{
  "type": "report",
  "id": "report--00000000-0000-0000-0000-000000000000",
  "created_by_ref": "identity--00000000-0000-0000-0000-000000000001",
  "created": "2026-09-09T12:15:23.892988Z",
  "modified": "2026-09-09T12:15:23.892988Z",
  "name": "Cyber Daily Brief IOC Report - 2026-09-09 12:15 UTC",
  "description": "Indicators of Compromise extracted from daily cyber briefing.\nReport ID: IOC-20260909-121523\nClassification: OPEN - Law Enforcement / DFIR use\nSources: Article: Alby Hub Critical Flaw Could Let Attackers Take Over Internet-Exposed Bitcoin Wallets, Article: Ivanti Patches Critical Flaws Across Enterprise Security Products, CISA KEV Catalog, OpenPhish",
  "object_marking_refs": [
    "marking-definition--00000000-0000-0000-0000-000000000002"
  ],
  "objects": {
    "identity--00000000-0000-0000-0000-000000000001": {
      "type": "identity",
      "name": "Cyber Daily Brief",
      "identity_class": "organization"
    },
    "marking-definition--00000000-0000-0000-0000-000000000002": {
      "type": "marking-definition",
      "definition_type": "statement",
      "definition": {
        "statement": "OPEN - Law Enforcement / DFIR use"
      }
    },
    "indicator--00000000-00000001-0000-0000-0000-000000000000": {
      "type": "indicator",
      "id": "indicator--00000000-00000001-0000-0000-0000-000000000000",
      "created": "2026-09-09T12:15:23.892988Z",
      "modified": "2026-09-09T12:15:23.892988Z",
      "name": "CVE-2026-75650",
      "description": "Adobe Commerce and Magento Open Source contain an improper neutralization of special elements used in a template engine vulnerability that could allow an attacker to execute arbitrary code.",
      "indicator_types": [
        "CISA KEV (KNOWN EXPLOITED VULNERABILITY)",
        "malicious-activity"
      ],
      "pattern": "[x-oca-asset:id = 'CVE-2026-75650']",
      "pattern_type": "stix",
      "pattern_version": "2.0",
      "valid_from": "2026-09-09T12:15:23.892988Z",
      "confidence": "high",
      "labels": [
        "indicator",
        "cve",
        "kev",
        "cisa",
        "active-exploitation"
      ],
      "created_by_ref": "identity--00000000-0000-0000-0000-000000000001",
      "object_marking_refs": [
        "marking-definition--00000000-0000-0000-0000-000000000002"
      ],
      "x_custom": {
        "severity": "CRITICAL",
        "product": "Commerce and Magento (Adobe)",
        "source": "CISA KEV Catalog",
        "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
        "date": "2026-09-08",
        "original_section": "CISA KEV (KNOWN EXPLOITED VULNERABILITY)"
      }
    },
    "indicator--00000000-00000002-0000-0000-0000-000000000000": {
      "type": "indicator",
      "id": "indicator--00000000-00000002-0000-0000-0000-000000000000",
      "created": "2026-09-09T12:15:23.892988Z",
      "modified": "2026-09-09T12:15:23.892988Z",
      "name": "CVE-2026-81963",
      "description": "Microsoft Windows Update Stack contains a link following vulnerability that allows a local attacker to escalate privileges locally up to SYSTEM.",
      "indicator_types": [
        "CISA KEV (KNOWN EXPLOITED VULNERABILITY)",
        "malicious-activity"
      ],
      "pattern": "[x-oca-asset:id = 'CVE-2026-81963']",
      "pattern_type": "stix",
      "pattern_version": "2.0",
      "valid_from": "2026-09-09T12:15:23.892988Z",
      "confidence": "high",
      "labels": [
        "indicator",
        "cve",
        "kev",
        "cisa",
        "active-exploitation"
      ],
      "created_by_ref": "identity--00000000-0000-0000-0000-000000000001",
      "object_marking_refs": [
        "marking-definition--00000000-0000-0000-0000-000000000002"
      ],
      "x_custom": {
        "severity": "CRITICAL",
        "product": "Windows (Microsoft)",
        "source": "CISA KEV Catalog",
        "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
        "date": "2026-09-08",
        "original_section": "CISA KEV (KNOWN EXPLOITED VULNERABILITY)"
      }
    },
    "indicator--00000000-00000003-0000-0000-0000-000000000000": {
      "type": "indicator",
      "id": "indicator--00000000-00000003-0000-0000-0000-000000000000",
      "created": "2026-09-09T12:15:23.892988Z",
      "modified": "2026-09-09T12:15:23.892988Z",
      "name": "CVE-2026-86218",
      "description": "N-able N-central contains a static code injection vulnerability that could allow for pre-authentication remote code execution.",
      "indicator_types": [
        "CISA KEV (KNOWN EXPLOITED VULNERABILITY)",
        "malicious-activity"
      ],
      "pattern": "[x-oca-asset:id = 'CVE-2026-86218']",
      "pattern_type": "stix",
      "pattern_version": "2.0",
      "valid_from": "2026-09-09T12:15:23.892988Z",
      "confidence": "high",
      "labels": [
        "indicator",
        "cve",
        "kev",
        "cisa",
        "active-exploitation"
      ],
      "created_by_ref": "identity--00000000-0000-0000-0000-000000000001",
      "object_marking_refs": [
        "marking-definition--00000000-0000-0000-0000-000000000002"
      ],
      "x_custom": {
        "severity": "CRITICAL",
        "product": "N-central (N-able)",
        "source": "CISA KEV Catalog",
        "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
        "date": "2026-09-08",
        "original_section": "CISA KEV (KNOWN EXPLOITED VULNERABILITY)"
      }
    },
    "indicator--00000000-00000004-0000-0000-0000-000000000000": {
      "type": "indicator",
      "id": "indicator--00000000-00000004-0000-0000-0000-000000000000",
      "created": "2026-09-09T12:15:23.892988Z",
      "modified": "2026-09-09T12:15:23.892988Z",
      "name": "CVE-2026-85880",
      "description": "Microsoft Windows Advanced Local Procedure Call contains a heap-based buffer overflow vulnerability that allows an attacker to elevate privileges locally.",
      "indicator_types": [
        "CISA KEV (KNOWN EXPLOITED VULNERABILITY)",
        "malicious-activity"
      ],
      "pattern": "[x-oca-asset:id = 'CVE-2026-85880']",
      "pattern_type": "stix",
      "pattern_version": "2.0",
      "valid_from": "2026-09-09T12:15:23.892988Z",
      "confidence": "high",
      "labels": [
        "indicator",
        "cve",
        "kev",
        "cisa",
        "active-exploitation"
      ],
      "created_by_ref": "identity--00000000-0000-0000-0000-000000000001",
      "object_marking_refs": [
        "marking-definition--00000000-0000-0000-0000-000000000002"
      ],
      "x_custom": {
        "severity": "CRITICAL",
        "product": "Windows (Microsoft)",
        "source": "CISA KEV Catalog",
        "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
        "date": "2026-09-08",
        "original_section": "CISA KEV (KNOWN EXPLOITED VULNERABILITY)"
      }
    },
    "indicator--00000000-00000005-0000-0000-0000-000000000000": {
      "type": "indicator",
      "id": "indicator--00000000-00000005-0000-0000-0000-000000000000",
      "created": "2026-09-09T12:15:23.892988Z",
      "modified": "2026-09-09T12:15:23.892988Z",
      "name": "CVE-2026-85046",
      "description": "Google Chromium V8 contains a type confusion vulnerability that allows a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but",
      "indicator_types": [
        "CISA KEV (KNOWN EXPLOITED VULNERABILITY)",
