings": 519, "tags": "cve,exploited-in-the-wild,high,nvd", "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "context": "Microsoft Outlook contains a security feature bypass vulnerability that allows an attacker to bypass the Microsoft Outlook Security Notice prompt.", "tlp": "CLEAR", "score_factors": {"score": 88, "confidence_base": 80, "source_count": 2, "source_identifiers": ["cisa_kev", "nist_nvd_recent"], "reporting_groups": ["cisa", "nvd"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 8, "age_hours": 0.0, "half_life_hours": 8760.0, "decay_factor": 1.0}}
{"indicator": "CVE-2023-27997", "type": "cve", "source": "cisa_kev,nist_nvd_recent", "first_seen": "2023-06-13T00:00:00Z", "last_seen": "2026-10-24T22:12:15Z", "confidence": "high", "score": 88, "sightings": 519, "tags": "critical,cve,exploited-in-the-wild,nvd", "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "context": "Fortinet FortiOS and FortiProxy SSL-VPN contain a heap-based buffer overflow vulnerability which can allow an unauthenticated, remote attacker to execute code or commands via specifically crafted requests.", "tlp": "CLEAR", "score_factors": {"score": 88, "confidence_base": 80, "source_count": 2, "source_identifiers": ["cisa_kev", "nist_nvd_recent"], "reporting_groups": ["cisa", "nvd"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 8, "age_hours": 0.0, "half_life_hours": 8760.0, "decay_factor": 1.0}}
{"indicator": "CVE-2023-3079", "type": "cve", "source": "cisa_kev,nist_nvd_recent", "first_seen": "2023-06-05T22:15:12Z", "last_seen": "2026-10-24T22:12:15Z", "confidence": "high", "score": 88, "sightings": 519, "tags": "cve,exploited-in-the-wild,high,nvd", "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "context": "Google Chromium V8 Engine contains a type confusion vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.", "tlp": "CLEAR", "score_factors": {"score": 88, "confidence_base": 80, "source_count": 2, "source_identifiers": ["cisa_kev", "nist_nvd_recent"], "reporting_groups": ["cisa", "nvd"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 8, "age_hours": 0.0, "half_life_hours": 8760.0, "decay_factor": 1.0}}
{"indicator": "CVE-2016-8735", "type": "cve", "source": "cisa_kev,nist_nvd_recent", "first_seen": "2023-05-12T00:00:00Z", "last_seen": "2026-10-24T22:12:15Z", "confidence": "high", "score": 88, "sightings": 519, "tags": "critical,cve,exploited-in-the-wild,nvd", "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "context": "Apache Tomcat contains an unspecified vulnerability that allows for remote code execution if JmxRemoteLifecycleListener is used and an attacker can reach Java Management Extension (JMX) ports. This CVE exists because this listener wasn't updated for consistency with the Oracle patched issues for CVE-2016-3427 which affected credential types.", "tlp": "CLEAR", "score_factors": {"score": 88, "confidence_base": 80, "source_count": 2, "source_identifiers": ["cisa_kev", "nist_nvd_recent"], "reporting_groups": ["cisa", "nvd"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 8, "age_hours": 0.0, "half_life_hours": 8760.0, "decay_factor": 1.0}}
{"indicator": "CVE-2023-27351", "type": "cve", "source": "cisa_kev,nist_nvd_recent", "first_seen": "2023-04-20T16:15:07Z", "last_seen": "2026-10-24T22:12:15Z", "confidence": "high", "score": 88, "sightings": 519, "tags": "cve,exploited-in-the-wild,high,nvd", "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "context": "PaperCut NG/MF contains an improper authentication vulnerability that could allow remote attackers to bypass authentication on affected installations via the SecurityRequestFilter class.", "tlp": "CLEAR", "score_factors": {"score": 88, "confidence_base": 80, "source_count": 2, "source_identifiers": ["cisa_kev", "nist_nvd_recent"], "reporting_groups": ["cisa", "nvd"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 8, "age_hours": 0.0, "half_life_hours": 8760.0, "decay_factor": 1.0}}
{"indicator": "CVE-2023-22894", "type": "cve", "source": "cisa_kev,nist_nvd_recent", "first_seen": "2023-04-19T16:15:07Z", "last_seen": "2026-10-24T22:12:15Z", "confidence": "high", "score": 88, "sightings": 59, "tags": "cve,exploited-in-the-wild,medium,nvd", "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "context": "Strapi contains a cleartext storage of sensitive information vulnerability that could allow attackers with access to the admin panel to discover sensitive user details via the query filter. The impacted product(s) could be end-of-life (EoL) and/or end-of-service (EoS). Users are advised to discontinue use and/or transition to a supported version. This vulnerability can be chained with CVE-2023-22621 to achieve remote code execution. ", "tlp": "CLEAR", "score_factors": {"score": 88, "confidence_base": 80, "source_count": 2, "source_identifiers": ["cisa_kev", "nist_nvd_recent"], "reporting_groups": ["cisa", "nvd"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 8, "age_hours": 0.0, "half_life_hours": 8760.0, "decay_factor": 1.0}}
{"indicator": "CVE-2023-23376", "type": "cve", "source": "cisa_kev,nist_nvd_recent", "first_seen": "2023-02-14T00:00:00Z", "last_seen": "2026-10-24T22:12:15Z", "confidence": "high", "score": 88, "sightings": 519, "tags": "cve,exploited-in-the-wild,high,nvd", "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "context": "Microsoft Windows Common Log File System (CLFS) driver contains an unspecified vulnerability that allows for privilege escalation.", "tlp": "CLEAR", "score_factors": {"score": 88, "confidence_base": 80, "source_count": 2, "source_identifiers": ["cisa_kev", "nist_nvd_recent"], "reporting_groups": ["cisa", "nvd"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 8, "age_hours": 0.0, "half_life_hours": 8760.0, "decay_factor": 1.0}}
{"indicator": "CVE-2023-0669", "type": "cve", "source": "cisa_kev,nist_nvd_recent", "first_seen": "2023-02-10T00:00:00Z", "last_seen": "2026-10-24T22:12:15Z", "confidence": "high", "score": 88, "sightings": 519, "tags": "cve,exploited-in-the-wild,high,nvd", "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "context": "Fortra (formerly, HelpSystems) GoAnywhere MFT contains a pre-authentication remote code execution vulnerability in the License Response Servlet due to deserializing an attacker-controlled object.", "tlp": "CLEAR", "score_factors": {"score": 88, "confidence_base": 80, "source_count": 2, "source_identifiers": ["cisa_kev", "nist_nvd_recent"], "reporting_groups": ["cisa", "nvd"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 8, "age_hours": 0.0, "half_life_hours": 8760.0, "decay_factor": 1.0}}
{"indicator": "CVE-2017-11357", "type": "cve", "source": "cisa_kev,nist_nvd_recent", "first_seen": "2023-01-26T00:00:00Z", "last_seen": "2026-10-24T22:12:15Z", "confidence": "high", "score": 88, "sightings": 519, "tags": "critical,cve,exploited-in-the-wild,nvd", "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "context": "Telerik UI for ASP.NET AJAX contains an insecure direct object reference vulnerability in RadAsyncUpload that can result in file uploads in a limited location and/or remote code execution.", "tlp": "CLEAR", "score_factors": {"score": 88, "confidence_base": 80, "source_count": 2, "source_identifiers": ["cisa_kev", "nist_nvd_recent"], "reporting_groups": ["cisa", "nvd"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 8, "age_hours": 0.0, "half_life_hours": 8760.0, "decay_factor": 1.0}}
{"indicator": "CVE-2022-47966", "type": "cve", "source": "cisa_kev,nist_nvd_recent", "first_seen": "2023-01-23T00:00:00Z", "last_seen": "2026-10-24T22:12:15Z", "confidence": "high", "score": 88, "sightings": 519, "tags": "critical,cve,exploited-in-the-wild,nvd", "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "context": "Multiple Zoho ManageEngine products contain an unauthenticated remote code execution vulnerability due to the usage of an outdated third-party dependency, Apache Santuario.", "tlp": "CLEAR", "score_factors": {"score": 88, "confidence_base": 80, "source_count": 2, "source_identifiers": ["cisa_kev", "nist_nvd_recent"], "reporting_groups": ["cisa", "nvd"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 8, "age_hours": 0.0, "half_life_hours": 8760.0, "decay_factor": 1.0}}
{"indicator": "CVE-2020-3433", "type": "cve", "source": "cisa_kev,nist_nvd_recent", "first_seen": "2022-10-24T00:00:00Z", "last_seen": "2026-10-24T22:12:15Z", "confidence": "high", "score": 88, "sightings": 519, "tags": "cve,exploited-in-the-wild,high,nvd", "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "context": "Cisco AnyConnect Secure Mobility Client for Windows interprocess communication (IPC) channel allows for insufficient validation of resources that are loaded by the application at run time. An attacker with valid credentials on Windows could execute code on the affected machine with SYSTEM privileges.", "tlp": "CLEAR", "score_factors": {"score": 88, "confidence_base": 80, "source_count": 2, "source_identifiers": ["cisa_kev", "nist_nvd_recent"], "reporting_groups": ["cisa", "nvd"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 8, "age_hours": 0.0, "half_life_hours": 8760.0, "decay_factor": 1.0}}
{"indicator": "CVE-2020-3153", "type": "cve", "source": "cisa_kev,nist_nvd_recent", "first_seen": "2022-10-24T00:00:00Z", "last_seen": "2026-10-24T22:12:15Z", "confidence": "high", "score": 88, "sightings": 519, "tags": "cve,exploited-in-the-wild,medium,nvd", "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "context": "Cisco AnyConnect Secure Mobility Client for Windows allows for incorrect handling of directory paths. An attacker with valid credentials on Windows would be able to copy malicious files to arbitrary locations with system level privileges. This could include DLL pre-loading, DLL hijacking, and other related attacks.", "tlp": "CLEAR", "score_factors": {"score": 88, "confidence_base": 80, "source_count": 2, "source_identifiers": ["cisa_kev", "nist_nvd_recent"], "reporting_groups": ["cisa", "nvd"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 8, "age_hours": 0.0, "half_life_hours": 8760.0, "decay_factor": 1.0}}
{"indicator": "CVE-2018-19322", "type": "cve", "source": "cisa_kev,nist_nvd_recent", "first_seen": "2022-10-24T00:00:00Z", "last_seen": "2026-10-24T22:12:15Z", "confidence": "high", "score": 88, "sightings": 519, "tags": "cve,exploited-in-the-wild,high,nvd", "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "context": "The GPCIDrv and GDrv low-level drivers in GIGABYTE App Center, AORUS Graphics Engine, XTREME Gaming Engine, and OC GURU II expose functionality to read/write data from/to IO ports. This could be leveraged in a number of ways to ultimately run code with elevated privileges.", "tlp": "CLEAR", "score_factors": {"score": 88, "confidence_base": 80, "source_count": 2, "source_identifiers": ["cisa_kev", "nist_nvd_recent"], "reporting_groups": ["cisa", "nvd"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 8, "age_hours": 0.0, "half_life_hours": 8760.0, "decay_factor": 1.0}}
{"indicator": "CVE-2018-19321", "type": "cve", "source": "cisa_kev,nist_nvd_recent", "first_seen": "2022-10-24T00:00:00Z", "last_seen": "2026-10-24T22:12:15Z", "confidence": "high", "score": 88, "sightings": 519, "tags": "cve,exploited-in-the-wild,high,nvd", "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "context": "The GPCIDrv and GDrv low-level drivers in GIGABYTE App Center, AORUS Graphics Engine, XTREME Gaming Engine, and OC GURU II expose functionality to read and write arbitrary physical memory. This could be leveraged by a local attacker to elevate privileges.", "tlp": "CLEAR", "score_factors": {"score": 88, "confidence_base": 80, "source_count": 2, "source_identifiers": ["cisa_kev", "nist_nvd_recent"], "reporting_groups": ["cisa", "nvd"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 8, "age_hours": 0.0, "half_life_hours": 8760.0, "decay_factor": 1.0}}
{"indicator": "CVE-2018-19320", "type": "cve", "source": "cisa_kev,nist_nvd_recent", "first_seen": "2022-10-24T00:00:00Z", "last_seen": "2026-10-24T22:12:15Z", "confidence": "high", "score": 88, "sightings": 519, "tags": "cve,exploited-in-the-wild,high,nvd", "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "context": "The GDrv low-level driver in GIGABYTE App Center, AORUS Graphics Engine, XTREME Gaming Engine, and OC GURU II exposes ring0 memcpy-like functionality that could allow a local attacker to take complete control of the affected system.", "tlp": "CLEAR", "score_factors": {"score": 88, "confidence_base": 80, "source_count": 2, "source_identifiers": ["cisa_kev", "nist_nvd_recent"], "reporting_groups": ["cisa", "nvd"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 8, "age_hours": 0.0, "half_life_hours": 8760.0, "decay_factor": 1.0}}
{"indicator": "CVE-2022-40684", "type": "cve", "source": "cisa_kev,nist_nvd_recent", "first_seen": "2022-10-11T00:00:00Z", "last_seen": "2026-10-24T22:12:15Z", "confidence": "high", "score": 88, "sightings": 519, "tags": "critical,cve,exploited-in-the-wild,nvd", "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "context": "Fortinet FortiOS, FortiProxy, and FortiSwitchManager contain an authentication bypass vulnerability that could allow an unauthenticated attacker to perform operations on the administrative interface via specially crafted HTTP or HTTPS requests.", "tlp": "CLEAR", "score_factors": {"score": 88, "confidence_base": 80, "source_count": 2, "source_identifiers": ["cisa_kev", "nist_nvd_recent"], "reporting_groups": ["cisa", "nvd"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 8, "age_hours": 0.0, "half_life_hours": 8760.0, "decay_factor": 1.0}}
{"indicator": "CVE-2022-41352", "type": "cve", "source": "cisa_kev,nist_nvd_recent", "first_seen": "2022-09-26T02:15:10Z", "last_seen": "2026-10-24T22:12:15Z", "confidence": "high", "score": 88, "sightings": 519, "tags": "critical,cve,exploited-in-the-wild,nvd", "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "context": "Synacor Zimbra Collaboration Suite (ZCS) allows an attacker to upload arbitrary files using cpio package to gain incorrect access to any other user accounts.", "tlp": "CLEAR", "score_factors": {"score": 88, "confidence_base": 80, "source_count": 2, "source_identifiers": ["cisa_kev", "nist_nvd_recent"], "reporting_groups": ["cisa", "nvd"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 8, "age_hours": 0.0, "half_life_hours": 8760.0, "decay_factor": 1.0}}
{"indicator": "CVE-2022-37969", "type": "cve", "source": "cisa_kev,nist_nvd_recent", "first_seen": "2022-09-13T19:15:12Z", "last_seen": "2026-10-24T22:12:15Z", "confidence": "high", "score": 88, "sightings": 519, "tags": "cve,exploited-in-the-wild,high,nvd", "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "context": "Microsoft Windows Common Log File System (CLFS) driver contains an unspecified vulnerability that allows for privilege escalation.", "tlp": "CLEAR", "score_factors": {"score": 88, "confidence_base": 80, "source_count": 2, "source_identifiers": ["cisa_kev", "nist_nvd_recent"], "reporting_groups": ["cisa", "nvd"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 8, "age_hours": 0.0, "half_life_hours": 8760.0, "decay_factor": 1.0}}
{"indicator": "CVE-2022-2294", "type": "cve", "source": "cisa_kev,nist_nvd_recent", "first_seen": "2022-08-25T00:00:00Z", "last_seen": "2026-10-24T22:12:15Z", "confidence": "high", "score": 88, "sightings": 519, "tags": "cve,exploited-in-the-wild,high,nvd", "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "context": "WebRTC, an open-source project providing web browsers with real-time communication, contains a heap buffer overflow vulnerability that allows an attacker to perform shellcode execution. This vulnerability impacts web browsers using WebRTC including but not limited to Google Chrome.", "tlp": "CLEAR", "score_factors": {"score": 88, "confidence_base": 80, "source_count": 2, "source_identifiers": ["cisa_kev", "nist_nvd_recent"], "reporting_groups": ["cisa", "nvd"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 8, "age_hours": 0.0, "half_life_hours": 8760.0, "decay_factor": 1.0}}
{"indicator": "CVE-2022-37042", "type": "cve", "source": "cisa_kev,nist_nvd_recent", "first_seen": "2022-08-11T00:00:00Z", "last_seen": "2026-10-24T22:12:15Z", "confidence": "high", "score": 88, "sightings": 519, "tags": "critical,cve,exploited-in-the-wild,nvd", "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "context": "Synacor Zimbra Collaboration Suite (ZCS) contains an authentication bypass vulnerability in MailboxImportServlet. This vulnerability was chained with CVE-2022-27925 which allows for unauthenticated remote code execution.", "tlp": "CLEAR", "score_factors": {"score": 88, "confidence_base": 80, "source_count": 2, "source_identifiers": ["cisa_kev", "nist_nvd_recent"], "reporting_groups": ["cisa", "nvd"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 8, "age_hours": 0.0, "half_life_hours": 8760.0, "decay_factor": 1.0}}
{"indicator": "CVE-2022-29499", "type": "cve", "source": "cisa_kev,nist_nvd_recent", "first_seen": "2022-06-27T00:00:00Z", "last_seen": "2026-10-24T22:12:15Z", "confidence": "high", "score": 88, "sightings": 519, "tags": "critical,cve,exploited-in-the-wild,nvd", "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "context": "The Service Appliance component in Mitel MiVoice Connect allows remote code execution due to incorrect data validation.", "tlp": "CLEAR", "score_factors": {"score": 88, "confidence_base": 80, "source_count": 2, "source_identifiers": ["cisa_kev", "nist_nvd_recent"], "reporting_groups": ["cisa", "nvd"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 8, "age_hours": 0.0, "half_life_hours": 8760.0, "decay_factor": 1.0}}
{"indicator": "CVE-2021-4034", "type": "cve", "source": "cisa_kev,nist_nvd_recent", "first_seen": "2022-06-27T00:00:00Z", "last_seen": "2026-10-24T22:12:15Z", "confidence": "high", "score": 88, "sightings": 519, "tags": "cve,exploited-in-the-wild,high,nvd", "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "context": "The Red Hat polkit pkexec utility contains an out-of-bounds read and write vulnerability that allows for privilege escalation with administrative rights.", "tlp": "CLEAR", "score_factors": {"score": 88, "confidence_base": 80, "source_count": 2, "source_identifiers": ["cisa_kev", "nist_nvd_recent"], "reporting_groups": ["cisa", "nvd"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 8, "age_hours": 0.0, "half_life_hours": 8760.0, "decay_factor": 1.0}}
{"indicator": "CVE-2022-30190", "type": "cve", "source": "cisa_kev,nist_nvd_recent", "first_seen": "2022-06-14T00:00:00Z", "last_seen": "2026-10-24T22:12:15Z", "confidence": "high", "score": 88, "sightings": 519, "tags": "cve,exploited-in-the-wild,high,nvd", "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "context": "A remote code execution vulnerability exists when MSDT is called using the URL protocol from a calling application such as Word. An attacker who successfully exploits this vulnerability can run code with the privileges of the calling application.", "tlp": "CLEAR", "score_factors": {"score": 88, "confidence_base": 80, "source_count": 2, "source_identifiers": ["cisa_kev", "nist_nvd_recent"], "reporting_groups": ["cisa", "nvd"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 8, "age_hours": 0.0, "half_life_hours": 8760.0, "decay_factor": 1.0}}
{"indicator": "CVE-2016-0034", "type": "cve", "source": "cisa_kev,nist_nvd_recent", "first_seen": "2022-05-25T00:00:00Z", "last_seen": "2026-10-24T22:12:15Z", "confidence": "high", "score": 88, "sightings": 519, "tags": "cve,exploited-in-the-wild,high,nvd", "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "context": "Microsoft Silverlight mishandles negative offsets during decoding, which allows attackers to execute remote code or cause a denial-of-service (DoS).", "tlp": "CLEAR", "score_factors": {"score": 88, "confidence_base": 80, "source_count": 2, "source_identifiers": ["cisa_kev", "nist_nvd_recent"], "reporting_groups": ["cisa", "nvd"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 8, "age_hours": 0.0, "half_life_hours": 8760.0, "decay_factor": 1.0}}
{"indicator": "CVE-2013-0074", "type": "cve", "source": "cisa_kev,nist_nvd_recent", "first_seen": "2022-05-25T00:00:00Z", "last_seen": "2026-10-24T22:12:15Z", "confidence": "high", "score": 88, "sightings": 519, "tags": "cve,exploited-in-the-wild,high,nvd", "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "context": "Microsoft Silverlight does not properly validate pointers during HTML object rendering, which allows remote attackers to execute code via a crafted Silverlight application.", "tlp": "CLEAR", "score_factors": {"score": 88, "confidence_base": 80, "source_count": 2, "source_identifiers": ["cisa_kev", "nist_nvd_recent"], "reporting_groups": ["cisa", "nvd"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 8, "age_hours": 0.0, "half_life_hours": 8760.0, "decay_factor": 1.0}}
{"indicator": "CVE-2018-19943", "type": "cve", "source": "cisa_kev,nist_nvd_recent", "first_seen": "2022-05-24T00:00:00Z", "last_seen": "2026-10-24T22:12:15Z", "confidence": "high", "score": 88, "sightings": 519, "tags": "cve,exploited-in-the-wild,high,nvd", "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "context": "A cross-site scripting vulnerability affecting QNAP NAS File Station could allow remote attackers to inject malicious code.", "tlp": "CLEAR", "score_factors": {"score": 88, "confidence_base": 80, "source_count": 2, "source_identifiers": ["cisa_kev", "nist_nvd_recent"], "reporting_groups": ["cisa", "nvd"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 8, "age_hours": 0.0, "half_life_hours": 8760.0, "decay_factor": 1.0}}
{"indicator": "CVE-2017-18362", "type": "cve", "source": "cisa_kev,nist_nvd_recent", "first_seen": "2022-05-24T00:00:00Z", "last_seen": "2026-10-24T22:12:15Z", "confidence": "high", "score": 88, "sightings": 519, "tags": "critical,cve,exploited-in-the-wild,nvd", "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "context": "ConnectWise ManagedITSync integration for Kaseya VSA is vulnerable to unauthenticated remote commands that allow full direct access to the Kaseya VSA database.", "tlp": "CLEAR", "score_factors": {"score": 88, "confidence_base": 80, "source_count": 2, "source_identifiers": ["cisa_kev", "nist_nvd_recent"], "reporting_groups": ["cisa", "nvd"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 8, "age_hours": 0.0, "half_life_hours": 8760.0, "decay_factor": 1.0}}
{"indicator": "CVE-2016-3351", "type": "cve", "source": "cisa_kev,nist_nvd_recent", "first_seen": "2022-05-24T00:00:00Z", "last_seen": "2026-10-24T22:12:15Z", "confidence": "high", "score": 88, "sightings": 519, "tags": "cve,exploited-in-the-wild,medium,nvd", "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "context": "An information disclosure vulnerability exists in the way that certain functions in Internet Explorer and Edge handle objects in memory. The vulnerability could allow an attacker to detect specific files on the user's computer.", "tlp": "CLEAR", "score_factors": {"score": 88, "confidence_base": 80, "source_count": 2, "source_identifiers": ["cisa_kev", "nist_nvd_recent"], "reporting_groups": ["cisa", "nvd"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 8, "age_hours": 0.0, "half_life_hours": 8760.0, "decay_factor": 1.0}}
{"indicator": "CVE-2020-0638", "type": "cve", "source": "cisa_kev,nist_nvd_recent", "first_seen": "2022-05-23T00:00:00Z", "last_seen": "2026-10-24T22:12:15Z", "confidence": "high", "score": 88, "sightings": 519, "tags": "cve,exploited-in-the-wild,high,nvd", "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "context": "Microsoft Update Notification Manager contains an unspecified vulnerability that allows for privilege escalation.", "tlp": "CLEAR", "score_factors": {"score": 88, "confidence_base": 80, "source_count": 2, "source_identifiers": ["cisa_kev", "nist_nvd_recent"], "reporting_groups": ["cisa", "nvd"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 8, "age_hours": 0.0, "half_life_hours": 8760.0, "decay_factor": 1.0}}
{"indicator": "CVE-2019-8720", "type": "cve", "source": "cisa_kev,nist_nvd_recent", "first_seen": "2022-05-23T00:00:00Z", "last_seen": "2026-10-24T22:12:15Z", "confidence": "high", "score": 88, "sightings": 519, "tags": "cve,exploited-in-the-wild,high,nvd", "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "context": "WebKitGTK contains a memory corruption vulnerability which can allow an attacker to perform remote code execution.", "tlp": "CLEAR", "score_factors": {"score": 88, "confidence_base": 80, "source_count": 2, "source_identifiers": ["cisa_kev", "nist_nvd_recent"], "reporting_groups": ["cisa", "nvd"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 8, "age_hours": 0.0, "half_life_hours": 8760.0, "decay_factor": 1.0}}
{"indicator": "CVE-2019-1385", "type": "cve", "source": "cisa_kev,nist_nvd_recent", "first_seen": "2022-05-23T00:00:00Z", "last_seen": "2026-10-24T22:12:15Z", "confidence": "high", "score": 88, "sightings": 519, "tags": "cve,exploited-in-the-wild,high,nvd", "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "context": "A privilege escalation vulnerability exists when the Windows AppX Deployment Extensions improperly performs privilege management, resulting in access to system files.", "tlp": "CLEAR", "score_factors": {"score": 88, "confidence_base": 80, "source_count": 2, "source_identifiers": ["cisa_kev", "nist_nvd_recent"], "reporting_groups": ["cisa", "nvd"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 8, "age_hours": 0.0, "half_life_hours": 8760.0, "decay_factor": 1.0}}
{"indicator": "CVE-2019-1130", "type": "cve", "source": "cisa_kev,nist_nvd_recent", "first_seen": "2022-05-23T00:00:00Z", "last_seen": "2026-10-24T22:12:15Z", "confidence": "high", "score": 88, "sightings": 519, "tags": "cve,exploited-in-the-wild,high,nvd", "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "context": "A privilege escalation vulnerability exists when Windows AppX Deployment Service (AppXSVC) improperly handles hard links.", "tlp": "CLEAR", "score_factors": {"score": 88, "confidence_base": 80, "source_count": 2, "source_identifiers": ["cisa_kev", "nist_nvd_recent"], "reporting_groups": ["cisa", "nvd"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 8, "age_hours": 0.0, "half_life_hours": 8760.0, "decay_factor": 1.0}}
{"indicator": "CVE-2022-30333", "type": "cve", "source": "cisa_kev,nist_nvd_recent", "first_seen": "2022-05-09T08:15:06Z", "last_seen": "2026-10-24T22:12:15Z", "confidence": "high", "score": 88, "sightings": 519, "tags": "cve,exploited-in-the-wild,high,nvd", "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "context": "RARLAB UnRAR on Linux and UNIX contains a directory traversal vulnerability, allowing an attacker to write to files during an extract (unpack) operation.", "tlp": "CLEAR", "score_factors": {"score": 88, "confidence_base": 80, "source_count": 2, "source_identifiers": ["cisa_kev", "nist_nvd_recent"], "reporting_groups": ["cisa", "nvd"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 8, "age_hours": 0.0, "half_life_hours": 8760.0, "decay_factor": 1.0}}
{"indicator": "CVE-2022-27925", "type": "cve", "source": "cisa_kev,nist_nvd_recent", "first_seen": "2022-04-21T00:15:08Z", "last_seen": "2026-10-24T22:12:15Z", "confidence": "high", "score": 88, "sightings": 519, "tags": "cve,exploited-in-the-wild,high,nvd", "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "context": "Synacor Zimbra Collaboration Suite (ZCS) contains flaw in the mboximport functionality, allowing an authenticated attacker to upload arbitrary files to perform remote code execution. This vulnerability was chained with CVE-2022-37042 which allows for unauthenticated remote code execution.", "tlp": "CLEAR", "score_factors": {"score": 88, "confidence_base": 80, "source_count": 2, "source_identifiers": ["cisa_kev", "nist_nvd_recent"], "reporting_groups": ["cisa", "nvd"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 8, "age_hours": 0.0, "half_life_hours": 8760.0, "decay_factor": 1.0}}
{"indicator": "CVE-2022-27924", "type": "cve", "source": "cisa_kev,nist_nvd_recent", "first_seen": "2022-04-21T00:15:08Z", "last_seen": "2026-10-24T22:12:15Z", "confidence": "high", "score": 88, "sightings": 519, "tags": "cve,exploited-in-the-wild,high,nvd", "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "context": "Synacor Zimbra Collaboration Suite (ZCS) allows an attacker to inject memcache commands into a targeted instance which causes an overwrite of arbitrary cached entries.", "tlp": "CLEAR", "score_factors": {"score": 88, "confidence_base": 80, "source_count": 2, "source_identifiers": ["cisa_kev", "nist_nvd_recent"], "reporting_groups": ["cisa", "nvd"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 8, "age_hours": 0.0, "half_life_hours": 8760.0, "decay_factor": 1.0}}
{"indicator": "CVE-2018-20753", "type": "cve", "source": "cisa_kev,nist_nvd_recent", "first_seen": "2022-04-13T00:00:00Z", "last_seen": "2026-10-24T22:12:15Z", "confidence": "high", "score": 88, "sightings": 519, "tags": "critical,cve,exploited-in-the-wild,nvd", "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "context": "Kaseya VSA RMM allows unprivileged remote attackers to execute PowerShell payloads on all managed devices.", "tlp": "CLEAR", "score_factors": {"score": 88, "confidence_base": 80, "source_count": 2, "source_identifiers": ["cisa_kev", "nist_nvd_recent"], "reporting_groups": ["cisa", "nvd"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 8, "age_hours": 0.0, "half_life_hours": 8760.0, "decay_factor": 1.0}}
{"indicator": "CVE-2021-42287", "type": "cve", "source": "cisa_kev,nist_nvd_recent", "first_seen": "2022-04-11T00:00:00Z", "last_seen": "2026-10-24T22:12:15Z", "confidence": "high", "score": 88, "sightings": 519, "tags": "cve,exploited-in-the-wild,high,nvd", "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "context": "Microsoft Active Directory Domain Services contains an unspecified vulnerability that allows for privilege escalation.", "tlp": "CLEAR", "score_factors": {"score": 88, "confidence_base": 80, "source_count": 2, "source_identifiers": ["cisa_kev", "nist_nvd_recent"], "reporting_groups": ["cisa", "nvd"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 8, "age_hours": 0.0, "half_life_hours": 8760.0, "decay_factor": 1.0}}
{"indicator": "CVE-2021-42278", "type": "cve", "source": "cisa_kev,nist_nvd_recent", "first_seen": "2022-04-11T00:00:00Z", "last_seen": "2026-10-24T22:12:15Z", "confidence": "high", "score": 88, "sightings": 519, "tags": "cve,exploited-in-the-wild,high,nvd", "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "context": "Microsoft Active Directory Domain Services contains an unspecified vulnerability that allows for privilege escalation.", "tlp": "CLEAR", "score_factors": {"score": 88, "confidence_base": 80, "source_count": 2, "source_identifiers": ["cisa_kev", "nist_nvd_recent"], "reporting_groups": ["cisa", "nvd"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 8, "age_hours": 0.0, "half_life_hours": 8760.0, "decay_factor": 1.0}}
{"indicator": "CVE-2021-34484", "type": "cve", "source": "cisa_kev,nist_nvd_recent", "first_seen": "2022-03-31T00:00:00Z", "last_seen": "2026-10-24T22:12:15Z", "confidence": "high", "score": 88, "sightings": 519, "tags": "cve,exploited-in-the-wild,high,nvd", "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "context": "Microsoft Windows User Profile Service contains an unspecified vulnerability that allows for privilege escalation.", "tlp": "CLEAR", "score_factors": {"score": 88, "confidence_base": 80, "source_count": 2, "source_identifiers": ["cisa_kev", "nist_nvd_recent"], "reporting_groups": ["cisa", "nvd"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 8, "age_hours": 0.0, "half_life_hours": 8760.0, "decay_factor": 1.0}}
{"indicator": "CVE-2021-38646", "type": "cve", "source": "cisa_kev,nist_nvd_recent", "first_seen": "2022-03-28T00:00:00Z", "last_seen": "2026-10-24T22:12:15Z", "confidence": "high", "score": 88, "sightings": 519, "tags": "cve,exploited-in-the-wild,high,nvd", "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "context": "Microsoft Office Access Connectivity Engine contains an unspecified vulnerability which can allow for remote code execution.", "tlp": "CLEAR", "score_factors": {"score": 88, "confidence_base": 80, "source_count": 2, "source_identifiers": ["cisa_kev", "nist_nvd_recent"], "reporting_groups": ["cisa", "nvd"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 8, "age_hours": 0.0, "half_life_hours": 8760.0, "decay_factor": 1.0}}
{"indicator": "CVE-2021-34486", "type": "cve", "source": "cisa_kev,nist_nvd_recent", "first_seen": "2022-03-28T00:00:00Z", "last_seen": "2026-10-24T22:12:15Z", "confidence": "high", "score": 88, "sightings": 519, "tags": "cve,exploited-in-the-wild,high,nvd", "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "context": "Microsoft Windows Event Tracing contains an unspecified vulnerability which can allow for privilege escalation.", "tlp": "CLEAR", "score_factors": {"score": 88, "confidence_base": 80, "source_count": 2, "source_identifiers": ["cisa_kev", "nist_nvd_recent"], "reporting_groups": ["cisa", "nvd"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 8, "age_hours": 0.0, "half_life_hours": 8760.0, "decay_factor": 1.0}}
{"indicator": "CVE-2019-15107", "type": "cve", "source": "cisa_kev,nist_nvd_recent", "first_seen": "2022-03-25T00:00:00Z", "last_seen": "2026-10-24T22:12:15Z", "confidence": "high", "score": 88, "sightings": 519, "tags": "critical,cve,exploited-in-the-wild,nvd", "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "context": "An issue was discovered in Webmin. The parameter old in password_change.cgi contains a command injection vulnerability.", "tlp": "CLEAR", "score_factors": {"score": 88, "confidence_base": 80, "source_count": 2, "source_identifiers": ["cisa_kev", "nist_nvd_recent"], "reporting_groups": ["cisa", "nvd"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 8, "age_hours": 0.0, "half_life_hours": 8760.0, "decay_factor": 1.0}}
{"indicator": "CVE-2018-1273", "type": "cve", "source": "cisa_kev,nist_nvd_recent", "first_seen": "2022-03-25T00:00:00Z", "last_seen": "2026-10-24T22:12:15Z", "confidence": "high", "score": 88, "sightings": 519, "tags": "critical,cve,exploited-in-the-wild,nvd", "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "context": "Spring Data Commons contains a property binder vulnerability which can allow an attacker to perform remote code execution.", "tlp": "CLEAR", "score_factors": {"score": 88, "confidence_base": 80, "source_count": 2, "source_identifiers": ["cisa_kev", "nist_nvd_recent"], "reporting_groups": ["cisa", "nvd"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 8, "age_hours": 0.0, "half_life_hours": 8760.0, "decay_factor": 1.0}}
{"indicator": "CVE-2018-11138", "type": "cve", "source": "cisa_kev,nist_nvd_recent", "first_seen": "2022-03-25T00:00:00Z", "last_seen": "2026-10-24T22:12:15Z", "confidence": "high", "score": 88, "sightings": 519, "tags": "critical,cve,exploited-in-the-wild,nvd", "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "context": "The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance is accessible by anonymous users and can be abused to perform remote code execution.", "tlp": "CLEAR", "score_factors": {"score": 88, "confidence_base": 80, "source_count": 2, "source_identifiers": ["cisa_kev", "nist_nvd_recent"], "reporting_groups": ["cisa", "nvd"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 8, "age_hours": 0.0, "half_life_hours": 8760.0, "decay_factor": 1.0}}
{"indicator": "CVE-2017-12617", "type": "cve", "source": "cisa_kev,nist_nvd_recent", "first_seen": "2022-03-25T00:00:00Z", "last_seen": "2026-10-24T22:12:15Z", "confidence": "high", "score": 88, "sightings": 519, "tags": "cve,exploited-in-the-wild,high,nvd", "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "context": "When running Apache Tomcat, it is possible to upload a JSP file to the server via a specially crafted request. This JSP could then be requested and any code it contained would be executed by the server.", "tlp": "CLEAR", "score_factors": {"score": 88, "confidence_base": 80, "source_count": 2, "source_identifiers": ["cisa_kev", "nist_nvd_recent"], "reporting_groups": ["cisa", "nvd"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 8, "age_hours": 0.0, "half_life_hours": 8760.0, "decay_factor": 1.0}}
{"indicator": "CVE-2017-12615", "type": "cve", "source": "cisa_kev,nist_nvd_recent", "first_seen": "2022-03-25T00:00:00Z", "last_seen": "2026-10-24T22:12:15Z", "confidence": "high", "score": 88, "sightings": 519, "tags": "cve,exploited-in-the-wild,high,nvd", "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "context": "When running Apache Tomcat on Windows with HTTP PUTs enabled, it is possible to upload a JSP file to the server via a specially crafted request. This JSP could then be requested and any code it contained would be executed by the server.", "tlp": "CLEAR", "score_factors": {"score": 88, "confidence_base": 80, "source_count": 2, "source_identifiers": ["cisa_kev", "nist_nvd_recent"], "reporting_groups": ["cisa", "nvd"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 8, "age_hours": 0.0, "half_life_hours": 8760.0, "decay_factor": 1.0}}
{"indicator": "CVE-2019-1405", "type": "cve", "source": "cisa_kev,nist_nvd_recent", "first_seen": "2022-03-15T00:00:00Z", "last_seen": "2026-10-24T22:12:15Z", "confidence": "high", "score": 88, "sightings": 519, "tags": "cve,exploited-in-the-wild,high,nvd", "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "context": "A privilege escalation vulnerability exists when the Windows UPnP service improperly allows COM object creation.", "tlp": "CLEAR", "score_factors": {"score": 88, "confidence_base": 80, "source_count": 2, "source_identifiers": ["cisa_kev", "nist_nvd_recent"], "reporting_groups": ["cisa", "nvd"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 8, "age_hours": 0.0, "half_life_hours": 8760.0, "decay_factor": 1.0}}
{"indicator": "CVE-2019-1069", "type": "cve", "source": "cisa_kev,nist_nvd_recent", "first_seen": "2022-03-15T00:00:00Z", "last_seen": "2026-10-24T22:12:15Z", "confidence": "high", "score": 88, "sightings": 519, "tags": "cve,exploited-in-the-wild,high,nvd", "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "context": "A privilege escalation vulnerability exists in the way the Task Scheduler Service validates certain file operations.", "tlp": "CLEAR", "score_factors": {"score": 88, "confidence_base": 80, "source_count": 2, "source_identifiers": ["cisa_kev", "nist_nvd_recent"], "reporting_groups": ["cisa", "nvd"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 8, "age_hours": 0.0, "half_life_hours": 8760.0, "decay_factor": 1.0}}
{"indicator": "CVE-2018-8120", "type": "cve", "source": "cisa_kev,nist_nvd_recent", "first_seen": "2022-03-15T00:00:00Z", "last_seen": "2026-10-24T22:12:15Z", "confidence": "high", "score": 88, "sightings": 519, "tags": "cve,exploited-in-the-wild,high,nvd", "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "context": "A privilege escalation vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory.", "tlp": "CLEAR", "score_factors": {"score": 88, "confidence_base": 80, "source_count": 2, "source_identifiers": ["cisa_kev", "nist_nvd_recent"], "reporting_groups": ["cisa", "nvd"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 8, "age_hours": 0.0, "half_life_hours": 8760.0, "decay_factor": 1.0}}
{"indicator": "CVE-2015-2546", "type": "cve", "source": "cisa_kev,nist_nvd_recent", "first_seen": "2022-03-15T00:00:00Z", "last_seen": "2026-10-24T22:12:15Z", "confidence": "high", "score": 88, "sightings": 519, "tags": "cve,exploited-in-the-wild,high,nvd", "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "context": "The kernel-mode driver in Microsoft Windows OS and Server allows local users to gain privileges via a crafted application.", "tlp": "CLEAR", "score_factors": {"score": 88, "confidence_base": 80, "source_count": 2, "source_identifiers": ["cisa_kev", "nist_nvd_recent"], "reporting_groups": ["cisa", "nvd"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 8, "age_hours": 0.0, "half_life_hours": 8760.0, "decay_factor": 1.0}}
{"indicator": "CVE-2022-26486", "type": "cve", "source": "cisa_kev,nist_nvd_recent", "first_seen": "2022-03-07T00:00:00Z", "last_seen": "2026-10-24T22:12:15Z", "confidence": "high", "score": 88, "sightings": 519, "tags": "critical,cve,exploited-in-the-wild,nvd", "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "context": "Mozilla Firefox contains a use-after-free vulnerability in WebGPU IPC Framework which can be exploited to perform arbitrary code execution.", "tlp": "CLEAR", "score_factors": {"score": 88, "confidence_base": 80, "source_count": 2, "source_identifiers": ["cisa_kev", "nist_nvd_recent"], "reporting_groups": ["cisa", "nvd"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 8, "age_hours": 0.0, "half_life_hours": 8760.0, "decay_factor": 1.0}}
{"indicator": "CVE-2022-26485", "type": "cve", "source": "cisa_kev,nist_nvd_recent", "first_seen": "2022-03-07T00:00:00Z", "last_seen": "2026-10-24T22:12:15Z", "confidence": "high", "score": 88, "sightings": 519, "tags": "cve,exploited-in-the-wild,high,nvd", "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "context": "Mozilla Firefox contains a use-after-free vulnerability in XSLT parameter processing which can be exploited to perform arbitrary code execution.", "tlp": "CLEAR", "score_factors": {"score": 88, "confidence_base": 80, "source_count": 2, "source_identifiers": ["cisa_kev", "nist_nvd_recent"], "reporting_groups": ["cisa", "nvd"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 8, "age_hours": 0.0, "half_life_hours": 8760.0, "decay_factor": 1.0}}
{"indicator": "CVE-2009-3960", "type": "cve", "source": "cisa_kev,nist_nvd_recent", "first_seen": "2022-03-07T00:00:00Z", "last_seen": "2026-10-24T22:12:15Z", "confidence": "high", "score": 88, "sightings": 519, "tags": "cve,exploited-in-the-wild,medium,nvd", "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "context": "Adobe BlazeDS, which is utilized in LifeCycle and Coldfusion, contains a vulnerability that allows for information disclosure.", "tlp": "CLEAR", "score_factors": {"score": 88, "confidence_base": 80, "source_count": 2, "source_identifiers": ["cisa_kev", "nist_nvd_recent"], "reporting_groups": ["cisa", "nvd"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 8, "age_hours": 0.0, "half_life_hours": 8760.0, "decay_factor": 1.0}}
{"indicator": "CVE-2020-1938", "type": "cve", "source": "cisa_kev,nist_nvd_recent", "first_seen": "2022-03-03T00:00:00Z", "last_seen": "2026-10-24T22:12:15Z", "confidence": "high", "score": 88, "sightings": 519, "tags": "critical,cve,exploited-in-the-wild,nvd", "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "context": "Apache Tomcat treats Apache JServ Protocol (AJP) connections as having higher trust than, for example, a similar HTTP connection. If such connections are available to an attacker, they can be exploited.", "tlp": "CLEAR", "score_factors": {"score": 88, "confidence_base": 80, "source_count": 2, "source_identifiers": ["cisa_kev", "nist_nvd_recent"], "reporting_groups": ["cisa", "nvd"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 8, "age_hours": 0.0, "half_life_hours": 8760.0, "decay_factor": 1.0}}
{"indicator": "CVE-2015-1701", "type": "cve", "source": "cisa_kev,nist_nvd_recent", "first_seen": "2022-03-03T00:00:00Z", "last_seen": "2026-10-24T22:12:15Z", "confidence": "high", "score": 88, "sightings": 519, "tags": "cve,exploited-in-the-wild,high,nvd", "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "context": "An unspecified vulnerability exists in the Win32k.sys kernel-mode driver in Microsoft Windows Server that allows a local attacker to execute arbitrary code with elevated privileges.", "tlp": "CLEAR", "score_factors": {"score": 88, "confidence_base": 80, "source_count": 2, "source_identifiers": ["cisa_kev", "nist_nvd_recent"], "reporting_groups": ["cisa", "nvd"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 8, "age_hours": 0.0, "half_life_hours": 8760.0, "decay_factor": 1.0}}
{"indicator": "CVE-2012-4681", "type": "cve", "source": "cisa_kev,nist_nvd_recent", "first_seen": "2022-03-03T00:00:00Z", "last_seen": "2026-10-24T22:12:15Z", "confidence": "high", "score": 88, "sightings": 519, "tags": "critical,cve,exploited-in-the-wild,nvd", "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "context": "The Java Runtime Environment (JRE) component in Oracle Java SE allow for remote code execution.", "tlp": "CLEAR", "score_factors": {"score": 88, "confidence_base": 80, "source_count": 2, "source_identifiers": ["cisa_kev", "nist_nvd_recent"], "reporting_groups": ["cisa", "nvd"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 8, "age_hours": 0.0, "half_life_hours": 8760.0, "decay_factor": 1.0}}