        "malicious-activity"
      ],
      "pattern": "[x-oca-asset:id = 'CVE-2026-85046']",
      "pattern_type": "stix",
      "pattern_version": "2.0",
      "valid_from": "2026-09-09T12:15:23.892988Z",
      "confidence": "high",
      "labels": [
        "indicator",
        "cve",
        "kev",
        "cisa",
        "active-exploitation"
      ],
      "created_by_ref": "identity--00000000-0000-0000-0000-000000000001",
      "object_marking_refs": [
        "marking-definition--00000000-0000-0000-0000-000000000002"
      ],
      "x_custom": {
        "severity": "CRITICAL",
        "product": "Chromium V8 (Google)",
        "source": "CISA KEV Catalog",
        "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
        "date": "2026-09-04",
        "original_section": "CISA KEV (KNOWN EXPLOITED VULNERABILITY)"
      }
    },
    "indicator--00000000-00000006-0000-0000-0000-000000000000": {
      "type": "indicator",
      "id": "indicator--00000000-00000006-0000-0000-0000-000000000000",
      "created": "2026-09-09T12:15:23.892988Z",
      "modified": "2026-09-09T12:15:23.892988Z",
      "name": "CVE-2026-59822",
      "description": "BerriAI LiteLLM contains an improper authentication vulnerability in the MCP Streamable HTTP endpoint that could allow an unauthenticated attacker to establish an authenticated MCP session using an arbitrary Bearer token.",
      "indicator_types": [
        "CISA KEV (KNOWN EXPLOITED VULNERABILITY)",
        "malicious-activity"
      ],
      "pattern": "[x-oca-asset:id = 'CVE-2026-59822']",
      "pattern_type": "stix",
      "pattern_version": "2.0",
      "valid_from": "2026-09-09T12:15:23.892988Z",
      "confidence": "high",
      "labels": [
        "indicator",
        "cve",
        "kev",
        "cisa",
        "active-exploitation"
      ],
      "created_by_ref": "identity--00000000-0000-0000-0000-000000000001",
      "object_marking_refs": [
        "marking-definition--00000000-0000-0000-0000-000000000002"
      ],
      "x_custom": {
        "severity": "CRITICAL",
        "product": "LiteLLM (BerriAI)",
        "source": "CISA KEV Catalog",
        "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
        "date": "2026-09-02",
        "original_section": "CISA KEV (KNOWN EXPLOITED VULNERABILITY)"
      }
    },
    "indicator--00000000-00000007-0000-0000-0000-000000000000": {
      "type": "indicator",
      "id": "indicator--00000000-00000007-0000-0000-0000-000000000000",
      "created": "2026-09-09T12:15:23.892988Z",
      "modified": "2026-09-09T12:15:23.892988Z",
      "name": "CVE-2026-48710",
      "description": "Kludex Starlette contains a HTTP request/response smuggling vulnerability that could allow attackers to inject paths into the host part, prepending the actual path leading to issues such as authentication bypass when the authentication depends on the",
      "indicator_types": [
        "CISA KEV (KNOWN EXPLOITED VULNERABILITY)",
        "malicious-activity"
      ],
      "pattern": "[x-oca-asset:id = 'CVE-2026-48710']",
      "pattern_type": "stix",
      "pattern_version": "2.0",
      "valid_from": "2026-09-09T12:15:23.892988Z",
      "confidence": "high",
      "labels": [
        "indicator",
        "cve",
        "kev",
        "cisa",
        "active-exploitation"
      ],
      "created_by_ref": "identity--00000000-0000-0000-0000-000000000001",
      "object_marking_refs": [
        "marking-definition--00000000-0000-0000-0000-000000000002"
      ],
      "x_custom": {
        "severity": "CRITICAL",
        "product": "Starlette (Kludex)",
        "source": "CISA KEV Catalog",
        "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
        "date": "2026-09-02",
        "original_section": "CISA KEV (KNOWN EXPLOITED VULNERABILITY)"
      }
    },
    "indicator--00000000-00000008-0000-0000-0000-000000000000": {
      "type": "indicator",
      "id": "indicator--00000000-00000008-0000-0000-0000-000000000000",
      "created": "2026-09-09T12:15:23.892988Z",
      "modified": "2026-09-09T12:15:23.892988Z",
      "name": "CVE-2026-49869",
      "description": "Kestra OSS contains an OS command injection vulnerability that could allow an unauthenticated remote attacker to create and execute arbitrary workflows without credentials.",
      "indicator_types": [
        "CISA KEV (KNOWN EXPLOITED VULNERABILITY)",
        "malicious-activity"
      ],
      "pattern": "[x-oca-asset:id = 'CVE-2026-49869']",
      "pattern_type": "stix",
      "pattern_version": "2.0",
      "valid_from": "2026-09-09T12:15:23.892988Z",
      "confidence": "high",
      "labels": [
        "indicator",
        "cve",
        "kev",
        "cisa",
        "active-exploitation"
      ],
      "created_by_ref": "identity--00000000-0000-0000-0000-000000000001",
      "object_marking_refs": [
        "marking-definition--00000000-0000-0000-0000-000000000002"
      ],
      "x_custom": {
        "severity": "CRITICAL",
        "product": "Kestra OSS (Kestra)",
        "source": "CISA KEV Catalog",
        "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
        "date": "2026-09-02",
        "original_section": "CISA KEV (KNOWN EXPLOITED VULNERABILITY)"
      }
    },
    "indicator--00000000-00000009-0000-0000-0000-000000000000": {
      "type": "indicator",
      "id": "indicator--00000000-00000009-0000-0000-0000-000000000000",
      "created": "2026-09-09T12:15:23.892988Z",
      "modified": "2026-09-09T12:15:23.892988Z",
      "name": "CVE-2026-82329",
      "description": "JFrog Artifactory contains an improper authentication vulnerability that under default configuration can allow an unauthenticated attacker with network access to obtain administrative privileges.",
      "indicator_types": [
        "CISA KEV (KNOWN EXPLOITED VULNERABILITY)",
        "malicious-activity"
      ],
      "pattern": "[x-oca-asset:id = 'CVE-2026-82329']",
      "pattern_type": "stix",
      "pattern_version": "2.0",
      "valid_from": "2026-09-09T12:15:23.892988Z",
      "confidence": "high",
      "labels": [
        "indicator",
        "cve",
        "kev",
        "cisa",
        "active-exploitation"
      ],
      "created_by_ref": "identity--00000000-0000-0000-0000-000000000001",
      "object_marking_refs": [
        "marking-definition--00000000-0000-0000-0000-000000000002"
      ],
      "x_custom": {
        "severity": "CRITICAL",
        "product": "Artifactory (JFrog)",
        "source": "CISA KEV Catalog",
        "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
        "date": "2026-09-02",
        "original_section": "CISA KEV (KNOWN EXPLOITED VULNERABILITY)"
      }
    },
    "indicator--00000000-00000010-0000-0000-0000-000000000000": {
      "type": "indicator",
      "id": "indicator--00000000-00000010-0000-0000-0000-000000000000",
      "created": "2026-09-09T12:15:23.892988Z",
      "modified": "2026-09-09T12:15:23.892988Z",
      "name": "CVE-2026-9586",
      "description": "Sangoma Switchvox contains a SQL injection vulnerability which allows an unauthenticated remote attacker to execute arbitrary SQL statements against the backend PostgreSQL database using a single crafted request, including database operations and rem",
      "indicator_types": [
        "IP ADDRESS",
        "malicious-activity"