{"indicator": "CVE-2012-1723", "type": "cve", "source": "cisa_kev,nist_nvd_recent", "first_seen": "2022-03-03T00:00:00Z", "last_seen": "2026-10-24T22:12:15Z", "confidence": "high", "score": 88, "sightings": 519, "tags": "critical,cve,exploited-in-the-wild,nvd", "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "context": "Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE allows remote attackers to affect confidentiality, integrity, and availability via Unknown vectors related to Hotspot.", "tlp": "CLEAR", "score_factors": {"score": 88, "confidence_base": 80, "source_count": 2, "source_identifiers": ["cisa_kev", "nist_nvd_recent"], "reporting_groups": ["cisa", "nvd"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 8, "age_hours": 0.0, "half_life_hours": 8760.0, "decay_factor": 1.0}}
{"indicator": "CVE-2012-0507", "type": "cve", "source": "cisa_kev,nist_nvd_recent", "first_seen": "2022-03-03T00:00:00Z", "last_seen": "2026-10-24T22:12:15Z", "confidence": "high", "score": 88, "sightings": 519, "tags": "critical,cve,exploited-in-the-wild,nvd", "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "context": "An incorrect type vulnerability exists in the Concurrency component of Oracle's Java Runtime Environment allows an attacker to remotely execute arbitrary code.", "tlp": "CLEAR", "score_factors": {"score": 88, "confidence_base": 80, "source_count": 2, "source_identifiers": ["cisa_kev", "nist_nvd_recent"], "reporting_groups": ["cisa", "nvd"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 8, "age_hours": 0.0, "half_life_hours": 8760.0, "decay_factor": 1.0}}
{"indicator": "CVE-2010-0188", "type": "cve", "source": "cisa_kev,nist_nvd_recent", "first_seen": "2022-03-03T00:00:00Z", "last_seen": "2026-10-24T22:12:15Z", "confidence": "high", "score": 88, "sightings": 519, "tags": "cve,exploited-in-the-wild,high,nvd", "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "context": "Unspecified vulnerability in Adobe Reader and Acrobat allows attackers to cause a denial of service or possibly execute arbitrary code.", "tlp": "CLEAR", "score_factors": {"score": 88, "confidence_base": 80, "source_count": 2, "source_identifiers": ["cisa_kev", "nist_nvd_recent"], "reporting_groups": ["cisa", "nvd"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 8, "age_hours": 0.0, "half_life_hours": 8760.0, "decay_factor": 1.0}}
{"indicator": "CVE-2022-24682", "type": "cve", "source": "cisa_kev,nist_nvd_recent", "first_seen": "2022-02-25T00:00:00Z", "last_seen": "2026-10-24T22:12:15Z", "confidence": "high", "score": 88, "sightings": 519, "tags": "cve,exploited-in-the-wild,medium,nvd", "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "context": "Synacor Zimbra Collaboration Suite (ZCS) contains a cross-site scripting (XSS) vulnerability in the Calendar feature that allows an attacker to execute arbitrary code.", "tlp": "CLEAR", "score_factors": {"score": 88, "confidence_base": 80, "source_count": 2, "source_identifiers": ["cisa_kev", "nist_nvd_recent"], "reporting_groups": ["cisa", "nvd"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 8, "age_hours": 0.0, "half_life_hours": 8760.0, "decay_factor": 1.0}}
{"indicator": "CVE-2019-0752", "type": "cve", "source": "cisa_kev,nist_nvd_recent", "first_seen": "2022-02-15T00:00:00Z", "last_seen": "2026-10-24T22:12:15Z", "confidence": "high", "score": 88, "sightings": 519, "tags": "cve,exploited-in-the-wild,high,nvd", "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "context": "A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer", "tlp": "CLEAR", "score_factors": {"score": 88, "confidence_base": 80, "source_count": 2, "source_identifiers": ["cisa_kev", "nist_nvd_recent"], "reporting_groups": ["cisa", "nvd"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 8, "age_hours": 0.0, "half_life_hours": 8760.0, "decay_factor": 1.0}}
{"indicator": "CVE-2018-8174", "type": "cve", "source": "cisa_kev,nist_nvd_recent", "first_seen": "2022-02-15T00:00:00Z", "last_seen": "2026-10-24T22:12:15Z", "confidence": "high", "score": 88, "sightings": 519, "tags": "cve,exploited-in-the-wild,high,nvd", "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "context": "A remote code execution vulnerability exists in the way that the VBScript engine handles objects in memory, aka \"Windows VBScript Engine Remote Code Execution\"", "tlp": "CLEAR", "score_factors": {"score": 88, "confidence_base": 80, "source_count": 2, "source_identifiers": ["cisa_kev", "nist_nvd_recent"], "reporting_groups": ["cisa", "nvd"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 8, "age_hours": 0.0, "half_life_hours": 8760.0, "decay_factor": 1.0}}
{"indicator": "CVE-2018-20250", "type": "cve", "source": "cisa_kev,nist_nvd_recent", "first_seen": "2022-02-15T00:00:00Z", "last_seen": "2026-10-24T22:12:15Z", "confidence": "high", "score": 88, "sightings": 519, "tags": "cve,exploited-in-the-wild,high,nvd", "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "context": "WinRAR Absolute Path Traversal vulnerability leads to Remote Code Execution", "tlp": "CLEAR", "score_factors": {"score": 88, "confidence_base": 80, "source_count": 2, "source_identifiers": ["cisa_kev", "nist_nvd_recent"], "reporting_groups": ["cisa", "nvd"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 8, "age_hours": 0.0, "half_life_hours": 8760.0, "decay_factor": 1.0}}
{"indicator": "CVE-2021-36934", "type": "cve", "source": "cisa_kev,nist_nvd_recent", "first_seen": "2022-02-10T00:00:00Z", "last_seen": "2026-10-24T22:12:15Z", "confidence": "high", "score": 88, "sightings": 519, "tags": "cve,exploited-in-the-wild,high,nvd", "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "context": "If a Volume Shadow Copy (VSS) shadow copy of the system drive is available, users can read the SAM file which would allow any user to escalate privileges to SYSTEM level.", "tlp": "CLEAR", "score_factors": {"score": 88, "confidence_base": 80, "source_count": 2, "source_identifiers": ["cisa_kev", "nist_nvd_recent"], "reporting_groups": ["cisa", "nvd"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 8, "age_hours": 0.0, "half_life_hours": 8760.0, "decay_factor": 1.0}}
{"indicator": "CVE-2017-10271", "type": "cve", "source": "cisa_kev,nist_nvd_recent", "first_seen": "2022-02-10T00:00:00Z", "last_seen": "2026-10-24T22:12:15Z", "confidence": "high", "score": 88, "sightings": 519, "tags": "cve,exploited-in-the-wild,high,nvd", "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "context": "Oracle Corporation WebLogic Server contains a vulnerability that allows for remote code execution.", "tlp": "CLEAR", "score_factors": {"score": 88, "confidence_base": 80, "source_count": 2, "source_identifiers": ["cisa_kev", "nist_nvd_recent"], "reporting_groups": ["cisa", "nvd"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 8, "age_hours": 0.0, "half_life_hours": 8760.0, "decay_factor": 1.0}}
{"indicator": "CVE-2017-0145", "type": "cve", "source": "cisa_kev,nist_nvd_recent", "first_seen": "2022-02-10T00:00:00Z", "last_seen": "2026-10-24T22:12:15Z", "confidence": "high", "score": 88, "sightings": 519, "tags": "cve,exploited-in-the-wild,high,nvd", "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "context": "The SMBv1 server in multiple Microsoft Windows versions allows remote attackers to execute arbitrary code via crafted packets.", "tlp": "CLEAR", "score_factors": {"score": 88, "confidence_base": 80, "source_count": 2, "source_identifiers": ["cisa_kev", "nist_nvd_recent"], "reporting_groups": ["cisa", "nvd"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 8, "age_hours": 0.0, "half_life_hours": 8760.0, "decay_factor": 1.0}}
{"indicator": "CVE-2017-0144", "type": "cve", "source": "cisa_kev,nist_nvd_recent", "first_seen": "2022-02-10T00:00:00Z", "last_seen": "2026-10-24T22:12:15Z", "confidence": "high", "score": 88, "sightings": 519, "tags": "cve,exploited-in-the-wild,high,nvd", "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "context": "The SMBv1 server in multiple Microsoft Windows versions allows remote attackers to execute arbitrary code via crafted packets.", "tlp": "CLEAR", "score_factors": {"score": 88, "confidence_base": 80, "source_count": 2, "source_identifiers": ["cisa_kev", "nist_nvd_recent"], "reporting_groups": ["cisa", "nvd"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 8, "age_hours": 0.0, "half_life_hours": 8760.0, "decay_factor": 1.0}}
{"indicator": "CVE-2022-21882", "type": "cve", "source": "cisa_kev,nist_nvd_recent", "first_seen": "2022-02-04T00:00:00Z", "last_seen": "2026-10-24T22:12:15Z", "confidence": "high", "score": 88, "sightings": 519, "tags": "cve,exploited-in-the-wild,high,nvd", "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "context": "Microsoft Win32k contains an unspecified vulnerability that allows for privilege escalation.", "tlp": "CLEAR", "score_factors": {"score": 88, "confidence_base": 80, "source_count": 2, "source_identifiers": ["cisa_kev", "nist_nvd_recent"], "reporting_groups": ["cisa", "nvd"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 8, "age_hours": 0.0, "half_life_hours": 8760.0, "decay_factor": 1.0}}
{"indicator": "CVE-2020-0787", "type": "cve", "source": "cisa_kev,nist_nvd_recent", "first_seen": "2022-01-28T00:00:00Z", "last_seen": "2026-10-24T22:12:15Z", "confidence": "high", "score": 88, "sightings": 519, "tags": "cve,exploited-in-the-wild,high,nvd", "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "context": "Microsoft Windows BITS is vulnerable to to a privilege elevation vulnerability if it improperly handles symbolic links. An actor can exploit this vulnerability to execute arbitrary code with system-level privileges.", "tlp": "CLEAR", "score_factors": {"score": 88, "confidence_base": 80, "source_count": 2, "source_identifiers": ["cisa_kev", "nist_nvd_recent"], "reporting_groups": ["cisa", "nvd"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 8, "age_hours": 0.0, "half_life_hours": 8760.0, "decay_factor": 1.0}}
{"indicator": "CVE-2018-8453", "type": "cve", "source": "cisa_kev,nist_nvd_recent", "first_seen": "2022-01-21T00:00:00Z", "last_seen": "2026-10-24T22:12:15Z", "confidence": "high", "score": 88, "sightings": 519, "tags": "cve,exploited-in-the-wild,high,nvd", "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "context": "Microsoft Windows Win32k contains a vulnerability that allows an attacker to escalate privileges.", "tlp": "CLEAR", "score_factors": {"score": 88, "confidence_base": 80, "source_count": 2, "source_identifiers": ["cisa_kev", "nist_nvd_recent"], "reporting_groups": ["cisa", "nvd"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 8, "age_hours": 0.0, "half_life_hours": 8760.0, "decay_factor": 1.0}}
{"indicator": "CVE-2021-33766", "type": "cve", "source": "cisa_kev,nist_nvd_recent", "first_seen": "2022-01-18T00:00:00Z", "last_seen": "2026-10-24T22:12:15Z", "confidence": "high", "score": 88, "sightings": 519, "tags": "cve,exploited-in-the-wild,high,nvd", "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "context": "Microsoft Exchange Server contains an information disclosure vulnerability which can allow an unauthenticated attacker to steal email traffic from target.", "tlp": "CLEAR", "score_factors": {"score": 88, "confidence_base": 80, "source_count": 2, "source_identifiers": ["cisa_kev", "nist_nvd_recent"], "reporting_groups": ["cisa", "nvd"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 8, "age_hours": 0.0, "half_life_hours": 8760.0, "decay_factor": 1.0}}
{"indicator": "CVE-2019-1458", "type": "cve", "source": "cisa_kev,nist_nvd_recent", "first_seen": "2022-01-10T00:00:00Z", "last_seen": "2026-10-24T22:12:15Z", "confidence": "high", "score": 88, "sightings": 519, "tags": "cve,exploited-in-the-wild,high,nvd", "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "context": "A privilege escalation vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory, aka 'Win32k EoP.", "tlp": "CLEAR", "score_factors": {"score": 88, "confidence_base": 80, "source_count": 2, "source_identifiers": ["cisa_kev", "nist_nvd_recent"], "reporting_groups": ["cisa", "nvd"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 8, "age_hours": 0.0, "half_life_hours": 8760.0, "decay_factor": 1.0}}
{"indicator": "CVE-2021-22054", "type": "cve", "source": "cisa_kev,nist_nvd_recent", "first_seen": "2021-12-17T17:15:12Z", "last_seen": "2026-10-24T22:12:15Z", "confidence": "high", "score": 88, "sightings": 519, "tags": "cve,exploited-in-the-wild,high,nvd", "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "context": "Omnissa Workspace One UEM formerly known as VMware Workspace One UEM contains a server-side request forgery (SSRF) vulnerability that could allow a malicious actor with network access to UEM to send their requests without authentication and to gain access to sensitive information.", "tlp": "CLEAR", "score_factors": {"score": 88, "confidence_base": 80, "source_count": 2, "source_identifiers": ["cisa_kev", "nist_nvd_recent"], "reporting_groups": ["cisa", "nvd"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 8, "age_hours": 0.0, "half_life_hours": 8760.0, "decay_factor": 1.0}}
{"indicator": "CVE-2021-43890", "type": "cve", "source": "cisa_kev,nist_nvd_recent", "first_seen": "2021-12-15T00:00:00Z", "last_seen": "2026-10-24T22:12:15Z", "confidence": "high", "score": 88, "sightings": 519, "tags": "cve,exploited-in-the-wild,high,nvd", "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "context": "Microsoft Windows AppX Installer contains a spoofing vulnerability which has a high impacts to confidentiality, integrity, and availability.", "tlp": "CLEAR", "score_factors": {"score": 88, "confidence_base": 80, "source_count": 2, "source_identifiers": ["cisa_kev", "nist_nvd_recent"], "reporting_groups": ["cisa", "nvd"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 8, "age_hours": 0.0, "half_life_hours": 8760.0, "decay_factor": 1.0}}
{"indicator": "CVE-2021-44228", "type": "cve", "source": "cisa_kev,nist_nvd_recent", "first_seen": "2021-12-10T00:00:00Z", "last_seen": "2026-10-24T22:12:15Z", "confidence": "high", "score": 88, "sightings": 519, "tags": "critical,cve,exploited-in-the-wild,nvd", "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "context": "Apache Log4j2 contains a vulnerability where JNDI features do not protect against attacker-controlled JNDI-related endpoints, allowing for remote code execution.", "tlp": "CLEAR", "score_factors": {"score": 88, "confidence_base": 80, "source_count": 2, "source_identifiers": ["cisa_kev", "nist_nvd_recent"], "reporting_groups": ["cisa", "nvd"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 8, "age_hours": 0.0, "half_life_hours": 8760.0, "decay_factor": 1.0}}
{"indicator": "CVE-2021-40438", "type": "cve", "source": "cisa_kev,nist_nvd_recent", "first_seen": "2021-12-01T00:00:00Z", "last_seen": "2026-10-24T22:12:15Z", "confidence": "high", "score": 88, "sightings": 519, "tags": "critical,cve,exploited-in-the-wild,nvd", "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "context": "A crafted request uri-path can cause mod_proxy to forward the request to an origin server choosen by the remote user. This issue affects Apache HTTP Server 2.4.48 and earlier.", "tlp": "CLEAR", "score_factors": {"score": 88, "confidence_base": 80, "source_count": 2, "source_identifiers": ["cisa_kev", "nist_nvd_recent"], "reporting_groups": ["cisa", "nvd"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 8, "age_hours": 0.0, "half_life_hours": 8760.0, "decay_factor": 1.0}}
{"indicator": "CVE-2021-41277", "type": "cve", "source": "cisa_kev,nist_nvd_recent", "first_seen": "2021-11-17T20:15:10Z", "last_seen": "2026-10-24T22:12:15Z", "confidence": "high", "score": 88, "sightings": 519, "tags": "critical,cve,exploited-in-the-wild,nvd", "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "context": "Metabase contains a local file inclusion vulnerability in the custom map support in the API to read GeoJSON formatted data.", "tlp": "CLEAR", "score_factors": {"score": 88, "confidence_base": 80, "source_count": 2, "source_identifiers": ["cisa_kev", "nist_nvd_recent"], "reporting_groups": ["cisa", "nvd"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 8, "age_hours": 0.0, "half_life_hours": 8760.0, "decay_factor": 1.0}}
{"indicator": "CVE-2021-40444", "type": "cve", "source": "cisa_kev,nist_nvd_recent", "first_seen": "2021-11-03T00:00:00Z", "last_seen": "2026-10-24T22:12:15Z", "confidence": "high", "score": 88, "sightings": 519, "tags": "cve,exploited-in-the-wild,high,nvd", "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "context": "Microsoft MSHTML contains a unspecified vulnerability that allows for remote code execution.", "tlp": "CLEAR", "score_factors": {"score": 88, "confidence_base": 80, "source_count": 2, "source_identifiers": ["cisa_kev", "nist_nvd_recent"], "reporting_groups": ["cisa", "nvd"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 8, "age_hours": 0.0, "half_life_hours": 8760.0, "decay_factor": 1.0}}
{"indicator": "CVE-2021-38649", "type": "cve", "source": "cisa_kev,nist_nvd_recent", "first_seen": "2021-11-03T00:00:00Z", "last_seen": "2026-10-24T22:12:15Z", "confidence": "high", "score": 88, "sightings": 519, "tags": "cve,exploited-in-the-wild,high,nvd", "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "context": "Microsoft Open Management Infrastructure (OMI) within Azure VM Management Extensions contains an unspecified vulnerability allowing privilege escalation.", "tlp": "CLEAR", "score_factors": {"score": 88, "confidence_base": 80, "source_count": 2, "source_identifiers": ["cisa_kev", "nist_nvd_recent"], "reporting_groups": ["cisa", "nvd"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 8, "age_hours": 0.0, "half_life_hours": 8760.0, "decay_factor": 1.0}}
{"indicator": "CVE-2021-38648", "type": "cve", "source": "cisa_kev,nist_nvd_recent", "first_seen": "2021-11-03T00:00:00Z", "last_seen": "2026-10-24T22:12:15Z", "confidence": "high", "score": 88, "sightings": 519, "tags": "cve,exploited-in-the-wild,high,nvd", "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "context": "Microsoft Open Management Infrastructure (OMI) within Azure VM Management Extensions contains an unspecified vulnerability allowing privilege escalation.", "tlp": "CLEAR", "score_factors": {"score": 88, "confidence_base": 80, "source_count": 2, "source_identifiers": ["cisa_kev", "nist_nvd_recent"], "reporting_groups": ["cisa", "nvd"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 8, "age_hours": 0.0, "half_life_hours": 8760.0, "decay_factor": 1.0}}
{"indicator": "CVE-2021-38647", "type": "cve", "source": "cisa_kev,nist_nvd_recent", "first_seen": "2021-11-03T00:00:00Z", "last_seen": "2026-10-24T22:12:15Z", "confidence": "high", "score": 88, "sightings": 519, "tags": "critical,cve,exploited-in-the-wild,nvd", "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "context": "Microsoft Open Management Infrastructure (OMI) within Azure VM Management Extensions contains an unspecified vulnerability allowing remote code execution.", "tlp": "CLEAR", "score_factors": {"score": 88, "confidence_base": 80, "source_count": 2, "source_identifiers": ["cisa_kev", "nist_nvd_recent"], "reporting_groups": ["cisa", "nvd"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 8, "age_hours": 0.0, "half_life_hours": 8760.0, "decay_factor": 1.0}}
{"indicator": "CVE-2021-38645", "type": "cve", "source": "cisa_kev,nist_nvd_recent", "first_seen": "2021-11-03T00:00:00Z", "last_seen": "2026-10-24T22:12:15Z", "confidence": "high", "score": 88, "sightings": 519, "tags": "cve,exploited-in-the-wild,high,nvd", "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "context": "Microsoft Open Management Infrastructure (OMI) within Azure VM Management Extensions contains an unspecified vulnerability that allows for privilege escalation.", "tlp": "CLEAR", "score_factors": {"score": 88, "confidence_base": 80, "source_count": 2, "source_identifiers": ["cisa_kev", "nist_nvd_recent"], "reporting_groups": ["cisa", "nvd"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 8, "age_hours": 0.0, "half_life_hours": 8760.0, "decay_factor": 1.0}}
{"indicator": "CVE-2021-36955", "type": "cve", "source": "cisa_kev,nist_nvd_recent", "first_seen": "2021-11-03T00:00:00Z", "last_seen": "2026-10-24T22:12:15Z", "confidence": "high", "score": 88, "sightings": 519, "tags": "cve,exploited-in-the-wild,high,nvd", "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "context": "Microsoft Windows Common Log File System (CLFS) driver contains an unspecified vulnerability that allows for privilege escalation.", "tlp": "CLEAR", "score_factors": {"score": 88, "confidence_base": 80, "source_count": 2, "source_identifiers": ["cisa_kev", "nist_nvd_recent"], "reporting_groups": ["cisa", "nvd"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 8, "age_hours": 0.0, "half_life_hours": 8760.0, "decay_factor": 1.0}}
{"indicator": "CVE-2021-36948", "type": "cve", "source": "cisa_kev,nist_nvd_recent", "first_seen": "2021-11-03T00:00:00Z", "last_seen": "2026-10-24T22:12:15Z", "confidence": "high", "score": 88, "sightings": 519, "tags": "cve,exploited-in-the-wild,high,nvd", "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "context": "Microsoft Windows Update Medic Service contains an unspecified vulnerability that allows for privilege escalation.", "tlp": "CLEAR", "score_factors": {"score": 88, "confidence_base": 80, "source_count": 2, "source_identifiers": ["cisa_kev", "nist_nvd_recent"], "reporting_groups": ["cisa", "nvd"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 8, "age_hours": 0.0, "half_life_hours": 8760.0, "decay_factor": 1.0}}
{"indicator": "CVE-2021-36942", "type": "cve", "source": "cisa_kev,nist_nvd_recent", "first_seen": "2021-11-03T00:00:00Z", "last_seen": "2026-10-24T22:12:15Z", "confidence": "high", "score": 88, "sightings": 519, "tags": "cve,exploited-in-the-wild,high,nvd", "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "context": "Microsoft Windows Local Security Authority (LSA) contains a spoofing vulnerability allowing an unauthenticated attacker to call a method on the LSARPC interface and coerce the domain controller to authenticate against another server using NTLM.", "tlp": "CLEAR", "score_factors": {"score": 88, "confidence_base": 80, "source_count": 2, "source_identifiers": ["cisa_kev", "nist_nvd_recent"], "reporting_groups": ["cisa", "nvd"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 8, "age_hours": 0.0, "half_life_hours": 8760.0, "decay_factor": 1.0}}
{"indicator": "CVE-2021-34527", "type": "cve", "source": "cisa_kev,nist_nvd_recent", "first_seen": "2021-11-03T00:00:00Z", "last_seen": "2026-10-24T22:12:15Z", "confidence": "high", "score": 88, "sightings": 519, "tags": "cve,exploited-in-the-wild,high,nvd", "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "context": "Microsoft Windows Print Spooler contains an unspecified vulnerability due to the Windows Print Spooler service improperly performing privileged file operations. Successful exploitation allows an attacker to perform remote code execution with SYSTEM privileges. The vulnerability is also known under the moniker of PrintNightmare.", "tlp": "CLEAR", "score_factors": {"score": 88, "confidence_base": 80, "source_count": 2, "source_identifiers": ["cisa_kev", "nist_nvd_recent"], "reporting_groups": ["cisa", "nvd"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 8, "age_hours": 0.0, "half_life_hours": 8760.0, "decay_factor": 1.0}}
{"indicator": "CVE-2021-34523", "type": "cve", "source": "cisa_kev,nist_nvd_recent", "first_seen": "2021-11-03T00:00:00Z", "last_seen": "2026-10-24T22:12:15Z", "confidence": "high", "score": 88, "sightings": 519, "tags": "critical,cve,exploited-in-the-wild,nvd", "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "context": "Microsoft Exchange Server contains an unspecified vulnerability that allows for privilege escalation.", "tlp": "CLEAR", "score_factors": {"score": 88, "confidence_base": 80, "source_count": 2, "source_identifiers": ["cisa_kev", "nist_nvd_recent"], "reporting_groups": ["cisa", "nvd"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 8, "age_hours": 0.0, "half_life_hours": 8760.0, "decay_factor": 1.0}}
{"indicator": "CVE-2021-34473", "type": "cve", "source": "cisa_kev,nist_nvd_recent", "first_seen": "2021-11-03T00:00:00Z", "last_seen": "2026-10-24T22:12:15Z", "confidence": "high", "score": 88, "sightings": 519, "tags": "critical,cve,exploited-in-the-wild,nvd", "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "context": "Microsoft Exchange Server contains an unspecified vulnerability that allows for remote code execution.", "tlp": "CLEAR", "score_factors": {"score": 88, "confidence_base": 80, "source_count": 2, "source_identifiers": ["cisa_kev", "nist_nvd_recent"], "reporting_groups": ["cisa", "nvd"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 8, "age_hours": 0.0, "half_life_hours": 8760.0, "decay_factor": 1.0}}
{"indicator": "CVE-2021-34448", "type": "cve", "source": "cisa_kev,nist_nvd_recent", "first_seen": "2021-11-03T00:00:00Z", "last_seen": "2026-10-24T22:12:15Z", "confidence": "high", "score": 88, "sightings": 519, "tags": "cve,exploited-in-the-wild,medium,nvd", "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "context": "Microsoft Windows Scripting Engine contains an unspecified vulnerability that allows for memory corruption.", "tlp": "CLEAR", "score_factors": {"score": 88, "confidence_base": 80, "source_count": 2, "source_identifiers": ["cisa_kev", "nist_nvd_recent"], "reporting_groups": ["cisa", "nvd"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 8, "age_hours": 0.0, "half_life_hours": 8760.0, "decay_factor": 1.0}}
{"indicator": "CVE-2021-33771", "type": "cve", "source": "cisa_kev,nist_nvd_recent", "first_seen": "2021-11-03T00:00:00Z", "last_seen": "2026-10-24T22:12:15Z", "confidence": "high", "score": 88, "sightings": 519, "tags": "cve,exploited-in-the-wild,high,nvd", "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "context": "Microsoft Windows kernel contains an unspecified vulnerability that allows for privilege escalation.", "tlp": "CLEAR", "score_factors": {"score": 88, "confidence_base": 80, "source_count": 2, "source_identifiers": ["cisa_kev", "nist_nvd_recent"], "reporting_groups": ["cisa", "nvd"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 8, "age_hours": 0.0, "half_life_hours": 8760.0, "decay_factor": 1.0}}
{"indicator": "CVE-2021-31979", "type": "cve", "source": "cisa_kev,nist_nvd_recent", "first_seen": "2021-11-03T00:00:00Z", "last_seen": "2026-10-24T22:12:15Z", "confidence": "high", "score": 88, "sightings": 519, "tags": "cve,exploited-in-the-wild,high,nvd", "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "context": "Microsoft Windows kernel contains an unspecified vulnerability that allows for privilege escalation.", "tlp": "CLEAR", "score_factors": {"score": 88, "confidence_base": 80, "source_count": 2, "source_identifiers": ["cisa_kev", "nist_nvd_recent"], "reporting_groups": ["cisa", "nvd"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 8, "age_hours": 0.0, "half_life_hours": 8760.0, "decay_factor": 1.0}}
{"indicator": "CVE-2021-30116", "type": "cve", "source": "cisa_kev,nist_nvd_recent", "first_seen": "2021-11-03T00:00:00Z", "last_seen": "2026-10-24T22:12:15Z", "confidence": "high", "score": 88, "sightings": 519, "tags": "critical,cve,exploited-in-the-wild,nvd", "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "context": "Kaseya Virtual System/Server Administrator (VSA) contains an information disclosure vulnerability allowing an attacker to obtain the sessionId that can be used to execute further attacks against the system.", "tlp": "CLEAR", "score_factors": {"score": 88, "confidence_base": 80, "source_count": 2, "source_identifiers": ["cisa_kev", "nist_nvd_recent"], "reporting_groups": ["cisa", "nvd"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 8, "age_hours": 0.0, "half_life_hours": 8760.0, "decay_factor": 1.0}}
{"indicator": "CVE-2021-27059", "type": "cve", "source": "cisa_kev,nist_nvd_recent", "first_seen": "2021-11-03T00:00:00Z", "last_seen": "2026-10-24T22:12:15Z", "confidence": "high", "score": 88, "sightings": 519, "tags": "cve,exploited-in-the-wild,high,nvd", "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "context": "Microsoft Office contains an unspecified vulnerability that allows for remote code execution.", "tlp": "CLEAR", "score_factors": {"score": 88, "confidence_base": 80, "source_count": 2, "source_identifiers": ["cisa_kev", "nist_nvd_recent"], "reporting_groups": ["cisa", "nvd"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 8, "age_hours": 0.0, "half_life_hours": 8760.0, "decay_factor": 1.0}}
{"indicator": "CVE-2021-26857", "type": "cve", "source": "cisa_kev,nist_nvd_recent", "first_seen": "2021-11-03T00:00:00Z", "last_seen": "2026-10-24T22:12:15Z", "confidence": "high", "score": 88, "sightings": 519, "tags": "cve,exploited-in-the-wild,high,nvd", "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "context": "Microsoft Exchange Server contains an unspecified vulnerability that allows for remote code execution. This vulnerability is part of the ProxyLogon exploit chain.", "tlp": "CLEAR", "score_factors": {"score": 88, "confidence_base": 80, "source_count": 2, "source_identifiers": ["cisa_kev", "nist_nvd_recent"], "reporting_groups": ["cisa", "nvd"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 8, "age_hours": 0.0, "half_life_hours": 8760.0, "decay_factor": 1.0}}
{"indicator": "CVE-2021-26855", "type": "cve", "source": "cisa_kev,nist_nvd_recent", "first_seen": "2021-11-03T00:00:00Z", "last_seen": "2026-10-24T22:12:15Z", "confidence": "high", "score": 88, "sightings": 519, "tags": "critical,cve,exploited-in-the-wild,nvd", "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "context": "Microsoft Exchange Server contains an unspecified vulnerability that allows for remote code execution. This vulnerability is part of the ProxyLogon exploit chain.", "tlp": "CLEAR", "score_factors": {"score": 88, "confidence_base": 80, "source_count": 2, "source_identifiers": ["cisa_kev", "nist_nvd_recent"], "reporting_groups": ["cisa", "nvd"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 8, "age_hours": 0.0, "half_life_hours": 8760.0, "decay_factor": 1.0}}
{"indicator": "CVE-2021-22893", "type": "cve", "source": "cisa_kev,nist_nvd_recent", "first_seen": "2021-11-03T00:00:00Z", "last_seen": "2026-10-24T22:12:15Z", "confidence": "high", "score": 88, "sightings": 519, "tags": "critical,cve,exploited-in-the-wild,nvd", "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "context": "Ivanti Pulse Connect Secure contains a use-after-free vulnerability that allow a remote, unauthenticated attacker to execute code via license services.", "tlp": "CLEAR", "score_factors": {"score": 88, "confidence_base": 80, "source_count": 2, "source_identifiers": ["cisa_kev", "nist_nvd_recent"], "reporting_groups": ["cisa", "nvd"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 8, "age_hours": 0.0, "half_life_hours": 8760.0, "decay_factor": 1.0}}
{"indicator": "CVE-2021-22205", "type": "cve", "source": "cisa_kev,nist_nvd_recent", "first_seen": "2021-11-03T00:00:00Z", "last_seen": "2026-10-24T22:12:15Z", "confidence": "high", "score": 88, "sightings": 519, "tags": "critical,cve,exploited-in-the-wild,nvd", "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "context": "GitHub Community and Enterprise Editions that utilize the ability to upload images through GitLab Workhorse are vulnerable to remote code execution. Workhorse passes image file extensions through ExifTool, which improperly validates the image files.", "tlp": "CLEAR", "score_factors": {"score": 88, "confidence_base": 80, "source_count": 2, "source_identifiers": ["cisa_kev", "nist_nvd_recent"], "reporting_groups": ["cisa", "nvd"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 8, "age_hours": 0.0, "half_life_hours": 8760.0, "decay_factor": 1.0}}
{"indicator": "CVE-2021-21985", "type": "cve", "source": "cisa_kev,nist_nvd_recent", "first_seen": "2021-11-03T00:00:00Z", "last_seen": "2026-10-24T22:12:15Z", "confidence": "high", "score": 88, "sightings": 519, "tags": "critical,cve,exploited-in-the-wild,nvd", "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "context": "VMware vSphere Client contains an improper input validation vulnerability in the Virtual SAN Health Check plug-in, which is enabled by default in vCenter Server, which allows for remote code execution.", "tlp": "CLEAR", "score_factors": {"score": 88, "confidence_base": 80, "source_count": 2, "source_identifiers": ["cisa_kev", "nist_nvd_recent"], "reporting_groups": ["cisa", "nvd"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 8, "age_hours": 0.0, "half_life_hours": 8760.0, "decay_factor": 1.0}}
{"indicator": "CVE-2021-21972", "type": "cve", "source": "cisa_kev,nist_nvd_recent", "first_seen": "2021-11-03T00:00:00Z", "last_seen": "2026-10-24T22:12:15Z", "confidence": "high", "score": 88, "sightings": 519, "tags": "critical,cve,exploited-in-the-wild,nvd", "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "context": "VMware vCenter Server vSphere Client contains a remote code execution vulnerability in a vCenter Server plugin which allows an attacker with network access to port 443 to execute commands with unrestricted privileges on the underlying operating system.", "tlp": "CLEAR", "score_factors": {"score": 88, "confidence_base": 80, "source_count": 2, "source_identifiers": ["cisa_kev", "nist_nvd_recent"], "reporting_groups": ["cisa", "nvd"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 8, "age_hours": 0.0, "half_life_hours": 8760.0, "decay_factor": 1.0}}
{"indicator": "CVE-2021-20021", "type": "cve", "source": "cisa_kev,nist_nvd_recent", "first_seen": "2021-11-03T00:00:00Z", "last_seen": "2026-10-24T22:12:15Z", "confidence": "high", "score": 88, "sightings": 519, "tags": "critical,cve,exploited-in-the-wild,nvd", "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "context": "SonicWall Email Security contains an improper privilege management vulnerability that allows an attacker to create an administrative account by sending a crafted HTTP request to the remote host. This vulnerability has known usage in a SonicWall Email Security exploit chain along with CVE-2021-20022 and CVE-2021-20023 to achieve privilege escalation.", "tlp": "CLEAR", "score_factors": {"score": 88, "confidence_base": 80, "source_count": 2, "source_identifiers": ["cisa_kev", "nist_nvd_recent"], "reporting_groups": ["cisa", "nvd"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 8, "age_hours": 0.0, "half_life_hours": 8760.0, "decay_factor": 1.0}}
{"indicator": "CVE-2021-20016", "type": "cve", "source": "cisa_kev,nist_nvd_recent", "first_seen": "2021-11-03T00:00:00Z", "last_seen": "2026-10-24T22:12:15Z", "confidence": "high", "score": 88, "sightings": 519, "tags": "critical,cve,exploited-in-the-wild,nvd", "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "context": "SonicWall SSLVPN SMA100 contains a SQL injection vulnerability that allows remote exploitation for credential access by an unauthenticated attacker.", "tlp": "CLEAR", "score_factors": {"score": 88, "confidence_base": 80, "source_count": 2, "source_identifiers": ["cisa_kev", "nist_nvd_recent"], "reporting_groups": ["cisa", "nvd"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 8, "age_hours": 0.0, "half_life_hours": 8760.0, "decay_factor": 1.0}}
{"indicator": "CVE-2021-1732", "type": "cve", "source": "cisa_kev,nist_nvd_recent", "first_seen": "2021-11-03T00:00:00Z", "last_seen": "2026-10-24T22:12:15Z", "confidence": "high", "score": 88, "sightings": 519, "tags": "cve,exploited-in-the-wild,high,nvd", "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "context": "Microsoft Win32k contains an unspecified vulnerability that allows for privilege escalation.", "tlp": "CLEAR", "score_factors": {"score": 88, "confidence_base": 80, "source_count": 2, "source_identifiers": ["cisa_kev", "nist_nvd_recent"], "reporting_groups": ["cisa", "nvd"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 8, "age_hours": 0.0, "half_life_hours": 8760.0, "decay_factor": 1.0}}
{"indicator": "CVE-2021-1675", "type": "cve", "source": "cisa_kev,nist_nvd_recent", "first_seen": "2021-11-03T00:00:00Z", "last_seen": "2026-10-24T22:12:15Z", "confidence": "high", "score": 88, "sightings": 519, "tags": "cve,exploited-in-the-wild,high,nvd", "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "context": "Microsoft Windows Print Spooler contains an unspecified vulnerability that allows for remote code execution.", "tlp": "CLEAR", "score_factors": {"score": 88, "confidence_base": 80, "source_count": 2, "source_identifiers": ["cisa_kev", "nist_nvd_recent"], "reporting_groups": ["cisa", "nvd"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 8, "age_hours": 0.0, "half_life_hours": 8760.0, "decay_factor": 1.0}}
{"indicator": "CVE-2020-3992", "type": "cve", "source": "cisa_kev,nist_nvd_recent", "first_seen": "2021-11-03T00:00:00Z", "last_seen": "2026-10-24T22:12:15Z", "confidence": "high", "score": 88, "sightings": 519, "tags": "critical,cve,exploited-in-the-wild,nvd", "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "context": "VMware ESXi OpenSLP contains a use-after-free vulnerability that allows an attacker residing in the management network with access to port 427 to perform remote code execution.", "tlp": "CLEAR", "score_factors": {"score": 88, "confidence_base": 80, "source_count": 2, "source_identifiers": ["cisa_kev", "nist_nvd_recent"], "reporting_groups": ["cisa", "nvd"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 8, "age_hours": 0.0, "half_life_hours": 8760.0, "decay_factor": 1.0}}
{"indicator": "CVE-2020-3580", "type": "cve", "source": "cisa_kev,nist_nvd_recent", "first_seen": "2021-11-03T00:00:00Z", "last_seen": "2026-10-24T22:12:15Z", "confidence": "high", "score": 88, "sightings": 519, "tags": "cve,exploited-in-the-wild,medium,nvd", "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "context": "Cisco Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) contain an insufficient input validation vulnerability for user-supplied input by the web services interface.  Successful exploitation could allow an attacker to perform cross-site scripting (XSS) in the context of the interface or access sensitive browser-based information.", "tlp": "CLEAR", "score_factors": {"score": 88, "confidence_base": 80, "source_count": 2, "source_identifiers": ["cisa_kev", "nist_nvd_recent"], "reporting_groups": ["cisa", "nvd"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 8, "age_hours": 0.0, "half_life_hours": 8760.0, "decay_factor": 1.0}}
{"indicator": "CVE-2020-3452", "type": "cve", "source": "cisa_kev,nist_nvd_recent", "first_seen": "2021-11-03T00:00:00Z", "last_seen": "2026-10-24T22:12:15Z", "confidence": "high", "score": 88, "sightings": 519, "tags": "cve,exploited-in-the-wild,high,nvd", "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "context": "Cisco Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) contain an improper input validation vulnerability when HTTP requests process URLs.  An attacker could exploit this vulnerability by sending a crafted HTTP request containing directory traversal character sequences to an affected device. A successful exploit could allow the attacker to view arbitrary files within the web services file system on the targeted device.", "tlp": "CLEAR", "score_factors": {"score": 88, "confidence_base": 80, "source_count": 2, "source_identifiers": ["cisa_kev", "nist_nvd_recent"], "reporting_groups": ["cisa", "nvd"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 8, "age_hours": 0.0, "half_life_hours": 8760.0, "decay_factor": 1.0}}
{"indicator": "CVE-2019-7481", "type": "cve", "source": "cisa_kev,nist_nvd_recent", "first_seen": "2021-11-03T00:00:00Z", "last_seen": "2026-10-24T22:12:15Z", "confidence": "high", "score": 88, "sightings": 519, "tags": "cve,exploited-in-the-wild,high,nvd", "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "context": "SonicWall SMA100 contains a SQL injection vulnerability allowing an unauthenticated user to gain read-only access to unauthorized resources.", "tlp": "CLEAR", "score_factors": {"score": 88, "confidence_base": 80, "source_count": 2, "source_identifiers": ["cisa_kev", "nist_nvd_recent"], "reporting_groups": ["cisa", "nvd"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 8, "age_hours": 0.0, "half_life_hours": 8760.0, "decay_factor": 1.0}}
{"indicator": "CVE-2019-5591", "type": "cve", "source": "cisa_kev,nist_nvd_recent", "first_seen": "2021-11-03T00:00:00Z", "last_seen": "2026-10-24T22:12:15Z", "confidence": "high", "score": 88, "sightings": 519, "tags": "cve,exploited-in-the-wild,medium,nvd", "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "context": "Fortinet FortiOS contains a default configuration vulnerability that may allow an unauthenticated attacker on the same subnet to intercept sensitive information by impersonating the Lightweight Directory Access Protocol (LDAP) server.", "tlp": "CLEAR", "score_factors": {"score": 88, "confidence_base": 80, "source_count": 2, "source_identifiers": ["cisa_kev", "nist_nvd_recent"], "reporting_groups": ["cisa", "nvd"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 8, "age_hours": 0.0, "half_life_hours": 8760.0, "decay_factor": 1.0}}
{"indicator": "CVE-2019-19781", "type": "cve", "source": "cisa_kev,nist_nvd_recent", "first_seen": "2021-11-03T00:00:00Z", "last_seen": "2026-10-24T22:12:15Z", "confidence": "high", "score": 88, "sightings": 519, "tags": "critical,cve,exploited-in-the-wild,nvd", "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "context": "Citrix ADC, Citrix Gateway, and multiple Citrix SD-WAN WANOP appliance models contain an unspecified vulnerability that could allow an unauthenticated attacker to perform code execution.", "tlp": "CLEAR", "score_factors": {"score": 88, "confidence_base": 80, "source_count": 2, "source_identifiers": ["cisa_kev", "nist_nvd_recent"], "reporting_groups": ["cisa", "nvd"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 8, "age_hours": 0.0, "half_life_hours": 8760.0, "decay_factor": 1.0}}
{"indicator": "CVE-2019-11634", "type": "cve", "source": "cisa_kev,nist_nvd_recent", "first_seen": "2021-11-03T00:00:00Z", "last_seen": "2026-10-24T22:12:15Z", "confidence": "high", "score": 88, "sightings": 519, "tags": "critical,cve,exploited-in-the-wild,nvd", "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "context": "Citrix Workspace Application and Receiver for Windows contains remote code execution vulnerability resulting from local drive access preferences not being enforced into the clients' local drives.", "tlp": "CLEAR", "score_factors": {"score": 88, "confidence_base": 80, "source_count": 2, "source_identifiers": ["cisa_kev", "nist_nvd_recent"], "reporting_groups": ["cisa", "nvd"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 8, "age_hours": 0.0, "half_life_hours": 8760.0, "decay_factor": 1.0}}
{"indicator": "CVE-2018-0296", "type": "cve", "source": "cisa_kev,nist_nvd_recent", "first_seen": "2021-11-03T00:00:00Z", "last_seen": "2026-10-24T22:12:15Z", "confidence": "high", "score": 88, "sightings": 519, "tags": "cve,exploited-in-the-wild,high,nvd", "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "context": "Cisco Adaptive Security Appliance (ASA) contains an improper input validation vulnerability with HTTP URLs. Exploitation could allow an attacker to cause a denial-of-service (DoS) condition or information disclosure.", "tlp": "CLEAR", "score_factors": {"score": 88, "confidence_base": 80, "source_count": 2, "source_identifiers": ["cisa_kev", "nist_nvd_recent"], "reporting_groups": ["cisa", "nvd"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 8, "age_hours": 0.0, "half_life_hours": 8760.0, "decay_factor": 1.0}}
{"indicator": "CVE-2021-22555", "type": "cve", "source": "cisa_kev,nist_nvd_recent", "first_seen": "2021-07-07T12:15:08Z", "last_seen": "2026-10-24T22:12:15Z", "confidence": "high", "score": 88, "sightings": 519, "tags": "cve,exploited-in-the-wild,high,nvd", "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "context": "Linux Kernel contains a heap out-of-bounds write vulnerability that could allow an attacker to gain privileges or cause a DoS (via heap memory corruption) through user name space.", "tlp": "CLEAR", "score_factors": {"score": 88, "confidence_base": 80, "source_count": 2, "source_identifiers": ["cisa_kev", "nist_nvd_recent"], "reporting_groups": ["cisa", "nvd"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 8, "age_hours": 0.0, "half_life_hours": 8760.0, "decay_factor": 1.0}}
{"indicator": "CVE-2021-22175", "type": "cve", "source": "cisa_kev,nist_nvd_recent", "first_seen": "2021-06-11T16:15:09Z", "last_seen": "2026-10-24T22:12:15Z", "confidence": "high", "score": 88, "sightings": 519, "tags": "cve,exploited-in-the-wild,medium,nvd", "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "context": "GitLab contains a server-side request forgery (SSRF) vulnerability when requests to the internal network for webhooks are enabled.", "tlp": "CLEAR", "score_factors": {"score": 88, "confidence_base": 80, "source_count": 2, "source_identifiers": ["cisa_kev", "nist_nvd_recent"], "reporting_groups": ["cisa", "nvd"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 8, "age_hours": 0.0, "half_life_hours": 8760.0, "decay_factor": 1.0}}