      ],
      "pattern": "[x-oca-asset:id = 'CVE-2026-9586']",
      "pattern_type": "stix",
      "pattern_version": "2.0",
      "valid_from": "2026-09-09T12:15:23.892988Z",
      "confidence": "high",
      "labels": [
        "indicator",
        "cve",
        "kev",
        "cisa",
        "active-exploitation"
      ],
      "created_by_ref": "identity--00000000-0000-0000-0000-000000000001",
      "object_marking_refs": [
        "marking-definition--00000000-0000-0000-0000-000000000002"
      ],
      "x_custom": {
        "severity": "CRITICAL",
        "product": "Switchvox (Sangoma)",
        "source": "CISA KEV Catalog",
        "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
        "date": "2026-09-02",
        "original_section": "IP ADDRESS"
      }
    },
    "indicator--00000000-00000011-0000-0000-0000-000000000000": {
      "type": "indicator",
      "id": "indicator--00000000-00000011-0000-0000-0000-000000000000",
      "created": "2026-09-09T12:15:23.892988Z",
      "modified": "2026-09-09T12:15:23.892988Z",
      "name": "127.0.0.1",
      "description": "C2/infrastructure in threat context: Alby Hub Critical Flaw Could Let Attackers Take Over Internet-Exposed Bitcoin Wa",
      "indicator_types": [
        "IP ADDRESS",
        "malicious-activity"
      ],
      "pattern": "[ipv4-addr:value = '127.0.0.1']",
      "pattern_type": "stix",
      "pattern_version": "2.0",
      "valid_from": "2026-09-09T12:15:23.892988Z",
      "confidence": "medium",
      "labels": [
        "indicator",
        "ipv4-addr",
        "ip",
        "infrastructure"
      ],
      "created_by_ref": "identity--00000000-0000-0000-0000-000000000001",
      "object_marking_refs": [
        "marking-definition--00000000-0000-0000-0000-000000000002"
      ],
      "x_custom": {
        "severity": "HIGH",
        "product": "",
        "source": "Article: Alby Hub Critical Flaw Could Let Attackers Take Over Internet-Exposed Bitcoin Wallets",
        "url": "https://thehackernews.com/2026/09/alby-hub-critical-flaw-could-let.html",
        "date": "",
        "original_section": "IP ADDRESS"
      }
    },
    "indicator--00000000-00000012-0000-0000-0000-000000000000": {
      "type": "indicator",
      "id": "indicator--00000000-00000012-0000-0000-0000-000000000000",
      "created": "2026-09-09T12:15:23.892988Z",
      "modified": "2026-09-09T12:15:23.892988Z",
      "name": "127.0.0.1",
      "description": "C2/infrastructure in threat context: Alby Hub Critical Flaw Could Let Attackers Take Over Internet-Exposed Bitcoin Wa",
      "indicator_types": [
        "IP ADDRESS",
        "malicious-activity"
      ],
      "pattern": "[ipv4-addr:value = '127.0.0.1']",
      "pattern_type": "stix",
      "pattern_version": "2.0",
      "valid_from": "2026-09-09T12:15:23.892988Z",
      "confidence": "medium",
      "labels": [
        "indicator",
        "ipv4-addr",
        "ip",
        "infrastructure"
      ],
      "created_by_ref": "identity--00000000-0000-0000-0000-000000000001",
      "object_marking_refs": [
        "marking-definition--00000000-0000-0000-0000-000000000002"
      ],
      "x_custom": {
        "severity": "HIGH",
        "product": "",
        "source": "Article: Alby Hub Critical Flaw Could Let Attackers Take Over Internet-Exposed Bitcoin Wallets",
        "url": "https://thehackernews.com/2026/09/alby-hub-critical-flaw-could-let.html",
        "date": "",
        "original_section": "IP ADDRESS"
      }
    },
    "indicator--00000000-00000013-0000-0000-0000-000000000000": {
      "type": "indicator",
      "id": "indicator--00000000-00000013-0000-0000-0000-000000000000",
      "created": "2026-09-09T12:15:23.892988Z",
      "modified": "2026-09-09T12:15:23.892988Z",
      "name": "127.0.0.1",
      "description": "C2/infrastructure in threat context: Alby Hub Critical Flaw Could Let Attackers Take Over Internet-Exposed Bitcoin Wa",
      "indicator_types": [
        "IP ADDRESS",
        "malicious-activity"
      ],
      "pattern": "[ipv4-addr:value = '127.0.0.1']",
      "pattern_type": "stix",
      "pattern_version": "2.0",
      "valid_from": "2026-09-09T12:15:23.892988Z",
      "confidence": "medium",
      "labels": [
        "indicator",
        "ipv4-addr",
        "ip",
        "infrastructure"
      ],
      "created_by_ref": "identity--00000000-0000-0000-0000-000000000001",
      "object_marking_refs": [
        "marking-definition--00000000-0000-0000-0000-000000000002"
      ],
      "x_custom": {
        "severity": "HIGH",
        "product": "",
        "source": "Article: Alby Hub Critical Flaw Could Let Attackers Take Over Internet-Exposed Bitcoin Wallets",
        "url": "https://thehackernews.com/2026/09/alby-hub-critical-flaw-could-let.html",
        "date": "",
        "original_section": "IP ADDRESS"
      }
    },
    "indicator--00000000-00000014-0000-0000-0000-000000000000": {
      "type": "indicator",
      "id": "indicator--00000000-00000014-0000-0000-0000-000000000000",
      "created": "2026-09-09T12:15:23.892988Z",
      "modified": "2026-09-09T12:15:23.892988Z",
      "name": "127.0.0.1",
      "description": "C2/infrastructure in threat context: Alby Hub Critical Flaw Could Let Attackers Take Over Internet-Exposed Bitcoin Wa",
      "indicator_types": [
        "IP ADDRESS",
        "malicious-activity"
      ],
      "pattern": "[ipv4-addr:value = '127.0.0.1']",
      "pattern_type": "stix",
      "pattern_version": "2.0",
      "valid_from": "2026-09-09T12:15:23.892988Z",
      "confidence": "medium",
      "labels": [
        "indicator",
        "ipv4-addr",
        "ip",
        "infrastructure"
      ],
      "created_by_ref": "identity--00000000-0000-0000-0000-000000000001",
      "object_marking_refs": [
        "marking-definition--00000000-0000-0000-0000-000000000002"
      ],
      "x_custom": {
        "severity": "HIGH",
        "product": "",
        "source": "Article: Alby Hub Critical Flaw Could Let Attackers Take Over Internet-Exposed Bitcoin Wallets",
        "url": "https://thehackernews.com/2026/09/alby-hub-critical-flaw-could-let.html",
        "date": "",
        "original_section": "IP ADDRESS"
      }
    },
    "indicator--00000000-00000015-0000-0000-0000-000000000000": {
      "type": "indicator",
      "id": "indicator--00000000-00000015-0000-0000-0000-000000000000",
      "created": "2026-09-09T12:15:23.892988Z",
      "modified": "2026-09-09T12:15:23.892988Z",
      "name": "12.10.0.0",
      "description": "C2/infrastructure in threat context: Ivanti Patches Critical Flaws Across Enterprise Security Products",
      "indicator_types": [
        "IP ADDRESS",
        "malicious-activity"
      ],
      "pattern": "[ipv4-addr:value = '12.10.0.0']",
      "pattern_type": "stix",
      "pattern_version": "2.0",
      "valid_from": "2026-09-09T12:15:23.892988Z",
      "confidence": "medium",
      "labels": [
        "indicator",
        "ipv4-addr",
        "ip",
        "infrastructure"
      ],
      "created_by_ref": "identity--00000000-0000-0000-0000-000000000001",
      "object_marking_refs": [
        "marking-definition--00000000-0000-0000-0000-000000000002"
      ],
      "x_custom": {
        "severity": "HIGH",
        "product": "",
        "source": "Article: Ivanti Patches Critical Flaws Across Enterprise Security Products",
        "url": "https://www.securityweek.com/ivanti-patches-critical-flaws-across-enterprise-security-products/",
        "date": "",
        "original_section": "IP ADDRESS"
      }
    },
    "indicator--00000000-00000016-0000-0000-0000-000000000000": {
      "type": "indicator",
      "id": "indicator--00000000-00000016-0000-0000-0000-000000000000",
      "created": "2026-09-09T12:15:23.892988Z",
      "modified": "2026-09-09T12:15:23.892988Z",
      "name": "12.9.0.2",
      "description": "C2/infrastructure in threat context: Ivanti Patches Critical Flaws Across Enterprise Security Products",
      "indicator_types": [
        "IP ADDRESS",
        "malicious-activity"
      ],
      "pattern": "[ipv4-addr:value = '12.9.0.2']",
      "pattern_type": "stix",
      "pattern_version": "2.0",
      "valid_from": "2026-09-09T12:15:23.892988Z",
      "confidence": "medium",
      "labels": [
        "indicator",
        "ipv4-addr",
        "ip",
        "infrastructure"
      ],
      "created_by_ref": "identity--00000000-0000-0000-0000-000000000001",
      "object_marking_refs": [
        "marking-definition--00000000-0000-0000-0000-000000000002"
      ],
      "x_custom": {
        "severity": "HIGH",
        "product": "",
        "source": "Article: Ivanti Patches Critical Flaws Across Enterprise Security Products",
        "url": "https://www.securityweek.com/ivanti-patches-critical-flaws-across-enterprise-security-products/",
        "date": "",
        "original_section": "IP ADDRESS"
      }
    },
    "indicator--00000000-00000017-0000-0000-0000-000000000000": {
      "type": "indicator",
      "id": "indicator--00000000-00000017-0000-0000-0000-000000000000",
      "created": "2026-09-09T12:15:23.892988Z",
      "modified": "2026-09-09T12:15:23.892988Z",
      "name": "12.8.0.4",
      "description": "C2/infrastructure in threat context: Ivanti Patches Critical Flaws Across Enterprise Security Products",
      "indicator_types": [
        "IP ADDRESS",
        "malicious-activity"
      ],
      "pattern": "[ipv4-addr:value = '12.8.0.4']",
      "pattern_type": "stix",
      "pattern_version": "2.0",
      "valid_from": "2026-09-09T12:15:23.892988Z",
      "confidence": "medium",
      "labels": [
        "indicator",
        "ipv4-addr",
        "ip",
        "infrastructure"
      ],
      "created_by_ref": "identity--00000000-0000-0000-0000-000000000001",
      "object_marking_refs": [
        "marking-definition--00000000-0000-0000-0000-000000000002"
      ],
      "x_custom": {
        "severity": "HIGH",
        "product": "",
        "source": "Article: Ivanti Patches Critical Flaws Across Enterprise Security Products",
        "url": "https://www.securityweek.com/ivanti-patches-critical-flaws-across-enterprise-security-products/",
        "date": "",
        "original_section": "IP ADDRESS"
      }
    },
    "indicator--00000000-00000018-0000-0000-0000-000000000000": {
      "type": "indicator",
      "id": "indicator--00000000-00000018-0000-0000-0000-000000000000",
      "created": "2026-09-09T12:15:23.892988Z",
      "modified": "2026-09-09T12:15:23.892988Z",
      "name": "12.10.0.0",
      "description": "C2/infrastructure in threat context: Ivanti Patches Critical Flaws Across Enterprise Security Products",
      "indicator_types": [
        "IP ADDRESS",
        "malicious-activity"
      ],
      "pattern": "[ipv4-addr:value = '12.10.0.0']",
      "pattern_type": "stix",
      "pattern_version": "2.0",
      "valid_from": "2026-09-09T12:15:23.892988Z",
      "confidence": "medium",
      "labels": [
        "indicator",
        "ipv4-addr",
        "ip",
        "infrastructure"
      ],
      "created_by_ref": "identity--00000000-0000-0000-0000-000000000001",
      "object_marking_refs": [
        "marking-definition--00000000-0000-0000-0000-000000000002"
      ],
      "x_custom": {
        "severity": "HIGH",
        "product": "",
        "source": "Article: Ivanti Patches Critical Flaws Across Enterprise Security Products",
        "url": "https://www.securityweek.com/ivanti-patches-critical-flaws-across-enterprise-security-products/",
        "date": "",
        "original_section": "IP ADDRESS"
      }
    },
    "indicator--00000000-00000019-0000-0000-0000-000000000000": {
      "type": "indicator",
      "id": "indicator--00000000-00000019-0000-0000-0000-000000000000",
      "created": "2026-09-09T12:15:23.892988Z",
      "modified": "2026-09-09T12:15:23.892988Z",
      "name": "12.9.0.2",
      "description": "C2/infrastructure in threat context: Ivanti Patches Critical Flaws Across Enterprise Security Products",
      "indicator_types": [
        "IP ADDRESS",
        "malicious-activity"
      ],
      "pattern": "[ipv4-addr:value = '12.9.0.2']",
      "pattern_type": "stix",
      "pattern_version": "2.0",
      "valid_from": "2026-09-09T12:15:23.892988Z",
      "confidence": "medium",
      "labels": [
        "indicator",
        "ipv4-addr",
        "ip",
        "infrastructure"
      ],
      "created_by_ref": "identity--00000000-0000-0000-0000-000000000001",
      "object_marking_refs": [
        "marking-definition--00000000-0000-0000-0000-000000000002"
      ],
      "x_custom": {
        "severity": "HIGH",
        "product": "",
        "source": "Article: Ivanti Patches Critical Flaws Across Enterprise Security Products",
        "url": "https://www.securityweek.com/ivanti-patches-critical-flaws-across-enterprise-security-products/",
        "date": "",
        "original_section": "IP ADDRESS"
      }
    },
    "indicator--00000000-00000020-0000-0000-0000-000000000000": {
      "type": "indicator",
      "id": "indicator--00000000-00000020-0000-0000-0000-000000000000",
      "created": "2026-09-09T12:15:23.892988Z",
      "modified": "2026-09-09T12:15:23.892988Z",
      "name": "12.8.0.4",
      "description": "C2/infrastructure in threat context: Ivanti Patches Critical Flaws Across Enterprise Security Products",
      "indicator_types": [
        "IP ADDRESS",
        "malicious-activity"
      ],
      "pattern": "[ipv4-addr:value = '12.8.0.4']",
      "pattern_type": "stix",
      "pattern_version": "2.0",
      "valid_from": "2026-09-09T12:15:23.892988Z",
      "confidence": "medium",
      "labels": [
        "indicator",
        "ipv4-addr",
        "ip",
        "infrastructure"
      ],
      "created_by_ref": "identity--00000000-0000-0000-0000-000000000001",
      "object_marking_refs": [
        "marking-definition--00000000-0000-0000-0000-000000000002"
      ],
      "x_custom": {
        "severity": "HIGH",
        "product": "",
        "source": "Article: Ivanti Patches Critical Flaws Across Enterprise Security Products",
        "url": "https://www.securityweek.com/ivanti-patches-critical-flaws-across-enterprise-security-products/",
        "date": "",
        "original_section": "IP ADDRESS"
      }
    },
    "indicator--00000000-00000021-0000-0000-0000-000000000000": {
      "type": "indicator",
      "id": "indicator--00000000-00000021-0000-0000-0000-000000000000",
      "created": "2026-09-09T12:15:23.892988Z",
      "modified": "2026-09-09T12:15:23.892988Z",
      "name": "12.10.0.0",
      "description": "C2/infrastructure in threat context: Ivanti Patches Critical Flaws Across Enterprise Security Products",