{"indicator": "CVE-2021-20023", "type": "cve", "source": "cisa_kev,nist_nvd_recent", "first_seen": "2021-04-20T12:15:12Z", "last_seen": "2026-10-24T22:12:15Z", "confidence": "high", "score": 88, "sightings": 519, "tags": "cve,exploited-in-the-wild,medium,nvd", "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "context": "SonicWall Email Security contains a path traversal vulnerability that allows a post-authenticated attacker to read files on the remote host. This vulnerability has known usage in a SonicWall Email Security exploit chain along with CVE-2021-20021 and CVE-2021-20022 to achieve privilege escalation.", "tlp": "CLEAR", "score_factors": {"score": 88, "confidence_base": 80, "source_count": 2, "source_identifiers": ["cisa_kev", "nist_nvd_recent"], "reporting_groups": ["cisa", "nvd"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 8, "age_hours": 0.0, "half_life_hours": 8760.0, "decay_factor": 1.0}}
{"indicator": "CVE-2021-20022", "type": "cve", "source": "cisa_kev,nist_nvd_recent", "first_seen": "2021-04-09T18:15:13Z", "last_seen": "2026-10-24T22:12:15Z", "confidence": "high", "score": 88, "sightings": 519, "tags": "cve,exploited-in-the-wild,high,nvd", "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "context": "SonicWall Email Security contains an unrestricted upload of file with dangerous type vulnerability that allows a post-authenticated attacker to upload a file to the remote host. This vulnerability has known usage in a SonicWall Email Security exploit chain along with CVE-2021-20021 and CVE-2021-20023 to achieve privilege escalation.", "tlp": "CLEAR", "score_factors": {"score": 88, "confidence_base": 80, "source_count": 2, "source_identifiers": ["cisa_kev", "nist_nvd_recent"], "reporting_groups": ["cisa", "nvd"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 8, "age_hours": 0.0, "half_life_hours": 8760.0, "decay_factor": 1.0}}
{"indicator": "CVE-2021-21975", "type": "cve", "source": "cisa_kev,nist_nvd_recent", "first_seen": "2021-03-31T18:15:14Z", "last_seen": "2026-10-24T22:12:15Z", "confidence": "high", "score": 88, "sightings": 519, "tags": "cve,exploited-in-the-wild,high,nvd", "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "context": "Server Side Request Forgery (SSRF) in vRealize Operations Manager API prior to 8.4 may allow a malicious actor with network access to the vRealize Operations Manager API to perform a SSRF attack to steal administrative credentials.", "tlp": "CLEAR", "score_factors": {"score": 88, "confidence_base": 80, "source_count": 2, "source_identifiers": ["cisa_kev", "nist_nvd_recent"], "reporting_groups": ["cisa", "nvd"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 8, "age_hours": 0.0, "half_life_hours": 8760.0, "decay_factor": 1.0}}
{"indicator": "CVE-2021-26411", "type": "cve", "source": "cisa_kev,nist_nvd_recent", "first_seen": "2021-03-11T16:15:13Z", "last_seen": "2026-10-24T22:12:15Z", "confidence": "high", "score": 88, "sightings": 519, "tags": "cve,exploited-in-the-wild,high,nvd", "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "context": "Microsoft Internet Explorer contains an unspecified vulnerability that allows for memory corruption.", "tlp": "CLEAR", "score_factors": {"score": 88, "confidence_base": 80, "source_count": 2, "source_identifiers": ["cisa_kev", "nist_nvd_recent"], "reporting_groups": ["cisa", "nvd"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 8, "age_hours": 0.0, "half_life_hours": 8760.0, "decay_factor": 1.0}}
{"indicator": "CVE-2021-27065", "type": "cve", "source": "cisa_kev,nist_nvd_recent", "first_seen": "2021-03-03T00:15:12Z", "last_seen": "2026-10-24T22:12:15Z", "confidence": "high", "score": 88, "sightings": 519, "tags": "cve,exploited-in-the-wild,high,nvd", "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "context": "Microsoft Exchange Server contains an unspecified vulnerability that allows for remote code execution. This vulnerability is part of the ProxyLogon exploit chain.", "tlp": "CLEAR", "score_factors": {"score": 88, "confidence_base": 80, "source_count": 2, "source_identifiers": ["cisa_kev", "nist_nvd_recent"], "reporting_groups": ["cisa", "nvd"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 8, "age_hours": 0.0, "half_life_hours": 8760.0, "decay_factor": 1.0}}
{"indicator": "CVE-2021-26858", "type": "cve", "source": "cisa_kev,nist_nvd_recent", "first_seen": "2021-03-03T00:15:12Z", "last_seen": "2026-10-24T22:12:15Z", "confidence": "high", "score": 88, "sightings": 519, "tags": "cve,exploited-in-the-wild,high,nvd", "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "context": "Microsoft Exchange Server contains an unspecified vulnerability that allows for remote code execution. This vulnerability is part of the ProxyLogon exploit chain.", "tlp": "CLEAR", "score_factors": {"score": 88, "confidence_base": 80, "source_count": 2, "source_identifiers": ["cisa_kev", "nist_nvd_recent"], "reporting_groups": ["cisa", "nvd"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 8, "age_hours": 0.0, "half_life_hours": 8760.0, "decay_factor": 1.0}}
{"indicator": "CVE-2021-3199", "type": "cve", "source": "cisa_kev,nist_nvd_recent", "first_seen": "2021-01-26T18:16:28Z", "last_seen": "2026-10-24T22:12:15Z", "confidence": "high", "score": 88, "sightings": 59, "tags": "critical,cve,exploited-in-the-wild,nvd", "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "context": "ONLYOFFICE Docs contains a path traversal vulnerability that can occur when JWT is used, via a /.. sequence in an image upload parameter and could allow for remote code execution.", "tlp": "CLEAR", "score_factors": {"score": 88, "confidence_base": 80, "source_count": 2, "source_identifiers": ["cisa_kev", "nist_nvd_recent"], "reporting_groups": ["cisa", "nvd"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 8, "age_hours": 0.0, "half_life_hours": 8760.0, "decay_factor": 1.0}}
{"indicator": "CVE-2018-19953", "type": "cve", "source": "cisa_kev,nist_nvd_recent", "first_seen": "2020-10-28T18:15:12Z", "last_seen": "2026-10-24T22:12:15Z", "confidence": "high", "score": 88, "sightings": 519, "tags": "cve,exploited-in-the-wild,medium,nvd", "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "context": "A cross-site scripting vulnerability affecting QNAP NAS File Station could allow remote attackers to inject malicious code.", "tlp": "CLEAR", "score_factors": {"score": 88, "confidence_base": 80, "source_count": 2, "source_identifiers": ["cisa_kev", "nist_nvd_recent"], "reporting_groups": ["cisa", "nvd"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 8, "age_hours": 0.0, "half_life_hours": 8760.0, "decay_factor": 1.0}}
{"indicator": "CVE-2018-19949", "type": "cve", "source": "cisa_kev,nist_nvd_recent", "first_seen": "2020-10-28T18:15:12Z", "last_seen": "2026-10-24T22:12:15Z", "confidence": "high", "score": 88, "sightings": 519, "tags": "critical,cve,exploited-in-the-wild,nvd", "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "context": "A command injection vulnerability affecting QNAP NAS File Station could allow remote attackers to run commands.", "tlp": "CLEAR", "score_factors": {"score": 88, "confidence_base": 80, "source_count": 2, "source_identifiers": ["cisa_kev", "nist_nvd_recent"], "reporting_groups": ["cisa", "nvd"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 8, "age_hours": 0.0, "half_life_hours": 8760.0, "decay_factor": 1.0}}
{"indicator": "CVE-2020-12812", "type": "cve", "source": "cisa_kev,nist_nvd_recent", "first_seen": "2020-07-24T23:15:12Z", "last_seen": "2026-10-24T22:12:15Z", "confidence": "high", "score": 88, "sightings": 519, "tags": "critical,cve,exploited-in-the-wild,nvd", "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "context": "Fortinet FortiOS SSL VPN contains an improper authentication vulnerability that may allow a user to login successfully without being prompted for the second factor of authentication (FortiToken) if they change the case in their username.", "tlp": "CLEAR", "score_factors": {"score": 88, "confidence_base": 80, "source_count": 2, "source_identifiers": ["cisa_kev", "nist_nvd_recent"], "reporting_groups": ["cisa", "nvd"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 8, "age_hours": 0.0, "half_life_hours": 8760.0, "decay_factor": 1.0}}
{"indicator": "CVE-2020-1054", "type": "cve", "source": "cisa_kev,nist_nvd_recent", "first_seen": "2020-05-21T23:15:12Z", "last_seen": "2026-10-24T22:12:15Z", "confidence": "high", "score": 88, "sightings": 519, "tags": "cve,exploited-in-the-wild,high,nvd", "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "context": "Microsoft Win32k contains a privilege escalation vulnerability when the Windows kernel-mode driver fails to properly handle objects in memory. Successful exploitation allows an attacker to execute code in kernel mode.", "tlp": "CLEAR", "score_factors": {"score": 88, "confidence_base": 80, "source_count": 2, "source_identifiers": ["cisa_kev", "nist_nvd_recent"], "reporting_groups": ["cisa", "nvd"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 8, "age_hours": 0.0, "half_life_hours": 8760.0, "decay_factor": 1.0}}
{"indicator": "CVE-2020-0796", "type": "cve", "source": "cisa_kev,nist_nvd_recent", "first_seen": "2020-03-12T16:15:15Z", "last_seen": "2026-10-24T22:12:15Z", "confidence": "high", "score": 88, "sightings": 519, "tags": "critical,cve,exploited-in-the-wild,nvd", "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "context": "A remote code execution vulnerability exists in the way that the Microsoft Server Message Block 3.1.1 (SMBv3) protocol handles certain requests. An attacker who successfully exploited the vulnerability could gain the ability to execute code on the target server or client.", "tlp": "CLEAR", "score_factors": {"score": 88, "confidence_base": 80, "source_count": 2, "source_identifiers": ["cisa_kev", "nist_nvd_recent"], "reporting_groups": ["cisa", "nvd"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 8, "age_hours": 0.0, "half_life_hours": 8760.0, "decay_factor": 1.0}}
{"indicator": "CVE-2020-9054", "type": "cve", "source": "cisa_kev,nist_nvd_recent", "first_seen": "2020-03-04T20:15:10Z", "last_seen": "2026-10-24T22:12:15Z", "confidence": "high", "score": 88, "sightings": 220, "tags": "critical,cve,exploited-in-the-wild,nvd", "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "context": "Multiple Zyxel network-attached storage (NAS) devices contain a pre-authentication command injection vulnerability, which may allow a remote, unauthenticated attacker to execute arbitrary code.", "tlp": "CLEAR", "score_factors": {"score": 88, "confidence_base": 80, "source_count": 2, "source_identifiers": ["cisa_kev", "nist_nvd_recent"], "reporting_groups": ["cisa", "nvd"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 8, "age_hours": 0.0, "half_life_hours": 8760.0, "decay_factor": 1.0}}
{"indicator": "CVE-2019-1579", "type": "cve", "source": "cisa_kev,nist_nvd_recent", "first_seen": "2019-07-19T22:15:11Z", "last_seen": "2026-10-24T22:12:15Z", "confidence": "high", "score": 88, "sightings": 519, "tags": "cve,exploited-in-the-wild,high,nvd", "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "context": "Remote Code Execution in PAN-OS with GlobalProtect Portal or GlobalProtect Gateway Interface enabled.", "tlp": "CLEAR", "score_factors": {"score": 88, "confidence_base": 80, "source_count": 2, "source_identifiers": ["cisa_kev", "nist_nvd_recent"], "reporting_groups": ["cisa", "nvd"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 8, "age_hours": 0.0, "half_life_hours": 8760.0, "decay_factor": 1.0}}
{"indicator": "CVE-2019-1068", "type": "cve", "source": "cisa_kev,nist_nvd_recent", "first_seen": "2019-07-15T19:15:16Z", "last_seen": "2026-10-24T22:12:15Z", "confidence": "high", "score": 88, "sightings": 278, "tags": "cve,exploited-in-the-wild,high,nvd", "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "context": "Microsoft SQL Server contains a remote code execution vulnerability that could allow an attacker to execute code in the context of the SQL Server Database Engine service account.", "tlp": "CLEAR", "score_factors": {"score": 88, "confidence_base": 80, "source_count": 2, "source_identifiers": ["cisa_kev", "nist_nvd_recent"], "reporting_groups": ["cisa", "nvd"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 8, "age_hours": 0.0, "half_life_hours": 8760.0, "decay_factor": 1.0}}
{"indicator": "CVE-2019-2725", "type": "cve", "source": "cisa_kev,nist_nvd_recent", "first_seen": "2019-04-26T19:29:00Z", "last_seen": "2026-10-24T22:12:15Z", "confidence": "high", "score": 88, "sightings": 519, "tags": "critical,cve,exploited-in-the-wild,nvd", "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "context": "Injection vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: Web Services).", "tlp": "CLEAR", "score_factors": {"score": 88, "confidence_base": 80, "source_count": 2, "source_identifiers": ["cisa_kev", "nist_nvd_recent"], "reporting_groups": ["cisa", "nvd"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 8, "age_hours": 0.0, "half_life_hours": 8760.0, "decay_factor": 1.0}}
{"indicator": "CVE-2018-13374", "type": "cve", "source": "cisa_kev,nist_nvd_recent", "first_seen": "2019-01-22T14:29:00Z", "last_seen": "2026-10-24T22:12:15Z", "confidence": "high", "score": 88, "sightings": 519, "tags": "cve,exploited-in-the-wild,medium,nvd", "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "context": "Fortinet FortiOS and FortiADC contain an improper access control vulnerability that allows attackers to obtain the LDAP server login credentials configured in FortiGate by pointing a LDAP server connectivity test request to a rogue LDAP server.", "tlp": "CLEAR", "score_factors": {"score": 88, "confidence_base": 80, "source_count": 2, "source_identifiers": ["cisa_kev", "nist_nvd_recent"], "reporting_groups": ["cisa", "nvd"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 8, "age_hours": 0.0, "half_life_hours": 8760.0, "decay_factor": 1.0}}
{"indicator": "CVE-2018-15982", "type": "cve", "source": "cisa_kev,nist_nvd_recent", "first_seen": "2019-01-18T17:29:01Z", "last_seen": "2026-10-24T22:12:15Z", "confidence": "high", "score": 88, "sightings": 519, "tags": "cve,exploited-in-the-wild,high,nvd", "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "context": "Adobe Flash Player com.adobe.tvsdk.mediacore.metadata Use After Free Vulnerability", "tlp": "CLEAR", "score_factors": {"score": 88, "confidence_base": 80, "source_count": 2, "source_identifiers": ["cisa_kev", "nist_nvd_recent"], "reporting_groups": ["cisa", "nvd"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 8, "age_hours": 0.0, "half_life_hours": 8760.0, "decay_factor": 1.0}}
{"indicator": "CVE-2018-19323", "type": "cve", "source": "cisa_kev,nist_nvd_recent", "first_seen": "2018-12-21T23:29:00Z", "last_seen": "2026-10-24T22:12:15Z", "confidence": "high", "score": 88, "sightings": 519, "tags": "critical,cve,exploited-in-the-wild,nvd", "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "context": "The GPCIDrv and GDrv low-level drivers in GIGABYTE App Center, AORUS Graphics Engine, XTREME Gaming Engine, and OC GURU expose functionality to read and write arbitrary physical memory. This could be leveraged by a local attacker to elevate privileges.", "tlp": "CLEAR", "score_factors": {"score": 88, "confidence_base": 80, "source_count": 2, "source_identifiers": ["cisa_kev", "nist_nvd_recent"], "reporting_groups": ["cisa", "nvd"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 8, "age_hours": 0.0, "half_life_hours": 8760.0, "decay_factor": 1.0}}
{"indicator": "CVE-2018-7602", "type": "cve", "source": "cisa_kev,nist_nvd_recent", "first_seen": "2018-07-19T17:29:00Z", "last_seen": "2026-10-24T22:12:15Z", "confidence": "high", "score": 88, "sightings": 519, "tags": "critical,cve,exploited-in-the-wild,nvd", "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "context": "A remote code execution vulnerability exists within multiple subsystems of Drupal that can allow attackers to exploit multiple attack vectors on a Drupal site.", "tlp": "CLEAR", "score_factors": {"score": 88, "confidence_base": 80, "source_count": 2, "source_identifiers": ["cisa_kev", "nist_nvd_recent"], "reporting_groups": ["cisa", "nvd"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 8, "age_hours": 0.0, "half_life_hours": 8760.0, "decay_factor": 1.0}}
{"indicator": "CVE-2018-6882", "type": "cve", "source": "cisa_kev,nist_nvd_recent", "first_seen": "2018-03-27T16:29:00Z", "last_seen": "2026-10-24T22:12:15Z", "confidence": "high", "score": 88, "sightings": 519, "tags": "cve,exploited-in-the-wild,medium,nvd", "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "context": "Synacor Zimbra Collaboration Suite (ZCS) contains a cross-site scripting vulnerability that might allow remote attackers to inject arbitrary web script or HTML.", "tlp": "CLEAR", "score_factors": {"score": 88, "confidence_base": 80, "source_count": 2, "source_identifiers": ["cisa_kev", "nist_nvd_recent"], "reporting_groups": ["cisa", "nvd"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 8, "age_hours": 0.0, "half_life_hours": 8760.0, "decay_factor": 1.0}}
{"indicator": "CVE-2017-12149", "type": "cve", "source": "cisa_kev,nist_nvd_recent", "first_seen": "2017-10-04T21:01:00Z", "last_seen": "2026-10-24T22:12:15Z", "confidence": "high", "score": 88, "sightings": 519, "tags": "critical,cve,exploited-in-the-wild,nvd", "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "context": "The JBoss Application Server, shipped with Red Hat Enterprise Application Platform 5.2, allows an attacker to execute arbitrary code via crafted serialized data.", "tlp": "CLEAR", "score_factors": {"score": 88, "confidence_base": 80, "source_count": 2, "source_identifiers": ["cisa_kev", "nist_nvd_recent"], "reporting_groups": ["cisa", "nvd"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 8, "age_hours": 0.0, "half_life_hours": 8760.0, "decay_factor": 1.0}}
{"indicator": "CVE-2015-2291", "type": "cve", "source": "cisa_kev,nist_nvd_recent", "first_seen": "2017-08-09T18:29:00Z", "last_seen": "2026-10-24T22:12:15Z", "confidence": "high", "score": 88, "sightings": 519, "tags": "cve,exploited-in-the-wild,high,nvd", "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "context": "Intel ethernet diagnostics driver for Windows IQVW32.sys and IQVW64.sys contain an unspecified vulnerability that allows for a denial-of-service (DoS).", "tlp": "CLEAR", "score_factors": {"score": 88, "confidence_base": 80, "source_count": 2, "source_identifiers": ["cisa_kev", "nist_nvd_recent"], "reporting_groups": ["cisa", "nvd"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 8, "age_hours": 0.0, "half_life_hours": 8760.0, "decay_factor": 1.0}}
{"indicator": "CVE-2017-6884", "type": "cve", "source": "cisa_kev,nist_nvd_recent", "first_seen": "2017-04-06T17:59:00Z", "last_seen": "2026-10-24T22:12:15Z", "confidence": "high", "score": 88, "sightings": 519, "tags": "cve,exploited-in-the-wild,high,nvd", "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "context": "Zyxel EMG2926 routers contain a command injection vulnerability located in the diagnostic tools, specifically the nslookup function. A malicious user may exploit numerous vectors to execute malicious commands on the router, such as the ping_ip parameter to the expert/maintenance/diagnostic/nslookup URI.", "tlp": "CLEAR", "score_factors": {"score": 88, "confidence_base": 80, "source_count": 2, "source_identifiers": ["cisa_kev", "nist_nvd_recent"], "reporting_groups": ["cisa", "nvd"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 8, "age_hours": 0.0, "half_life_hours": 8760.0, "decay_factor": 1.0}}
{"indicator": "CVE-2016-7255", "type": "cve", "source": "cisa_kev,nist_nvd_recent", "first_seen": "2016-11-10T07:00:09Z", "last_seen": "2026-10-24T22:12:15Z", "confidence": "high", "score": 88, "sightings": 220, "tags": "cve,exploited-in-the-wild,high,nvd", "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "context": "Microsoft Win32k kernel-mode driver fails to properly handle objects in memory which allows for privilege escalation. Successful exploitation allows an attacker to run code in kernel mode.", "tlp": "CLEAR", "score_factors": {"score": 88, "confidence_base": 80, "source_count": 2, "source_identifiers": ["cisa_kev", "nist_nvd_recent"], "reporting_groups": ["cisa", "nvd"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 8, "age_hours": 0.0, "half_life_hours": 8760.0, "decay_factor": 1.0}}
{"indicator": "CVE-2016-4117", "type": "cve", "source": "cisa_kev,nist_nvd_recent", "first_seen": "2016-05-11T01:59:46Z", "last_seen": "2026-10-24T22:12:15Z", "confidence": "high", "score": 88, "sightings": 220, "tags": "critical,cve,exploited-in-the-wild,nvd", "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "context": "An access of resource using incompatible type vulnerability exists within Adobe Flash Player that allows an attacker to perform remote code execution.", "tlp": "CLEAR", "score_factors": {"score": 88, "confidence_base": 80, "source_count": 2, "source_identifiers": ["cisa_kev", "nist_nvd_recent"], "reporting_groups": ["cisa", "nvd"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 8, "age_hours": 0.0, "half_life_hours": 8760.0, "decay_factor": 1.0}}
{"indicator": "CVE-2016-3081", "type": "cve", "source": "cisa_kev,nist_nvd_recent", "first_seen": "2016-04-26T14:59:02Z", "last_seen": "2026-10-24T22:12:15Z", "confidence": "high", "score": 88, "sightings": 59, "tags": "cve,exploited-in-the-wild,high,nvd", "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "context": "Apache Struts contains a command injection vulnerability that could allow remote attackers to execute arbitrary code via method:prefix when Dynamic Method Invocation is enabled.", "tlp": "CLEAR", "score_factors": {"score": 88, "confidence_base": 80, "source_count": 2, "source_identifiers": ["cisa_kev", "nist_nvd_recent"], "reporting_groups": ["cisa", "nvd"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 8, "age_hours": 0.0, "half_life_hours": 8760.0, "decay_factor": 1.0}}
{"indicator": "CVE-2016-1019", "type": "cve", "source": "cisa_kev,nist_nvd_recent", "first_seen": "2016-04-07T10:59:01Z", "last_seen": "2026-10-24T22:12:15Z", "confidence": "high", "score": 88, "sightings": 519, "tags": "critical,cve,exploited-in-the-wild,nvd", "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "context": "Adobe Flash Player allows remote attackers to cause a denial of service or possibly execute arbitrary code.", "tlp": "CLEAR", "score_factors": {"score": 88, "confidence_base": 80, "source_count": 2, "source_identifiers": ["cisa_kev", "nist_nvd_recent"], "reporting_groups": ["cisa", "nvd"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 8, "age_hours": 0.0, "half_life_hours": 8760.0, "decay_factor": 1.0}}
{"indicator": "CVE-2015-3246", "type": "cve", "source": "cisa_kev,nist_nvd_recent", "first_seen": "2015-08-11T14:59:07Z", "last_seen": "2026-10-24T22:12:15Z", "confidence": "high", "score": 88, "sightings": 277, "tags": "cve,exploited-in-the-wild,high,medium,nvd", "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "context": "Red Hat libuser contains a race condition vulnerability that allows authenticated local users to corrupt the /etc/passwd file to cause a denial of service or privilege escalation. ", "tlp": "CLEAR", "score_factors": {"score": 88, "confidence_base": 80, "source_count": 2, "source_identifiers": ["cisa_kev", "nist_nvd_recent"], "reporting_groups": ["cisa", "nvd"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 8, "age_hours": 0.0, "half_life_hours": 8760.0, "decay_factor": 1.0}}
{"indicator": "CVE-2015-5477", "type": "cve", "source": "cisa_kev,nist_nvd_recent", "first_seen": "2015-07-29T14:59:05Z", "last_seen": "2026-10-24T22:12:15Z", "confidence": "high", "score": 88, "sightings": 59, "tags": "cve,exploited-in-the-wild,high,nvd", "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "context": "ISC BIND contains a data processing errors vulnerability that could allow remote attackers to cause a denial of service via TKEY queries.", "tlp": "CLEAR", "score_factors": {"score": 88, "confidence_base": 80, "source_count": 2, "source_identifiers": ["cisa_kev", "nist_nvd_recent"], "reporting_groups": ["cisa", "nvd"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 8, "age_hours": 0.0, "half_life_hours": 8760.0, "decay_factor": 1.0}}
{"indicator": "CVE-2015-3306", "type": "cve", "source": "cisa_kev,nist_nvd_recent", "first_seen": "2015-05-18T15:59:10Z", "last_seen": "2026-10-24T22:12:15Z", "confidence": "high", "score": 88, "sightings": 59, "tags": "critical,cve,exploited-in-the-wild,nvd", "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "context": "ProFTPD contains an improper access control vulnerability that could allow remote attackers to read and write to arbitrary files via the site cpfr and site cpto commands.", "tlp": "CLEAR", "score_factors": {"score": 88, "confidence_base": 80, "source_count": 2, "source_identifiers": ["cisa_kev", "nist_nvd_recent"], "reporting_groups": ["cisa", "nvd"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 8, "age_hours": 0.0, "half_life_hours": 8760.0, "decay_factor": 1.0}}
{"indicator": "CVE-2013-3900", "type": "cve", "source": "cisa_kev,nist_nvd_recent", "first_seen": "2013-12-11T00:55:03Z", "last_seen": "2026-10-24T22:12:15Z", "confidence": "high", "score": 88, "sightings": 220, "tags": "cve,exploited-in-the-wild,medium,nvd", "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "context": "A remote code execution vulnerability exists in the way that the WinVerifyTrust function handles Windows Authenticode signature verification for PE files.", "tlp": "CLEAR", "score_factors": {"score": 88, "confidence_base": 80, "source_count": 2, "source_identifiers": ["cisa_kev", "nist_nvd_recent"], "reporting_groups": ["cisa", "nvd"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 8, "age_hours": 0.0, "half_life_hours": 8760.0, "decay_factor": 1.0}}
{"indicator": "CVE-2013-0431", "type": "cve", "source": "cisa_kev,nist_nvd_recent", "first_seen": "2013-01-31T14:55:01Z", "last_seen": "2026-10-24T22:12:15Z", "confidence": "high", "score": 88, "sightings": 519, "tags": "cve,exploited-in-the-wild,low,medium,nvd", "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "context": "Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle allows remote attackers to bypass the Java security sandbox.", "tlp": "CLEAR", "score_factors": {"score": 88, "confidence_base": 80, "source_count": 2, "source_identifiers": ["cisa_kev", "nist_nvd_recent"], "reporting_groups": ["cisa", "nvd"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 8, "age_hours": 0.0, "half_life_hours": 8760.0, "decay_factor": 1.0}}
{"indicator": "CVE-2012-1710", "type": "cve", "source": "cisa_kev,nist_nvd_recent", "first_seen": "2012-05-03T22:55:02Z", "last_seen": "2026-10-24T22:12:15Z", "confidence": "high", "score": 88, "sightings": 519, "tags": "critical,cve,exploited-in-the-wild,nvd", "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "context": "Unspecified vulnerability in the Oracle WebCenter Forms Recognition component in Oracle Fusion Middleware allows remote attackers to affect confidentiality, integrity, and availability via Unknown vectors related to Designer.", "tlp": "CLEAR", "score_factors": {"score": 88, "confidence_base": 80, "source_count": 2, "source_identifiers": ["cisa_kev", "nist_nvd_recent"], "reporting_groups": ["cisa", "nvd"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 8, "age_hours": 0.0, "half_life_hours": 8760.0, "decay_factor": 1.0}}
{"indicator": "CVE-2010-2861", "type": "cve", "source": "cisa_kev,nist_nvd_recent", "first_seen": "2010-08-11T18:47:51Z", "last_seen": "2026-10-24T22:12:15Z", "confidence": "high", "score": 88, "sightings": 519, "tags": "critical,cve,exploited-in-the-wild,nvd", "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "context": "A directory traversal vulnerability exists in the administrator console in Adobe ColdFusion which allows remote attackers to read arbitrary files.", "tlp": "CLEAR", "score_factors": {"score": 88, "confidence_base": 80, "source_count": 2, "source_identifiers": ["cisa_kev", "nist_nvd_recent"], "reporting_groups": ["cisa", "nvd"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 8, "age_hours": 0.0, "half_life_hours": 8760.0, "decay_factor": 1.0}}
{"indicator": "CVE-2010-1428", "type": "cve", "source": "cisa_kev,nist_nvd_recent", "first_seen": "2010-04-28T22:30:00Z", "last_seen": "2026-10-24T22:12:15Z", "confidence": "high", "score": 88, "sightings": 519, "tags": "cve,exploited-in-the-wild,high,nvd", "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "context": "Unauthenticated access to the JBoss Application Server Web Console (/web-console) is blocked by default. However, it was found that this block was incomplete, and only blocked GET and POST HTTP verbs. A remote attacker could use this flaw to gain access to sensitive information.", "tlp": "CLEAR", "score_factors": {"score": 88, "confidence_base": 80, "source_count": 2, "source_identifiers": ["cisa_kev", "nist_nvd_recent"], "reporting_groups": ["cisa", "nvd"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 8, "age_hours": 0.0, "half_life_hours": 8760.0, "decay_factor": 1.0}}
{"indicator": "CVE-2010-0738", "type": "cve", "source": "cisa_kev,nist_nvd_recent", "first_seen": "2010-04-28T22:30:00Z", "last_seen": "2026-10-24T22:12:15Z", "confidence": "high", "score": 88, "sightings": 519, "tags": "cve,exploited-in-the-wild,medium,nvd", "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "context": "The JMX-Console web application in JBossAs in Red Hat JBoss Enterprise Application Platform performs access control only for the GET and POST methods, which allows remote attackers to send requests to this application's GET handler by using a different method.", "tlp": "CLEAR", "score_factors": {"score": 88, "confidence_base": 80, "source_count": 2, "source_identifiers": ["cisa_kev", "nist_nvd_recent"], "reporting_groups": ["cisa", "nvd"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 8, "age_hours": 0.0, "half_life_hours": 8760.0, "decay_factor": 1.0}}
{"indicator": "CVE-2008-4128", "type": "cve", "source": "cisa_kev,nist_nvd_recent", "first_seen": "2008-09-18T20:00:00Z", "last_seen": "2026-10-24T22:12:15Z", "confidence": "high", "score": 88, "sightings": 518, "tags": "cve,exploited-in-the-wild,high,nvd", "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "context": "Cisco IOS 12.4 contains multiple cross-site forgery vulnerabilities that allows remote attackers to execute arbitrary commands via (1) a certain \"show privilege\" command to the /level/15/exec/- URI, and (2) a certain \"alias exec\" command to the /level/15/exec/-/configure/http URI.", "tlp": "CLEAR", "score_factors": {"score": 88, "confidence_base": 80, "source_count": 2, "source_identifiers": ["cisa_kev", "nist_nvd_recent"], "reporting_groups": ["cisa", "nvd"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 8, "age_hours": 0.0, "half_life_hours": 8760.0, "decay_factor": 1.0}}
{"indicator": "45[.]198[.]224[.]89", "type": "ipv4", "source": "ci_army_list,ipsum_level5,threatfox_export_json", "first_seen": "2026-10-19T13:06:02Z", "last_seen": "2026-10-24T08:34:35Z", "confidence": "high", "score": 83, "sightings": 13, "tags": "MooBot,aggregated,blocklist,cins,ipsum,multi-list,scanner,threatfox", "reference": "https://cinsscore.com/", "context": "Blocklist entry from ci_army_list", "tlp": "CLEAR", "score_factors": {"score": 83, "confidence_base": 80, "source_count": 2, "source_identifiers": ["ci_army_list", "ipsum_level5", "threatfox_export_json"], "reporting_groups": ["abuse.ch", "cins"], "excluded_sources": [{"source": "ipsum_level5", "role": "aggregate"}], "unmapped_sources": [], "corroboration_bonus": 8, "age_hours": 13.6, "half_life_hours": 168.0, "decay_factor": 0.9453}}
{"indicator": "bioindiaservices[.]com", "type": "domain", "source": "threatfox_export_json", "first_seen": "2026-10-24T22:07:42Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 1, "tags": "compromised,etherhide,threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "ClearFake", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 336.0, "decay_factor": 1.0}}
{"indicator": "www[.]alliancefr-bizerte[.]tn", "type": "domain", "source": "threatfox_export_json", "first_seen": "2026-10-24T22:07:41Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 1, "tags": "compromised,etherhide,threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "ClearFake", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 336.0, "decay_factor": 1.0}}
{"indicator": "beatjournals[.]store", "type": "domain", "source": "threatfox_export_json", "first_seen": "2026-10-24T22:07:41Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 1, "tags": "compromised,etherhide,threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "ClearFake", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 336.0, "decay_factor": 1.0}}
{"indicator": "baiihua[.]com", "type": "domain", "source": "threatfox_export_json", "first_seen": "2026-10-24T22:07:41Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 1, "tags": "compromised,etherhide,threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "ClearFake", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 336.0, "decay_factor": 1.0}}
{"indicator": "aqeellogistic[.]com", "type": "domain", "source": "threatfox_export_json", "first_seen": "2026-10-24T22:07:41Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 1, "tags": "compromised,etherhide,threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "ClearFake", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 336.0, "decay_factor": 1.0}}
{"indicator": "hxxps://c[.]adilawa99[.]org/", "type": "url", "source": "threatfox_export_json", "first_seen": "2026-10-24T22:05:48Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 1, "tags": "Vidar,threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "Vidar", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 168.0, "decay_factor": 1.0}}
{"indicator": "c[.]adilawa99[.]org", "type": "domain", "source": "threatfox_export_json", "first_seen": "2026-10-24T22:05:48Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 1, "tags": "Vidar,threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "Vidar", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 336.0, "decay_factor": 1.0}}
{"indicator": "156[.]240[.]14[.]155", "type": "ipv4", "source": "threatfox_export_json", "first_seen": "2026-10-24T22:05:06Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 1, "tags": "Vshell,threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "VShell", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 168.0, "decay_factor": 1.0}}
{"indicator": "110[.]173[.]53[.]101", "type": "ipv4", "source": "threatfox_export_json", "first_seen": "2026-10-24T22:05:06Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 1, "tags": "Vshell,threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "VShell", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 168.0, "decay_factor": 1.0}}
{"indicator": "hxxp://129[.]121[.]115[.]43:9163/llx[.]apk", "type": "url", "source": "threatfox_export_json", "first_seen": "2026-10-24T22:03:50Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 1, "tags": "ADB,Android,apk,honeypot,llx,threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "Unknown malware", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 168.0, "decay_factor": 1.0}}
{"indicator": "9c2d8150f4dfb5030060c8ae701d8e79211b8f37bd43197fae1c2075121211c0", "type": "sha256", "source": "threatfox_export_json", "first_seen": "2026-10-24T21:59:45Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 1, "tags": "Amos,ClickFix,Foxveil,forge,macOS,threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "AMOS", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 4320.0, "decay_factor": 1.0}}
{"indicator": "blogstartups[.]com", "type": "domain", "source": "threatfox_export_json", "first_seen": "2026-10-24T21:57:39Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 1, "tags": "compromised,etherhide,threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "ClearFake", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 336.0, "decay_factor": 1.0}}
{"indicator": "blog[.]edelzone[.]fr", "type": "domain", "source": "threatfox_export_json", "first_seen": "2026-10-24T21:57:39Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 1, "tags": "compromised,etherhide,threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "ClearFake", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 336.0, "decay_factor": 1.0}}
{"indicator": "bestpayoutcasinos[.]org", "type": "domain", "source": "threatfox_export_json", "first_seen": "2026-10-24T21:57:39Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 1, "tags": "compromised,etherhide,threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "ClearFake", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 336.0, "decay_factor": 1.0}}
{"indicator": "azwebsoft[.]online", "type": "domain", "source": "threatfox_export_json", "first_seen": "2026-10-24T21:57:39Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 1, "tags": "compromised,etherhide,threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "ClearFake", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 336.0, "decay_factor": 1.0}}
{"indicator": "appconsulting[.]fr", "type": "domain", "source": "threatfox_export_json", "first_seen": "2026-10-24T21:57:39Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 1, "tags": "compromised,etherhide,threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "ClearFake", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 336.0, "decay_factor": 1.0}}
{"indicator": "beautyavenue[.]us", "type": "domain", "source": "threatfox_export_json", "first_seen": "2026-10-24T21:57:38Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 1, "tags": "compromised,etherhide,threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "ClearFake", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 336.0, "decay_factor": 1.0}}
{"indicator": "barkacsolokboltja[.]hu", "type": "domain", "source": "threatfox_export_json", "first_seen": "2026-10-24T21:57:38Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 1, "tags": "compromised,etherhide,threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "ClearFake", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 336.0, "decay_factor": 1.0}}
{"indicator": "artsetindustriesinformatiques[.]fr", "type": "domain", "source": "threatfox_export_json", "first_seen": "2026-10-24T21:57:38Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 1, "tags": "compromised,etherhide,threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "ClearFake", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 336.0, "decay_factor": 1.0}}
{"indicator": "v[.]getpi[.]su", "type": "domain", "source": "threatfox_export_json", "first_seen": "2026-10-24T21:56:54Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 1, "tags": "threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "Vidar", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 336.0, "decay_factor": 1.0}}
{"indicator": "a7bd0e9cb7c225d7bfe570f8621ce8ca63c178eddc4c318f0b15c8ead45e2cd2", "type": "sha256", "source": "threatfox_export_json", "first_seen": "2026-10-24T21:56:43Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 1, "tags": "Amos,ClickFix,Foxveil,boost,macOS,threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "AMOS", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 4320.0, "decay_factor": 1.0}}
{"indicator": "hxxp://123[.]8[.]55[.]138:39954/i", "type": "url", "source": "urlhaus_recent_urls", "first_seen": "2026-10-24T21:55:13Z", "last_seen": "2026-10-24T22:12:18Z", "confidence": "high", "score": 80, "sightings": 1, "tags": "malware,malware_download,elf,Mozi", "reference": "https://urlhaus.abuse.ch/", "context": "URLhaus: malware_download", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["urlhaus_recent_urls"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 168.0, "decay_factor": 1.0}}
{"indicator": "hxxp://115[.]49[.]4[.]137:40320/i", "type": "url", "source": "urlhaus_recent_urls", "first_seen": "2026-10-24T21:55:12Z", "last_seen": "2026-10-24T22:12:18Z", "confidence": "high", "score": 80, "sightings": 1, "tags": "malware,malware_download,32-bit,elf,mips,Mozi", "reference": "https://urlhaus.abuse.ch/", "context": "URLhaus: malware_download", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["urlhaus_recent_urls"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 168.0, "decay_factor": 1.0}}
{"indicator": "c15a77a91792f555cf29cdcd2415c2ae0fd00005d2bceb3ccd241adca0cf98f7", "type": "sha256", "source": "threatfox_export_json", "first_seen": "2026-10-24T21:53:42Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 1, "tags": "Amos,ClickFix,Foxveil,macOS,stratos,threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "AMOS", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 4320.0, "decay_factor": 1.0}}
{"indicator": "4188fcab89b6b88a761f8ff3facd6ac36f8e66bd15f171775188dd2b8fa51939", "type": "sha256", "source": "threatfox_export_json", "first_seen": "2026-10-24T21:50:51Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 1, "tags": "Amos,ClickFix,Foxveil,grove,macOS,threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "AMOS", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 4320.0, "decay_factor": 1.0}}
{"indicator": "5b6458c024a0333edf779148aa23e3072fb1508103001f4dd6477f5805e262f5", "type": "sha256", "source": "malwarebazaar_recent", "first_seen": "2026-10-24T21:49:56Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 1, "tags": "malware,Mirai", "reference": "https://bazaar.abuse.ch/", "context": "MalwareBazaar: Mirai", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["malwarebazaar_recent"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 4320.0, "decay_factor": 1.0}}
{"indicator": "hxxps://del[.]sou[.]pp[.]ua/ip_ranges[.]txt", "type": "url", "source": "threatfox_export_json", "first_seen": "2026-10-24T21:49:03Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 1, "tags": "honeypot,proxyware,python,threatfox,traffmonetizer", "reference": "https://threatfox.abuse.ch/browse/", "context": "Unknown malware", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 168.0, "decay_factor": 1.0}}
{"indicator": "hxxps://del[.]sou[.]pp[.]ua/install_tm[.]sh", "type": "url", "source": "threatfox_export_json", "first_seen": "2026-10-24T21:49:03Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 1, "tags": "honeypot,proxyware,python,threatfox,traffmonetizer", "reference": "https://threatfox.abuse.ch/browse/", "context": "Unknown malware", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 168.0, "decay_factor": 1.0}}
{"indicator": "hxxps://del[.]sou[.]pp[.]ua/install[.]sh", "type": "url", "source": "threatfox_export_json", "first_seen": "2026-10-24T21:49:03Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 1, "tags": "honeypot,proxyware,python,threatfox,traffmonetizer", "reference": "https://threatfox.abuse.ch/browse/", "context": "Unknown malware", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 168.0, "decay_factor": 1.0}}
{"indicator": "hxxps://del[.]sou[.]pp[.]ua/del[.]txt", "type": "url", "source": "threatfox_export_json", "first_seen": "2026-10-24T21:49:03Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 1, "tags": "honeypot,proxyware,python,threatfox,traffmonetizer", "reference": "https://threatfox.abuse.ch/browse/", "context": "Unknown malware", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 168.0, "decay_factor": 1.0}}
{"indicator": "hxxp://176[.]65[.]139[.]201/nyx_bot_linux_amd64_hkdf", "type": "url", "source": "threatfox_export_json", "first_seen": "2026-10-24T21:48:10Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 1, "tags": "DDoS,elf,golang,honeypot,nyx,threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "Unknown malware", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 168.0, "decay_factor": 1.0}}
{"indicator": "9ffec38b5f3343980fdf7a926bfad3f07c17a4a2e16eb4b4ad909decb5465ff1", "type": "sha256", "source": "threatfox_export_json", "first_seen": "2026-10-24T21:47:49Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 1, "tags": "Amos,ClickFix,Foxveil,frame97,macOS,threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "AMOS", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 4320.0, "decay_factor": 1.0}}
{"indicator": "hxxp://196[.]191[.]231[.]12:53338/i", "type": "url", "source": "urlhaus_recent_urls", "first_seen": "2026-10-24T21:47:10Z", "last_seen": "2026-10-24T22:12:18Z", "confidence": "high", "score": 80, "sightings": 1, "tags": "malware,malware_download,mirai", "reference": "https://urlhaus.abuse.ch/", "context": "URLhaus: malware_download", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["urlhaus_recent_urls"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 168.0, "decay_factor": 1.0}}
{"indicator": "hxxp://59[.]96[.]140[.]238:54441/i", "type": "url", "source": "urlhaus_recent_urls", "first_seen": "2026-10-24T21:47:08Z", "last_seen": "2026-10-24T22:12:18Z", "confidence": "high", "score": 80, "sightings": 1, "tags": "malware,malware_download,Mozi", "reference": "https://urlhaus.abuse.ch/", "context": "URLhaus: malware_download", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["urlhaus_recent_urls"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 168.0, "decay_factor": 1.0}}