      "indicator_types": [
        "IP ADDRESS",
        "malicious-activity"
      ],
      "pattern": "[ipv4-addr:value = '12.10.0.0']",
      "pattern_type": "stix",
      "pattern_version": "2.0",
      "valid_from": "2026-09-09T12:15:23.892988Z",
      "confidence": "medium",
      "labels": [
        "indicator",
        "ipv4-addr",
        "ip",
        "infrastructure"
      ],
      "created_by_ref": "identity--00000000-0000-0000-0000-000000000001",
      "object_marking_refs": [
        "marking-definition--00000000-0000-0000-0000-000000000002"
      ],
      "x_custom": {
        "severity": "HIGH",
        "product": "",
        "source": "Article: Ivanti Patches Critical Flaws Across Enterprise Security Products",
        "url": "https://www.securityweek.com/ivanti-patches-critical-flaws-across-enterprise-security-products/",
        "date": "",
        "original_section": "IP ADDRESS"
      }
    },
    "indicator--00000000-00000022-0000-0000-0000-000000000000": {
      "type": "indicator",
      "id": "indicator--00000000-00000022-0000-0000-0000-000000000000",
      "created": "2026-09-09T12:15:23.892988Z",
      "modified": "2026-09-09T12:15:23.892988Z",
      "name": "12.9.0.2",
      "description": "C2/infrastructure in threat context: Ivanti Patches Critical Flaws Across Enterprise Security Products",
      "indicator_types": [
        "IP ADDRESS",
        "malicious-activity"
      ],
      "pattern": "[ipv4-addr:value = '12.9.0.2']",
      "pattern_type": "stix",
      "pattern_version": "2.0",
      "valid_from": "2026-09-09T12:15:23.892988Z",
      "confidence": "medium",
      "labels": [
        "indicator",
        "ipv4-addr",
        "ip",
        "infrastructure"
      ],
      "created_by_ref": "identity--00000000-0000-0000-0000-000000000001",
      "object_marking_refs": [
        "marking-definition--00000000-0000-0000-0000-000000000002"
      ],
      "x_custom": {
        "severity": "HIGH",
        "product": "",
        "source": "Article: Ivanti Patches Critical Flaws Across Enterprise Security Products",
        "url": "https://www.securityweek.com/ivanti-patches-critical-flaws-across-enterprise-security-products/",
        "date": "",
        "original_section": "IP ADDRESS"
      }
    },
    "indicator--00000000-00000023-0000-0000-0000-000000000000": {
      "type": "indicator",
      "id": "indicator--00000000-00000023-0000-0000-0000-000000000000",
      "created": "2026-09-09T12:15:23.892988Z",
      "modified": "2026-09-09T12:15:23.892988Z",
      "name": "12.8.0.4",
      "description": "C2/infrastructure in threat context: Ivanti Patches Critical Flaws Across Enterprise Security Products",
      "indicator_types": [
        "IP ADDRESS",
        "malicious-activity"
      ],
      "pattern": "[ipv4-addr:value = '12.8.0.4']",
      "pattern_type": "stix",
      "pattern_version": "2.0",
      "valid_from": "2026-09-09T12:15:23.892988Z",
      "confidence": "medium",
      "labels": [
        "indicator",
        "ipv4-addr",
        "ip",
        "infrastructure"
      ],
      "created_by_ref": "identity--00000000-0000-0000-0000-000000000001",
      "object_marking_refs": [
        "marking-definition--00000000-0000-0000-0000-000000000002"
      ],
      "x_custom": {
        "severity": "HIGH",
        "product": "",
        "source": "Article: Ivanti Patches Critical Flaws Across Enterprise Security Products",
        "url": "https://www.securityweek.com/ivanti-patches-critical-flaws-across-enterprise-security-products/",
        "date": "",
        "original_section": "IP ADDRESS"
      }
    },
    "indicator--00000000-00000024-0000-0000-0000-000000000000": {
      "type": "indicator",
      "id": "indicator--00000000-00000024-0000-0000-0000-000000000000",
      "created": "2026-09-09T12:15:23.892988Z",
      "modified": "2026-09-09T12:15:23.892988Z",
      "name": "12.10.0.0",
      "description": "C2/infrastructure in threat context: Ivanti Patches Critical Flaws Across Enterprise Security Products",
      "indicator_types": [
        "IP ADDRESS",
        "malicious-activity"
      ],
      "pattern": "[ipv4-addr:value = '12.10.0.0']",
      "pattern_type": "stix",
      "pattern_version": "2.0",
      "valid_from": "2026-09-09T12:15:23.892988Z",
      "confidence": "medium",
      "labels": [
        "indicator",
        "ipv4-addr",
        "ip",
        "infrastructure"
      ],
      "created_by_ref": "identity--00000000-0000-0000-0000-000000000001",
      "object_marking_refs": [
        "marking-definition--00000000-0000-0000-0000-000000000002"
      ],
      "x_custom": {
        "severity": "HIGH",
        "product": "",
        "source": "Article: Ivanti Patches Critical Flaws Across Enterprise Security Products",
        "url": "https://www.securityweek.com/ivanti-patches-critical-flaws-across-enterprise-security-products/",
        "date": "",
        "original_section": "IP ADDRESS"
      }
    },
    "indicator--00000000-00000025-0000-0000-0000-000000000000": {
      "type": "indicator",
      "id": "indicator--00000000-00000025-0000-0000-0000-000000000000",
      "created": "2026-09-09T12:15:23.892988Z",
      "modified": "2026-09-09T12:15:23.892988Z",
      "name": "12.9.0.2",
      "description": "C2/infrastructure in threat context: Ivanti Patches Critical Flaws Across Enterprise Security Products",
      "indicator_types": [
        "IP ADDRESS",
        "malicious-activity"
      ],
      "pattern": "[ipv4-addr:value = '12.9.0.2']",
      "pattern_type": "stix",
      "pattern_version": "2.0",
      "valid_from": "2026-09-09T12:15:23.892988Z",
      "confidence": "medium",
      "labels": [
        "indicator",
        "ipv4-addr",
        "ip",
        "infrastructure"
      ],
      "created_by_ref": "identity--00000000-0000-0000-0000-000000000001",
      "object_marking_refs": [
        "marking-definition--00000000-0000-0000-0000-000000000002"
      ],
      "x_custom": {
        "severity": "HIGH",
        "product": "",
        "source": "Article: Ivanti Patches Critical Flaws Across Enterprise Security Products",
        "url": "https://www.securityweek.com/ivanti-patches-critical-flaws-across-enterprise-security-products/",
        "date": "",
        "original_section": "IP ADDRESS"
      }
    },
    "indicator--00000000-00000026-0000-0000-0000-000000000000": {
      "type": "indicator",
      "id": "indicator--00000000-00000026-0000-0000-0000-000000000000",
      "created": "2026-09-09T12:15:23.892988Z",
      "modified": "2026-09-09T12:15:23.892988Z",
      "name": "12.8.0.4",
      "description": "C2/infrastructure in threat context: Ivanti Patches Critical Flaws Across Enterprise Security Products",
      "indicator_types": [
        "PHISHING URL",
        "malicious-activity"
      ],
      "pattern": "[ipv4-addr:value = '12.8.0.4']",
      "pattern_type": "stix",
      "pattern_version": "2.0",
      "valid_from": "2026-09-09T12:15:23.892988Z",
      "confidence": "medium",
      "labels": [
        "indicator",
        "ipv4-addr",
        "ip",
        "infrastructure"
      ],
      "created_by_ref": "identity--00000000-0000-0000-0000-000000000001",
      "object_marking_refs": [
        "marking-definition--00000000-0000-0000-0000-000000000002"
      ],
      "x_custom": {