{"indicator": "hxxp://115[.]49[.]11[.]8:51631/bin[.]sh", "type": "url", "source": "urlhaus_recent_urls", "first_seen": "2026-10-24T21:47:08Z", "last_seen": "2026-10-24T22:12:18Z", "confidence": "high", "score": 80, "sightings": 1, "tags": "malware,malware_download,mirai", "reference": "https://urlhaus.abuse.ch/", "context": "URLhaus: malware_download", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["urlhaus_recent_urls"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 168.0, "decay_factor": 1.0}}
{"indicator": "hxxp://61[.]176[.]70[.]91:43838/i", "type": "url", "source": "urlhaus_recent_urls", "first_seen": "2026-10-24T21:47:07Z", "last_seen": "2026-10-24T22:12:18Z", "confidence": "high", "score": 80, "sightings": 1, "tags": "malware,malware_download,None", "reference": "https://urlhaus.abuse.ch/", "context": "URLhaus: malware_download", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["urlhaus_recent_urls"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 168.0, "decay_factor": 1.0}}
{"indicator": "hxxp://123[.]189[.]18[.]155:33861/i", "type": "url", "source": "urlhaus_recent_urls", "first_seen": "2026-10-24T21:47:06Z", "last_seen": "2026-10-24T22:12:18Z", "confidence": "high", "score": 80, "sightings": 1, "tags": "malware,malware_download,None", "reference": "https://urlhaus.abuse.ch/", "context": "URLhaus: malware_download", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["urlhaus_recent_urls"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 168.0, "decay_factor": 1.0}}
{"indicator": "155[.]138[.]175[.]126", "type": "ipv4", "source": "threatfox_export_json", "first_seen": "2026-10-24T21:46:45Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 1, "tags": "Beacon,honeypot,persistence,threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "Unknown malware", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 168.0, "decay_factor": 1.0}}
{"indicator": "655addd2cef1396715a4eeb69c793e205bd7cae5bb64770d4d37291eae3b17e3", "type": "sha256", "source": "threatfox_export_json", "first_seen": "2026-10-24T21:44:58Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 1, "tags": "Amos,ClickFix,Foxveil,frame,macOS,threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "AMOS", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 4320.0, "decay_factor": 1.0}}
{"indicator": "4f0dfbf07451be9c9e20efe612a60ee92413e085a77d3c7bd82847d21e8c559c", "type": "sha256", "source": "threatfox_export_json", "first_seen": "2026-10-24T21:42:05Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 1, "tags": "Amos,ClickFix,Foxveil,macOS,nova,threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "AMOS", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 4320.0, "decay_factor": 1.0}}
{"indicator": "event[.]springdepot[.]lat", "type": "domain", "source": "threatfox_export_json", "first_seen": "2026-10-24T21:39:22Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 1, "tags": "RevStealer,threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "RevStealer", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 336.0, "decay_factor": 1.0}}
{"indicator": "bb059bf8aa39a8e8365d9f99b586447853026db3ad1e684a17a9b72fd949956a", "type": "sha256", "source": "threatfox_export_json", "first_seen": "2026-10-24T21:39:12Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 1, "tags": "Amos,ClickFix,Foxveil,haven,macOS,threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "AMOS", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 4320.0, "decay_factor": 1.0}}
{"indicator": "www[.]allcopytx[.]com", "type": "domain", "source": "threatfox_export_json", "first_seen": "2026-10-24T21:37:36Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 1, "tags": "compromised,etherhide,threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "ClearFake", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 336.0, "decay_factor": 1.0}}
{"indicator": "www[.]alvesaraujo[.]com", "type": "domain", "source": "threatfox_export_json", "first_seen": "2026-10-24T21:37:35Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 1, "tags": "compromised,etherhide,threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "ClearFake", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 336.0, "decay_factor": 1.0}}
{"indicator": "www[.]alubox[.]org", "type": "domain", "source": "threatfox_export_json", "first_seen": "2026-10-24T21:37:35Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 1, "tags": "compromised,etherhide,threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "ClearFake", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 336.0, "decay_factor": 1.0}}
{"indicator": "www[.]allcoastinteriorlinings[.]com[.]au", "type": "domain", "source": "threatfox_export_json", "first_seen": "2026-10-24T21:37:35Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 1, "tags": "compromised,etherhide,threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "ClearFake", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 336.0, "decay_factor": 1.0}}
{"indicator": "www[.]adamellobrentameteo[.]it", "type": "domain", "source": "threatfox_export_json", "first_seen": "2026-10-24T21:37:35Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 1, "tags": "compromised,etherhide,threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "ClearFake", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 336.0, "decay_factor": 1.0}}
{"indicator": "e11d97166f3419f58d5c2996e12046ccf6e4522cd6739251e50319203def3979", "type": "sha256", "source": "threatfox_export_json", "first_seen": "2026-10-24T21:36:22Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 1, "tags": "Amos,ClickFix,Foxveil,chant,macOS,threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "AMOS", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 4320.0, "decay_factor": 1.0}}
{"indicator": "hxxp://115[.]55[.]220[.]145:36742/i", "type": "url", "source": "urlhaus_recent_urls", "first_seen": "2026-10-24T21:36:19Z", "last_seen": "2026-10-24T22:12:18Z", "confidence": "high", "score": 80, "sightings": 1, "tags": "malware,malware_download,32-bit,elf,mips,Mozi", "reference": "https://urlhaus.abuse.ch/", "context": "URLhaus: malware_download", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["urlhaus_recent_urls"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 168.0, "decay_factor": 1.0}}
{"indicator": "2d2e0392b48f3e2c97f6153709a9adc333a85287749c04c007e44cb7cdc0374d", "type": "sha256", "source": "threatfox_export_json", "first_seen": "2026-10-24T21:33:21Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 1, "tags": "Amos,ClickFix,Foxveil,macOS,threatfox,willow", "reference": "https://threatfox.abuse.ch/browse/", "context": "AMOS", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 4320.0, "decay_factor": 1.0}}
{"indicator": "hxxp://42[.]227[.]173[.]102:56891/bin[.]sh", "type": "url", "source": "urlhaus_recent_urls", "first_seen": "2026-10-24T21:32:11Z", "last_seen": "2026-10-24T22:12:18Z", "confidence": "high", "score": 80, "sightings": 1, "tags": "malware,malware_download,Mozi", "reference": "https://urlhaus.abuse.ch/", "context": "URLhaus: malware_download", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["urlhaus_recent_urls"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 168.0, "decay_factor": 1.0}}
{"indicator": "845c5901c9d0492dc0d212e4784e0c8ec3252adb9fabb7eb1c1f6fa0a457724a", "type": "sha256", "source": "threatfox_export_json", "first_seen": "2026-10-24T21:30:27Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 1, "tags": "Amos,ClickFix,Foxveil,macOS,quill,threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "AMOS", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 4320.0, "decay_factor": 1.0}}
{"indicator": "hxxp://115[.]49[.]4[.]137:40320/bin[.]sh", "type": "url", "source": "urlhaus_recent_urls", "first_seen": "2026-10-24T21:27:18Z", "last_seen": "2026-10-24T22:12:18Z", "confidence": "high", "score": 80, "sightings": 1, "tags": "malware,malware_download,32-bit,elf,mips,Mozi", "reference": "https://urlhaus.abuse.ch/", "context": "URLhaus: malware_download", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["urlhaus_recent_urls"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 168.0, "decay_factor": 1.0}}
{"indicator": "www[.]111tv[.]it", "type": "domain", "source": "threatfox_export_json", "first_seen": "2026-10-24T21:22:18Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 1, "tags": "compromised,etherhide,threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "ClearFake", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 336.0, "decay_factor": 1.0}}
{"indicator": "allianzexecutivo[.]com[.]br", "type": "domain", "source": "threatfox_export_json", "first_seen": "2026-10-24T21:22:18Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 1, "tags": "compromised,etherhide,threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "ClearFake", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 336.0, "decay_factor": 1.0}}
{"indicator": "6e136391f87beac4ae152e4f3f24ad61fb7b06df0fdb39d0005660ea1c5ea55e", "type": "sha256", "source": "malwarebazaar_recent", "first_seen": "2026-10-24T21:17:19Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 1, "tags": "malware,Mirai", "reference": "https://bazaar.abuse.ch/", "context": "MalwareBazaar: Mirai", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["malwarebazaar_recent"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 4320.0, "decay_factor": 1.0}}
{"indicator": "hxxp://221[.]14[.]182[.]104:50789/bin[.]sh", "type": "url", "source": "urlhaus_recent_urls", "first_seen": "2026-10-24T21:17:08Z", "last_seen": "2026-10-24T22:12:18Z", "confidence": "high", "score": 80, "sightings": 1, "tags": "malware,malware_download,Mozi", "reference": "https://urlhaus.abuse.ch/", "context": "URLhaus: malware_download", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["urlhaus_recent_urls"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 168.0, "decay_factor": 1.0}}
{"indicator": "hxxp://42[.]239[.]240[.]52:51436/i", "type": "url", "source": "urlhaus_recent_urls", "first_seen": "2026-10-24T21:17:07Z", "last_seen": "2026-10-24T22:12:18Z", "confidence": "high", "score": 80, "sightings": 1, "tags": "malware,malware_download,Mozi", "reference": "https://urlhaus.abuse.ch/", "context": "URLhaus: malware_download", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["urlhaus_recent_urls"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 168.0, "decay_factor": 1.0}}
{"indicator": "hxxp://219[.]155[.]80[.]139:35992/i", "type": "url", "source": "urlhaus_recent_urls", "first_seen": "2026-10-24T21:17:07Z", "last_seen": "2026-10-24T22:12:18Z", "confidence": "high", "score": 80, "sightings": 1, "tags": "malware,malware_download,Mozi", "reference": "https://urlhaus.abuse.ch/", "context": "URLhaus: malware_download", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["urlhaus_recent_urls"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 168.0, "decay_factor": 1.0}}
{"indicator": "hxxp://183[.]12[.]171[.]187:44417/bin[.]sh", "type": "url", "source": "urlhaus_recent_urls", "first_seen": "2026-10-24T21:17:07Z", "last_seen": "2026-10-24T22:12:18Z", "confidence": "high", "score": 80, "sightings": 1, "tags": "malware,malware_download,mirai", "reference": "https://urlhaus.abuse.ch/", "context": "URLhaus: malware_download", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["urlhaus_recent_urls"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 168.0, "decay_factor": 1.0}}
{"indicator": "hxxp://182[.]116[.]115[.]115:58495/i", "type": "url", "source": "urlhaus_recent_urls", "first_seen": "2026-10-24T21:17:07Z", "last_seen": "2026-10-24T22:12:18Z", "confidence": "high", "score": 80, "sightings": 1, "tags": "malware,malware_download,Mozi", "reference": "https://urlhaus.abuse.ch/", "context": "URLhaus: malware_download", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["urlhaus_recent_urls"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 168.0, "decay_factor": 1.0}}
{"indicator": "hxxp://123[.]189[.]18[.]155:33861/bin[.]sh", "type": "url", "source": "urlhaus_recent_urls", "first_seen": "2026-10-24T21:17:07Z", "last_seen": "2026-10-24T22:12:18Z", "confidence": "high", "score": 80, "sightings": 1, "tags": "malware,malware_download,None", "reference": "https://urlhaus.abuse.ch/", "context": "URLhaus: malware_download", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["urlhaus_recent_urls"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 168.0, "decay_factor": 1.0}}
{"indicator": "3cad72ca97f4394491d63bbcb0c33f79c3871e4b58f2913a7270520a2b6da162", "type": "sha256", "source": "malwarebazaar_recent", "first_seen": "2026-10-24T21:15:09Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 1, "tags": "malware,WannaCry", "reference": "https://bazaar.abuse.ch/", "context": "MalwareBazaar: WannaCry", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["malwarebazaar_recent"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 4320.0, "decay_factor": 1.0}}
{"indicator": "deload[.]getpi[.]su", "type": "domain", "source": "threatfox_export_json", "first_seen": "2026-10-24T21:13:19Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 1, "tags": "threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "Vidar", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 336.0, "decay_factor": 1.0}}
{"indicator": "www[.]150graziadeledda[.]it", "type": "domain", "source": "threatfox_export_json", "first_seen": "2026-10-24T21:12:17Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 1, "tags": "compromised,etherhide,threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "ClearFake", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 336.0, "decay_factor": 1.0}}
{"indicator": "24siete[.]info", "type": "domain", "source": "threatfox_export_json", "first_seen": "2026-10-24T21:12:17Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 1, "tags": "compromised,etherhide,threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "ClearFake", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 336.0, "decay_factor": 1.0}}
{"indicator": "alldatadaily[.]info", "type": "domain", "source": "threatfox_export_json", "first_seen": "2026-10-24T21:12:16Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 1, "tags": "compromised,etherhide,threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "ClearFake", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 336.0, "decay_factor": 1.0}}
{"indicator": "alansarkw[.]com", "type": "domain", "source": "threatfox_export_json", "first_seen": "2026-10-24T21:12:16Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 1, "tags": "compromised,etherhide,threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "ClearFake", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 336.0, "decay_factor": 1.0}}
{"indicator": "a-head[.]fr", "type": "domain", "source": "threatfox_export_json", "first_seen": "2026-10-24T21:12:16Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 1, "tags": "compromised,etherhide,threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "ClearFake", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 336.0, "decay_factor": 1.0}}
{"indicator": "www[.]11quu[.]com", "type": "domain", "source": "threatfox_export_json", "first_seen": "2026-10-24T21:12:15Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 1, "tags": "compromised,etherhide,threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "ClearFake", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 336.0, "decay_factor": 1.0}}
{"indicator": "afritekers[.]com", "type": "domain", "source": "threatfox_export_json", "first_seen": "2026-10-24T21:12:15Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 1, "tags": "compromised,etherhide,threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "ClearFake", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 336.0, "decay_factor": 1.0}}
{"indicator": "affordablemedicalhealthcare[.]com", "type": "domain", "source": "threatfox_export_json", "first_seen": "2026-10-24T21:12:15Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 1, "tags": "compromised,etherhide,threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "ClearFake", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 336.0, "decay_factor": 1.0}}
{"indicator": "afb-aspect[.]com", "type": "domain", "source": "threatfox_export_json", "first_seen": "2026-10-24T21:12:15Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 1, "tags": "compromised,etherhide,threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "ClearFake", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 336.0, "decay_factor": 1.0}}
{"indicator": "aciencia-cap[.]com", "type": "domain", "source": "threatfox_export_json", "first_seen": "2026-10-24T21:12:15Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 1, "tags": "compromised,etherhide,threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "ClearFake", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 336.0, "decay_factor": 1.0}}
{"indicator": "administrationvisa[.]com", "type": "domain", "source": "threatfox_export_json", "first_seen": "2026-10-24T21:12:14Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 1, "tags": "compromised,etherhide,threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "ClearFake", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 336.0, "decay_factor": 1.0}}
{"indicator": "aceexterior[.]com", "type": "domain", "source": "threatfox_export_json", "first_seen": "2026-10-24T21:12:14Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 1, "tags": "compromised,etherhide,threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "ClearFake", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 336.0, "decay_factor": 1.0}}
{"indicator": "acecamps[.]net", "type": "domain", "source": "threatfox_export_json", "first_seen": "2026-10-24T21:12:14Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 1, "tags": "compromised,etherhide,threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "ClearFake", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 336.0, "decay_factor": 1.0}}
{"indicator": "99websitestudio[.]com", "type": "domain", "source": "threatfox_export_json", "first_seen": "2026-10-24T21:12:14Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 1, "tags": "compromised,etherhide,threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "ClearFake", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 336.0, "decay_factor": 1.0}}
{"indicator": "4xvc[.]com", "type": "domain", "source": "threatfox_export_json", "first_seen": "2026-10-24T21:12:13Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 1, "tags": "compromised,etherhide,threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "ClearFake", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 336.0, "decay_factor": 1.0}}
{"indicator": "38[.]60[.]179[.]108", "type": "ipv4", "source": "threatfox_export_json", "first_seen": "2026-10-24T21:05:04Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 1, "tags": "CobaltStrike,threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "Cobalt Strike", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 168.0, "decay_factor": 1.0}}
{"indicator": "18[.]118[.]229[.]48", "type": "ipv4", "source": "threatfox_export_json", "first_seen": "2026-10-24T21:05:03Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 1, "tags": "CobaltStrike,threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "Cobalt Strike", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 168.0, "decay_factor": 1.0}}
{"indicator": "cd72c23bef1c9120ba0528efb8437c4fe0b7f5d2bbe8877ba02ae8b980420453", "type": "sha256", "source": "threatfox_export_json", "first_seen": "2026-10-24T21:03:04Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 1, "tags": "Amos,ClickFix,Foxveil,forge,macOS,threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "AMOS", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 4320.0, "decay_factor": 1.0}}
{"indicator": "amberbriefs[.]store", "type": "domain", "source": "threatfox_export_json", "first_seen": "2026-10-24T21:02:12Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 1, "tags": "compromised,etherhide,threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "ClearFake", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 336.0, "decay_factor": 1.0}}
{"indicator": "ambercorner[.]store", "type": "domain", "source": "threatfox_export_json", "first_seen": "2026-10-24T21:02:11Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 1, "tags": "compromised,etherhide,threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "ClearFake", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 336.0, "decay_factor": 1.0}}
{"indicator": "amberchronicle[.]store", "type": "domain", "source": "threatfox_export_json", "first_seen": "2026-10-24T21:02:11Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 1, "tags": "compromised,etherhide,threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "ClearFake", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 336.0, "decay_factor": 1.0}}
{"indicator": "adplaret[.]com", "type": "domain", "source": "threatfox_export_json", "first_seen": "2026-10-24T21:02:11Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 1, "tags": "compromised,etherhide,threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "ClearFake", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 336.0, "decay_factor": 1.0}}
{"indicator": "amberdiaries[.]store", "type": "domain", "source": "threatfox_export_json", "first_seen": "2026-10-24T21:02:10Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 1, "tags": "compromised,etherhide,threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "ClearFake", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 336.0, "decay_factor": 1.0}}
{"indicator": "admission[.]qaed[.]pk", "type": "domain", "source": "threatfox_export_json", "first_seen": "2026-10-24T21:02:10Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 1, "tags": "compromised,etherhide,threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "ClearFake", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 336.0, "decay_factor": 1.0}}
{"indicator": "556990[.]xyz", "type": "domain", "source": "threatfox_export_json", "first_seen": "2026-10-24T21:02:10Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 1, "tags": "compromised,etherhide,threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "ClearFake", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 336.0, "decay_factor": 1.0}}
{"indicator": "889992513[.]xyz", "type": "domain", "source": "threatfox_export_json", "first_seen": "2026-10-24T21:02:09Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 1, "tags": "compromised,etherhide,threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "ClearFake", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 336.0, "decay_factor": 1.0}}
{"indicator": "hxxp://42[.]234[.]142[.]188:57183/i", "type": "url", "source": "urlhaus_recent_urls", "first_seen": "2026-10-24T21:02:05Z", "last_seen": "2026-10-24T22:12:18Z", "confidence": "high", "score": 80, "sightings": 1, "tags": "malware,malware_download,Mozi", "reference": "https://urlhaus.abuse.ch/", "context": "URLhaus: malware_download", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["urlhaus_recent_urls"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 168.0, "decay_factor": 1.0}}
{"indicator": "hxxp://220[.]198[.]113[.]11:56881/i", "type": "url", "source": "urlhaus_recent_urls", "first_seen": "2026-10-24T21:02:05Z", "last_seen": "2026-10-24T22:12:18Z", "confidence": "high", "score": 80, "sightings": 1, "tags": "malware,malware_download,None", "reference": "https://urlhaus.abuse.ch/", "context": "URLhaus: malware_download", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["urlhaus_recent_urls"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 168.0, "decay_factor": 1.0}}
{"indicator": "hxxp://116[.]53[.]43[.]75:39671/bin[.]sh", "type": "url", "source": "urlhaus_recent_urls", "first_seen": "2026-10-24T21:01:28Z", "last_seen": "2026-10-24T22:12:18Z", "confidence": "high", "score": 80, "sightings": 1, "tags": "malware,malware_download,32-bit,arm,elf,mirai,Mozi", "reference": "https://urlhaus.abuse.ch/", "context": "URLhaus: malware_download", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["urlhaus_recent_urls"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 168.0, "decay_factor": 1.0}}
{"indicator": "hxxps://administrationvisa[.]com/", "type": "url", "source": "threatfox_export_json", "first_seen": "2026-10-24T21:00:37Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 1, "tags": "ClickFix,threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "Unknown malware", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 168.0, "decay_factor": 1.0}}
{"indicator": "hxxps://556990[.]xyz/", "type": "url", "source": "threatfox_export_json", "first_seen": "2026-10-24T21:00:37Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 1, "tags": "ClickFix,threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "Unknown malware", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 168.0, "decay_factor": 1.0}}
{"indicator": "19a24cdbaca4bf48f7a73697cbe6fe8404c402fa5d4f16ad34a1a5868f653fcd", "type": "sha256", "source": "threatfox_export_json", "first_seen": "2026-10-24T21:00:03Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 1, "tags": "Amos,ClickFix,Foxveil,boost,macOS,threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "AMOS", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 4320.0, "decay_factor": 1.0}}
{"indicator": "955fdf4dc9f3bbd7020fe002faa7ef85619e1a33c183b8d6929a407a0bb53f07", "type": "sha256", "source": "threatfox_export_json", "first_seen": "2026-10-24T20:56:53Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 1, "tags": "Amos,ClickFix,Foxveil,macOS,stratos,threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "AMOS", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 4320.0, "decay_factor": 1.0}}
{"indicator": "hxxp://60[.]211[.]70[.]40:36563/i", "type": "url", "source": "urlhaus_recent_urls", "first_seen": "2026-10-24T20:54:09Z", "last_seen": "2026-10-24T22:12:18Z", "confidence": "high", "score": 80, "sightings": 1, "tags": "malware,malware_download,32-bit,elf,mips,Mozi", "reference": "https://urlhaus.abuse.ch/", "context": "URLhaus: malware_download", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["urlhaus_recent_urls"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 168.0, "decay_factor": 1.0}}
{"indicator": "bd89557fc733124867570eafb2c762b63a18cfdc7005e8776d01e0346427e983", "type": "sha256", "source": "threatfox_export_json", "first_seen": "2026-10-24T20:54:00Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 1, "tags": "Amos,ClickFix,Foxveil,grove,macOS,threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "AMOS", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 4320.0, "decay_factor": 1.0}}
{"indicator": "d42fede1058f62ba45ce9eff1923d644fd2cc1ab6ac1994abc58bd1fd6c666e6", "type": "sha256", "source": "malwarebazaar_recent", "first_seen": "2026-10-24T20:52:23Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 1, "tags": "malware,Mirai", "reference": "https://bazaar.abuse.ch/", "context": "MalwareBazaar: Mirai", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["malwarebazaar_recent"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 4320.0, "decay_factor": 1.0}}
{"indicator": "db4cb5095a5d490265826c0dc5fa5f931c826679076a0e53acd2d7b1e7a54870", "type": "sha256", "source": "threatfox_export_json", "first_seen": "2026-10-24T20:51:04Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 1, "tags": "Amos,ClickFix,Foxveil,frame97,macOS,threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "AMOS", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 4320.0, "decay_factor": 1.0}}
{"indicator": "3d0ed188d7c5918481c91776459b664c13cdfa4cd57a4288aa37edaa9c596c74", "type": "sha256", "source": "threatfox_export_json", "first_seen": "2026-10-24T20:48:05Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 1, "tags": "Amos,ClickFix,Foxveil,frame,macOS,threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "AMOS", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 4320.0, "decay_factor": 1.0}}
{"indicator": "hxxp://42[.]239[.]240[.]52:51436/bin[.]sh", "type": "url", "source": "urlhaus_recent_urls", "first_seen": "2026-10-24T20:47:07Z", "last_seen": "2026-10-24T22:12:18Z", "confidence": "high", "score": 80, "sightings": 1, "tags": "malware,malware_download,Mozi", "reference": "https://urlhaus.abuse.ch/", "context": "URLhaus: malware_download", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["urlhaus_recent_urls"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 168.0, "decay_factor": 1.0}}
{"indicator": "hxxp://182[.]116[.]12[.]137:40825/i", "type": "url", "source": "urlhaus_recent_urls", "first_seen": "2026-10-24T20:47:06Z", "last_seen": "2026-10-24T22:12:18Z", "confidence": "high", "score": 80, "sightings": 1, "tags": "malware,malware_download,Mozi", "reference": "https://urlhaus.abuse.ch/", "context": "URLhaus: malware_download", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["urlhaus_recent_urls"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 168.0, "decay_factor": 1.0}}
{"indicator": "hxxp://125[.]45[.]11[.]156:53066/i", "type": "url", "source": "urlhaus_recent_urls", "first_seen": "2026-10-24T20:47:05Z", "last_seen": "2026-10-24T22:12:18Z", "confidence": "high", "score": 80, "sightings": 1, "tags": "malware,malware_download,Mozi", "reference": "https://urlhaus.abuse.ch/", "context": "URLhaus: malware_download", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["urlhaus_recent_urls"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 168.0, "decay_factor": 1.0}}
{"indicator": "4m8axf47[.]worknernorgram[.]rest", "type": "domain", "source": "threatfox_export_json", "first_seen": "2026-10-24T20:46:44Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 1, "tags": "ClearFake,mac-0xdcf2,macOS,threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "ClearFake", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 336.0, "decay_factor": 1.0}}
{"indicator": "0f1ac762b4e0e2e9a90e4aa340dc16c0fefbb38f3bfa5fe0d54ce7854686d583", "type": "sha256", "source": "threatfox_export_json", "first_seen": "2026-10-24T20:45:07Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 1, "tags": "Amos,ClickFix,Foxveil,macOS,nova,threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "AMOS", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 4320.0, "decay_factor": 1.0}}
{"indicator": "www[.]precisionprinterservices[.]com", "type": "domain", "source": "threatfox_export_json", "first_seen": "2026-10-24T20:42:06Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 1, "tags": "compromised,etherhide,threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "ClearFake", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 336.0, "decay_factor": 1.0}}
{"indicator": "500d4a59e841270ac27b93547f8d72a8c72dcf875ae4fca809f47380840d93ea", "type": "sha256", "source": "threatfox_export_json", "first_seen": "2026-10-24T20:42:06Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 1, "tags": "Amos,ClickFix,Foxveil,haven,macOS,threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "AMOS", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 4320.0, "decay_factor": 1.0}}
{"indicator": "www[.]trinityoftithing[.]com", "type": "domain", "source": "threatfox_export_json", "first_seen": "2026-10-24T20:42:03Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 1, "tags": "compromised,etherhide,threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "ClearFake", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 336.0, "decay_factor": 1.0}}
{"indicator": "c742ec47af51052c61882b6a097bcdfbfb4b905cffd59e7a2bc2fb535a78a4af", "type": "sha256", "source": "threatfox_export_json", "first_seen": "2026-10-24T20:39:15Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 1, "tags": "Amos,ClickFix,Foxveil,chant,macOS,threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "AMOS", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 4320.0, "decay_factor": 1.0}}
{"indicator": "7505f68c6428914e3d2fc83a22440694370d3b55013485595f9863950256f7c4", "type": "sha256", "source": "malwarebazaar_recent", "first_seen": "2026-10-24T20:36:04Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 1, "tags": "malware", "reference": "https://bazaar.abuse.ch/", "context": "MalwareBazaar: ", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["malwarebazaar_recent"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 4320.0, "decay_factor": 1.0}}
{"indicator": "6ac23271ee051abb71bf60a65daf39ab31d2b852165f88c5b5fe6ff7693c4e1e", "type": "sha256", "source": "threatfox_export_json", "first_seen": "2026-10-24T20:36:03Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 1, "tags": "Amos,ClickFix,Foxveil,macOS,threatfox,willow", "reference": "https://threatfox.abuse.ch/browse/", "context": "AMOS", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 4320.0, "decay_factor": 1.0}}
{"indicator": "8b88b5ce9263f49cbc0a2f05d754a75a860e970ceb9eb416cb767595a1d2451b", "type": "sha256", "source": "malwarebazaar_recent", "first_seen": "2026-10-24T20:34:07Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 1, "tags": "malware", "reference": "https://bazaar.abuse.ch/", "context": "MalwareBazaar: ", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["malwarebazaar_recent"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 4320.0, "decay_factor": 1.0}}
{"indicator": "gbhpljne[.]paars[.]poker", "type": "domain", "source": "threatfox_export_json", "first_seen": "2026-10-24T20:33:16Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 1, "tags": "ClearFake,mac-0x0f14,macOS,threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "ClearFake", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 336.0, "decay_factor": 1.0}}
{"indicator": "4d33abec3c68f195e84e92b3b50200604acffea9f5ffcb14d68c3917f4e25b3c", "type": "sha256", "source": "threatfox_export_json", "first_seen": "2026-10-24T20:33:07Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 1, "tags": "Amos,ClickFix,Foxveil,macOS,quill,threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "AMOS", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 4320.0, "decay_factor": 1.0}}
{"indicator": "c189d6a23a412aeabdb65e6ce77cee8632323bbc70c44435c2940d8725c69a01", "type": "sha256", "source": "malwarebazaar_recent", "first_seen": "2026-10-24T20:32:34Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 1, "tags": "malware", "reference": "https://bazaar.abuse.ch/", "context": "MalwareBazaar: ", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["malwarebazaar_recent"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 4320.0, "decay_factor": 1.0}}
{"indicator": "hxxp://60[.]19[.]243[.]54:44612/i", "type": "url", "source": "urlhaus_recent_urls", "first_seen": "2026-10-24T20:32:05Z", "last_seen": "2026-10-24T22:12:18Z", "confidence": "high", "score": 80, "sightings": 1, "tags": "malware,malware_download,None", "reference": "https://urlhaus.abuse.ch/", "context": "URLhaus: malware_download", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["urlhaus_recent_urls"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 168.0, "decay_factor": 1.0}}
{"indicator": "www[.]rotundavillas[.]com", "type": "domain", "source": "threatfox_export_json", "first_seen": "2026-10-24T20:32:02Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 1, "tags": "compromised,etherhide,threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "ClearFake", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 336.0, "decay_factor": 1.0}}
{"indicator": "www[.]shenzhen2050[.]com", "type": "domain", "source": "threatfox_export_json", "first_seen": "2026-10-24T20:31:59Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 1, "tags": "compromised,etherhide,threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "ClearFake", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 336.0, "decay_factor": 1.0}}
{"indicator": "31[.]77[.]220[.]7", "type": "ipv4", "source": "threatfox_export_json", "first_seen": "2026-10-24T20:31:00Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 1, "tags": "threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "Remus", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 168.0, "decay_factor": 1.0}}
{"indicator": "de[.]remusdownloads[.]su", "type": "domain", "source": "threatfox_export_json", "first_seen": "2026-10-24T20:30:37Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 1, "tags": "threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "Remus", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 336.0, "decay_factor": 1.0}}
{"indicator": "eaddd0e6bf1c396859cee853792e6878977c8951829e1c43a66b204cc11a6a47", "type": "sha256", "source": "malwarebazaar_recent", "first_seen": "2026-10-24T20:22:58Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 1, "tags": "malware", "reference": "https://bazaar.abuse.ch/", "context": "MalwareBazaar: ", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["malwarebazaar_recent"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 4320.0, "decay_factor": 1.0}}
{"indicator": "fac[.]ucao-uuz[.]com", "type": "domain", "source": "threatfox_export_json", "first_seen": "2026-10-24T20:21:57Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 1, "tags": "compromised,etherhide,threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "ClearFake", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 336.0, "decay_factor": 1.0}}
{"indicator": "www[.]lesmilanregistry[.]com", "type": "domain", "source": "threatfox_export_json", "first_seen": "2026-10-24T20:21:56Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 1, "tags": "compromised,etherhide,threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "ClearFake", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 336.0, "decay_factor": 1.0}}
{"indicator": "hxxp://83[.]188[.]251[.]9:60758/i", "type": "url", "source": "urlhaus_recent_urls", "first_seen": "2026-10-24T20:17:08Z", "last_seen": "2026-10-24T22:12:18Z", "confidence": "high", "score": 80, "sightings": 1, "tags": "malware,malware_download,mirai", "reference": "https://urlhaus.abuse.ch/", "context": "URLhaus: malware_download", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["urlhaus_recent_urls"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 168.0, "decay_factor": 1.0}}
{"indicator": "hxxp://115[.]53[.]241[.]76:42289/i", "type": "url", "source": "urlhaus_recent_urls", "first_seen": "2026-10-24T20:17:07Z", "last_seen": "2026-10-24T22:12:18Z", "confidence": "high", "score": 80, "sightings": 1, "tags": "malware,malware_download,Mozi", "reference": "https://urlhaus.abuse.ch/", "context": "URLhaus: malware_download", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["urlhaus_recent_urls"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 168.0, "decay_factor": 1.0}}
{"indicator": "hxxp://123[.]14[.]88[.]128:35845/i", "type": "url", "source": "urlhaus_recent_urls", "first_seen": "2026-10-24T20:17:06Z", "last_seen": "2026-10-24T22:12:18Z", "confidence": "high", "score": 80, "sightings": 1, "tags": "malware,malware_download,Mozi", "reference": "https://urlhaus.abuse.ch/", "context": "URLhaus: malware_download", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["urlhaus_recent_urls"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 168.0, "decay_factor": 1.0}}
{"indicator": "3u8krmfu[.]energedia[.]com", "type": "domain", "source": "threatfox_export_json", "first_seen": "2026-10-24T20:16:08Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 1, "tags": "ClearFake,mac-0x68dc,macOS,threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "ClearFake", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 336.0, "decay_factor": 1.0}}
{"indicator": "energedia[.]com", "type": "domain", "source": "threatfox_export_json", "first_seen": "2026-10-24T20:04:20Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 1, "tags": "ClearFake,threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "ClearFake", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 336.0, "decay_factor": 1.0}}
{"indicator": "hxxp://125[.]42[.]14[.]247:42475/i", "type": "url", "source": "urlhaus_recent_urls", "first_seen": "2026-10-24T20:03:06Z", "last_seen": "2026-10-24T22:12:18Z", "confidence": "high", "score": 80, "sightings": 1, "tags": "malware,malware_download,Mozi", "reference": "https://urlhaus.abuse.ch/", "context": "URLhaus: malware_download", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["urlhaus_recent_urls"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 168.0, "decay_factor": 1.0}}
{"indicator": "hxxp://60[.]19[.]220[.]91:35940/i", "type": "url", "source": "urlhaus_recent_urls", "first_seen": "2026-10-24T20:02:08Z", "last_seen": "2026-10-24T22:12:18Z", "confidence": "high", "score": 80, "sightings": 1, "tags": "malware,malware_download,None", "reference": "https://urlhaus.abuse.ch/", "context": "URLhaus: malware_download", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["urlhaus_recent_urls"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 168.0, "decay_factor": 1.0}}
{"indicator": "hxxp://219[.]156[.]115[.]201:41968/i", "type": "url", "source": "urlhaus_recent_urls", "first_seen": "2026-10-24T20:02:07Z", "last_seen": "2026-10-24T22:12:18Z", "confidence": "high", "score": 80, "sightings": 1, "tags": "malware,malware_download,Mozi", "reference": "https://urlhaus.abuse.ch/", "context": "URLhaus: malware_download", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["urlhaus_recent_urls"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 168.0, "decay_factor": 1.0}}
{"indicator": "hxxp://60[.]19[.]217[.]54:47297/bin[.]sh", "type": "url", "source": "urlhaus_recent_urls", "first_seen": "2026-10-24T20:02:06Z", "last_seen": "2026-10-24T22:12:18Z", "confidence": "high", "score": 80, "sightings": 1, "tags": "malware,malware_download,None", "reference": "https://urlhaus.abuse.ch/", "context": "URLhaus: malware_download", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["urlhaus_recent_urls"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 168.0, "decay_factor": 1.0}}
{"indicator": "hxxp://175[.]165[.]94[.]178:54439/bin[.]sh", "type": "url", "source": "urlhaus_recent_urls", "first_seen": "2026-10-24T20:02:06Z", "last_seen": "2026-10-24T22:12:18Z", "confidence": "high", "score": 80, "sightings": 1, "tags": "malware,malware_download,None", "reference": "https://urlhaus.abuse.ch/", "context": "URLhaus: malware_download", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["urlhaus_recent_urls"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 168.0, "decay_factor": 1.0}}
{"indicator": "emakbapaklugimanasehat[.]my[.]id", "type": "domain", "source": "threatfox_export_json", "first_seen": "2026-10-24T19:49:45Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 1, "tags": "ADB,AISURU,payload,threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "Aisuru", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 336.0, "decay_factor": 1.0}}
{"indicator": "manzzkontolaktolakan[.]my[.]id", "type": "domain", "source": "threatfox_export_json", "first_seen": "2026-10-24T19:49:44Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 1, "tags": "ADB,AISURU,DDoS,c2,threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "Aisuru", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 336.0, "decay_factor": 1.0}}
{"indicator": "129[.]121[.]115[.]43", "type": "ipv4", "source": "threatfox_export_json", "first_seen": "2026-10-24T19:49:44Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 1, "tags": "ADB,AISURU,Android,DDoS,c2,honeypot,llx,payload,threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "Unknown malware", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 168.0, "decay_factor": 1.0}}
{"indicator": "62e1c8b2f427296a64de68031105058afa1dfa0ada054cd98026746e51ba87c1", "type": "sha256", "source": "malwarebazaar_recent,threatfox_export_json", "first_seen": "2026-10-24T19:49:41Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 1, "tags": "ADB,AISURU,DDoS,Mirai,elf,malware,threatfox", "reference": "https://bazaar.abuse.ch/", "context": "MalwareBazaar: Mirai", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["malwarebazaar_recent", "threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 4320.0, "decay_factor": 1.0}}
{"indicator": "95d3b53b17d267bdb6b547a0c5f167d4807ce31349eb06fa698a6b0c111f2af2", "type": "sha256", "source": "malwarebazaar_recent,threatfox_export_json", "first_seen": "2026-10-24T19:49:34Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 1, "tags": "ADB,AISURU,DDoS,Mirai,elf,malware,threatfox", "reference": "https://bazaar.abuse.ch/", "context": "MalwareBazaar: Mirai", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["malwarebazaar_recent", "threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 4320.0, "decay_factor": 1.0}}
{"indicator": "9d12a0b1dac5467771edfeccb3c599b73412c0754051f5b0aabc8013e9346d50", "type": "sha256", "source": "malwarebazaar_recent,threatfox_export_json", "first_seen": "2026-10-24T19:49:27Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 1, "tags": "ADB,AISURU,DDoS,Mirai,elf,malware,threatfox", "reference": "https://bazaar.abuse.ch/", "context": "MalwareBazaar: Mirai", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["malwarebazaar_recent", "threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 4320.0, "decay_factor": 1.0}}