        "severity": "HIGH",
        "product": "",
        "source": "Article: Ivanti Patches Critical Flaws Across Enterprise Security Products",
        "url": "https://www.securityweek.com/ivanti-patches-critical-flaws-across-enterprise-security-products/",
        "date": "",
        "original_section": "PHISHING URL"
      }
    },
    "indicator--00000000-00000027-0000-0000-0000-000000000000": {
      "type": "indicator",
      "id": "indicator--00000000-00000027-0000-0000-0000-000000000000",
      "created": "2026-09-09T12:15:23.892988Z",
      "modified": "2026-09-09T12:15:23.892988Z",
      "name": "https://www.facebooklogin21.blogspot.com/",
      "description": "Active phishing URL: https://www.facebooklogin21.blogspot.com/",
      "indicator_types": [
        "PHISHING URL",
        "malicious-activity"
      ],
      "pattern": "[indicator:pattern = 'https://www.facebooklogin21.blogspot.com/']",
      "pattern_type": "stix",
      "pattern_version": "2.0",
      "valid_from": "2026-09-09T12:15:23.892988Z",
      "confidence": "high",
      "labels": [
        "indicator",
        "other",
        "phishing",
        "openphish"
      ],
      "created_by_ref": "identity--00000000-0000-0000-0000-000000000001",
      "object_marking_refs": [
        "marking-definition--00000000-0000-0000-0000-000000000002"
      ],
      "x_custom": {
        "severity": "CRITICAL",
        "product": "",
        "source": "OpenPhish",
        "url": "https://www.facebooklogin21.blogspot.com/",
        "date": "",
        "original_section": "PHISHING URL"
      }
    },
    "indicator--00000000-00000028-0000-0000-0000-000000000000": {
      "type": "indicator",
      "id": "indicator--00000000-00000028-0000-0000-0000-000000000000",
      "created": "2026-09-09T12:15:23.892988Z",
      "modified": "2026-09-09T12:15:23.892988Z",
      "name": "https://ledgrr-live-io-faq.pages.dev/",
      "description": "Active phishing URL: https://ledgrr-live-io-faq.pages.dev/",
      "indicator_types": [
        "PHISHING URL",
        "malicious-activity"
      ],
      "pattern": "[indicator:pattern = 'https://ledgrr-live-io-faq.pages.dev/']",
      "pattern_type": "stix",
      "pattern_version": "2.0",
      "valid_from": "2026-09-09T12:15:23.892988Z",
      "confidence": "high",
      "labels": [
        "indicator",
        "other",
        "phishing",
        "openphish"
      ],
      "created_by_ref": "identity--00000000-0000-0000-0000-000000000001",
      "object_marking_refs": [
        "marking-definition--00000000-0000-0000-0000-000000000002"
      ],
      "x_custom": {
        "severity": "CRITICAL",
        "product": "",
        "source": "OpenPhish",
        "url": "https://ledgrr-live-io-faq.pages.dev/",
        "date": "",
        "original_section": "PHISHING URL"
      }
    },
    "indicator--00000000-00000029-0000-0000-0000-000000000000": {
      "type": "indicator",
      "id": "indicator--00000000-00000029-0000-0000-0000-000000000000",
      "created": "2026-09-09T12:15:23.892988Z",
      "modified": "2026-09-09T12:15:23.892988Z",
      "name": "http://ledgrr--live.pages.dev/",
      "description": "Active phishing URL: http://ledgrr--live.pages.dev/",
      "indicator_types": [
        "PHISHING URL",
        "malicious-activity"
      ],
      "pattern": "[indicator:pattern = 'http://ledgrr--live.pages.dev/']",
      "pattern_type": "stix",
      "pattern_version": "2.0",
      "valid_from": "2026-09-09T12:15:23.892988Z",
      "confidence": "high",
      "labels": [
        "indicator",
        "other",
        "phishing",
        "openphish"
      ],
      "created_by_ref": "identity--00000000-0000-0000-0000-000000000001",
      "object_marking_refs": [
        "marking-definition--00000000-0000-0000-0000-000000000002"
      ],
      "x_custom": {
        "severity": "CRITICAL",
        "product": "",
        "source": "OpenPhish",
        "url": "http://ledgrr--live.pages.dev/",
        "date": "",
        "original_section": "PHISHING URL"
      }
    },
    "indicator--00000000-00000030-0000-0000-0000-000000000000": {
      "type": "indicator",
      "id": "indicator--00000000-00000030-0000-0000-0000-000000000000",
      "created": "2026-09-09T12:15:23.892988Z",
      "modified": "2026-09-09T12:15:23.892988Z",
      "name": "http://ledgrr-livv-app.pages.dev/",
      "description": "Active phishing URL: http://ledgrr-livv-app.pages.dev/",
      "indicator_types": [
        "PHISHING URL",
        "malicious-activity"
      ],
      "pattern": "[indicator:pattern = 'http://ledgrr-livv-app.pages.dev/']",
      "pattern_type": "stix",
      "pattern_version": "2.0",
      "valid_from": "2026-09-09T12:15:23.892988Z",
      "confidence": "high",
      "labels": [
        "indicator",
        "other",
        "phishing",
        "openphish"
      ],
      "created_by_ref": "identity--00000000-0000-0000-0000-000000000001",
      "object_marking_refs": [
        "marking-definition--00000000-0000-0000-0000-000000000002"
      ],
      "x_custom": {
        "severity": "CRITICAL",
        "product": "",
        "source": "OpenPhish",
        "url": "http://ledgrr-livv-app.pages.dev/",
        "date": "",
        "original_section": "PHISHING URL"
      }
    },
    "indicator--00000000-00000031-0000-0000-0000-000000000000": {
      "type": "indicator",
      "id": "indicator--00000000-00000031-0000-0000-0000-000000000000",
      "created": "2026-09-09T12:15:23.892988Z",
      "modified": "2026-09-09T12:15:23.892988Z",
      "name": "https://ledgrr-iolive.pages.dev/",
      "description": "Active phishing URL: https://ledgrr-iolive.pages.dev/",
      "indicator_types": [
        "PHISHING URL",
        "malicious-activity"
      ],
      "pattern": "[indicator:pattern = 'https://ledgrr-iolive.pages.dev/']",
      "pattern_type": "stix",
      "pattern_version": "2.0",
      "valid_from": "2026-09-09T12:15:23.892988Z",
      "confidence": "high",
      "labels": [
        "indicator",
        "other",
        "phishing",
        "openphish"
      ],
      "created_by_ref": "identity--00000000-0000-0000-0000-000000000001",
      "object_marking_refs": [
        "marking-definition--00000000-0000-0000-0000-000000000002"
      ],
      "x_custom": {
        "severity": "CRITICAL",
        "product": "",
        "source": "OpenPhish",
        "url": "https://ledgrr-iolive.pages.dev/",
        "date": "",
        "original_section": "PHISHING URL"
      }
    },
    "indicator--00000000-00000032-0000-0000-0000-000000000000": {
      "type": "indicator",
      "id": "indicator--00000000-00000032-0000-0000-0000-000000000000",
      "created": "2026-09-09T12:15:23.892988Z",
      "modified": "2026-09-09T12:15:23.892988Z",
      "name": "https://ledgrlive-app-guide.pages.dev/",
      "description": "Active phishing URL: https://ledgrlive-app-guide.pages.dev/",
      "indicator_types": [
        "PHISHING URL",
        "malicious-activity"
      ],
      "pattern": "[indicator:pattern = 'https://ledgrlive-app-guide.pages.dev/']",
      "pattern_type": "stix",
      "pattern_version": "2.0",
      "valid_from": "2026-09-09T12:15:23.892988Z",
      "confidence": "high",
      "labels": [
        "indicator",
        "other",
        "phishing",
        "openphish"
      ],