{"indicator": "9bd91039bad7799c22da48a6ddfd7e83510c0c4adddbb8c4151f3eb9b2d52d23", "type": "sha256", "source": "malwarebazaar_recent,threatfox_export_json", "first_seen": "2026-10-24T19:49:19Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 1, "tags": "ADB,AISURU,DDoS,Mirai,elf,malware,threatfox", "reference": "https://bazaar.abuse.ch/", "context": "MalwareBazaar: Mirai", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["malwarebazaar_recent", "threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 4320.0, "decay_factor": 1.0}}
{"indicator": "20740f7da1421e9fea1199c7a44689b53317da9f6c63fd6c96f0cf1c13567f78", "type": "sha256", "source": "malwarebazaar_recent,threatfox_export_json", "first_seen": "2026-10-24T19:49:12Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 1, "tags": "ADB,AISURU,DDoS,Mirai,elf,malware,threatfox", "reference": "https://bazaar.abuse.ch/", "context": "MalwareBazaar: Mirai", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["malwarebazaar_recent", "threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 4320.0, "decay_factor": 1.0}}
{"indicator": "2dc2cda5399b4d50d123592f8d4c890f84ce94b15b7f68d9084a362dbb9ede46", "type": "sha256", "source": "malwarebazaar_recent", "first_seen": "2026-10-24T19:49:10Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 1, "tags": "malware,Mirai", "reference": "https://bazaar.abuse.ch/", "context": "MalwareBazaar: Mirai", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["malwarebazaar_recent"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 4320.0, "decay_factor": 1.0}}
{"indicator": "b99da9425f9a73c0c887485fb5692987ec123a239ae0f6ceb7d4b788b059f330", "type": "sha256", "source": "malwarebazaar_recent,threatfox_export_json", "first_seen": "2026-10-24T19:49:05Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 1, "tags": "ADB,AISURU,DDoS,Mirai,elf,malware,threatfox", "reference": "https://bazaar.abuse.ch/", "context": "MalwareBazaar: Mirai", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["malwarebazaar_recent", "threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 4320.0, "decay_factor": 1.0}}
{"indicator": "66d809ab37751057afa220c80f31325357c8078780d6e35580e2b6f3a7b59a94", "type": "sha256", "source": "malwarebazaar_recent,threatfox_export_json", "first_seen": "2026-10-24T19:48:58Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 1, "tags": "ADB,AISURU,DDoS,Mirai,elf,malware,threatfox", "reference": "https://bazaar.abuse.ch/", "context": "MalwareBazaar: Mirai", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["malwarebazaar_recent", "threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 4320.0, "decay_factor": 1.0}}
{"indicator": "a51f6d785ad9d1952603177b431918fab29e969e4946b8baf9d9cffb1f8c92d9", "type": "sha256", "source": "malwarebazaar_recent,threatfox_export_json", "first_seen": "2026-10-24T19:48:50Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 1, "tags": "ADB,AISURU,DDoS,Mirai,elf,malware,threatfox", "reference": "https://bazaar.abuse.ch/", "context": "MalwareBazaar: Mirai", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["malwarebazaar_recent", "threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 4320.0, "decay_factor": 1.0}}
{"indicator": "adbimmo[.]cs-projets[.]be", "type": "domain", "source": "threatfox_export_json", "first_seen": "2026-10-24T19:48:35Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 1, "tags": "StrelaStealer,threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "StrelaStealer", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 336.0, "decay_factor": 1.0}}
{"indicator": "webshop[.]gereformeerdekerkoldebroek[.]nl", "type": "domain", "source": "threatfox_export_json", "first_seen": "2026-10-24T19:47:40Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 1, "tags": "etherhiding,threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "Unknown Loader", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 336.0, "decay_factor": 1.0}}
{"indicator": "srivaricotton[.]com", "type": "domain", "source": "threatfox_export_json", "first_seen": "2026-10-24T19:47:40Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 1, "tags": "etherhiding,threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "Unknown Loader", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 336.0, "decay_factor": 1.0}}
{"indicator": "sonarnegociosdigitais[.]com", "type": "domain", "source": "threatfox_export_json", "first_seen": "2026-10-24T19:47:40Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 1, "tags": "etherhiding,threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "Unknown Loader", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 336.0, "decay_factor": 1.0}}
{"indicator": "pro-vet[.]es", "type": "domain", "source": "threatfox_export_json", "first_seen": "2026-10-24T19:47:39Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 1, "tags": "etherhiding,threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "Unknown Loader", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 336.0, "decay_factor": 1.0}}
{"indicator": "precisionprinterservices[.]com", "type": "domain", "source": "threatfox_export_json", "first_seen": "2026-10-24T19:47:39Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 1, "tags": "etherhiding,threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "Unknown Loader", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 336.0, "decay_factor": 1.0}}
{"indicator": "ortopediaqueralto[.]com", "type": "domain", "source": "threatfox_export_json", "first_seen": "2026-10-24T19:47:39Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 1, "tags": "etherhiding,threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "Unknown Loader", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 336.0, "decay_factor": 1.0}}
{"indicator": "orangecountychemdry[.]com", "type": "domain", "source": "threatfox_export_json", "first_seen": "2026-10-24T19:47:39Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 1, "tags": "etherhiding,threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "Unknown Loader", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 336.0, "decay_factor": 1.0}}
{"indicator": "meteorprint[.]ca", "type": "domain", "source": "threatfox_export_json", "first_seen": "2026-10-24T19:47:39Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 1, "tags": "etherhiding,threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "Unknown Loader", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 336.0, "decay_factor": 1.0}}
{"indicator": "legalwise[.]rw", "type": "domain", "source": "threatfox_export_json", "first_seen": "2026-10-24T19:47:39Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 1, "tags": "etherhiding,threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "Unknown Loader", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 336.0, "decay_factor": 1.0}}
{"indicator": "framesi[.]com", "type": "domain", "source": "threatfox_export_json", "first_seen": "2026-10-24T19:47:39Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 1, "tags": "etherhiding,threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "Unknown Loader", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 336.0, "decay_factor": 1.0}}
{"indicator": "dimensionemosaico[.]it", "type": "domain", "source": "threatfox_export_json", "first_seen": "2026-10-24T19:47:39Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 1, "tags": "etherhiding,threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "Unknown Loader", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 336.0, "decay_factor": 1.0}}
{"indicator": "bolton-flooring[.]co[.]uk", "type": "domain", "source": "threatfox_export_json", "first_seen": "2026-10-24T19:47:39Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 1, "tags": "etherhiding,threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "Unknown Loader", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 336.0, "decay_factor": 1.0}}
{"indicator": "bixcash[.]net", "type": "domain", "source": "threatfox_export_json", "first_seen": "2026-10-24T19:47:39Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 1, "tags": "etherhiding,threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "Unknown Loader", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 336.0, "decay_factor": 1.0}}
{"indicator": "hxxp://123[.]14[.]88[.]128:35845/bin[.]sh", "type": "url", "source": "urlhaus_recent_urls", "first_seen": "2026-10-24T19:47:06Z", "last_seen": "2026-10-24T22:12:18Z", "confidence": "high", "score": 80, "sightings": 1, "tags": "malware,malware_download,Mozi", "reference": "https://urlhaus.abuse.ch/", "context": "URLhaus: malware_download", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["urlhaus_recent_urls"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 168.0, "decay_factor": 1.0}}
{"indicator": "hxxp://115[.]50[.]25[.]39:35911/i", "type": "url", "source": "urlhaus_recent_urls", "first_seen": "2026-10-24T19:47:05Z", "last_seen": "2026-10-24T22:12:18Z", "confidence": "high", "score": 80, "sightings": 1, "tags": "malware,malware_download,Mozi", "reference": "https://urlhaus.abuse.ch/", "context": "URLhaus: malware_download", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["urlhaus_recent_urls"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 168.0, "decay_factor": 1.0}}
{"indicator": "zigpsychocybercowboys[.]com", "type": "domain", "source": "threatfox_export_json", "first_seen": "2026-10-24T19:46:49Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 1, "tags": "Polygon,etherhiding,threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "Unknown Loader", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 336.0, "decay_factor": 1.0}}
{"indicator": "youblokle[.]com", "type": "domain", "source": "threatfox_export_json", "first_seen": "2026-10-24T19:46:49Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 1, "tags": "Polygon,etherhiding,threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "Unknown Loader", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 336.0, "decay_factor": 1.0}}
{"indicator": "wp[.]klipr[.]io", "type": "domain", "source": "threatfox_export_json", "first_seen": "2026-10-24T19:46:49Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 1, "tags": "Polygon,etherhiding,threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "Unknown Loader", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 336.0, "decay_factor": 1.0}}
{"indicator": "wishyourgifts[.]in", "type": "domain", "source": "threatfox_export_json", "first_seen": "2026-10-24T19:46:49Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 1, "tags": "Polygon,etherhiding,threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "Unknown Loader", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 336.0, "decay_factor": 1.0}}
{"indicator": "wealthwise[.]co[.]uk", "type": "domain", "source": "threatfox_export_json", "first_seen": "2026-10-24T19:46:49Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 1, "tags": "Polygon,etherhiding,threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "Unknown Loader", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 336.0, "decay_factor": 1.0}}
{"indicator": "usedcarfriendship[.]online", "type": "domain", "source": "threatfox_export_json", "first_seen": "2026-10-24T19:46:49Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 1, "tags": "Polygon,etherhiding,threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "Unknown Loader", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 336.0, "decay_factor": 1.0}}
{"indicator": "usa-salesforce[.]com", "type": "domain", "source": "threatfox_export_json", "first_seen": "2026-10-24T19:46:49Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 1, "tags": "Polygon,etherhiding,threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "Unknown Loader", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 336.0, "decay_factor": 1.0}}
{"indicator": "turkishrebars[.]com", "type": "domain", "source": "threatfox_export_json", "first_seen": "2026-10-24T19:46:49Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 1, "tags": "Polygon,etherhiding,threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "Unknown Loader", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 336.0, "decay_factor": 1.0}}
{"indicator": "tttbr[.]com", "type": "domain", "source": "threatfox_export_json", "first_seen": "2026-10-24T19:46:48Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 1, "tags": "Polygon,etherhiding,threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "Unknown Loader", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 336.0, "decay_factor": 1.0}}
{"indicator": "triwell[.]cz", "type": "domain", "source": "threatfox_export_json", "first_seen": "2026-10-24T19:46:48Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 1, "tags": "Polygon,etherhiding,threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "Unknown Loader", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 336.0, "decay_factor": 1.0}}
{"indicator": "trinityoftithing[.]com", "type": "domain", "source": "threatfox_export_json", "first_seen": "2026-10-24T19:46:48Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 1, "tags": "Polygon,etherhiding,threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "Unknown Loader", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 336.0, "decay_factor": 1.0}}
{"indicator": "toyota-club[.]by", "type": "domain", "source": "threatfox_export_json", "first_seen": "2026-10-24T19:46:48Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 1, "tags": "Polygon,etherhiding,threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "Unknown Loader", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 336.0, "decay_factor": 1.0}}
{"indicator": "tibor[.]es", "type": "domain", "source": "threatfox_export_json", "first_seen": "2026-10-24T19:46:48Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 1, "tags": "Polygon,etherhiding,threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "Unknown Loader", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 336.0, "decay_factor": 1.0}}
{"indicator": "theferrancegroup[.]ca", "type": "domain", "source": "threatfox_export_json", "first_seen": "2026-10-24T19:46:48Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 1, "tags": "Polygon,etherhiding,threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "Unknown Loader", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 336.0, "decay_factor": 1.0}}
{"indicator": "talentclub[.]uk", "type": "domain", "source": "threatfox_export_json", "first_seen": "2026-10-24T19:46:48Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 1, "tags": "Polygon,etherhiding,threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "Unknown Loader", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 336.0, "decay_factor": 1.0}}
{"indicator": "tagesnachrichten24[.]de", "type": "domain", "source": "threatfox_export_json", "first_seen": "2026-10-24T19:46:48Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 1, "tags": "Polygon,etherhiding,threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "Unknown Loader", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 336.0, "decay_factor": 1.0}}
{"indicator": "suo[.]company", "type": "domain", "source": "threatfox_export_json", "first_seen": "2026-10-24T19:46:48Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 1, "tags": "Polygon,etherhiding,threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "Unknown Loader", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 336.0, "decay_factor": 1.0}}
{"indicator": "sulthansalmanjaya[.]com", "type": "domain", "source": "threatfox_export_json", "first_seen": "2026-10-24T19:46:48Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 1, "tags": "Polygon,etherhiding,threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "Unknown Loader", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 336.0, "decay_factor": 1.0}}
{"indicator": "ssttower[.]com", "type": "domain", "source": "threatfox_export_json", "first_seen": "2026-10-24T19:46:48Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 1, "tags": "Polygon,etherhiding,threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "Unknown Loader", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 336.0, "decay_factor": 1.0}}
{"indicator": "shenzhen2050[.]com", "type": "domain", "source": "threatfox_export_json", "first_seen": "2026-10-24T19:46:48Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 1, "tags": "Polygon,etherhiding,threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "Unknown Loader", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 336.0, "decay_factor": 1.0}}
{"indicator": "sfasagg[.]com", "type": "domain", "source": "threatfox_export_json", "first_seen": "2026-10-24T19:46:48Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 1, "tags": "Polygon,etherhiding,threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "Unknown Loader", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 336.0, "decay_factor": 1.0}}
{"indicator": "rotundavillas[.]com", "type": "domain", "source": "threatfox_export_json", "first_seen": "2026-10-24T19:46:48Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 1, "tags": "Polygon,etherhiding,threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "Unknown Loader", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 336.0, "decay_factor": 1.0}}
{"indicator": "rosateeshop[.]com", "type": "domain", "source": "threatfox_export_json", "first_seen": "2026-10-24T19:46:48Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 1, "tags": "Polygon,etherhiding,threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "Unknown Loader", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 336.0, "decay_factor": 1.0}}
{"indicator": "rodriguesembalagem[.]com[.]br", "type": "domain", "source": "threatfox_export_json", "first_seen": "2026-10-24T19:46:48Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 1, "tags": "Polygon,etherhiding,threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "Unknown Loader", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 336.0, "decay_factor": 1.0}}
{"indicator": "residencialdama[.]com", "type": "domain", "source": "threatfox_export_json", "first_seen": "2026-10-24T19:46:48Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 1, "tags": "Polygon,etherhiding,threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "Unknown Loader", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 336.0, "decay_factor": 1.0}}
{"indicator": "reportehla[.]xyz", "type": "domain", "source": "threatfox_export_json", "first_seen": "2026-10-24T19:46:48Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 1, "tags": "Polygon,etherhiding,threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "Unknown Loader", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 336.0, "decay_factor": 1.0}}
{"indicator": "proyectosanborondon[.]es", "type": "domain", "source": "threatfox_export_json", "first_seen": "2026-10-24T19:46:48Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 1, "tags": "Polygon,etherhiding,threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "Unknown Loader", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 336.0, "decay_factor": 1.0}}
{"indicator": "prevoz-putnika[.]net", "type": "domain", "source": "threatfox_export_json", "first_seen": "2026-10-24T19:46:48Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 1, "tags": "Polygon,etherhiding,threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "Unknown Loader", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 336.0, "decay_factor": 1.0}}
{"indicator": "premiosarquitectura[.]org", "type": "domain", "source": "threatfox_export_json", "first_seen": "2026-10-24T19:46:48Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 1, "tags": "Polygon,etherhiding,threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "Unknown Loader", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 336.0, "decay_factor": 1.0}}
{"indicator": "pratikkagittahta[.]com", "type": "domain", "source": "threatfox_export_json", "first_seen": "2026-10-24T19:46:48Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 1, "tags": "Polygon,etherhiding,threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "Unknown Loader", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 336.0, "decay_factor": 1.0}}
{"indicator": "platinum[.]csfsistemi[.]it", "type": "domain", "source": "threatfox_export_json", "first_seen": "2026-10-24T19:46:48Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 1, "tags": "Polygon,etherhiding,threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "Unknown Loader", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 336.0, "decay_factor": 1.0}}
{"indicator": "permanentmakeup-andric[.]de", "type": "domain", "source": "threatfox_export_json", "first_seen": "2026-10-24T19:46:48Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 1, "tags": "Polygon,etherhiding,threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "Unknown Loader", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 336.0, "decay_factor": 1.0}}
{"indicator": "onekanimo[.]com", "type": "domain", "source": "threatfox_export_json", "first_seen": "2026-10-24T19:46:48Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 1, "tags": "Polygon,etherhiding,threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "Unknown Loader", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 336.0, "decay_factor": 1.0}}
{"indicator": "omnifluencer[.]com", "type": "domain", "source": "threatfox_export_json", "first_seen": "2026-10-24T19:46:48Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 1, "tags": "Polygon,etherhiding,threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "Unknown Loader", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 336.0, "decay_factor": 1.0}}
{"indicator": "omannaturals[.]store", "type": "domain", "source": "threatfox_export_json", "first_seen": "2026-10-24T19:46:48Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 1, "tags": "Polygon,etherhiding,threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "Unknown Loader", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 336.0, "decay_factor": 1.0}}
{"indicator": "oliscuquello[.]com", "type": "domain", "source": "threatfox_export_json", "first_seen": "2026-10-24T19:46:48Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 1, "tags": "Polygon,etherhiding,threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "Unknown Loader", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 336.0, "decay_factor": 1.0}}
{"indicator": "og-allgemeinerhof[.]ch", "type": "domain", "source": "threatfox_export_json", "first_seen": "2026-10-24T19:46:48Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 1, "tags": "Polygon,etherhiding,threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "Unknown Loader", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 336.0, "decay_factor": 1.0}}
{"indicator": "nypdprosecutorcorruption[.]com", "type": "domain", "source": "threatfox_export_json", "first_seen": "2026-10-24T19:46:48Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 1, "tags": "Polygon,etherhiding,threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "Unknown Loader", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 336.0, "decay_factor": 1.0}}
{"indicator": "mygumzy[.]com", "type": "domain", "source": "threatfox_export_json", "first_seen": "2026-10-24T19:46:47Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 1, "tags": "Polygon,etherhiding,threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "Unknown Loader", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 336.0, "decay_factor": 1.0}}
{"indicator": "mslightinggroup[.]com", "type": "domain", "source": "threatfox_export_json", "first_seen": "2026-10-24T19:46:47Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 1, "tags": "Polygon,etherhiding,threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "Unknown Loader", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 336.0, "decay_factor": 1.0}}
{"indicator": "mpresso[.]co[.]th", "type": "domain", "source": "threatfox_export_json", "first_seen": "2026-10-24T19:46:47Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 1, "tags": "Polygon,etherhiding,threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "Unknown Loader", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 336.0, "decay_factor": 1.0}}
{"indicator": "misguayabas[.]es", "type": "domain", "source": "threatfox_export_json", "first_seen": "2026-10-24T19:46:47Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 1, "tags": "Polygon,etherhiding,threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "Unknown Loader", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 336.0, "decay_factor": 1.0}}
{"indicator": "metasail[.]info", "type": "domain", "source": "threatfox_export_json", "first_seen": "2026-10-24T19:46:47Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 1, "tags": "Polygon,etherhiding,threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "Unknown Loader", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 336.0, "decay_factor": 1.0}}
{"indicator": "marbellamentalhealth[.]com", "type": "domain", "source": "threatfox_export_json", "first_seen": "2026-10-24T19:46:47Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 1, "tags": "Polygon,etherhiding,threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "Unknown Loader", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 336.0, "decay_factor": 1.0}}
{"indicator": "limo-deal[.]de", "type": "domain", "source": "threatfox_export_json", "first_seen": "2026-10-24T19:46:47Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 1, "tags": "Polygon,etherhiding,threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "Unknown Loader", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 336.0, "decay_factor": 1.0}}
{"indicator": "lesmilanregistry[.]com", "type": "domain", "source": "threatfox_export_json", "first_seen": "2026-10-24T19:46:47Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 1, "tags": "Polygon,etherhiding,threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "Unknown Loader", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 336.0, "decay_factor": 1.0}}
{"indicator": "ladnejany[.]eu", "type": "domain", "source": "threatfox_export_json", "first_seen": "2026-10-24T19:46:47Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 1, "tags": "Polygon,etherhiding,threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "Unknown Loader", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 336.0, "decay_factor": 1.0}}
{"indicator": "kusi75[.]ch", "type": "domain", "source": "threatfox_export_json", "first_seen": "2026-10-24T19:46:47Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 1, "tags": "Polygon,etherhiding,threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "Unknown Loader", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 336.0, "decay_factor": 1.0}}
{"indicator": "kurbad-st-leonhard[.]de", "type": "domain", "source": "threatfox_export_json", "first_seen": "2026-10-24T19:46:47Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 1, "tags": "Polygon,etherhiding,threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "Unknown Loader", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 336.0, "decay_factor": 1.0}}
{"indicator": "knokheadstudio[.]com", "type": "domain", "source": "threatfox_export_json", "first_seen": "2026-10-24T19:46:47Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 1, "tags": "Polygon,etherhiding,threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "Unknown Loader", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 336.0, "decay_factor": 1.0}}
{"indicator": "kd[.]ac[.]th", "type": "domain", "source": "threatfox_export_json", "first_seen": "2026-10-24T19:46:47Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 1, "tags": "Polygon,etherhiding,threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "Unknown Loader", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 336.0, "decay_factor": 1.0}}
{"indicator": "jheebdjw[.]com", "type": "domain", "source": "threatfox_export_json", "first_seen": "2026-10-24T19:46:47Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 1, "tags": "Polygon,etherhiding,threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "Unknown Loader", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 336.0, "decay_factor": 1.0}}
{"indicator": "italian-university[.]com", "type": "domain", "source": "threatfox_export_json", "first_seen": "2026-10-24T19:46:47Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 1, "tags": "Polygon,etherhiding,threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "Unknown Loader", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 336.0, "decay_factor": 1.0}}
{"indicator": "isuzucorluservis[.]com", "type": "domain", "source": "threatfox_export_json", "first_seen": "2026-10-24T19:46:47Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 1, "tags": "Polygon,etherhiding,threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "Unknown Loader", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 336.0, "decay_factor": 1.0}}
{"indicator": "idd-industrieservice[.]de", "type": "domain", "source": "threatfox_export_json", "first_seen": "2026-10-24T19:46:47Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 1, "tags": "Polygon,etherhiding,threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "Unknown Loader", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 336.0, "decay_factor": 1.0}}
{"indicator": "hubbmediaentertainment[.]com", "type": "domain", "source": "threatfox_export_json", "first_seen": "2026-10-24T19:46:47Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 1, "tags": "Polygon,etherhiding,threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "Unknown Loader", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 336.0, "decay_factor": 1.0}}
{"indicator": "hochzeitsband-dj[.]de", "type": "domain", "source": "threatfox_export_json", "first_seen": "2026-10-24T19:46:47Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 1, "tags": "Polygon,etherhiding,threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "Unknown Loader", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 336.0, "decay_factor": 1.0}}
{"indicator": "hafizbookstore[.]com", "type": "domain", "source": "threatfox_export_json", "first_seen": "2026-10-24T19:46:47Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 1, "tags": "Polygon,etherhiding,threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "Unknown Loader", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 336.0, "decay_factor": 1.0}}
{"indicator": "grarg[.]com", "type": "domain", "source": "threatfox_export_json", "first_seen": "2026-10-24T19:46:47Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 1, "tags": "Polygon,etherhiding,threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "Unknown Loader", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 336.0, "decay_factor": 1.0}}
{"indicator": "golfhotel-schweiz[.]com", "type": "domain", "source": "threatfox_export_json", "first_seen": "2026-10-24T19:46:47Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 1, "tags": "Polygon,etherhiding,threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "Unknown Loader", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 336.0, "decay_factor": 1.0}}
{"indicator": "gispvn[.]vn", "type": "domain", "source": "threatfox_export_json", "first_seen": "2026-10-24T19:46:47Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 1, "tags": "Polygon,etherhiding,threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "Unknown Loader", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 336.0, "decay_factor": 1.0}}
{"indicator": "folasasegbon[.]org", "type": "domain", "source": "threatfox_export_json", "first_seen": "2026-10-24T19:46:47Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 1, "tags": "Polygon,etherhiding,threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "Unknown Loader", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 336.0, "decay_factor": 1.0}}
{"indicator": "fhaedl[.]com", "type": "domain", "source": "threatfox_export_json", "first_seen": "2026-10-24T19:46:47Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 1, "tags": "Polygon,etherhiding,threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "Unknown Loader", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 336.0, "decay_factor": 1.0}}
{"indicator": "extremenitrowrestling[.]com", "type": "domain", "source": "threatfox_export_json", "first_seen": "2026-10-24T19:46:47Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 1, "tags": "Polygon,etherhiding,threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "Unknown Loader", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 336.0, "decay_factor": 1.0}}
{"indicator": "ecommunicate[.]biz", "type": "domain", "source": "threatfox_export_json", "first_seen": "2026-10-24T19:46:47Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 1, "tags": "Polygon,etherhiding,threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "Unknown Loader", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 336.0, "decay_factor": 1.0}}
{"indicator": "doortrans[.]hu", "type": "domain", "source": "threatfox_export_json", "first_seen": "2026-10-24T19:46:47Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 1, "tags": "Polygon,etherhiding,threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "Unknown Loader", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 336.0, "decay_factor": 1.0}}
{"indicator": "chiamanino[.]it", "type": "domain", "source": "threatfox_export_json", "first_seen": "2026-10-24T19:46:47Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 1, "tags": "Polygon,etherhiding,threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "Unknown Loader", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 336.0, "decay_factor": 1.0}}
{"indicator": "brownsenterprisesllc[.]com", "type": "domain", "source": "threatfox_export_json", "first_seen": "2026-10-24T19:46:46Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 1, "tags": "Polygon,etherhiding,threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "Unknown Loader", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 336.0, "decay_factor": 1.0}}
{"indicator": "bossleysportsclub[.]com[.]au", "type": "domain", "source": "threatfox_export_json", "first_seen": "2026-10-24T19:46:46Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 1, "tags": "Polygon,etherhiding,threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "Unknown Loader", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 336.0, "decay_factor": 1.0}}
{"indicator": "bluegeneration[.]es", "type": "domain", "source": "threatfox_export_json", "first_seen": "2026-10-24T19:46:46Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 1, "tags": "Polygon,etherhiding,threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "Unknown Loader", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 336.0, "decay_factor": 1.0}}
{"indicator": "bezdickova[.]cz", "type": "domain", "source": "threatfox_export_json", "first_seen": "2026-10-24T19:46:46Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 1, "tags": "Polygon,etherhiding,threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "Unknown Loader", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 336.0, "decay_factor": 1.0}}
{"indicator": "arrowsone[.]com", "type": "domain", "source": "threatfox_export_json", "first_seen": "2026-10-24T19:46:46Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 1, "tags": "Polygon,etherhiding,threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "Unknown Loader", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 336.0, "decay_factor": 1.0}}
{"indicator": "akupunktur-weiterstadt[.]com", "type": "domain", "source": "threatfox_export_json", "first_seen": "2026-10-24T19:46:46Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 1, "tags": "Polygon,etherhiding,threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "Unknown Loader", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 336.0, "decay_factor": 1.0}}
{"indicator": "abrahamalvarezgonzalez[.]com", "type": "domain", "source": "threatfox_export_json", "first_seen": "2026-10-24T19:46:46Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 1, "tags": "Polygon,etherhiding,threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "Unknown Loader", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 336.0, "decay_factor": 1.0}}
{"indicator": "92[.]4[.]93[.]169", "type": "ipv4", "source": "threatfox_export_json", "first_seen": "2026-10-24T19:45:29Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 1, "tags": "AdaptixC2,drb-ra,threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "AdaptixC2", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 168.0, "decay_factor": 1.0}}
{"indicator": "64[.]188[.]91[.]78", "type": "ipv4", "source": "threatfox_export_json", "first_seen": "2026-10-24T19:45:14Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 1, "tags": "Mythic,drb-ra,threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "Unknown malware", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 168.0, "decay_factor": 1.0}}
{"indicator": "52[.]128[.]230[.]20", "type": "ipv4", "source": "threatfox_export_json", "first_seen": "2026-10-24T19:45:12Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 1, "tags": "PureHVNC,PureRAT,RAT,drb-ra,threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "PureRAT", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 168.0, "decay_factor": 1.0}}
{"indicator": "50[.]114[.]179[.]6", "type": "ipv4", "source": "threatfox_export_json", "first_seen": "2026-10-24T19:45:10Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 1, "tags": "PureHVNC,PureRAT,RAT,drb-ra,threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "PureRAT", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 168.0, "decay_factor": 1.0}}
{"indicator": "45[.]225[.]135[.]133", "type": "ipv4", "source": "threatfox_export_json", "first_seen": "2026-10-24T19:45:00Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 1, "tags": "PureHVNC,PureRAT,RAT,drb-ra,threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "PureRAT", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 168.0, "decay_factor": 1.0}}
{"indicator": "31[.]56[.]209[.]196", "type": "ipv4", "source": "threatfox_export_json", "first_seen": "2026-10-24T19:44:42Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 1, "tags": "PureHVNC,PureRAT,RAT,drb-ra,threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "PureRAT", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 168.0, "decay_factor": 1.0}}
{"indicator": "207[.]189[.]17[.]124", "type": "ipv4", "source": "threatfox_export_json", "first_seen": "2026-10-24T19:44:13Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 1, "tags": "PureHVNC,PureRAT,RAT,drb-ra,threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "PureRAT", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 168.0, "decay_factor": 1.0}}
{"indicator": "193[.]142[.]146[.]172", "type": "ipv4", "source": "threatfox_export_json", "first_seen": "2026-10-24T19:44:03Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 1, "tags": "PureHVNC,PureRAT,RAT,drb-ra,threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "PureRAT", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 168.0, "decay_factor": 1.0}}
{"indicator": "150[.]241[.]69[.]22", "type": "ipv4", "source": "threatfox_export_json", "first_seen": "2026-10-24T19:43:30Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 1, "tags": "Mythic,drb-ra,threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "Unknown malware", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 168.0, "decay_factor": 1.0}}
{"indicator": "131[.]226[.]2[.]185", "type": "ipv4", "source": "threatfox_export_json", "first_seen": "2026-10-24T19:43:21Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 1, "tags": "AdaptixC2,drb-ra,threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "AdaptixC2", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 168.0, "decay_factor": 1.0}}
{"indicator": "new[.]decorhome[.]kz", "type": "domain", "source": "threatfox_export_json", "first_seen": "2026-10-24T19:42:10Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 1, "tags": "StrelaStealer,threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "StrelaStealer", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 336.0, "decay_factor": 1.0}}
{"indicator": "88ba6c9b3ec7ff1f9b05479ada24ba3702f100a1a521d11474f711ab71a785fd", "type": "sha256", "source": "threatfox_export_json", "first_seen": "2026-10-24T19:41:46Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 1, "tags": "Amos,ClickFix,Foxveil,macOS,quill,threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "AMOS", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 4320.0, "decay_factor": 1.0}}
{"indicator": "551cd532444fd1d8f86b36c06951d530801fb1affe0154b539cf8effc23d07a8", "type": "sha256", "source": "threatfox_export_json", "first_seen": "2026-10-24T19:38:55Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 1, "tags": "Amos,ClickFix,Foxveil,forge,macOS,threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "AMOS", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 4320.0, "decay_factor": 1.0}}
{"indicator": "0b6b6527204ed3cb0f5663a37d5c29bbef8e0e012336e2f426caacc4d70cae18", "type": "sha256", "source": "threatfox_export_json", "first_seen": "2026-10-24T19:35:52Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 1, "tags": "Amos,ClickFix,Foxveil,boost,macOS,threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "AMOS", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 4320.0, "decay_factor": 1.0}}
{"indicator": "29d9f9085b69b3d26f92fb76e1bb037a195250400ba0d38df2179185760ee783", "type": "sha256", "source": "malwarebazaar_recent", "first_seen": "2026-10-24T19:35:02Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 1, "tags": "malware,Mirai", "reference": "https://bazaar.abuse.ch/", "context": "MalwareBazaar: Mirai", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["malwarebazaar_recent"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 4320.0, "decay_factor": 1.0}}
{"indicator": "f14a465c87a898cb0817daef1217492c3539a7f385bc5c101182c0656fc9d8c3", "type": "sha256", "source": "threatfox_export_json", "first_seen": "2026-10-24T19:32:45Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 1, "tags": "Amos,ClickFix,Foxveil,macOS,stratos,threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "AMOS", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 4320.0, "decay_factor": 1.0}}
{"indicator": "hxxp://61[.]52[.]159[.]144:45720/bin[.]sh", "type": "url", "source": "urlhaus_recent_urls", "first_seen": "2026-10-24T19:32:05Z", "last_seen": "2026-10-24T22:12:18Z", "confidence": "high", "score": 80, "sightings": 1, "tags": "malware,malware_download,Mozi", "reference": "https://urlhaus.abuse.ch/", "context": "URLhaus: malware_download", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["urlhaus_recent_urls"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 168.0, "decay_factor": 1.0}}
{"indicator": "hxxp://42[.]239[.]153[.]8:46089/i", "type": "url", "source": "urlhaus_recent_urls", "first_seen": "2026-10-24T19:32:05Z", "last_seen": "2026-10-24T22:12:18Z", "confidence": "high", "score": 80, "sightings": 1, "tags": "malware,malware_download,Mozi", "reference": "https://urlhaus.abuse.ch/", "context": "URLhaus: malware_download", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["urlhaus_recent_urls"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 168.0, "decay_factor": 1.0}}
{"indicator": "www[.]abrahamalvarezgonzalez[.]com", "type": "domain", "source": "threatfox_export_json", "first_seen": "2026-10-24T19:31:47Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 1, "tags": "compromised,etherhide,threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "ClearFake", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 336.0, "decay_factor": 1.0}}
{"indicator": "c4615d12c5729435d2aa2799cba426cccfc0fb16de18cfafc3670df55d96ef98", "type": "sha256", "source": "threatfox_export_json", "first_seen": "2026-10-24T19:29:52Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 1, "tags": "Amos,ClickFix,Foxveil,grove,macOS,threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "AMOS", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 4320.0, "decay_factor": 1.0}}
{"indicator": "0b3cd85d11d82969427d4d45dd23e3d6a0c4c8cefd68df51248b019f420e27b2", "type": "sha256", "source": "threatfox_export_json", "first_seen": "2026-10-24T19:26:56Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 1, "tags": "Amos,ClickFix,Foxveil,frame97,macOS,threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "AMOS", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 4320.0, "decay_factor": 1.0}}
{"indicator": "237bf2f7b0e8c41dc9990d50b97b7a2e890cff0862f3258b435575e2a4998807", "type": "sha256", "source": "threatfox_export_json", "first_seen": "2026-10-24T19:24:07Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 1, "tags": "Amos,ClickFix,Foxveil,frame,macOS,threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "AMOS", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 4320.0, "decay_factor": 1.0}}
{"indicator": "www[.]bolton-flooring[.]co[.]uk", "type": "domain", "source": "threatfox_export_json", "first_seen": "2026-10-24T19:21:46Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 1, "tags": "compromised,etherhide,threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "ClearFake", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 336.0, "decay_factor": 1.0}}
{"indicator": "barneyschurch[.]au", "type": "domain", "source": "threatfox_export_json", "first_seen": "2026-10-24T19:21:46Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 1, "tags": "compromised,etherhide,threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "ClearFake", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 336.0, "decay_factor": 1.0}}
{"indicator": "www[.]joliveira[.]com[.]br", "type": "domain", "source": "threatfox_export_json", "first_seen": "2026-10-24T19:21:45Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 1, "tags": "compromised,etherhide,threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "ClearFake", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 336.0, "decay_factor": 1.0}}
{"indicator": "www[.]isuzucorluservis[.]com", "type": "domain", "source": "threatfox_export_json", "first_seen": "2026-10-24T19:21:45Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 1, "tags": "compromised,etherhide,threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "ClearFake", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 336.0, "decay_factor": 1.0}}
{"indicator": "www[.]hubbmediaentertainment[.]com", "type": "domain", "source": "threatfox_export_json", "first_seen": "2026-10-24T19:21:45Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 1, "tags": "compromised,etherhide,threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "ClearFake", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 336.0, "decay_factor": 1.0}}
{"indicator": "www[.]bossleysportsclub[.]com[.]au", "type": "domain", "source": "threatfox_export_json", "first_seen": "2026-10-24T19:21:45Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 1, "tags": "compromised,etherhide,threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "ClearFake", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 336.0, "decay_factor": 1.0}}
{"indicator": "jemohgh[.]com", "type": "domain", "source": "threatfox_export_json", "first_seen": "2026-10-24T19:21:45Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 1, "tags": "compromised,etherhide,threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "ClearFake", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 336.0, "decay_factor": 1.0}}
{"indicator": "9995d51130d86e9c745e2e7cab4c47d89251da9765d517c69d47855de185147d", "type": "sha256", "source": "threatfox_export_json", "first_seen": "2026-10-24T19:21:11Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 1, "tags": "Amos,ClickFix,Foxveil,macOS,nova,threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "AMOS", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 4320.0, "decay_factor": 1.0}}
{"indicator": "8816810a3f8520a0520afa391b25ac58b5d8bf918ecd320e1f8e4a28d61848e6", "type": "sha256", "source": "malwarebazaar_recent", "first_seen": "2026-10-24T19:21:01Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 1, "tags": "malware,Mirai", "reference": "https://bazaar.abuse.ch/", "context": "MalwareBazaar: Mirai", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["malwarebazaar_recent"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 4320.0, "decay_factor": 1.0}}
{"indicator": "n2late[.]fr", "type": "domain", "source": "threatfox_export_json", "first_seen": "2026-10-24T19:19:55Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 1, "tags": "StrelaStealer,threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "StrelaStealer", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 336.0, "decay_factor": 1.0}}
{"indicator": "mytutions[.]com", "type": "domain", "source": "threatfox_export_json", "first_seen": "2026-10-24T19:19:24Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 1, "tags": "StrelaStealer,threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "StrelaStealer", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 336.0, "decay_factor": 1.0}}
{"indicator": "hxxp://113[.]238[.]236[.]218:56630/i", "type": "url", "source": "urlhaus_recent_urls", "first_seen": "2026-10-24T19:18:06Z", "last_seen": "2026-10-24T22:12:18Z", "confidence": "high", "score": 80, "sightings": 1, "tags": "malware,malware_download,None", "reference": "https://urlhaus.abuse.ch/", "context": "URLhaus: malware_download", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["urlhaus_recent_urls"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 168.0, "decay_factor": 1.0}}
{"indicator": "f044230ed52e82d62ee6c78654f8cdc875fed94264023fcb48b3b3a217460b74", "type": "sha256", "source": "threatfox_export_json", "first_seen": "2026-10-24T19:18:05Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 1, "tags": "Amos,ClickFix,Foxveil,haven,macOS,threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "AMOS", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 4320.0, "decay_factor": 1.0}}
{"indicator": "2e2612d964aaf92e7b57bccab58349518bcdfd3a3f07e1c70a71f4f6f6fef16c", "type": "sha256", "source": "malwarebazaar_recent", "first_seen": "2026-10-24T19:17:33Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 1, "tags": "malware", "reference": "https://bazaar.abuse.ch/", "context": "MalwareBazaar: ", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["malwarebazaar_recent"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 4320.0, "decay_factor": 1.0}}
{"indicator": "hxxp://123[.]190[.]160[.]239:52844/bin[.]sh", "type": "url", "source": "urlhaus_recent_urls", "first_seen": "2026-10-24T19:17:06Z", "last_seen": "2026-10-24T22:12:18Z", "confidence": "high", "score": 80, "sightings": 1, "tags": "malware,malware_download,None", "reference": "https://urlhaus.abuse.ch/", "context": "URLhaus: malware_download", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["urlhaus_recent_urls"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 168.0, "decay_factor": 1.0}}
{"indicator": "hxxp://61[.]52[.]185[.]113:43444/i", "type": "url", "source": "urlhaus_recent_urls", "first_seen": "2026-10-24T19:17:05Z", "last_seen": "2026-10-24T22:12:18Z", "confidence": "high", "score": 80, "sightings": 1, "tags": "malware,malware_download,Mozi", "reference": "https://urlhaus.abuse.ch/", "context": "URLhaus: malware_download", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["urlhaus_recent_urls"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 168.0, "decay_factor": 1.0}}
{"indicator": "hxxp://42[.]239[.]153[.]8:46089/bin[.]sh", "type": "url", "source": "urlhaus_recent_urls", "first_seen": "2026-10-24T19:17:05Z", "last_seen": "2026-10-24T22:12:18Z", "confidence": "high", "score": 80, "sightings": 1, "tags": "malware,malware_download,Mozi", "reference": "https://urlhaus.abuse.ch/", "context": "URLhaus: malware_download", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["urlhaus_recent_urls"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 168.0, "decay_factor": 1.0}}
{"indicator": "hxxp://42[.]224[.]0[.]89:37584/i", "type": "url", "source": "urlhaus_recent_urls", "first_seen": "2026-10-24T19:17:05Z", "last_seen": "2026-10-24T22:12:18Z", "confidence": "high", "score": 80, "sightings": 1, "tags": "malware,malware_download,Mozi", "reference": "https://urlhaus.abuse.ch/", "context": "URLhaus: malware_download", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["urlhaus_recent_urls"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 168.0, "decay_factor": 1.0}}
{"indicator": "hxxp://27[.]204[.]196[.]55:39789/i", "type": "url", "source": "urlhaus_recent_urls", "first_seen": "2026-10-24T19:17:05Z", "last_seen": "2026-10-24T22:12:18Z", "confidence": "high", "score": 80, "sightings": 1, "tags": "malware,malware_download,Mozi", "reference": "https://urlhaus.abuse.ch/", "context": "URLhaus: malware_download", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["urlhaus_recent_urls"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 168.0, "decay_factor": 1.0}}
{"indicator": "hxxp://116[.]139[.]137[.]187:55052/i", "type": "url", "source": "urlhaus_recent_urls", "first_seen": "2026-10-24T19:17:05Z", "last_seen": "2026-10-24T22:12:18Z", "confidence": "high", "score": 80, "sightings": 1, "tags": "malware,malware_download,None", "reference": "https://urlhaus.abuse.ch/", "context": "URLhaus: malware_download", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["urlhaus_recent_urls"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 168.0, "decay_factor": 1.0}}
{"indicator": "fe5ab151cc1bc84e985263a4af1bde172c17ea6c3733e48d8da6631ca5ff82f3", "type": "sha256", "source": "malwarebazaar_recent", "first_seen": "2026-10-24T19:15:40Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 1, "tags": "malware,WannaCry", "reference": "https://bazaar.abuse.ch/", "context": "MalwareBazaar: WannaCry", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["malwarebazaar_recent"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 4320.0, "decay_factor": 1.0}}
{"indicator": "5cc1be09f0f23fc66b108e0de730189f7401db6b1ef1c525b8cbf6c7b2999365", "type": "sha256", "source": "malwarebazaar_recent", "first_seen": "2026-10-24T19:15:15Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 1, "tags": "malware", "reference": "https://bazaar.abuse.ch/", "context": "MalwareBazaar: ", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["malwarebazaar_recent"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 4320.0, "decay_factor": 1.0}}
{"indicator": "ab19199ad4f50548504330f49d5f9342a0bc65953a495dbaae5f9fa1ca08fef5", "type": "sha256", "source": "threatfox_export_json", "first_seen": "2026-10-24T19:15:12Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 1, "tags": "Amos,ClickFix,Foxveil,chant,macOS,threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "AMOS", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 4320.0, "decay_factor": 1.0}}
{"indicator": "d33f3c73613acba1b5f41475910257190f60097481842f8716e4caca22d4221d", "type": "sha256", "source": "threatfox_export_json", "first_seen": "2026-10-24T19:12:17Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 1, "tags": "Amos,ClickFix,Foxveil,macOS,threatfox,willow", "reference": "https://threatfox.abuse.ch/browse/", "context": "AMOS", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 4320.0, "decay_factor": 1.0}}
{"indicator": "in-gesprek[.]com", "type": "domain", "source": "threatfox_export_json", "first_seen": "2026-10-24T19:11:43Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 1, "tags": "compromised,etherhide,threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "ClearFake", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 336.0, "decay_factor": 1.0}}
{"indicator": "iepsantarosapurisimaves[.]edu[.]pe", "type": "domain", "source": "threatfox_export_json", "first_seen": "2026-10-24T19:11:43Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 1, "tags": "compromised,etherhide,threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "ClearFake", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 336.0, "decay_factor": 1.0}}
{"indicator": "buycocainethessaloniki[.]com", "type": "domain", "source": "threatfox_export_json", "first_seen": "2026-10-24T19:11:43Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 1, "tags": "compromised,etherhide,threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "ClearFake", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 336.0, "decay_factor": 1.0}}
{"indicator": "besttechnoschool[.]com", "type": "domain", "source": "threatfox_export_json", "first_seen": "2026-10-24T19:11:43Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 1, "tags": "compromised,etherhide,threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "ClearFake", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 336.0, "decay_factor": 1.0}}
{"indicator": "anfgroup[.]co[.]za", "type": "domain", "source": "threatfox_export_json", "first_seen": "2026-10-24T19:11:43Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 1, "tags": "compromised,etherhide,threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "ClearFake", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 336.0, "decay_factor": 1.0}}
{"indicator": "hondapareindah[.]com", "type": "domain", "source": "threatfox_export_json", "first_seen": "2026-10-24T19:11:42Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 1, "tags": "compromised,etherhide,threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "ClearFake", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 336.0, "decay_factor": 1.0}}
{"indicator": "farhangsch[.]ir", "type": "domain", "source": "threatfox_export_json", "first_seen": "2026-10-24T19:11:42Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 1, "tags": "compromised,etherhide,threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "ClearFake", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 336.0, "decay_factor": 1.0}}
{"indicator": "bgrenergysolutions[.]com", "type": "domain", "source": "threatfox_export_json", "first_seen": "2026-10-24T19:11:42Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 1, "tags": "compromised,etherhide,threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "ClearFake", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 336.0, "decay_factor": 1.0}}
{"indicator": "7seasstore[.]com", "type": "domain", "source": "threatfox_export_json", "first_seen": "2026-10-24T19:11:42Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 1, "tags": "compromised,etherhide,threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "ClearFake", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 336.0, "decay_factor": 1.0}}
{"indicator": "drleonardofiuza[.]com[.]br", "type": "domain", "source": "threatfox_export_json", "first_seen": "2026-10-24T19:11:41Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 1, "tags": "compromised,etherhide,threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "ClearFake", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 336.0, "decay_factor": 1.0}}
{"indicator": "diepsam[.]vn", "type": "domain", "source": "threatfox_export_json", "first_seen": "2026-10-24T19:11:41Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 1, "tags": "compromised,etherhide,threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "ClearFake", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 336.0, "decay_factor": 1.0}}
{"indicator": "byhandhairstudio[.]com", "type": "domain", "source": "threatfox_export_json", "first_seen": "2026-10-24T19:11:41Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 1, "tags": "compromised,etherhide,threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "ClearFake", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 336.0, "decay_factor": 1.0}}
{"indicator": "athenaengenharia[.]eng[.]br", "type": "domain", "source": "threatfox_export_json", "first_seen": "2026-10-24T19:11:41Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 1, "tags": "compromised,etherhide,threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "ClearFake", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 336.0, "decay_factor": 1.0}}
{"indicator": "adzyw[.]cn", "type": "domain", "source": "threatfox_export_json", "first_seen": "2026-10-24T19:11:41Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 1, "tags": "compromised,etherhide,threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "ClearFake", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 336.0, "decay_factor": 1.0}}
{"indicator": "ghyasigroup[.]com", "type": "domain", "source": "threatfox_export_json", "first_seen": "2026-10-24T19:11:40Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 1, "tags": "compromised,etherhide,threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "ClearFake", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 336.0, "decay_factor": 1.0}}
{"indicator": "ejscontabil[.]com[.]br", "type": "domain", "source": "threatfox_export_json", "first_seen": "2026-10-24T19:11:40Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 1, "tags": "compromised,etherhide,threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "ClearFake", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 336.0, "decay_factor": 1.0}}
{"indicator": "ehsan-perfume[.]com", "type": "domain", "source": "threatfox_export_json", "first_seen": "2026-10-24T19:11:40Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 1, "tags": "compromised,etherhide,threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "ClearFake", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 336.0, "decay_factor": 1.0}}
{"indicator": "ec69d3e0d4d9e797c2942cd2aa177b269db94edf5bd104d7a8eb2ecc73029b4c", "type": "sha256", "source": "malwarebazaar_recent,threatfox_export_json", "first_seen": "2026-10-24T19:06:57Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 1, "tags": "Mirai,elf,malware,threatfox", "reference": "https://bazaar.abuse.ch/", "context": "MalwareBazaar: Mirai", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["malwarebazaar_recent", "threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 4320.0, "decay_factor": 1.0}}
{"indicator": "229d92d5ee1ad82be7388975dacf2087363ff4371515e711b29fdeb35dc06c1d", "type": "sha256", "source": "malwarebazaar_recent", "first_seen": "2026-10-24T19:06:55Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 1, "tags": "malware,Mirai", "reference": "https://bazaar.abuse.ch/", "context": "MalwareBazaar: Mirai", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["malwarebazaar_recent"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 4320.0, "decay_factor": 1.0}}
{"indicator": "hxxp://115[.]55[.]51[.]189:47141/i", "type": "url", "source": "urlhaus_recent_urls", "first_seen": "2026-10-24T19:02:08Z", "last_seen": "2026-10-24T22:12:18Z", "confidence": "high", "score": 80, "sightings": 1, "tags": "malware,malware_download,None", "reference": "https://urlhaus.abuse.ch/", "context": "URLhaus: malware_download", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["urlhaus_recent_urls"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 168.0, "decay_factor": 1.0}}
{"indicator": "hxxp://59[.]97[.]250[.]4:48029/bin[.]sh", "type": "url", "source": "urlhaus_recent_urls", "first_seen": "2026-10-24T19:02:07Z", "last_seen": "2026-10-24T22:12:18Z", "confidence": "high", "score": 80, "sightings": 1, "tags": "malware,malware_download,Mozi", "reference": "https://urlhaus.abuse.ch/", "context": "URLhaus: malware_download", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["urlhaus_recent_urls"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 168.0, "decay_factor": 1.0}}
{"indicator": "hxxp://42[.]232[.]229[.]217:46603/bin[.]sh", "type": "url", "source": "urlhaus_recent_urls", "first_seen": "2026-10-24T19:02:07Z", "last_seen": "2026-10-24T22:12:18Z", "confidence": "high", "score": 80, "sightings": 1, "tags": "malware,malware_download,None", "reference": "https://urlhaus.abuse.ch/", "context": "URLhaus: malware_download", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["urlhaus_recent_urls"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 168.0, "decay_factor": 1.0}}
{"indicator": "hxxp://27[.]204[.]196[.]55:39789/bin[.]sh", "type": "url", "source": "urlhaus_recent_urls", "first_seen": "2026-10-24T19:02:07Z", "last_seen": "2026-10-24T22:12:18Z", "confidence": "high", "score": 80, "sightings": 1, "tags": "malware,malware_download,Mozi", "reference": "https://urlhaus.abuse.ch/", "context": "URLhaus: malware_download", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["urlhaus_recent_urls"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 168.0, "decay_factor": 1.0}}
{"indicator": "hxxp://182[.]126[.]84[.]152:44186/i", "type": "url", "source": "urlhaus_recent_urls", "first_seen": "2026-10-24T19:02:06Z", "last_seen": "2026-10-24T22:12:18Z", "confidence": "high", "score": 80, "sightings": 1, "tags": "malware,malware_download,Mozi", "reference": "https://urlhaus.abuse.ch/", "context": "URLhaus: malware_download", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["urlhaus_recent_urls"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 168.0, "decay_factor": 1.0}}
{"indicator": "eudfitaly[.]org", "type": "domain", "source": "threatfox_export_json", "first_seen": "2026-10-24T19:01:39Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 1, "tags": "compromised,etherhide,threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "ClearFake", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 336.0, "decay_factor": 1.0}}
{"indicator": "ecointernationalltd[.]com", "type": "domain", "source": "threatfox_export_json", "first_seen": "2026-10-24T19:01:39Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 1, "tags": "compromised,etherhide,threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "ClearFake", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 336.0, "decay_factor": 1.0}}
{"indicator": "kargowa[.]ayz[.]pl", "type": "domain", "source": "threatfox_export_json", "first_seen": "2026-10-24T19:01:38Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 1, "tags": "compromised,etherhide,threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "ClearFake", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 336.0, "decay_factor": 1.0}}
{"indicator": "immexadvisory[.]com", "type": "domain", "source": "threatfox_export_json", "first_seen": "2026-10-24T19:01:38Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 1, "tags": "compromised,etherhide,threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "ClearFake", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 336.0, "decay_factor": 1.0}}
{"indicator": "chemdrygreen[.]com", "type": "domain", "source": "threatfox_export_json", "first_seen": "2026-10-24T19:01:38Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 1, "tags": "compromised,etherhide,threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "ClearFake", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 336.0, "decay_factor": 1.0}}
{"indicator": "canaillechicproduction[.]com", "type": "domain", "source": "threatfox_export_json", "first_seen": "2026-10-24T19:01:38Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 1, "tags": "compromised,etherhide,threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "ClearFake", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 336.0, "decay_factor": 1.0}}
{"indicator": "immexsolutions[.]com", "type": "domain", "source": "threatfox_export_json", "first_seen": "2026-10-24T19:01:37Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 1, "tags": "compromised,etherhide,threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "ClearFake", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 336.0, "decay_factor": 1.0}}
{"indicator": "dicktigerfoundation[.]org", "type": "domain", "source": "threatfox_export_json", "first_seen": "2026-10-24T19:01:37Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 1, "tags": "compromised,etherhide,threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "ClearFake", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 336.0, "decay_factor": 1.0}}
{"indicator": "cleandrygreen[.]com", "type": "domain", "source": "threatfox_export_json", "first_seen": "2026-10-24T19:01:37Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 1, "tags": "compromised,etherhide,threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "ClearFake", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 336.0, "decay_factor": 1.0}}
{"indicator": "chemdryoflosangeles[.]com", "type": "domain", "source": "threatfox_export_json", "first_seen": "2026-10-24T19:01:37Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 1, "tags": "compromised,etherhide,threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "ClearFake", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 336.0, "decay_factor": 1.0}}
{"indicator": "chem-dryoforange[.]com", "type": "domain", "source": "threatfox_export_json", "first_seen": "2026-10-24T19:01:37Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 1, "tags": "compromised,etherhide,threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "ClearFake", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 336.0, "decay_factor": 1.0}}
{"indicator": "immexcompany[.]com", "type": "domain", "source": "threatfox_export_json", "first_seen": "2026-10-24T19:01:36Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 1, "tags": "compromised,etherhide,threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "ClearFake", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 336.0, "decay_factor": 1.0}}
{"indicator": "hirbodmotors[.]com", "type": "domain", "source": "threatfox_export_json", "first_seen": "2026-10-24T19:01:36Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 1, "tags": "compromised,etherhide,threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "ClearFake", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 336.0, "decay_factor": 1.0}}
{"indicator": "gpwlegal[.]com", "type": "domain", "source": "threatfox_export_json", "first_seen": "2026-10-24T19:01:36Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 1, "tags": "compromised,etherhide,threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "ClearFake", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 336.0, "decay_factor": 1.0}}
{"indicator": "city-dentist[.]de", "type": "domain", "source": "threatfox_export_json", "first_seen": "2026-10-24T19:01:36Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 1, "tags": "compromised,etherhide,threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "ClearFake", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 336.0, "decay_factor": 1.0}}
{"indicator": "blackhillsutv[.]rentals", "type": "domain", "source": "threatfox_export_json", "first_seen": "2026-10-24T19:01:35Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 1, "tags": "compromised,etherhide,threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "ClearFake", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 336.0, "decay_factor": 1.0}}
{"indicator": "baraksamoon[.]com", "type": "domain", "source": "threatfox_export_json", "first_seen": "2026-10-24T19:01:35Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 1, "tags": "compromised,etherhide,threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "ClearFake", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 336.0, "decay_factor": 1.0}}
{"indicator": "cc234b6d637cc98c9aa679beec766346c14815fce21e4278f7cb066b3763956d", "type": "sha256", "source": "threatfox_export_json", "first_seen": "2026-10-24T18:59:40Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 1, "tags": "Amos,ClickFix,Foxveil,forge,macOS,threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "AMOS", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 4320.0, "decay_factor": 1.0}}
{"indicator": "fd145fdc03907adec5eab5cb060da29c7bfc96c92d31fecdde087bc6f4c2b044", "type": "sha256", "source": "threatfox_export_json", "first_seen": "2026-10-24T18:56:24Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 1, "tags": "Amos,ClickFix,Foxveil,boost,macOS,threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "AMOS", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 4320.0, "decay_factor": 1.0}}
{"indicator": "8e7d45f486c3438e2e6d855faeded6d6dad9561fdd36b08477a12a768a375fc4", "type": "sha256", "source": "threatfox_export_json", "first_seen": "2026-10-24T18:55:11Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 1, "tags": "Dropper,Loader,SmartLoader,threatfox,trojan,zip", "reference": "https://threatfox.abuse.ch/browse/", "context": "SmartLoader", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 4320.0, "decay_factor": 1.0}}
{"indicator": "ecadbe1c7666d720590cadedfb26b570fdbac1a7e2b4ce239a616581ef9f93f0", "type": "sha256", "source": "malwarebazaar_recent", "first_seen": "2026-10-24T18:55:09Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 1, "tags": "malware,Amadey", "reference": "https://bazaar.abuse.ch/", "context": "MalwareBazaar: Amadey", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["malwarebazaar_recent"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 4320.0, "decay_factor": 1.0}}
{"indicator": "fffce85ded6c9b6a529179d5c9cb21f40b8c79b913308c412f5db7222ad5bd47", "type": "sha256", "source": "threatfox_export_json", "first_seen": "2026-10-24T18:53:25Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 1, "tags": "Amos,ClickFix,Foxveil,macOS,stratos,threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "AMOS", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 4320.0, "decay_factor": 1.0}}
{"indicator": "84dbdfd2a982da772f7389a07e4398a4597f46cb4455d0b1b3a6301a17ef86c8", "type": "sha256", "source": "threatfox_export_json", "first_seen": "2026-10-24T18:50:23Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 1, "tags": "Amos,ClickFix,Foxveil,grove,macOS,threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "AMOS", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 4320.0, "decay_factor": 1.0}}
{"indicator": "8a67f2bc78d859d328a491b68ab53f3f2680b183df0f2773ad511802007c8fbb", "type": "sha256", "source": "malwarebazaar_recent", "first_seen": "2026-10-24T18:48:38Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 1, "tags": "malware", "reference": "https://bazaar.abuse.ch/", "context": "MalwareBazaar: ", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["malwarebazaar_recent"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 4320.0, "decay_factor": 1.0}}
{"indicator": "hxxp://221[.]0[.]125[.]141:33223/i", "type": "url", "source": "urlhaus_recent_urls", "first_seen": "2026-10-24T18:48:20Z", "last_seen": "2026-10-24T22:12:18Z", "confidence": "high", "score": 80, "sightings": 1, "tags": "malware,malware_download,32-bit,elf,mips,Mozi", "reference": "https://urlhaus.abuse.ch/", "context": "URLhaus: malware_download", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["urlhaus_recent_urls"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 168.0, "decay_factor": 1.0}}
{"indicator": "b059699327f09f0cb601063973d978fd86da62b1c358e0b5e966a04401c99e29", "type": "sha256", "source": "threatfox_export_json", "first_seen": "2026-10-24T18:47:16Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 1, "tags": "Amos,ClickFix,Foxveil,frame97,macOS,threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "AMOS", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 4320.0, "decay_factor": 1.0}}
{"indicator": "hxxp://222[.]140[.]224[.]96:39117/i", "type": "url", "source": "urlhaus_recent_urls", "first_seen": "2026-10-24T18:47:07Z", "last_seen": "2026-10-24T22:12:18Z", "confidence": "high", "score": 80, "sightings": 1, "tags": "malware,malware_download,Mozi", "reference": "https://urlhaus.abuse.ch/", "context": "URLhaus: malware_download", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["urlhaus_recent_urls"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 168.0, "decay_factor": 1.0}}
{"indicator": "hxxp://115[.]57[.]45[.]77:58355/i", "type": "url", "source": "urlhaus_recent_urls", "first_seen": "2026-10-24T18:47:07Z", "last_seen": "2026-10-24T22:12:18Z", "confidence": "high", "score": 80, "sightings": 1, "tags": "malware,malware_download,Mozi", "reference": "https://urlhaus.abuse.ch/", "context": "URLhaus: malware_download", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["urlhaus_recent_urls"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 168.0, "decay_factor": 1.0}}
{"indicator": "hxxp://42[.]224[.]0[.]89:37584/bin[.]sh", "type": "url", "source": "urlhaus_recent_urls", "first_seen": "2026-10-24T18:47:06Z", "last_seen": "2026-10-24T22:12:18Z", "confidence": "high", "score": 80, "sightings": 1, "tags": "malware,malware_download,Mozi", "reference": "https://urlhaus.abuse.ch/", "context": "URLhaus: malware_download", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["urlhaus_recent_urls"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 168.0, "decay_factor": 1.0}}
{"indicator": "hxxp://113[.]238[.]236[.]218:56630/bin[.]sh", "type": "url", "source": "urlhaus_recent_urls", "first_seen": "2026-10-24T18:47:06Z", "last_seen": "2026-10-24T22:12:18Z", "confidence": "high", "score": 80, "sightings": 1, "tags": "malware,malware_download,None", "reference": "https://urlhaus.abuse.ch/", "context": "URLhaus: malware_download", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["urlhaus_recent_urls"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 168.0, "decay_factor": 1.0}}
{"indicator": "netjournal[.]id", "type": "domain", "source": "threatfox_export_json", "first_seen": "2026-10-24T18:45:27Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 1, "tags": "StrelaStealer,threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "StrelaStealer", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 336.0, "decay_factor": 1.0}}
{"indicator": "ac2bb5cd4f46145d7c287a7a045787803fb4d4543188ea5df25dd32782c18f66", "type": "sha256", "source": "threatfox_export_json", "first_seen": "2026-10-24T18:44:17Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 1, "tags": "Amos,ClickFix,Foxveil,frame,macOS,threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "AMOS", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 4320.0, "decay_factor": 1.0}}
{"indicator": "c08c25633ef0e47de41dbdd39469193ac8a6cc5e5faa1a09df290b0d2d2e2bb9", "type": "sha256", "source": "threatfox_export_json", "first_seen": "2026-10-24T18:41:18Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 1, "tags": "Amos,ClickFix,Foxveil,macOS,nova,threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "AMOS", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 4320.0, "decay_factor": 1.0}}
{"indicator": "hxxp://119[.]179[.]22[.]130:39856/i", "type": "url", "source": "urlhaus_recent_urls", "first_seen": "2026-10-24T18:40:18Z", "last_seen": "2026-10-24T22:12:18Z", "confidence": "high", "score": 80, "sightings": 1, "tags": "malware,malware_download,elf,Mozi", "reference": "https://urlhaus.abuse.ch/", "context": "URLhaus: malware_download", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["urlhaus_recent_urls"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 168.0, "decay_factor": 1.0}}
{"indicator": "snowdonart[.]co[.]uk", "type": "domain", "source": "threatfox_export_json", "first_seen": "2026-10-24T18:40:04Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 1, "tags": "StrelaStealer,threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "StrelaStealer", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 336.0, "decay_factor": 1.0}}
{"indicator": "4889484535ccefeb35a9dfae28f2ca27d725c5b26a211f9a2743a5bfd68672e9", "type": "sha256", "source": "threatfox_export_json", "first_seen": "2026-10-24T18:38:21Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 1, "tags": "Amos,ClickFix,Foxveil,haven,macOS,threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "AMOS", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 4320.0, "decay_factor": 1.0}}
{"indicator": "hxxp://125[.]43[.]229[.]161:41236/i", "type": "url", "source": "urlhaus_recent_urls", "first_seen": "2026-10-24T18:38:10Z", "last_seen": "2026-10-24T22:12:18Z", "confidence": "high", "score": 80, "sightings": 1, "tags": "malware,malware_download,elf,Mozi", "reference": "https://urlhaus.abuse.ch/", "context": "URLhaus: malware_download", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["urlhaus_recent_urls"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 168.0, "decay_factor": 1.0}}
{"indicator": "a0d5daefe2d6fb6acf4ea1af63dca214a286e9e29298f4b5e4d5d5162e7b73e0", "type": "sha256", "source": "threatfox_export_json", "first_seen": "2026-10-24T18:35:13Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 1, "tags": "Amos,ClickFix,Foxveil,chant,macOS,threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "AMOS", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 4320.0, "decay_factor": 1.0}}
{"indicator": "smart[.]net-developer[.]co[.]uk", "type": "domain", "source": "threatfox_export_json", "first_seen": "2026-10-24T18:34:55Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 1, "tags": "StrelaStealer,threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "StrelaStealer", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 336.0, "decay_factor": 1.0}}
{"indicator": "hxxp://119[.]179[.]254[.]90:55402/bin[.]sh", "type": "url", "source": "urlhaus_recent_urls", "first_seen": "2026-10-24T18:33:06Z", "last_seen": "2026-10-24T22:12:18Z", "confidence": "high", "score": 80, "sightings": 1, "tags": "malware,malware_download,Mozi", "reference": "https://urlhaus.abuse.ch/", "context": "URLhaus: malware_download", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["urlhaus_recent_urls"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 168.0, "decay_factor": 1.0}}
{"indicator": "hxxp://182[.]126[.]84[.]152:44186/bin[.]sh", "type": "url", "source": "urlhaus_recent_urls", "first_seen": "2026-10-24T18:32:06Z", "last_seen": "2026-10-24T22:12:18Z", "confidence": "high", "score": 80, "sightings": 1, "tags": "malware,malware_download,Mozi", "reference": "https://urlhaus.abuse.ch/", "context": "URLhaus: malware_download", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["urlhaus_recent_urls"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 168.0, "decay_factor": 1.0}}
{"indicator": "hxxp://222[.]141[.]83[.]10:48348/i", "type": "url", "source": "urlhaus_recent_urls", "first_seen": "2026-10-24T18:32:05Z", "last_seen": "2026-10-24T22:12:18Z", "confidence": "high", "score": 80, "sightings": 1, "tags": "malware,malware_download,Mozi", "reference": "https://urlhaus.abuse.ch/", "context": "URLhaus: malware_download", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["urlhaus_recent_urls"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 168.0, "decay_factor": 1.0}}
{"indicator": "dc5b73caae42063575889263c0e646c8b9ec1933adc013b6504c759729862e00", "type": "sha256", "source": "threatfox_export_json", "first_seen": "2026-10-24T18:31:51Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 2, "tags": "Amos,ClickFix,Foxveil,macOS,threatfox,willow", "reference": "https://threatfox.abuse.ch/browse/", "context": "AMOS", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 4320.0, "decay_factor": 1.0}}
{"indicator": "xn--80affqomjaccdhnt[.]xn--p1ai", "type": "domain", "source": "threatfox_export_json", "first_seen": "2026-10-24T18:31:32Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 2, "tags": "compromised,etherhide,threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "ClearFake", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 336.0, "decay_factor": 1.0}}
{"indicator": "www[.]permanentart[.]cz", "type": "domain", "source": "threatfox_export_json", "first_seen": "2026-10-24T18:31:32Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 2, "tags": "compromised,etherhide,threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "ClearFake", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 336.0, "decay_factor": 1.0}}
{"indicator": "vanadiumholding[.]com", "type": "domain", "source": "threatfox_export_json", "first_seen": "2026-10-24T18:31:32Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 2, "tags": "compromised,etherhide,threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "ClearFake", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 336.0, "decay_factor": 1.0}}
{"indicator": "www[.]residencialdama[.]com", "type": "domain", "source": "threatfox_export_json", "first_seen": "2026-10-24T18:31:31Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 2, "tags": "compromised,etherhide,threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "ClearFake", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 336.0, "decay_factor": 1.0}}
{"indicator": "hxxp://196[.]251[.]107[.]186/8jdjZhdf7/index[.]php", "type": "url", "source": "threatfox_export_json", "first_seen": "2026-10-24T18:30:04Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 2, "tags": "Amadey,threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "Amadey", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 168.0, "decay_factor": 1.0}}
{"indicator": "c3e0d4186258c150b94004c3b66b6a3f0f4e10525ddfad8fadc439351afcc265", "type": "sha256", "source": "threatfox_export_json", "first_seen": "2026-10-24T18:28:14Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 2, "tags": "Amos,ClickFix,Foxveil,macOS,quill,threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "AMOS", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 4320.0, "decay_factor": 1.0}}
{"indicator": "slideshowtomsk[.]ru", "type": "domain", "source": "threatfox_export_json", "first_seen": "2026-10-24T18:26:26Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 2, "tags": "StrelaStealer,threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "StrelaStealer", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 336.0, "decay_factor": 1.0}}
{"indicator": "panel[.]vidar[.]to", "type": "domain", "source": "threatfox_export_json", "first_seen": "2026-10-24T18:26:02Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 2, "tags": "Vidar,threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "Vidar", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 336.0, "decay_factor": 1.0}}
{"indicator": "hxxp://42[.]178[.]110[.]53:45783/i", "type": "url", "source": "urlhaus_recent_urls", "first_seen": "2026-10-24T18:24:09Z", "last_seen": "2026-10-24T22:12:18Z", "confidence": "high", "score": 80, "sightings": 1, "tags": "malware,malware_download,32-bit,elf,mips,Mozi", "reference": "https://urlhaus.abuse.ch/", "context": "URLhaus: malware_download", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["urlhaus_recent_urls"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 168.0, "decay_factor": 1.0}}
{"indicator": "2c4229230fdcb224538828468a8642aaf4429a1591fe83776f8b3aa683d65050", "type": "sha256", "source": "malwarebazaar_recent", "first_seen": "2026-10-24T18:23:38Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 2, "tags": "malware", "reference": "https://bazaar.abuse.ch/", "context": "MalwareBazaar: ", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["malwarebazaar_recent"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 4320.0, "decay_factor": 1.0}}
{"indicator": "hxxp://182[.]127[.]41[.]21:41691/i", "type": "url", "source": "urlhaus_recent_urls", "first_seen": "2026-10-24T18:21:15Z", "last_seen": "2026-10-24T22:12:18Z", "confidence": "high", "score": 80, "sightings": 1, "tags": "malware,malware_download,elf,iot", "reference": "https://urlhaus.abuse.ch/", "context": "URLhaus: malware_download", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["urlhaus_recent_urls"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 168.0, "decay_factor": 1.0}}
{"indicator": "1913ed2ad175632b1b75e99bf5e291f551302b16dea51df318379e77a36f1ce9", "type": "sha256", "source": "malwarebazaar_recent,threatfox_export_json", "first_seen": "2026-10-24T18:21:12Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 2, "tags": "Mirai,elf,malware,threatfox", "reference": "https://bazaar.abuse.ch/", "context": "MalwareBazaar: Mirai", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["malwarebazaar_recent", "threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 4320.0, "decay_factor": 1.0}}
{"indicator": "0f1f82ed773b41dbcda1bb48984d8dc0b14e4192db2f3aea45f54cb592523a86", "type": "sha256", "source": "malwarebazaar_recent", "first_seen": "2026-10-24T18:21:10Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 2, "tags": "Mirai,malware", "reference": "https://bazaar.abuse.ch/", "context": "MalwareBazaar: Mirai", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["malwarebazaar_recent"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 4320.0, "decay_factor": 1.0}}
{"indicator": "hxxp://27[.]204[.]193[.]8:33514/Mozi[.]m", "type": "url", "source": "threatfox_export_json", "first_seen": "2026-10-24T18:19:42Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 2, "tags": "IoT,Mozi,elf,threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "Mozi", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 168.0, "decay_factor": 1.0}}
{"indicator": "a10712fc263510bc02cc4fefd96e0ad776aeb0e28e8f50fb0421d535321bbc1a", "type": "sha256", "source": "threatfox_export_json", "first_seen": "2026-10-24T18:19:42Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 2, "tags": "IoT,elf,threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "Mirai", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 4320.0, "decay_factor": 1.0}}
{"indicator": "hxxp://45[.]198[.]224[.]89/gamebin/d3d11", "type": "url", "source": "threatfox_export_json", "first_seen": "2026-10-24T18:19:41Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 2, "tags": "IoT,elf,threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "Mirai", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 168.0, "decay_factor": 1.0}}
{"indicator": "d53a8a4ad1409c069299e1217986badd91baa034c5795860f9eb5607f96cda79", "type": "sha256", "source": "malwarebazaar_recent", "first_seen": "2026-10-24T18:19:06Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 2, "tags": "Mirai,malware", "reference": "https://bazaar.abuse.ch/", "context": "MalwareBazaar: Mirai", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["malwarebazaar_recent"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 4320.0, "decay_factor": 1.0}}
{"indicator": "189199[.]xyz", "type": "domain", "source": "threatfox_export_json", "first_seen": "2026-10-24T18:16:05Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 2, "tags": "compromised,etherhide,threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "ClearFake", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 336.0, "decay_factor": 1.0}}