      "created_by_ref": "identity--00000000-0000-0000-0000-000000000001",
      "object_marking_refs": [
        "marking-definition--00000000-0000-0000-0000-000000000002"
      ],
      "x_custom": {
        "severity": "CRITICAL",
        "product": "",
        "source": "OpenPhish",
        "url": "https://ledgrlive-app-guide.pages.dev/",
        "date": "",
        "original_section": "PHISHING URL"
      }
    },
    "indicator--00000000-00000033-0000-0000-0000-000000000000": {
      "type": "indicator",
      "id": "indicator--00000000-00000033-0000-0000-0000-000000000000",
      "created": "2026-09-09T12:15:23.892988Z",
      "modified": "2026-09-09T12:15:23.892988Z",
      "name": "http://ledgrr-live-run.pages.dev/",
      "description": "Active phishing URL: http://ledgrr-live-run.pages.dev/",
      "indicator_types": [
        "PHISHING URL",
        "malicious-activity"
      ],
      "pattern": "[indicator:pattern = 'http://ledgrr-live-run.pages.dev/']",
      "pattern_type": "stix",
      "pattern_version": "2.0",
      "valid_from": "2026-09-09T12:15:23.892988Z",
      "confidence": "high",
      "labels": [
        "indicator",
        "other",
        "phishing",
        "openphish"
      ],
      "created_by_ref": "identity--00000000-0000-0000-0000-000000000001",
      "object_marking_refs": [
        "marking-definition--00000000-0000-0000-0000-000000000002"
      ],
      "x_custom": {
        "severity": "CRITICAL",
        "product": "",
        "source": "OpenPhish",
        "url": "http://ledgrr-live-run.pages.dev/",
        "date": "",
        "original_section": "PHISHING URL"
      }
    },
    "indicator--00000000-00000034-0000-0000-0000-000000000000": {
      "type": "indicator",
      "id": "indicator--00000000-00000034-0000-0000-0000-000000000000",
      "created": "2026-09-09T12:15:23.892988Z",
      "modified": "2026-09-09T12:15:23.892988Z",
      "name": "http://ledgr-livdesktp.pages.dev/",
      "description": "Active phishing URL: http://ledgr-livdesktp.pages.dev/",
      "indicator_types": [
        "PHISHING URL",
        "malicious-activity"
      ],
      "pattern": "[indicator:pattern = 'http://ledgr-livdesktp.pages.dev/']",
      "pattern_type": "stix",
      "pattern_version": "2.0",
      "valid_from": "2026-09-09T12:15:23.892988Z",
      "confidence": "high",
      "labels": [
        "indicator",
        "other",
        "phishing",
        "openphish"
      ],
      "created_by_ref": "identity--00000000-0000-0000-0000-000000000001",
      "object_marking_refs": [
        "marking-definition--00000000-0000-0000-0000-000000000002"
      ],
      "x_custom": {
        "severity": "CRITICAL",
        "product": "",
        "source": "OpenPhish",
        "url": "http://ledgr-livdesktp.pages.dev/",
        "date": "",
        "original_section": "PHISHING URL"
      }
    },
    "indicator--00000000-00000035-0000-0000-0000-000000000000": {
      "type": "indicator",
      "id": "indicator--00000000-00000035-0000-0000-0000-000000000000",
      "created": "2026-09-09T12:15:23.892988Z",
      "modified": "2026-09-09T12:15:23.892988Z",
      "name": "https://sso-uphold--en-cdn.webflow.io/",
      "description": "Active phishing URL: https://sso-uphold--en-cdn.webflow.io/",
      "indicator_types": [
        "DOMAIN",
        "malicious-activity"
      ],
      "pattern": "[indicator:pattern = 'https://sso-uphold--en-cdn.webflow.io/']",
      "pattern_type": "stix",
      "pattern_version": "2.0",
      "valid_from": "2026-09-09T12:15:23.892988Z",
      "confidence": "high",
      "labels": [
        "indicator",
        "other",
        "phishing",
        "openphish"
      ],
      "created_by_ref": "identity--00000000-0000-0000-0000-000000000001",
      "object_marking_refs": [
        "marking-definition--00000000-0000-0000-0000-000000000002"
      ],
      "x_custom": {
        "severity": "CRITICAL",
        "product": "",
        "source": "OpenPhish",
        "url": "https://sso-uphold--en-cdn.webflow.io/",
        "date": "",
        "original_section": "DOMAIN"
      }
    },
    "indicator--00000000-00000036-0000-0000-0000-000000000000": {
      "type": "indicator",
      "id": "indicator--00000000-00000036-0000-0000-0000-000000000000",
      "created": "2026-09-09T12:15:23.892988Z",
      "modified": "2026-09-09T12:15:23.892988Z",
      "name": "facebooklogin21.blogspot",
      "description": "Phishing domain: facebooklogin21.blogspot",
      "indicator_types": [
        "DOMAIN",
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'facebooklogin21.blogspot']",
      "pattern_type": "stix",
      "pattern_version": "2.0",
      "valid_from": "2026-09-09T12:15:23.892988Z",
      "confidence": "high",
      "labels": [
        "indicator",
        "domain-name",
        "phishing",
        "openphish",
        "domain"
      ],
      "created_by_ref": "identity--00000000-0000-0000-0000-000000000001",
      "object_marking_refs": [
        "marking-definition--00000000-0000-0000-0000-000000000002"
      ],
      "x_custom": {
        "severity": "CRITICAL",
        "product": "",
        "source": "OpenPhish",
        "url": "https://www.facebooklogin21.blogspot.com/",
        "date": "",
        "original_section": "DOMAIN"
      }
    },
    "indicator--00000000-00000037-0000-0000-0000-000000000000": {
      "type": "indicator",
      "id": "indicator--00000000-00000037-0000-0000-0000-000000000000",
      "created": "2026-09-09T12:15:23.892988Z",
      "modified": "2026-09-09T12:15:23.892988Z",
      "name": "ledgrr-live-io-faq.pages",
      "description": "Phishing domain: ledgrr-live-io-faq.pages",
      "indicator_types": [
        "DOMAIN",
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'ledgrr-live-io-faq.pages']",
      "pattern_type": "stix",
      "pattern_version": "2.0",
      "valid_from": "2026-09-09T12:15:23.892988Z",
      "confidence": "high",
      "labels": [
        "indicator",
        "domain-name",
        "phishing",
        "openphish",
        "domain"
      ],
      "created_by_ref": "identity--00000000-0000-0000-0000-000000000001",
      "object_marking_refs": [
        "marking-definition--00000000-0000-0000-0000-000000000002"
      ],
      "x_custom": {
        "severity": "CRITICAL",
        "product": "",
        "source": "OpenPhish",
        "url": "https://ledgrr-live-io-faq.pages.dev/",
        "date": "",
        "original_section": "DOMAIN"
      }
    },
    "indicator--00000000-00000038-0000-0000-0000-000000000000": {
      "type": "indicator",
      "id": "indicator--00000000-00000038-0000-0000-0000-000000000000",
      "created": "2026-09-09T12:15:23.892988Z",
      "modified": "2026-09-09T12:15:23.892988Z",
      "name": "ledgrr--live.pages",
      "description": "Phishing domain: ledgrr--live.pages",
      "indicator_types": [
        "DOMAIN",
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'ledgrr--live.pages']",
      "pattern_type": "stix",
      "pattern_version": "2.0",
      "valid_from": "2026-09-09T12:15:23.892988Z",
      "confidence": "high",
      "labels": [
        "indicator",
        "domain-name",
        "phishing",
        "openphish",
        "domain"
      ],
      "created_by_ref": "identity--00000000-0000-0000-0000-000000000001",
      "object_marking_refs": [
        "marking-definition--00000000-0000-0000-0000-000000000002"
      ],
      "x_custom": {
        "severity": "CRITICAL",
        "product": "",
        "source": "OpenPhish",
        "url": "http://ledgrr--live.pages.dev/",
        "date": "",
        "original_section": "DOMAIN"
      }
    },
    "indicator--00000000-00000039-0000-0000-0000-000000000000": {
      "type": "indicator",
      "id": "indicator--00000000-00000039-0000-0000-0000-000000000000",
      "created": "2026-09-09T12:15:23.892988Z",
      "modified": "2026-09-09T12:15:23.892988Z",
      "name": "ledgrr-livv-app.pages",
      "description": "Phishing domain: ledgrr-livv-app.pages",
      "indicator_types": [
        "DOMAIN",
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'ledgrr-livv-app.pages']",
      "pattern_type": "stix",
      "pattern_version": "2.0",
      "valid_from": "2026-09-09T12:15:23.892988Z",
      "confidence": "high",
      "labels": [
        "indicator",
        "domain-name",
        "phishing",
        "openphish",
        "domain"
      ],
      "created_by_ref": "identity--00000000-0000-0000-0000-000000000001",
      "object_marking_refs": [
        "marking-definition--00000000-0000-0000-0000-000000000002"
      ],
      "x_custom": {
        "severity": "CRITICAL",
        "product": "",
        "source": "OpenPhish",
        "url": "http://ledgrr-livv-app.pages.dev/",
        "date": "",
        "original_section": "DOMAIN"
      }
    },
    "indicator--00000000-00000040-0000-0000-0000-000000000000": {
      "type": "indicator",
      "id": "indicator--00000000-00000040-0000-0000-0000-000000000000",
      "created": "2026-09-09T12:15:23.892988Z",
      "modified": "2026-09-09T12:15:23.892988Z",
      "name": "ledgrr-iolive.pages",
      "description": "Phishing domain: ledgrr-iolive.pages",
      "indicator_types": [
        "DOMAIN",
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'ledgrr-iolive.pages']",
      "pattern_type": "stix",
      "pattern_version": "2.0",
      "valid_from": "2026-09-09T12:15:23.892988Z",
      "confidence": "high",
      "labels": [
        "indicator",
        "domain-name",
        "phishing",
        "openphish",
        "domain"
      ],
      "created_by_ref": "identity--00000000-0000-0000-0000-000000000001",
      "object_marking_refs": [
        "marking-definition--00000000-0000-0000-0000-000000000002"
      ],
      "x_custom": {
        "severity": "CRITICAL",
        "product": "",
        "source": "OpenPhish",
        "url": "https://ledgrr-iolive.pages.dev/",
        "date": "",
        "original_section": "DOMAIN"
      }
    },
    "indicator--00000000-00000041-0000-0000-0000-000000000000": {
      "type": "indicator",
      "id": "indicator--00000000-00000041-0000-0000-0000-000000000000",
      "created": "2026-09-09T12:15:23.892988Z",
      "modified": "2026-09-09T12:15:23.892988Z",
      "name": "ledgrlive-app-guide.pages",
      "description": "Phishing domain: ledgrlive-app-guide.pages",
      "indicator_types": [
        "DOMAIN",
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'ledgrlive-app-guide.pages']",
      "pattern_type": "stix",
      "pattern_version": "2.0",
      "valid_from": "2026-09-09T12:15:23.892988Z",
      "confidence": "high",
      "labels": [
        "indicator",
        "domain-name",
        "phishing",
        "openphish",
        "domain"
      ],
      "created_by_ref": "identity--00000000-0000-0000-0000-000000000001",
      "object_marking_refs": [
        "marking-definition--00000000-0000-0000-0000-000000000002"
      ],
      "x_custom": {
        "severity": "CRITICAL",
        "product": "",
        "source": "OpenPhish",
        "url": "https://ledgrlive-app-guide.pages.dev/",
        "date": "",
        "original_section": "DOMAIN"
      }
    },
    "indicator--00000000-00000042-0000-0000-0000-000000000000": {
      "type": "indicator",
      "id": "indicator--00000000-00000042-0000-0000-0000-000000000000",
      "created": "2026-09-09T12:15:23.892988Z",
      "modified": "2026-09-09T12:15:23.892988Z",
      "name": "ledgrr-live-run.pages",
      "description": "Phishing domain: ledgrr-live-run.pages",
      "indicator_types": [
        "DOMAIN",
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'ledgrr-live-run.pages']",
      "pattern_type": "stix",
      "pattern_version": "2.0",
      "valid_from": "2026-09-09T12:15:23.892988Z",
      "confidence": "high",
      "labels": [
        "indicator",
        "domain-name",
        "phishing",
        "openphish",
        "domain"
      ],
      "created_by_ref": "identity--00000000-0000-0000-0000-000000000001",
      "object_marking_refs": [
        "marking-definition--00000000-0000-0000-0000-000000000002"
      ],
      "x_custom": {
        "severity": "CRITICAL",
        "product": "",
        "source": "OpenPhish",
        "url": "http://ledgrr-live-run.pages.dev/",
        "date": "",
        "original_section": "DOMAIN"
      }
    },
    "indicator--00000000-00000043-0000-0000-0000-000000000000": {
      "type": "indicator",
      "id": "indicator--00000000-00000043-0000-0000-0000-000000000000",
      "created": "2026-09-09T12:15:23.892988Z",
      "modified": "2026-09-09T12:15:23.892988Z",
      "name": "ledgr-livdesktp.pages",
      "description": "Phishing domain: ledgr-livdesktp.pages",
      "indicator_types": [
        "DOMAIN",
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'ledgr-livdesktp.pages']",
      "pattern_type": "stix",
      "pattern_version": "2.0",
      "valid_from": "2026-09-09T12:15:23.892988Z",
      "confidence": "high",
      "labels": [
        "indicator",
        "domain-name",
        "phishing",
        "openphish",
        "domain"
      ],
      "created_by_ref": "identity--00000000-0000-0000-0000-000000000001",
      "object_marking_refs": [
        "marking-definition--00000000-0000-0000-0000-000000000002"
      ],
      "x_custom": {
        "severity": "CRITICAL",
        "product": "",
        "source": "OpenPhish",
        "url": "http://ledgr-livdesktp.pages.dev/",
        "date": "",
        "original_section": "DOMAIN"
      }
    },
    "indicator--00000000-00000044-0000-0000-0000-000000000000": {
      "type": "indicator",
      "id": "indicator--00000000-00000044-0000-0000-0000-000000000000",
      "created": "2026-09-09T12:15:23.892988Z",
      "modified": "2026-09-09T12:15:23.892988Z",
      "name": "sso-uphold--en-cdn.webflow",
      "description": "Phishing domain: sso-uphold--en-cdn.webflow",
      "indicator_types": [
        "DOMAIN",
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'sso-uphold--en-cdn.webflow']",
      "pattern_type": "stix",
      "pattern_version": "2.0",
      "valid_from": "2026-09-09T12:15:23.892988Z",
      "confidence": "high",
      "labels": [
        "indicator",
        "domain-name",
        "phishing",
        "openphish",
        "domain"
      ],
      "created_by_ref": "identity--00000000-0000-0000-0000-000000000001",
      "object_marking_refs": [
        "marking-definition--00000000-0000-0000-0000-000000000002"
      ],
      "x_custom": {
        "severity": "CRITICAL",
        "product": "",
        "source": "OpenPhish",
        "url": "https://sso-uphold--en-cdn.webflow.io/",
        "date": "",
        "original_section": "DOMAIN"
      }
    }
  }
}