{"indicator": "www[.]neonail[.]ro", "type": "domain", "source": "threatfox_export_json", "first_seen": "2026-10-24T18:16:04Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 2, "tags": "compromised,etherhide,threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "ClearFake", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 336.0, "decay_factor": 1.0}}
{"indicator": "www[.]gibertpaul[.]com", "type": "domain", "source": "threatfox_export_json", "first_seen": "2026-10-24T18:16:04Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 2, "tags": "compromised,etherhide,threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "ClearFake", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 336.0, "decay_factor": 1.0}}
{"indicator": "rcreformes[.]com", "type": "domain", "source": "threatfox_export_json", "first_seen": "2026-10-24T18:16:04Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 2, "tags": "compromised,etherhide,threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "ClearFake", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 336.0, "decay_factor": 1.0}}
{"indicator": "www[.]nypdprosecutorcorruption[.]com", "type": "domain", "source": "threatfox_export_json", "first_seen": "2026-10-24T18:16:03Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 2, "tags": "compromised,etherhide,threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "ClearFake", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 336.0, "decay_factor": 1.0}}
{"indicator": "lapinga[.]com[.]br", "type": "domain", "source": "threatfox_export_json", "first_seen": "2026-10-24T18:16:03Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 2, "tags": "compromised,etherhide,threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "ClearFake", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 336.0, "decay_factor": 1.0}}
{"indicator": "sigaconstrucoes[.]com[.]br", "type": "domain", "source": "threatfox_export_json", "first_seen": "2026-10-24T18:12:07Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 2, "tags": "StrelaStealer,threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "StrelaStealer", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 336.0, "decay_factor": 1.0}}
{"indicator": "26117ae94f91603edcfd4811af97db75cc910ce11bc29da1fbc8ed7d5651c837", "type": "sha256", "source": "malwarebazaar_recent", "first_seen": "2026-10-24T18:09:01Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 2, "tags": "malware", "reference": "https://bazaar.abuse.ch/", "context": "MalwareBazaar: ", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["malwarebazaar_recent"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 4320.0, "decay_factor": 1.0}}
{"indicator": "www[.]fibraimpresa[.]it", "type": "domain", "source": "threatfox_export_json", "first_seen": "2026-10-24T18:06:01Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 2, "tags": "compromised,etherhide,threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "ClearFake", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 336.0, "decay_factor": 1.0}}
{"indicator": "nubiaestetica[.]com", "type": "domain", "source": "threatfox_export_json", "first_seen": "2026-10-24T18:06:00Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 2, "tags": "compromised,etherhide,threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "ClearFake", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 336.0, "decay_factor": 1.0}}
{"indicator": "erzincanisitme[.]com", "type": "domain", "source": "threatfox_export_json", "first_seen": "2026-10-24T18:06:00Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 2, "tags": "compromised,etherhide,threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "ClearFake", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 336.0, "decay_factor": 1.0}}
{"indicator": "comvale[.]com[.]br", "type": "domain", "source": "threatfox_export_json", "first_seen": "2026-10-24T18:06:00Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 2, "tags": "compromised,etherhide,threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "ClearFake", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 336.0, "decay_factor": 1.0}}
{"indicator": "www[.]mineniches[.]com", "type": "domain", "source": "threatfox_export_json", "first_seen": "2026-10-24T18:05:59Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 2, "tags": "compromised,etherhide,threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "ClearFake", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 336.0, "decay_factor": 1.0}}
{"indicator": "www[.]danabagroup[.]com", "type": "domain", "source": "threatfox_export_json", "first_seen": "2026-10-24T18:05:59Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 2, "tags": "compromised,etherhide,threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "ClearFake", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 336.0, "decay_factor": 1.0}}
{"indicator": "rf[.]adilawa99[.]org", "type": "domain", "source": "threatfox_export_json", "first_seen": "2026-10-24T18:05:48Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 2, "tags": "Vidar,threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "Vidar", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 336.0, "decay_factor": 1.0}}
{"indicator": "hxxps://rf[.]adilawa99[.]org/", "type": "url", "source": "threatfox_export_json", "first_seen": "2026-10-24T18:05:48Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 2, "tags": "Vidar,threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "Vidar", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 168.0, "decay_factor": 1.0}}
{"indicator": "38[.]60[.]246[.]113", "type": "ipv4", "source": "threatfox_export_json", "first_seen": "2026-10-24T18:05:06Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 2, "tags": "CobaltStrike,threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "Cobalt Strike", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 168.0, "decay_factor": 1.0}}
{"indicator": "156[.]240[.]14[.]154", "type": "ipv4", "source": "threatfox_export_json", "first_seen": "2026-10-24T18:05:06Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 2, "tags": "Vshell,threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "VShell", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 168.0, "decay_factor": 1.0}}
{"indicator": "103[.]178[.]235[.]51", "type": "ipv4", "source": "threatfox_export_json", "first_seen": "2026-10-24T18:05:06Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 2, "tags": "asyncrat,threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "AsyncRAT", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 168.0, "decay_factor": 1.0}}
{"indicator": "143[.]244[.]140[.]4", "type": "ipv4", "source": "threatfox_export_json", "first_seen": "2026-10-24T18:05:05Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 2, "tags": "Vshell,threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "VShell", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 168.0, "decay_factor": 1.0}}
{"indicator": "b1822124f3aa3160c0def4aa6c46699459713b90c31d7b053b51265701886871", "type": "sha256", "source": "threatfox_export_json", "first_seen": "2026-10-24T18:02:48Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 2, "tags": "NSIS,email,guloader,threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "CloudEyE", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 4320.0, "decay_factor": 1.0}}
{"indicator": "0685c49db9d52f0c2c4b217cc1389bb91257cfbda6d11c6c3c66c375032acadb", "type": "sha256", "source": "threatfox_export_json", "first_seen": "2026-10-24T18:02:48Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 2, "tags": "NSIS,email,guloader,threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "CloudEyE", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 4320.0, "decay_factor": 1.0}}
{"indicator": "edypsomlbd[.]com", "type": "domain", "source": "threatfox_export_json", "first_seen": "2026-10-24T18:02:47Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 2, "tags": "NSIS,email,guloader,threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "CloudEyE", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 336.0, "decay_factor": 1.0}}
{"indicator": "134[.]255[.]216[.]227", "type": "ipv4", "source": "threatfox_export_json", "first_seen": "2026-10-24T18:02:47Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 2, "tags": "NSIS,email,guloader,threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "CloudEyE", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 168.0, "decay_factor": 1.0}}
{"indicator": "hxxp://182[.]127[.]41[.]21:41691/bin[.]sh", "type": "url", "source": "urlhaus_recent_urls", "first_seen": "2026-10-24T18:02:08Z", "last_seen": "2026-10-24T22:12:18Z", "confidence": "high", "score": 80, "sightings": 2, "tags": "None,malware,malware_download", "reference": "https://urlhaus.abuse.ch/", "context": "URLhaus: malware_download", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["urlhaus_recent_urls"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 168.0, "decay_factor": 1.0}}
{"indicator": "hxxp://125[.]47[.]236[.]168:42099/i", "type": "url", "source": "urlhaus_recent_urls", "first_seen": "2026-10-24T18:02:08Z", "last_seen": "2026-10-24T22:12:18Z", "confidence": "high", "score": 80, "sightings": 2, "tags": "Mozi,malware,malware_download", "reference": "https://urlhaus.abuse.ch/", "context": "URLhaus: malware_download", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["urlhaus_recent_urls"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 168.0, "decay_factor": 1.0}}
{"indicator": "hxxp://125[.]47[.]236[.]168:42099/bin[.]sh", "type": "url", "source": "urlhaus_recent_urls", "first_seen": "2026-10-24T18:02:08Z", "last_seen": "2026-10-24T22:12:18Z", "confidence": "high", "score": 80, "sightings": 2, "tags": "Mozi,malware,malware_download", "reference": "https://urlhaus.abuse.ch/", "context": "URLhaus: malware_download", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["urlhaus_recent_urls"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 168.0, "decay_factor": 1.0}}
{"indicator": "hxxp://221[.]0[.]125[.]141:33223/bin[.]sh", "type": "url", "source": "urlhaus_recent_urls", "first_seen": "2026-10-24T18:02:07Z", "last_seen": "2026-10-24T22:12:18Z", "confidence": "high", "score": 80, "sightings": 2, "tags": "None,malware,malware_download", "reference": "https://urlhaus.abuse.ch/", "context": "URLhaus: malware_download", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["urlhaus_recent_urls"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 168.0, "decay_factor": 1.0}}
{"indicator": "hxxp://220[.]198[.]113[.]45:49761/bin[.]sh", "type": "url", "source": "urlhaus_recent_urls", "first_seen": "2026-10-24T18:02:07Z", "last_seen": "2026-10-24T22:12:18Z", "confidence": "high", "score": 80, "sightings": 2, "tags": "None,malware,malware_download", "reference": "https://urlhaus.abuse.ch/", "context": "URLhaus: malware_download", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["urlhaus_recent_urls"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 168.0, "decay_factor": 1.0}}
{"indicator": "2ab90b276553446e47c1de9507e1b8b9851fc5d89c783f2dbddc645dda1d7beb", "type": "sha256", "source": "malwarebazaar_recent", "first_seen": "2026-10-24T18:01:55Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 2, "tags": "malware", "reference": "https://bazaar.abuse.ch/", "context": "MalwareBazaar: ", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["malwarebazaar_recent"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 4320.0, "decay_factor": 1.0}}
{"indicator": "shop[.]goforbranding[.]com", "type": "domain", "source": "threatfox_export_json", "first_seen": "2026-10-24T17:56:58Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 2, "tags": "StrelaStealer,threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "StrelaStealer", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 336.0, "decay_factor": 1.0}}
{"indicator": "22bc6453262b24d0811bd368c922a201e5f8fee726634448d9ff55794619a0b7", "type": "sha256", "source": "malwarebazaar_recent", "first_seen": "2026-10-24T17:54:57Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 2, "tags": "Mirai,malware", "reference": "https://bazaar.abuse.ch/", "context": "MalwareBazaar: Mirai", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["malwarebazaar_recent"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 4320.0, "decay_factor": 1.0}}
{"indicator": "hxxp://42[.]178[.]110[.]53:45783/bin[.]sh", "type": "url", "source": "urlhaus_recent_urls", "first_seen": "2026-10-24T17:54:17Z", "last_seen": "2026-10-24T22:12:18Z", "confidence": "high", "score": 80, "sightings": 2, "tags": "32-bit,Mozi,elf,malware,malware_download,mips", "reference": "https://urlhaus.abuse.ch/", "context": "URLhaus: malware_download", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["urlhaus_recent_urls"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 168.0, "decay_factor": 1.0}}
{"indicator": "www[.]polonez[.]org[.]au", "type": "domain", "source": "threatfox_export_json", "first_seen": "2026-10-24T17:52:36Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 2, "tags": "StrelaStealer,threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "StrelaStealer", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 336.0, "decay_factor": 1.0}}
{"indicator": "thelumberjackswife[.]com", "type": "domain", "source": "threatfox_export_json", "first_seen": "2026-10-24T17:52:36Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 2, "tags": "StrelaStealer,threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "StrelaStealer", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 336.0, "decay_factor": 1.0}}
{"indicator": "starthappylife[.]com", "type": "domain", "source": "threatfox_export_json", "first_seen": "2026-10-24T17:52:36Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 2, "tags": "StrelaStealer,threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "StrelaStealer", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 336.0, "decay_factor": 1.0}}
{"indicator": "ranganathcosmetologycenter[.]com", "type": "domain", "source": "threatfox_export_json", "first_seen": "2026-10-24T17:52:36Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 2, "tags": "StrelaStealer,threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "StrelaStealer", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 336.0, "decay_factor": 1.0}}
{"indicator": "hp-clinics[.]com", "type": "domain", "source": "threatfox_export_json", "first_seen": "2026-10-24T17:52:36Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 2, "tags": "StrelaStealer,threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "StrelaStealer", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 336.0, "decay_factor": 1.0}}
{"indicator": "greencrowdsourcing[.]com", "type": "domain", "source": "threatfox_export_json", "first_seen": "2026-10-24T17:52:36Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 2, "tags": "StrelaStealer,threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "StrelaStealer", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 336.0, "decay_factor": 1.0}}
{"indicator": "dannyeveritt[.]net", "type": "domain", "source": "threatfox_export_json", "first_seen": "2026-10-24T17:52:36Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 2, "tags": "StrelaStealer,threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "StrelaStealer", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 336.0, "decay_factor": 1.0}}
{"indicator": "canakkaleayvaciktdiosb[.]org[.]tr", "type": "domain", "source": "threatfox_export_json", "first_seen": "2026-10-24T17:52:36Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 2, "tags": "StrelaStealer,threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "StrelaStealer", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 336.0, "decay_factor": 1.0}}
{"indicator": "bragadeandrade[.]com[.]br", "type": "domain", "source": "threatfox_export_json", "first_seen": "2026-10-24T17:52:36Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 2, "tags": "StrelaStealer,threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "StrelaStealer", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 336.0, "decay_factor": 1.0}}
{"indicator": "association-acage[.]fr", "type": "domain", "source": "threatfox_export_json", "first_seen": "2026-10-24T17:52:36Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 2, "tags": "StrelaStealer,threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "StrelaStealer", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 336.0, "decay_factor": 1.0}}
{"indicator": "ailinshop[.]com", "type": "domain", "source": "threatfox_export_json", "first_seen": "2026-10-24T17:52:36Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 2, "tags": "StrelaStealer,threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "StrelaStealer", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 336.0, "decay_factor": 1.0}}
{"indicator": "06876beb9f04ee6d95882ee4b663b8081b6524dff46f4b58c8057bc8abeb18e3", "type": "sha256", "source": "threatfox_export_json", "first_seen": "2026-10-24T17:49:37Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 2, "tags": "Amos,ClickFix,Foxveil,forge,macOS,threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "AMOS", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 4320.0, "decay_factor": 1.0}}
{"indicator": "1moko8um[.]encompass-graphics[.]co[.]uk", "type": "domain", "source": "threatfox_export_json", "first_seen": "2026-10-24T17:49:30Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 2, "tags": "ClearFake,mac-0x68dc,macOS,threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "ClearFake", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 336.0, "decay_factor": 1.0}}
{"indicator": "cff237dcf3ab4cdc554209a469c4a85e8545bb568189401982aaf2e321af564b", "type": "sha256", "source": "malwarebazaar_recent", "first_seen": "2026-10-24T17:47:53Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 2, "tags": "malware", "reference": "https://bazaar.abuse.ch/", "context": "MalwareBazaar: ", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["malwarebazaar_recent"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 4320.0, "decay_factor": 1.0}}
{"indicator": "hxxp://42[.]227[.]44[.]100:48654/i", "type": "url", "source": "urlhaus_recent_urls", "first_seen": "2026-10-24T17:47:07Z", "last_seen": "2026-10-24T22:12:18Z", "confidence": "high", "score": 80, "sightings": 2, "tags": "Mozi,malware,malware_download", "reference": "https://urlhaus.abuse.ch/", "context": "URLhaus: malware_download", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["urlhaus_recent_urls"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 168.0, "decay_factor": 1.0}}
{"indicator": "hxxp://42[.]232[.]177[.]204:43511/i", "type": "url", "source": "urlhaus_recent_urls", "first_seen": "2026-10-24T17:47:06Z", "last_seen": "2026-10-24T22:12:18Z", "confidence": "high", "score": 80, "sightings": 2, "tags": "Mozi,malware,malware_download", "reference": "https://urlhaus.abuse.ch/", "context": "URLhaus: malware_download", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["urlhaus_recent_urls"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 168.0, "decay_factor": 1.0}}
{"indicator": "hxxp://36[.]64[.]184[.]26:58931/i", "type": "url", "source": "urlhaus_recent_urls", "first_seen": "2026-10-24T17:47:06Z", "last_seen": "2026-10-24T22:12:18Z", "confidence": "high", "score": 80, "sightings": 2, "tags": "malware,malware_download,mirai", "reference": "https://urlhaus.abuse.ch/", "context": "URLhaus: malware_download", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["urlhaus_recent_urls"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 168.0, "decay_factor": 1.0}}
{"indicator": "hxxp://222[.]140[.]216[.]62:57080/bin[.]sh", "type": "url", "source": "urlhaus_recent_urls", "first_seen": "2026-10-24T17:47:06Z", "last_seen": "2026-10-24T22:12:18Z", "confidence": "high", "score": 80, "sightings": 2, "tags": "Mozi,malware,malware_download", "reference": "https://urlhaus.abuse.ch/", "context": "URLhaus: malware_download", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["urlhaus_recent_urls"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 168.0, "decay_factor": 1.0}}
{"indicator": "hxxp://113[.]239[.]215[.]5:39653/i", "type": "url", "source": "urlhaus_recent_urls", "first_seen": "2026-10-24T17:47:06Z", "last_seen": "2026-10-24T22:12:18Z", "confidence": "high", "score": 80, "sightings": 2, "tags": "None,malware,malware_download", "reference": "https://urlhaus.abuse.ch/", "context": "URLhaus: malware_download", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["urlhaus_recent_urls"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 168.0, "decay_factor": 1.0}}
{"indicator": "d02034ee326121d11671db64a82c14d1a9261a78158d6341b5aae03a43d410f0", "type": "sha256", "source": "malwarebazaar_recent", "first_seen": "2026-10-24T17:47:02Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 2, "tags": "Mirai,malware", "reference": "https://bazaar.abuse.ch/", "context": "MalwareBazaar: Mirai", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["malwarebazaar_recent"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 4320.0, "decay_factor": 1.0}}
{"indicator": "3afb46077f2151e5315232d0a78355241253f5dbe5f867a0f9633535687110e8", "type": "sha256", "source": "threatfox_export_json", "first_seen": "2026-10-24T17:46:37Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 2, "tags": "Amos,ClickFix,Foxveil,boost,macOS,threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "AMOS", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 4320.0, "decay_factor": 1.0}}
{"indicator": "encompass-graphics[.]co[.]uk", "type": "domain", "source": "threatfox_export_json", "first_seen": "2026-10-24T17:44:01Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 2, "tags": "ClearFake,threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "ClearFake", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 336.0, "decay_factor": 1.0}}
{"indicator": "3054d8e241e5e6a37fb6d4ed63efe1653fe4ca265576005f054242da015a274d", "type": "sha256", "source": "threatfox_export_json", "first_seen": "2026-10-24T17:43:42Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 2, "tags": "Amos,ClickFix,Foxveil,macOS,stratos,threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "AMOS", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 4320.0, "decay_factor": 1.0}}
{"indicator": "www[.]premiosarquitectura[.]org", "type": "domain", "source": "threatfox_export_json", "first_seen": "2026-10-24T17:43:06Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 2, "tags": "compromised,etherhide,threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "ClearFake", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 336.0, "decay_factor": 1.0}}
{"indicator": "www[.]grarg[.]com", "type": "domain", "source": "threatfox_export_json", "first_seen": "2026-10-24T17:43:06Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 2, "tags": "compromised,etherhide,threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "ClearFake", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 336.0, "decay_factor": 1.0}}
{"indicator": "www[.]vvrs-info[.]be", "type": "domain", "source": "threatfox_export_json", "first_seen": "2026-10-24T17:43:05Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 2, "tags": "compromised,etherhide,threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "ClearFake", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 336.0, "decay_factor": 1.0}}
{"indicator": "www[.]radiosantateresa[.]it", "type": "domain", "source": "threatfox_export_json", "first_seen": "2026-10-24T17:43:05Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 2, "tags": "compromised,etherhide,threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "ClearFake", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 336.0, "decay_factor": 1.0}}
{"indicator": "anveraspain[.]com", "type": "domain", "source": "threatfox_export_json", "first_seen": "2026-10-24T17:43:05Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 2, "tags": "compromised,etherhide,threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "ClearFake", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 336.0, "decay_factor": 1.0}}
{"indicator": "www[.]sunagawa-shop[.]com", "type": "domain", "source": "threatfox_export_json", "first_seen": "2026-10-24T17:43:04Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 2, "tags": "compromised,etherhide,threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "ClearFake", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 336.0, "decay_factor": 1.0}}
{"indicator": "volegov-pravo[.]ru", "type": "domain", "source": "threatfox_export_json", "first_seen": "2026-10-24T17:43:04Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 2, "tags": "compromised,etherhide,threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "ClearFake", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 336.0, "decay_factor": 1.0}}
{"indicator": "saskiadesign[.]nl", "type": "domain", "source": "threatfox_export_json", "first_seen": "2026-10-24T17:43:04Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 2, "tags": "compromised,etherhide,threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "ClearFake", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 336.0, "decay_factor": 1.0}}
{"indicator": "n1492[.]ru", "type": "domain", "source": "threatfox_export_json", "first_seen": "2026-10-24T17:43:04Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 2, "tags": "compromised,etherhide,threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "ClearFake", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 336.0, "decay_factor": 1.0}}
{"indicator": "clinicasenise[.]com[.]br", "type": "domain", "source": "threatfox_export_json", "first_seen": "2026-10-24T17:43:03Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 2, "tags": "compromised,etherhide,threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "ClearFake", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 336.0, "decay_factor": 1.0}}
{"indicator": "205ec415fbd019c483684154649f9428fd35f0329bc954d0e5406abb20836586", "type": "sha256", "source": "malwarebazaar_recent", "first_seen": "2026-10-24T17:43:00Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 2, "tags": "Mirai,malware", "reference": "https://bazaar.abuse.ch/", "context": "MalwareBazaar: Mirai", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["malwarebazaar_recent"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 4320.0, "decay_factor": 1.0}}
{"indicator": "de164633165810bf27ebda7d6a2cc4c365a00f12faa7e0ffc1fff3c86290bded", "type": "sha256", "source": "threatfox_export_json", "first_seen": "2026-10-24T17:40:15Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 2, "tags": "Amos,ClickFix,Foxveil,grove,macOS,threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "AMOS", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 4320.0, "decay_factor": 1.0}}
{"indicator": "e65e083416cf7b98085dea847f8456b1e424c62b3391b187d42723acbfbed851", "type": "sha256", "source": "threatfox_export_json", "first_seen": "2026-10-24T17:37:18Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 2, "tags": "Amos,ClickFix,Foxveil,frame97,macOS,threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "AMOS", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 4320.0, "decay_factor": 1.0}}
{"indicator": "shavondezilva[.]com", "type": "domain", "source": "threatfox_export_json", "first_seen": "2026-10-24T17:35:46Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 2, "tags": "StrelaStealer,threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "StrelaStealer", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 336.0, "decay_factor": 1.0}}
{"indicator": "52196a9dcc2f5aa5578bebbbbf9acb8bea4bc35244fcba589ccc16f5db7332af", "type": "sha256", "source": "malwarebazaar_recent", "first_seen": "2026-10-24T17:34:55Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 2, "tags": "Mirai,malware", "reference": "https://bazaar.abuse.ch/", "context": "MalwareBazaar: Mirai", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["malwarebazaar_recent"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 4320.0, "decay_factor": 1.0}}
{"indicator": "cbad0a6d4ef25cc8b8ee846ab8508c42d6258e0bfc1c91ed429de788b4166820", "type": "sha256", "source": "threatfox_export_json", "first_seen": "2026-10-24T17:34:05Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 2, "tags": "Amos,ClickFix,Foxveil,frame,macOS,threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "AMOS", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 4320.0, "decay_factor": 1.0}}
{"indicator": "hxxp://123[.]189[.]19[.]159:52662/i", "type": "url", "source": "urlhaus_recent_urls", "first_seen": "2026-10-24T17:32:07Z", "last_seen": "2026-10-24T22:12:18Z", "confidence": "high", "score": 80, "sightings": 2, "tags": "None,malware,malware_download", "reference": "https://urlhaus.abuse.ch/", "context": "URLhaus: malware_download", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["urlhaus_recent_urls"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 168.0, "decay_factor": 1.0}}
{"indicator": "hxxp://27[.]204[.]193[.]8:33514/bin[.]sh", "type": "url", "source": "urlhaus_recent_urls", "first_seen": "2026-10-24T17:32:06Z", "last_seen": "2026-10-24T22:12:18Z", "confidence": "high", "score": 80, "sightings": 2, "tags": "Mozi,malware,malware_download", "reference": "https://urlhaus.abuse.ch/", "context": "URLhaus: malware_download", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["urlhaus_recent_urls"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 168.0, "decay_factor": 1.0}}
{"indicator": "d973e0010942759d30d49836ac7b18199d813e375980b76f73c10c527be2758d", "type": "sha256", "source": "threatfox_export_json", "first_seen": "2026-10-24T17:31:01Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 2, "tags": "Amos,ClickFix,Foxveil,macOS,nova,threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "AMOS", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 4320.0, "decay_factor": 1.0}}
{"indicator": "www[.]zigpsychocybercowboys[.]com", "type": "domain", "source": "threatfox_export_json", "first_seen": "2026-10-24T17:28:34Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 2, "tags": "ClickFix,Polygon,etherhiding,threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "IClickFix", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 336.0, "decay_factor": 1.0}}
{"indicator": "26735e9d2a1df0d918ac8b3a37b42bda1e2c2de3374c6a8ffc2187b6af1c3a80", "type": "sha256", "source": "threatfox_export_json", "first_seen": "2026-10-24T17:27:55Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 2, "tags": "Amos,ClickFix,Foxveil,haven,macOS,threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "AMOS", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 4320.0, "decay_factor": 1.0}}
{"indicator": "0d98501ac73fd2c318e0e1a4a223b9e2589f235627e512eac8b88a275315b69a", "type": "sha256", "source": "malwarebazaar_recent", "first_seen": "2026-10-24T17:25:49Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 2, "tags": "malware", "reference": "https://bazaar.abuse.ch/", "context": "MalwareBazaar: ", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["malwarebazaar_recent"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 4320.0, "decay_factor": 1.0}}
{"indicator": "70b2276aaa5ff9a8e714d625b9238c5bad790145be09827fb928143810df3bc9", "type": "sha256", "source": "malwarebazaar_recent", "first_seen": "2026-10-24T17:25:42Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 2, "tags": "malware", "reference": "https://bazaar.abuse.ch/", "context": "MalwareBazaar: ", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["malwarebazaar_recent"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 4320.0, "decay_factor": 1.0}}
{"indicator": "cca22fb5739abdfc4422a3a992235111cf64663983a59eb5d2780a8ef2b2a7a9", "type": "sha256", "source": "threatfox_export_json", "first_seen": "2026-10-24T17:25:03Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 2, "tags": "Amos,ClickFix,Foxveil,chant,macOS,threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "AMOS", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 4320.0, "decay_factor": 1.0}}
{"indicator": "3f9b5c3452b5542dc43b7e6fb9355713c132c497", "type": "sha1", "source": "threatfox_export_json", "first_seen": "2026-10-24T17:24:30Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 2, "tags": "threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "Raven Stealer", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 4320.0, "decay_factor": 1.0}}
{"indicator": "377cda3d6d3e088780aca9237d35fe08", "type": "md5", "source": "threatfox_export_json", "first_seen": "2026-10-24T17:24:30Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 2, "tags": "threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "Raven Stealer", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 4320.0, "decay_factor": 1.0}}
{"indicator": "ec29ff7d0c0acee15b978e64c7ce2d78", "type": "md5", "source": "threatfox_export_json", "first_seen": "2026-10-24T17:24:18Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 2, "tags": "threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "oRAT", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 4320.0, "decay_factor": 1.0}}
{"indicator": "645cf1c691412acaa51402aa2e44f6e4135b897c", "type": "sha1", "source": "threatfox_export_json", "first_seen": "2026-10-24T17:24:17Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 2, "tags": "threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "oRAT", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 4320.0, "decay_factor": 1.0}}
{"indicator": "f0822425f44551ba600204c5ae73c661", "type": "md5", "source": "threatfox_export_json", "first_seen": "2026-10-24T17:24:12Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 2, "tags": "threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "Raven Stealer", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 4320.0, "decay_factor": 1.0}}
{"indicator": "62631bacf64ccf513a607d6b1a6870046826bf8d", "type": "sha1", "source": "threatfox_export_json", "first_seen": "2026-10-24T17:24:12Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 2, "tags": "threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "Raven Stealer", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 4320.0, "decay_factor": 1.0}}
{"indicator": "9a206522981379d306ebde007cb549ff", "type": "md5", "source": "threatfox_export_json", "first_seen": "2026-10-24T17:24:04Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 2, "tags": "threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "SalatStealer", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 4320.0, "decay_factor": 1.0}}
{"indicator": "c862083cf0fb7f3e2c6d29c6f3f3800b39488908", "type": "sha1", "source": "threatfox_export_json", "first_seen": "2026-10-24T17:24:03Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 2, "tags": "threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "SalatStealer", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 4320.0, "decay_factor": 1.0}}
{"indicator": "fa10634e96d1ec758b4d0ccb50e7f1c0", "type": "md5", "source": "threatfox_export_json", "first_seen": "2026-10-24T17:24:02Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 2, "tags": "threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "SalatStealer", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 4320.0, "decay_factor": 1.0}}
{"indicator": "c62fd3dd2ed1d7a924ee13685a4344f7", "type": "md5", "source": "threatfox_export_json", "first_seen": "2026-10-24T17:24:02Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 2, "tags": "threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "SalatStealer", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 4320.0, "decay_factor": 1.0}}
{"indicator": "c09f2be7a47574eec6c7af357e06930ec7cd3295", "type": "sha1", "source": "threatfox_export_json", "first_seen": "2026-10-24T17:24:02Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 2, "tags": "threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "SalatStealer", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 4320.0, "decay_factor": 1.0}}
{"indicator": "efb810ce559a4299715294b2a8770342", "type": "md5", "source": "threatfox_export_json", "first_seen": "2026-10-24T17:24:01Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 2, "tags": "threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "SalatStealer", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 4320.0, "decay_factor": 1.0}}
{"indicator": "30ac44cbb461c543eabb9680e0616e02fbe60180", "type": "sha1", "source": "threatfox_export_json", "first_seen": "2026-10-24T17:24:01Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 2, "tags": "threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "SalatStealer", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 4320.0, "decay_factor": 1.0}}
{"indicator": "9635d97d3001cba7520aede1b2a34717ad383786", "type": "sha1", "source": "threatfox_export_json", "first_seen": "2026-10-24T17:24:00Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 2, "tags": "threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "SalatStealer", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 4320.0, "decay_factor": 1.0}}
{"indicator": "3216291f75673f0160dd82620c476e09251c178c", "type": "sha1", "source": "threatfox_export_json", "first_seen": "2026-10-24T17:24:00Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 2, "tags": "threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "SalatStealer", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 4320.0, "decay_factor": 1.0}}
{"indicator": "09a58d0deeb9b02610215b1cf96dd61c", "type": "md5", "source": "threatfox_export_json", "first_seen": "2026-10-24T17:24:00Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 2, "tags": "threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "SalatStealer", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 4320.0, "decay_factor": 1.0}}
{"indicator": "8fbe33848afc89dba3a1dcb6e359932af4c54a88", "type": "sha1", "source": "threatfox_export_json", "first_seen": "2026-10-24T17:23:59Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 2, "tags": "threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "SalatStealer", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 4320.0, "decay_factor": 1.0}}
{"indicator": "17f8c39ac1f7921a922e98124f8f262c", "type": "md5", "source": "threatfox_export_json", "first_seen": "2026-10-24T17:23:59Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 2, "tags": "threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "SalatStealer", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 4320.0, "decay_factor": 1.0}}
{"indicator": "d44662469e074d6e297cdbb3b9dcbb63", "type": "md5", "source": "threatfox_export_json", "first_seen": "2026-10-24T17:23:58Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 2, "tags": "threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "SigLoader", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 4320.0, "decay_factor": 1.0}}
{"indicator": "c4183375cdd381cee98a7e9c3919fc9473810424", "type": "sha1", "source": "threatfox_export_json", "first_seen": "2026-10-24T17:23:58Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 2, "tags": "threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "SigLoader", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 4320.0, "decay_factor": 1.0}}
{"indicator": "afe83d78740a05079739c7e32be5b23cc516d084", "type": "sha1", "source": "threatfox_export_json", "first_seen": "2026-10-24T17:23:57Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 2, "tags": "threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "SigLoader", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 4320.0, "decay_factor": 1.0}}
{"indicator": "343b233054a70c68b620a20f9c455d23", "type": "md5", "source": "threatfox_export_json", "first_seen": "2026-10-24T17:23:57Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 2, "tags": "threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "WannaCryptor", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 4320.0, "decay_factor": 1.0}}
{"indicator": "009e90fd0de9db004658827d4f9c2fd0", "type": "md5", "source": "threatfox_export_json", "first_seen": "2026-10-24T17:23:57Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 2, "tags": "threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "SigLoader", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 4320.0, "decay_factor": 1.0}}
{"indicator": "bec7c035c5aa438566a975ff9b556a56", "type": "md5", "source": "threatfox_export_json", "first_seen": "2026-10-24T17:23:56Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 2, "tags": "threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "WannaCryptor", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 4320.0, "decay_factor": 1.0}}
{"indicator": "923bc2b0ceffa97c7799f547fae7e8c95f2e8315", "type": "sha1", "source": "threatfox_export_json", "first_seen": "2026-10-24T17:23:56Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 2, "tags": "threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "WannaCryptor", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 4320.0, "decay_factor": 1.0}}
{"indicator": "55f5723e2da8790d6d16ad08e8c77fa8c3aa218e", "type": "sha1", "source": "threatfox_export_json", "first_seen": "2026-10-24T17:23:56Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 2, "tags": "threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "WannaCryptor", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 4320.0, "decay_factor": 1.0}}
{"indicator": "428ab7c8f0ccfd35d45b350b67d27f9f41a5eb9b", "type": "sha1", "source": "threatfox_export_json", "first_seen": "2026-10-24T17:23:55Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 2, "tags": "threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "Venus Stealer", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 4320.0, "decay_factor": 1.0}}
{"indicator": "1e6ea4a2385cf4c77cd140ab1a932b33", "type": "md5", "source": "threatfox_export_json", "first_seen": "2026-10-24T17:23:55Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 2, "tags": "threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "Venus Stealer", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 4320.0, "decay_factor": 1.0}}
{"indicator": "9507c69e91b6bfc73ac3442ca44059b6", "type": "md5", "source": "threatfox_export_json", "first_seen": "2026-10-24T17:23:54Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 2, "tags": "threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "ZStealer", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 4320.0, "decay_factor": 1.0}}
{"indicator": "42ffb8181322558154ad4d2a3f9b453b", "type": "md5", "source": "threatfox_export_json", "first_seen": "2026-10-24T17:23:54Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 2, "tags": "threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "ZStealer", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 4320.0, "decay_factor": 1.0}}
{"indicator": "084860512b7fe21de201bbda9c969864dd79c639", "type": "sha1", "source": "threatfox_export_json", "first_seen": "2026-10-24T17:23:54Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 2, "tags": "threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "ZStealer", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 4320.0, "decay_factor": 1.0}}
{"indicator": "885e153ed113c7cff48e7c2b1f36f4bf", "type": "md5", "source": "threatfox_export_json", "first_seen": "2026-10-24T17:23:53Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 2, "tags": "threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "DarkCloud Stealer", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 4320.0, "decay_factor": 1.0}}
{"indicator": "7d86cc665d90a040c3c05eec249137146e5c034d", "type": "sha1", "source": "threatfox_export_json", "first_seen": "2026-10-24T17:23:53Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 2, "tags": "threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "ZStealer", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 4320.0, "decay_factor": 1.0}}
{"indicator": "6834b8799efa25ce8a5e707b3bdc23c550ac0f06", "type": "sha1", "source": "threatfox_export_json", "first_seen": "2026-10-24T17:23:52Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 2, "tags": "threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "DarkCloud Stealer", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 4320.0, "decay_factor": 1.0}}
{"indicator": "5474b8a5b10f6f7eb3d546eb822cd74c", "type": "md5", "source": "threatfox_export_json", "first_seen": "2026-10-24T17:23:52Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 2, "tags": "threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "DarkCloud Stealer", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 4320.0, "decay_factor": 1.0}}
{"indicator": "50bc77b546bdd09b2e04d72bdf70b30e762ebb23", "type": "sha1", "source": "threatfox_export_json", "first_seen": "2026-10-24T17:23:52Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 2, "tags": "threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "DarkCloud Stealer", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 4320.0, "decay_factor": 1.0}}
{"indicator": "7e289a86d8ef29f24484719943d671e2", "type": "md5", "source": "threatfox_export_json", "first_seen": "2026-10-24T17:23:51Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 2, "tags": "threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "Raven Stealer", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 4320.0, "decay_factor": 1.0}}
{"indicator": "073d400a498b10679df29c90e3cbd8f4ff5349e2", "type": "sha1", "source": "threatfox_export_json", "first_seen": "2026-10-24T17:23:51Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 2, "tags": "threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "Raven Stealer", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 4320.0, "decay_factor": 1.0}}
{"indicator": "88da90e0ebb10fa85ea666ef2dce20fc51fa34ff", "type": "sha1", "source": "threatfox_export_json", "first_seen": "2026-10-24T17:23:50Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 2, "tags": "threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "Raven Stealer", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 4320.0, "decay_factor": 1.0}}
{"indicator": "4c5841ba2aa04daaf1cac18e05d206c7", "type": "md5", "source": "threatfox_export_json", "first_seen": "2026-10-24T17:23:50Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 2, "tags": "threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "Raven Stealer", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 4320.0, "decay_factor": 1.0}}
{"indicator": "ecefa13b77e4648c1ce67ff06d5d19e52ecaf963", "type": "sha1", "source": "threatfox_export_json", "first_seen": "2026-10-24T17:23:49Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 2, "tags": "threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "Raven Stealer", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 4320.0, "decay_factor": 1.0}}
{"indicator": "ec8c228cfdbc1e75c9d8b33b6039ae7e", "type": "md5", "source": "threatfox_export_json", "first_seen": "2026-10-24T17:23:49Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 2, "tags": "threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "Raven Stealer", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 4320.0, "decay_factor": 1.0}}
{"indicator": "bf3b86f413d5ce57e2d8f1dbcd13c1a2", "type": "md5", "source": "threatfox_export_json", "first_seen": "2026-10-24T17:23:49Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 2, "tags": "threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "Raven Stealer", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 4320.0, "decay_factor": 1.0}}
{"indicator": "fd249be16f00358ec374b4e7eb520258ae3bbd25", "type": "sha1", "source": "threatfox_export_json", "first_seen": "2026-10-24T17:23:48Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 2, "tags": "threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "Raven Stealer", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 4320.0, "decay_factor": 1.0}}
{"indicator": "9453806028e89be7dddd9777027f8487", "type": "md5", "source": "threatfox_export_json", "first_seen": "2026-10-24T17:23:48Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 2, "tags": "threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "Akira Stealer", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 4320.0, "decay_factor": 1.0}}
{"indicator": "bffbe29481217057dfe5afa0e244254e3a71f41f", "type": "sha1", "source": "threatfox_export_json", "first_seen": "2026-10-24T17:23:47Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 2, "tags": "threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "Akira Stealer", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 4320.0, "decay_factor": 1.0}}
{"indicator": "01ab970e35894f7aae5974d16799d75d", "type": "md5", "source": "threatfox_export_json", "first_seen": "2026-10-24T17:23:47Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 2, "tags": "threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "Vidar", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 4320.0, "decay_factor": 1.0}}
{"indicator": "c618d443aa71463824b4b302ae2c097e256362d1", "type": "sha1", "source": "threatfox_export_json", "first_seen": "2026-10-24T17:23:46Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 2, "tags": "threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "Vidar", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 4320.0, "decay_factor": 1.0}}
{"indicator": "429000990842d334df49dec819921cdb", "type": "md5", "source": "threatfox_export_json", "first_seen": "2026-10-24T17:23:46Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 2, "tags": "threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "Vidar", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 4320.0, "decay_factor": 1.0}}
{"indicator": "ee5f5e9971a0b6bf60f49411d43ecdf8", "type": "md5", "source": "threatfox_export_json", "first_seen": "2026-10-24T17:23:45Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 2, "tags": "threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "Venus Stealer", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 4320.0, "decay_factor": 1.0}}
{"indicator": "6e0881537e54ac5eb9d074959bd7214270b59c14", "type": "sha1", "source": "threatfox_export_json", "first_seen": "2026-10-24T17:23:45Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 2, "tags": "threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "Vidar", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 4320.0, "decay_factor": 1.0}}
{"indicator": "22dbca80786e472454fd780bbdb8e682ceef3713", "type": "sha1", "source": "threatfox_export_json", "first_seen": "2026-10-24T17:23:45Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 2, "tags": "threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "Venus Stealer", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 4320.0, "decay_factor": 1.0}}
{"indicator": "acb226599f597fe5f4b46b46ebceb246", "type": "md5", "source": "threatfox_export_json", "first_seen": "2026-10-24T17:23:44Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 2, "tags": "threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "Raven Stealer", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 4320.0, "decay_factor": 1.0}}
{"indicator": "59d48b983eec0e016573216551daa7f5f5939791", "type": "sha1", "source": "threatfox_export_json", "first_seen": "2026-10-24T17:23:44Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 2, "tags": "threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "Raven Stealer", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 4320.0, "decay_factor": 1.0}}
{"indicator": "d643145a05bc39c671986d73bf57e1c6", "type": "md5", "source": "threatfox_export_json", "first_seen": "2026-10-24T17:23:43Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 2, "tags": "threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "Raven Stealer", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 4320.0, "decay_factor": 1.0}}
{"indicator": "69ef58178acfe9c281398a513687508afa104e85", "type": "sha1", "source": "threatfox_export_json", "first_seen": "2026-10-24T17:23:43Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 2, "tags": "threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "Coinminer", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 4320.0, "decay_factor": 1.0}}
{"indicator": "331d183a570848a2da3d0d1164da65fe", "type": "md5", "source": "threatfox_export_json", "first_seen": "2026-10-24T17:23:43Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 2, "tags": "threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "Coinminer", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 4320.0, "decay_factor": 1.0}}
{"indicator": "fa0c60cb9b3fed5432bb2ab46393484c", "type": "md5", "source": "threatfox_export_json", "first_seen": "2026-10-24T17:23:42Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 2, "tags": "threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "Raven Stealer", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 4320.0, "decay_factor": 1.0}}
{"indicator": "ea8130ff4863a54c67e85df5b5fefe4b48097fb6", "type": "sha1", "source": "threatfox_export_json", "first_seen": "2026-10-24T17:23:42Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 2, "tags": "threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "Raven Stealer", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 4320.0, "decay_factor": 1.0}}
{"indicator": "51b0fea3cb4dd12ad9f6565c5e616563a67a7c36", "type": "sha1", "source": "threatfox_export_json", "first_seen": "2026-10-24T17:23:42Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 2, "tags": "threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "Raven Stealer", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 4320.0, "decay_factor": 1.0}}
{"indicator": "fdd53d081e1c3de133b7fe49580b6273e943fc0b", "type": "sha1", "source": "threatfox_export_json", "first_seen": "2026-10-24T17:23:41Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 2, "tags": "threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "Raven Stealer", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 4320.0, "decay_factor": 1.0}}
{"indicator": "bc659cbb17511fc027b9ca0708068fe3", "type": "md5", "source": "threatfox_export_json", "first_seen": "2026-10-24T17:23:41Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 2, "tags": "threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "Raven Stealer", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 4320.0, "decay_factor": 1.0}}
{"indicator": "d066dabf47e9741faa8a4861b4e5f8d5c45fa25b", "type": "sha1", "source": "threatfox_export_json", "first_seen": "2026-10-24T17:23:40Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 2, "tags": "threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "GoGoogle", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 4320.0, "decay_factor": 1.0}}
{"indicator": "ab133da759e361df9726c0242b61089b", "type": "md5", "source": "threatfox_export_json", "first_seen": "2026-10-24T17:23:40Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 2, "tags": "threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "Raven Stealer", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 4320.0, "decay_factor": 1.0}}
{"indicator": "a031f4d9e5c6e499bb4a364a0c51d318", "type": "md5", "source": "threatfox_export_json", "first_seen": "2026-10-24T17:23:40Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 2, "tags": "threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "GoGoogle", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 4320.0, "decay_factor": 1.0}}
{"indicator": "557ae6113a92cb947f6ca50468928901d619492c", "type": "sha1", "source": "threatfox_export_json", "first_seen": "2026-10-24T17:23:39Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 2, "tags": "threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "Raven Stealer", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 4320.0, "decay_factor": 1.0}}
{"indicator": "10279663d1607d5e32872610723c0ea0", "type": "md5", "source": "threatfox_export_json", "first_seen": "2026-10-24T17:23:39Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 2, "tags": "threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "Raven Stealer", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 4320.0, "decay_factor": 1.0}}
{"indicator": "0349e3f2d6e87b2944d8c33fd091f4ccd8989cda", "type": "sha1", "source": "threatfox_export_json", "first_seen": "2026-10-24T17:23:39Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 2, "tags": "threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "Raven Stealer", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 4320.0, "decay_factor": 1.0}}
{"indicator": "fd61aabc00889c5072aff88a86d170e38b66b03e", "type": "sha1", "source": "threatfox_export_json", "first_seen": "2026-10-24T17:23:38Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 2, "tags": "threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "SalatStealer", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 4320.0, "decay_factor": 1.0}}
{"indicator": "a60999eedf5fa4eafba99d74af02030e", "type": "md5", "source": "threatfox_export_json", "first_seen": "2026-10-24T17:23:38Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 2, "tags": "threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "SalatStealer", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 4320.0, "decay_factor": 1.0}}
{"indicator": "8259f98526e20c1b379b361995a6af8f7cf9a57f", "type": "sha1", "source": "threatfox_export_json", "first_seen": "2026-10-24T17:23:37Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 2, "tags": "threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "SalatStealer", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 4320.0, "decay_factor": 1.0}}
{"indicator": "50c15494ee156198110244e418400e22", "type": "md5", "source": "threatfox_export_json", "first_seen": "2026-10-24T17:23:37Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 2, "tags": "threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "SalatStealer", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 4320.0, "decay_factor": 1.0}}
{"indicator": "3d94d292b23f88b225f2fbaccaf3bd1515e4b90b", "type": "sha1", "source": "threatfox_export_json", "first_seen": "2026-10-24T17:23:36Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 2, "tags": "threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "SalatStealer", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 4320.0, "decay_factor": 1.0}}
{"indicator": "30067aa7ba1c1dd67256eb3df1c36d10", "type": "md5", "source": "threatfox_export_json", "first_seen": "2026-10-24T17:23:36Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 2, "tags": "threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "SalatStealer", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 4320.0, "decay_factor": 1.0}}
{"indicator": "7c9c6cf9c61c113f530fd993e1703897d8c0790c", "type": "sha1", "source": "threatfox_export_json", "first_seen": "2026-10-24T17:23:35Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 2, "tags": "threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "SalatStealer", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 4320.0, "decay_factor": 1.0}}
{"indicator": "33f9988ad3a9c08af73fceb0779ca7eb", "type": "md5", "source": "threatfox_export_json", "first_seen": "2026-10-24T17:23:35Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 2, "tags": "threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "SalatStealer", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 4320.0, "decay_factor": 1.0}}
{"indicator": "2a94aba32949a893bcf2c8bf7c63c165", "type": "md5", "source": "threatfox_export_json", "first_seen": "2026-10-24T17:23:34Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 2, "tags": "threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "SalatStealer", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 4320.0, "decay_factor": 1.0}}
{"indicator": "2a5130fc7e2e0e2f8a1c124994a2deabc1321e18", "type": "sha1", "source": "threatfox_export_json", "first_seen": "2026-10-24T17:23:34Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 2, "tags": "threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "SalatStealer", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 4320.0, "decay_factor": 1.0}}
{"indicator": "d6b4745eba53e6b4fcfe176b6e3b444b0f0258b0", "type": "sha1", "source": "threatfox_export_json", "first_seen": "2026-10-24T17:23:33Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 2, "tags": "threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "SalatStealer", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 4320.0, "decay_factor": 1.0}}
{"indicator": "a44b09d78e4e6dc952800197203744b6", "type": "md5", "source": "threatfox_export_json", "first_seen": "2026-10-24T17:23:33Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 2, "tags": "threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "SalatStealer", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 4320.0, "decay_factor": 1.0}}
{"indicator": "f310d8bf3615ce2877a519640775d56f8a29c493", "type": "sha1", "source": "threatfox_export_json", "first_seen": "2026-10-24T17:23:32Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 2, "tags": "threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "SalatStealer", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 4320.0, "decay_factor": 1.0}}
{"indicator": "e8043f0e17526caaafa67488dd5dff9d", "type": "md5", "source": "threatfox_export_json", "first_seen": "2026-10-24T17:23:32Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 2, "tags": "threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "SalatStealer", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 4320.0, "decay_factor": 1.0}}
{"indicator": "e4d9f03e6ed5705a3c76085003708672", "type": "md5", "source": "threatfox_export_json", "first_seen": "2026-10-24T17:23:31Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 2, "tags": "threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "SalatStealer", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 4320.0, "decay_factor": 1.0}}
{"indicator": "53da7d738c6ac27c3896c92e61cb950c44fbb92e", "type": "sha1", "source": "threatfox_export_json", "first_seen": "2026-10-24T17:23:31Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 2, "tags": "threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "SalatStealer", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 4320.0, "decay_factor": 1.0}}
{"indicator": "cec00169239d26be042583a4686a7443", "type": "md5", "source": "threatfox_export_json", "first_seen": "2026-10-24T17:23:30Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 2, "tags": "threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "CodeCore", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 4320.0, "decay_factor": 1.0}}
{"indicator": "aa3fe7778d9051e21b2c743c721ccffdb1a4ac2b", "type": "sha1", "source": "threatfox_export_json", "first_seen": "2026-10-24T17:23:30Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 2, "tags": "threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "CodeCore", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 4320.0, "decay_factor": 1.0}}
{"indicator": "6fde2e6448bd610d74350aa22d857ea2", "type": "md5", "source": "threatfox_export_json", "first_seen": "2026-10-24T17:23:29Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 2, "tags": "threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "stealler", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 4320.0, "decay_factor": 1.0}}
{"indicator": "451557402efaf5cfac916540e21840bd7c8eb8ed", "type": "sha1", "source": "threatfox_export_json", "first_seen": "2026-10-24T17:23:29Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 2, "tags": "threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "stealler", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 4320.0, "decay_factor": 1.0}}
{"indicator": "61b08489f490887c33c95bcc133041f138ef16ea", "type": "sha1", "source": "threatfox_export_json", "first_seen": "2026-10-24T17:23:28Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 2, "tags": "threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "stealler", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 4320.0, "decay_factor": 1.0}}
{"indicator": "491fee22edfa785911d113c4118c7a30", "type": "md5", "source": "threatfox_export_json", "first_seen": "2026-10-24T17:23:28Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 2, "tags": "threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "stealler", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 4320.0, "decay_factor": 1.0}}
{"indicator": "b0da124d0516528253f93109f57ab11c2ddc6c0b", "type": "sha1", "source": "threatfox_export_json", "first_seen": "2026-10-24T17:23:27Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 2, "tags": "threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "stealler", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 4320.0, "decay_factor": 1.0}}
{"indicator": "4902f4ba2bd67972289fbd9ce15ba560", "type": "md5", "source": "threatfox_export_json", "first_seen": "2026-10-24T17:23:27Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 2, "tags": "threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "stealler", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 4320.0, "decay_factor": 1.0}}
{"indicator": "ab66b02f6d3a789452d057a87746e62e", "type": "md5", "source": "threatfox_export_json", "first_seen": "2026-10-24T17:23:26Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 2, "tags": "threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "Venus Stealer", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 4320.0, "decay_factor": 1.0}}
{"indicator": "5a5ac9624714a1a27abac8221dabd3b3", "type": "md5", "source": "threatfox_export_json", "first_seen": "2026-10-24T17:23:26Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 2, "tags": "threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "AsyncRAT", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 4320.0, "decay_factor": 1.0}}
{"indicator": "334cfc35655efcacad3ceab311e52b1181ac44a0", "type": "sha1", "source": "threatfox_export_json", "first_seen": "2026-10-24T17:23:26Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 2, "tags": "threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "AsyncRAT", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 4320.0, "decay_factor": 1.0}}
{"indicator": "df4e9ed80d80d5d5cac0f2f37eb51d8eddb85626", "type": "sha1", "source": "threatfox_export_json", "first_seen": "2026-10-24T17:23:25Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 2, "tags": "threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "Venus Stealer", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 4320.0, "decay_factor": 1.0}}
{"indicator": "47eb130f82a0ed7ce09a984f92912e5b", "type": "md5", "source": "threatfox_export_json", "first_seen": "2026-10-24T17:23:25Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 2, "tags": "threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "Vidar", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 4320.0, "decay_factor": 1.0}}
{"indicator": "724ff952801621aeb96eefc38ec5e03e3214e646", "type": "sha1", "source": "threatfox_export_json", "first_seen": "2026-10-24T17:23:24Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 2, "tags": "threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "Vidar", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 4320.0, "decay_factor": 1.0}}
{"indicator": "3743600e163a3311adf4954b3cc16ad3", "type": "md5", "source": "threatfox_export_json", "first_seen": "2026-10-24T17:23:24Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 2, "tags": "threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "VileRAT", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 4320.0, "decay_factor": 1.0}}
{"indicator": "d2f26b8ac9967a86498d207936f19a3d", "type": "md5", "source": "threatfox_export_json", "first_seen": "2026-10-24T17:23:23Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 2, "tags": "threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "Raven Stealer", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 4320.0, "decay_factor": 1.0}}
{"indicator": "ce077890a42c12a856aa8bd7edb97241ad32e95d", "type": "sha1", "source": "threatfox_export_json", "first_seen": "2026-10-24T17:23:23Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 2, "tags": "threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "Raven Stealer", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 4320.0, "decay_factor": 1.0}}
{"indicator": "87f6e41b9c4dfe06f34caf622f4488f92f220a2c", "type": "sha1", "source": "threatfox_export_json", "first_seen": "2026-10-24T17:23:23Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 2, "tags": "threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "VileRAT", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 4320.0, "decay_factor": 1.0}}
{"indicator": "a30f6edac5bce73ab824a7789a023db3", "type": "md5", "source": "threatfox_export_json", "first_seen": "2026-10-24T17:23:22Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 2, "tags": "threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "RN Stealer", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 4320.0, "decay_factor": 1.0}}
{"indicator": "c0383319a9b891f618489a338a632ee4", "type": "md5", "source": "threatfox_export_json", "first_seen": "2026-10-24T17:23:21Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 2, "tags": "threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "Vidar", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 4320.0, "decay_factor": 1.0}}
{"indicator": "65fb746270dfe87fd860b1d3dbcacb6ae5d57273", "type": "sha1", "source": "threatfox_export_json", "first_seen": "2026-10-24T17:23:21Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 2, "tags": "threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "RN Stealer", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 4320.0, "decay_factor": 1.0}}
{"indicator": "2bb4ab437db7fe6533bef2350e4eb856cfc72a33", "type": "sha1", "source": "threatfox_export_json", "first_seen": "2026-10-24T17:23:21Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 2, "tags": "threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "Vidar", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 4320.0, "decay_factor": 1.0}}
{"indicator": "6b5a5cb88328a12e9be1418a44d6d1016b4ad51e", "type": "sha1", "source": "threatfox_export_json", "first_seen": "2026-10-24T17:23:20Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 2, "tags": "threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "Vidar", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 4320.0, "decay_factor": 1.0}}
{"indicator": "25e32712470da7abb13f03441114edee", "type": "md5", "source": "threatfox_export_json", "first_seen": "2026-10-24T17:23:20Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 2, "tags": "threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "Vidar", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 4320.0, "decay_factor": 1.0}}
{"indicator": "6caea476e8db92cb3fedaf3c6455d6da", "type": "md5", "source": "threatfox_export_json", "first_seen": "2026-10-24T17:23:19Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 2, "tags": "threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "SalatStealer", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 4320.0, "decay_factor": 1.0}}
{"indicator": "1eb0beec62da69e1c949f0c036e04a315639f5e7", "type": "sha1", "source": "threatfox_export_json", "first_seen": "2026-10-24T17:23:19Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 2, "tags": "threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "SalatStealer", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 4320.0, "decay_factor": 1.0}}
{"indicator": "e8def6f183ba324032a0f0ef06be0f6d", "type": "md5", "source": "threatfox_export_json", "first_seen": "2026-10-24T17:23:18Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 2, "tags": "threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "SalatStealer", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 4320.0, "decay_factor": 1.0}}
{"indicator": "92a5b2df6e497a8d5c4d8f17157834ab597d435e", "type": "sha1", "source": "threatfox_export_json", "first_seen": "2026-10-24T17:23:18Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 2, "tags": "threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "SalatStealer", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 4320.0, "decay_factor": 1.0}}
{"indicator": "63a7f54344e8aa6f2d6507e7cf602249", "type": "md5", "source": "threatfox_export_json", "first_seen": "2026-10-24T17:23:18Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 2, "tags": "threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "stealler", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 4320.0, "decay_factor": 1.0}}
{"indicator": "b167623c61805abe23fa0e98336571404e745c1d", "type": "sha1", "source": "threatfox_export_json", "first_seen": "2026-10-24T17:23:17Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 2, "tags": "threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "stealler", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 4320.0, "decay_factor": 1.0}}
{"indicator": "6ae7ca51332b6d0794f59d0c7e0ec3ac", "type": "md5", "source": "threatfox_export_json", "first_seen": "2026-10-24T17:23:17Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 2, "tags": "threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "Quasar RAT", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 4320.0, "decay_factor": 1.0}}
{"indicator": "7b32c0d813a104c42a48fd56612738a364e3ed3d", "type": "sha1", "source": "threatfox_export_json", "first_seen": "2026-10-24T17:23:16Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 2, "tags": "threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "Quasar RAT", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 4320.0, "decay_factor": 1.0}}
{"indicator": "0b7a546d1a6aab11126d57153582d629", "type": "md5", "source": "threatfox_export_json", "first_seen": "2026-10-24T17:23:16Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 2, "tags": "threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "SalatStealer", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 4320.0, "decay_factor": 1.0}}
{"indicator": "3ef2907c4439b948aaf47c336a307234", "type": "md5", "source": "threatfox_export_json", "first_seen": "2026-10-24T17:23:15Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 2, "tags": "threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "SalatStealer", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 4320.0, "decay_factor": 1.0}}
{"indicator": "176[.]121[.]51[.]1", "type": "ipv4", "source": "threatfox_export_json", "first_seen": "2026-10-24T17:05:06Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 2, "tags": "CobaltStrike,threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "Cobalt Strike", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 168.0, "decay_factor": 1.0}}
{"indicator": "185[.]193[.]125[.]201", "type": "ipv4", "source": "threatfox_export_json", "first_seen": "2026-10-24T16:58:50Z", "last_seen": "2026-10-24T22:12:17Z", "confidence": "high", "score": 80, "sightings": 2, "tags": "shodan,sliver,threatfox", "reference": "https://threatfox.abuse.ch/browse/", "context": "Sliver", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["threatfox_export_json"], "reporting_groups": ["abuse.ch"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 168.0, "decay_factor": 1.0}}
{"indicator": "98.98.195.0/24", "type": "ipv4_cidr", "source": "spamhaus_drop", "first_seen": "2026-10-24T15:16:22Z", "last_seen": "2026-10-24T22:12:16Z", "confidence": "high", "score": 80, "sightings": 3, "tags": "drop,spamhaus", "reference": "https://www.spamhaus.org/blocklists/do-not-route-or-peer/", "context": "Spamhaus DROP/EDROP network", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["spamhaus_drop"], "reporting_groups": ["spamhaus"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 720.0, "decay_factor": 1.0}}
{"indicator": "96.31.94.0/24", "type": "ipv4_cidr", "source": "spamhaus_drop", "first_seen": "2026-10-24T15:16:22Z", "last_seen": "2026-10-24T22:12:16Z", "confidence": "high", "score": 80, "sightings": 3, "tags": "drop,spamhaus", "reference": "https://www.spamhaus.org/blocklists/do-not-route-or-peer/", "context": "Spamhaus DROP/EDROP network", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["spamhaus_drop"], "reporting_groups": ["spamhaus"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 720.0, "decay_factor": 1.0}}
{"indicator": "95.85.238.0/24", "type": "ipv4_cidr", "source": "spamhaus_drop", "first_seen": "2026-10-24T15:16:22Z", "last_seen": "2026-10-24T22:12:16Z", "confidence": "high", "score": 80, "sightings": 3, "tags": "drop,spamhaus", "reference": "https://www.spamhaus.org/blocklists/do-not-route-or-peer/", "context": "Spamhaus DROP/EDROP network", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["spamhaus_drop"], "reporting_groups": ["spamhaus"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 720.0, "decay_factor": 1.0}}
{"indicator": "95.169.180.0/24", "type": "ipv4_cidr", "source": "spamhaus_drop", "first_seen": "2026-10-24T15:16:22Z", "last_seen": "2026-10-24T22:12:16Z", "confidence": "high", "score": 80, "sightings": 3, "tags": "drop,spamhaus", "reference": "https://www.spamhaus.org/blocklists/do-not-route-or-peer/", "context": "Spamhaus DROP/EDROP network", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["spamhaus_drop"], "reporting_groups": ["spamhaus"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 720.0, "decay_factor": 1.0}}
{"indicator": "95.164.162.0/24", "type": "ipv4_cidr", "source": "spamhaus_drop", "first_seen": "2026-10-24T15:16:22Z", "last_seen": "2026-10-24T22:12:16Z", "confidence": "high", "score": 80, "sightings": 3, "tags": "drop,spamhaus", "reference": "https://www.spamhaus.org/blocklists/do-not-route-or-peer/", "context": "Spamhaus DROP/EDROP network", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["spamhaus_drop"], "reporting_groups": ["spamhaus"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 720.0, "decay_factor": 1.0}}
{"indicator": "95.164.131.0/24", "type": "ipv4_cidr", "source": "spamhaus_drop", "first_seen": "2026-10-24T15:16:22Z", "last_seen": "2026-10-24T22:12:16Z", "confidence": "high", "score": 80, "sightings": 3, "tags": "drop,spamhaus", "reference": "https://www.spamhaus.org/blocklists/do-not-route-or-peer/", "context": "Spamhaus DROP/EDROP network", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["spamhaus_drop"], "reporting_groups": ["spamhaus"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 720.0, "decay_factor": 1.0}}
{"indicator": "94.74.191.0/24", "type": "ipv4_cidr", "source": "spamhaus_drop", "first_seen": "2026-10-24T15:16:22Z", "last_seen": "2026-10-24T22:12:16Z", "confidence": "high", "score": 80, "sightings": 3, "tags": "drop,spamhaus", "reference": "https://www.spamhaus.org/blocklists/do-not-route-or-peer/", "context": "Spamhaus DROP/EDROP network", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["spamhaus_drop"], "reporting_groups": ["spamhaus"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 720.0, "decay_factor": 1.0}}
{"indicator": "94.74.164.0/24", "type": "ipv4_cidr", "source": "spamhaus_drop", "first_seen": "2026-10-24T15:16:22Z", "last_seen": "2026-10-24T22:12:16Z", "confidence": "high", "score": 80, "sightings": 3, "tags": "drop,spamhaus", "reference": "https://www.spamhaus.org/blocklists/do-not-route-or-peer/", "context": "Spamhaus DROP/EDROP network", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["spamhaus_drop"], "reporting_groups": ["spamhaus"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 720.0, "decay_factor": 1.0}}
{"indicator": "94.26.88.0/24", "type": "ipv4_cidr", "source": "spamhaus_drop", "first_seen": "2026-10-24T15:16:22Z", "last_seen": "2026-10-24T22:12:16Z", "confidence": "high", "score": 80, "sightings": 3, "tags": "drop,spamhaus", "reference": "https://www.spamhaus.org/blocklists/do-not-route-or-peer/", "context": "Spamhaus DROP/EDROP network", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["spamhaus_drop"], "reporting_groups": ["spamhaus"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 720.0, "decay_factor": 1.0}}
{"indicator": "94.26.38.0/24", "type": "ipv4_cidr", "source": "spamhaus_drop", "first_seen": "2026-10-24T15:16:22Z", "last_seen": "2026-10-24T22:12:16Z", "confidence": "high", "score": 80, "sightings": 3, "tags": "drop,spamhaus", "reference": "https://www.spamhaus.org/blocklists/do-not-route-or-peer/", "context": "Spamhaus DROP/EDROP network", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["spamhaus_drop"], "reporting_groups": ["spamhaus"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 720.0, "decay_factor": 1.0}}
{"indicator": "94.26.106.0/24", "type": "ipv4_cidr", "source": "spamhaus_drop", "first_seen": "2026-10-24T15:16:22Z", "last_seen": "2026-10-24T22:12:16Z", "confidence": "high", "score": 80, "sightings": 3, "tags": "drop,spamhaus", "reference": "https://www.spamhaus.org/blocklists/do-not-route-or-peer/", "context": "Spamhaus DROP/EDROP network", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["spamhaus_drop"], "reporting_groups": ["spamhaus"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 720.0, "decay_factor": 1.0}}
{"indicator": "94.26.105.0/24", "type": "ipv4_cidr", "source": "spamhaus_drop", "first_seen": "2026-10-24T15:16:22Z", "last_seen": "2026-10-24T22:12:16Z", "confidence": "high", "score": 80, "sightings": 3, "tags": "drop,spamhaus", "reference": "https://www.spamhaus.org/blocklists/do-not-route-or-peer/", "context": "Spamhaus DROP/EDROP network", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["spamhaus_drop"], "reporting_groups": ["spamhaus"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 720.0, "decay_factor": 1.0}}
{"indicator": "94.26.0.0/24", "type": "ipv4_cidr", "source": "spamhaus_drop", "first_seen": "2026-10-24T15:16:22Z", "last_seen": "2026-10-24T22:12:16Z", "confidence": "high", "score": 80, "sightings": 3, "tags": "drop,spamhaus", "reference": "https://www.spamhaus.org/blocklists/do-not-route-or-peer/", "context": "Spamhaus DROP/EDROP network", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["spamhaus_drop"], "reporting_groups": ["spamhaus"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 720.0, "decay_factor": 1.0}}
{"indicator": "94.183.168.0/24", "type": "ipv4_cidr", "source": "spamhaus_drop", "first_seen": "2026-10-24T15:16:22Z", "last_seen": "2026-10-24T22:12:16Z", "confidence": "high", "score": 80, "sightings": 3, "tags": "drop,spamhaus", "reference": "https://www.spamhaus.org/blocklists/do-not-route-or-peer/", "context": "Spamhaus DROP/EDROP network", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["spamhaus_drop"], "reporting_groups": ["spamhaus"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 720.0, "decay_factor": 1.0}}
{"indicator": "94.154.46.0/24", "type": "ipv4_cidr", "source": "spamhaus_drop", "first_seen": "2026-10-24T15:16:22Z", "last_seen": "2026-10-24T22:12:16Z", "confidence": "high", "score": 80, "sightings": 3, "tags": "drop,spamhaus", "reference": "https://www.spamhaus.org/blocklists/do-not-route-or-peer/", "context": "Spamhaus DROP/EDROP network", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["spamhaus_drop"], "reporting_groups": ["spamhaus"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 720.0, "decay_factor": 1.0}}
{"indicator": "94.154.40.0/24", "type": "ipv4_cidr", "source": "spamhaus_drop", "first_seen": "2026-10-24T15:16:22Z", "last_seen": "2026-10-24T22:12:16Z", "confidence": "high", "score": 80, "sightings": 3, "tags": "drop,spamhaus", "reference": "https://www.spamhaus.org/blocklists/do-not-route-or-peer/", "context": "Spamhaus DROP/EDROP network", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["spamhaus_drop"], "reporting_groups": ["spamhaus"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 720.0, "decay_factor": 1.0}}
{"indicator": "94.154.35.0/24", "type": "ipv4_cidr", "source": "spamhaus_drop", "first_seen": "2026-10-24T15:16:22Z", "last_seen": "2026-10-24T22:12:16Z", "confidence": "high", "score": 80, "sightings": 3, "tags": "drop,spamhaus", "reference": "https://www.spamhaus.org/blocklists/do-not-route-or-peer/", "context": "Spamhaus DROP/EDROP network", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["spamhaus_drop"], "reporting_groups": ["spamhaus"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 720.0, "decay_factor": 1.0}}
{"indicator": "93.92.72.0/21", "type": "ipv4_cidr", "source": "spamhaus_drop", "first_seen": "2026-10-24T15:16:22Z", "last_seen": "2026-10-24T22:12:16Z", "confidence": "high", "score": 80, "sightings": 3, "tags": "drop,spamhaus", "reference": "https://www.spamhaus.org/blocklists/do-not-route-or-peer/", "context": "Spamhaus DROP/EDROP network", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["spamhaus_drop"], "reporting_groups": ["spamhaus"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 720.0, "decay_factor": 1.0}}
{"indicator": "93.90.72.0/23", "type": "ipv4_cidr", "source": "spamhaus_drop", "first_seen": "2026-10-24T15:16:22Z", "last_seen": "2026-10-24T22:12:16Z", "confidence": "high", "score": 80, "sightings": 3, "tags": "drop,spamhaus", "reference": "https://www.spamhaus.org/blocklists/do-not-route-or-peer/", "context": "Spamhaus DROP/EDROP network", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["spamhaus_drop"], "reporting_groups": ["spamhaus"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 720.0, "decay_factor": 1.0}}
{"indicator": "93.187.128.0/22", "type": "ipv4_cidr", "source": "spamhaus_drop", "first_seen": "2026-10-24T15:16:22Z", "last_seen": "2026-10-24T22:12:16Z", "confidence": "high", "score": 80, "sightings": 3, "tags": "drop,spamhaus", "reference": "https://www.spamhaus.org/blocklists/do-not-route-or-peer/", "context": "Spamhaus DROP/EDROP network", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["spamhaus_drop"], "reporting_groups": ["spamhaus"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 720.0, "decay_factor": 1.0}}
{"indicator": "93.177.76.0/22", "type": "ipv4_cidr", "source": "spamhaus_drop", "first_seen": "2026-10-24T15:16:22Z", "last_seen": "2026-10-24T22:12:16Z", "confidence": "high", "score": 80, "sightings": 3, "tags": "drop,spamhaus", "reference": "https://www.spamhaus.org/blocklists/do-not-route-or-peer/", "context": "Spamhaus DROP/EDROP network", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["spamhaus_drop"], "reporting_groups": ["spamhaus"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 720.0, "decay_factor": 1.0}}
{"indicator": "93.152.223.0/24", "type": "ipv4_cidr", "source": "spamhaus_drop", "first_seen": "2026-10-24T15:16:22Z", "last_seen": "2026-10-24T22:12:16Z", "confidence": "high", "score": 80, "sightings": 3, "tags": "drop,spamhaus", "reference": "https://www.spamhaus.org/blocklists/do-not-route-or-peer/", "context": "Spamhaus DROP/EDROP network", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["spamhaus_drop"], "reporting_groups": ["spamhaus"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 720.0, "decay_factor": 1.0}}
{"indicator": "93.152.221.0/24", "type": "ipv4_cidr", "source": "spamhaus_drop", "first_seen": "2026-10-24T15:16:22Z", "last_seen": "2026-10-24T22:12:16Z", "confidence": "high", "score": 80, "sightings": 3, "tags": "drop,spamhaus", "reference": "https://www.spamhaus.org/blocklists/do-not-route-or-peer/", "context": "Spamhaus DROP/EDROP network", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["spamhaus_drop"], "reporting_groups": ["spamhaus"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 720.0, "decay_factor": 1.0}}
{"indicator": "93.152.219.0/24", "type": "ipv4_cidr", "source": "spamhaus_drop", "first_seen": "2026-10-24T15:16:22Z", "last_seen": "2026-10-24T22:12:16Z", "confidence": "high", "score": 80, "sightings": 3, "tags": "drop,spamhaus", "reference": "https://www.spamhaus.org/blocklists/do-not-route-or-peer/", "context": "Spamhaus DROP/EDROP network", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["spamhaus_drop"], "reporting_groups": ["spamhaus"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 720.0, "decay_factor": 1.0}}
{"indicator": "93.123.109.0/24", "type": "ipv4_cidr", "source": "spamhaus_drop", "first_seen": "2026-10-24T15:16:22Z", "last_seen": "2026-10-24T22:12:16Z", "confidence": "high", "score": 80, "sightings": 3, "tags": "drop,spamhaus", "reference": "https://www.spamhaus.org/blocklists/do-not-route-or-peer/", "context": "Spamhaus DROP/EDROP network", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["spamhaus_drop"], "reporting_groups": ["spamhaus"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 720.0, "decay_factor": 1.0}}
{"indicator": "93.119.120.0/23", "type": "ipv4_cidr", "source": "spamhaus_drop", "first_seen": "2026-10-24T15:16:22Z", "last_seen": "2026-10-24T22:12:16Z", "confidence": "high", "score": 80, "sightings": 3, "tags": "drop,spamhaus", "reference": "https://www.spamhaus.org/blocklists/do-not-route-or-peer/", "context": "Spamhaus DROP/EDROP network", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["spamhaus_drop"], "reporting_groups": ["spamhaus"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 720.0, "decay_factor": 1.0}}
{"indicator": "93.119.118.0/23", "type": "ipv4_cidr", "source": "spamhaus_drop", "first_seen": "2026-10-24T15:16:22Z", "last_seen": "2026-10-24T22:12:16Z", "confidence": "high", "score": 80, "sightings": 3, "tags": "drop,spamhaus", "reference": "https://www.spamhaus.org/blocklists/do-not-route-or-peer/", "context": "Spamhaus DROP/EDROP network", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["spamhaus_drop"], "reporting_groups": ["spamhaus"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 720.0, "decay_factor": 1.0}}
{"indicator": "93.115.59.0/24", "type": "ipv4_cidr", "source": "spamhaus_drop", "first_seen": "2026-10-24T15:16:22Z", "last_seen": "2026-10-24T22:12:16Z", "confidence": "high", "score": 80, "sightings": 3, "tags": "drop,spamhaus", "reference": "https://www.spamhaus.org/blocklists/do-not-route-or-peer/", "context": "Spamhaus DROP/EDROP network", "tlp": "CLEAR", "score_factors": {"score": 80, "confidence_base": 80, "source_count": 1, "source_identifiers": ["spamhaus_drop"], "reporting_groups": ["spamhaus"], "excluded_sources": [], "unmapped_sources": [], "corroboration_bonus": 0, "age_hours": 0.0, "half_life_hours": 720.0, "decay_factor": 1.0}}