{ "type": "report", "id": "report--00000000-0000-0000-0000-000000000000", "created_by_ref": "identity--00000000-0000-0000-0000-000000000001", "created": "2026-11-10T12:15:57.614363Z", "modified": "2026-11-10T12:15:57.614363Z", "name": "Cyber Daily Brief IOC Report - 2026-11-10 12:15 UTC", "description": "Indicators of Compromise extracted from daily cyber briefing.\nReport ID: IOC-20261110-121557\nClassification: OPEN - Law Enforcement / DFIR use\nSources: CISA KEV Catalog, OpenPhish", "object_marking_refs": [ "marking-definition--00000000-0000-0000-0000-000000000002" ], "objects": { "identity--00000000-0000-0000-0000-000000000001": { "type": "identity", "name": "Cyber Daily Brief", "identity_class": "organization" }, "marking-definition--00000000-0000-0000-0000-000000000002": { "type": "marking-definition", "definition_type": "statement", "definition": { "statement": "OPEN - Law Enforcement / DFIR use" } }, "indicator--00000000-00000001-0000-0000-0000-000000000000": { "type": "indicator", "id": "indicator--00000000-00000001-0000-0000-0000-000000000000", "created": "2026-11-10T12:15:57.614363Z", "modified": "2026-11-10T12:15:57.614363Z", "name": "CVE-2026-102895", "description": "GPUStack contains an improper authentication vulnerability which could allow unauthenticated administrative access, including user and model changes, persistent administrator API-key creation, disclosure of worker and cloud-provider secrets, and code", "indicator_types": [ "CISA KEV (KNOWN EXPLOITED VULNERABILITY)", "malicious-activity" ], "pattern": "[x-oca-asset:id = 'CVE-2026-102895']", "pattern_type": "stix", "pattern_version": "2.0", "valid_from": "2026-11-10T12:15:57.614363Z", "confidence": "high", "labels": [ "indicator", "cve", "kev", "cisa", "active-exploitation" ], "created_by_ref": "identity--00000000-0000-0000-0000-000000000001", "object_marking_refs": [ "marking-definition--00000000-0000-0000-0000-000000000002" ], "x_custom": { "severity": "CRITICAL", "product": "GPUStack (GPUStack)", "source": "CISA KEV Catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "date": "2026-11-09", "original_section": "CISA KEV (KNOWN EXPLOITED VULNERABILITY)" } }, "indicator--00000000-00000002-0000-0000-0000-000000000000": { "type": "indicator", "id": "indicator--00000000-00000002-0000-0000-0000-000000000000", "created": "2026-11-10T12:15:57.614363Z", "modified": "2026-11-10T12:15:57.614363Z", "name": "CVE-2026-123158", "description": "OpenBSD OpenSSH on Linux contains an unexpected status code or return value vulnerability that could allow for authentication bypass.", "indicator_types": [ "CISA KEV (KNOWN EXPLOITED VULNERABILITY)", "malicious-activity" ], "pattern": "[x-oca-asset:id = 'CVE-2026-123158']", "pattern_type": "stix", "pattern_version": "2.0", "valid_from": "2026-11-10T12:15:57.614363Z", "confidence": "high", "labels": [ "indicator", "cve", "kev", "cisa", "active-exploitation" ], "created_by_ref": "identity--00000000-0000-0000-0000-000000000001", "object_marking_refs": [ "marking-definition--00000000-0000-0000-0000-000000000002" ], "x_custom": { "severity": "CRITICAL", "product": "OpenSSH (OpenBSD)", "source": "CISA KEV Catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "date": "2026-11-09", "original_section": "CISA KEV (KNOWN EXPLOITED VULNERABILITY)" } }, "indicator--00000000-00000003-0000-0000-0000-000000000000": { "type": "indicator", "id": "indicator--00000000-00000003-0000-0000-0000-000000000000", "created": "2026-11-10T12:15:57.614363Z", "modified": "2026-11-10T12:15:57.614363Z", "name": "CVE-2026-116779", "description": "SignalWire FreeSwitch contains a code injection vulnerability that permits configuration and credential disclosure, arbitrary call control, and command execution.", "indicator_types": [ "CISA KEV (KNOWN EXPLOITED VULNERABILITY)", "malicious-activity" ], "pattern": "[x-oca-asset:id = 'CVE-2026-116779']", "pattern_type": "stix", "pattern_version": "2.0", "valid_from": "2026-11-10T12:15:57.614363Z", "confidence": "high", "labels": [ "indicator", "cve", "kev", "cisa", "active-exploitation" ], "created_by_ref": "identity--00000000-0000-0000-0000-000000000001", "object_marking_refs": [ "marking-definition--00000000-0000-0000-0000-000000000002" ], "x_custom": { "severity": "CRITICAL", "product": "FreeSwitch (SignalWire)", "source": "CISA KEV Catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "date": "2026-11-09", "original_section": "CISA KEV (KNOWN EXPLOITED VULNERABILITY)" } }, "indicator--00000000-00000004-0000-0000-0000-000000000000": { "type": "indicator", "id": "indicator--00000000-00000004-0000-0000-0000-000000000000", "created": "2026-11-10T12:15:57.614363Z", "modified": "2026-11-10T12:15:57.614363Z", "name": "CVE-2026-123218", "description": "IBM Aspera Faspex contains an incorrect authorization vulnerability that could allow an authenticated user to craft a specific message to bypass authorization, causing privilege escalations.", "indicator_types": [ "CISA KEV (KNOWN EXPLOITED VULNERABILITY)", "malicious-activity" ], "pattern": "[x-oca-asset:id = 'CVE-2026-123218']", "pattern_type": "stix", "pattern_version": "2.0", "valid_from": "2026-11-10T12:15:57.614363Z", "confidence": "high", "labels": [ "indicator", "cve", "kev", "cisa", "active-exploitation" ], "created_by_ref": "identity--00000000-0000-0000-0000-000000000001", "object_marking_refs": [ "marking-definition--00000000-0000-0000-0000-000000000002" ], "x_custom": { "severity": "CRITICAL", "product": "Aspera Faspex (IBM)", "source": "CISA KEV Catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "date": "2026-11-09", "original_section": "CISA KEV (KNOWN EXPLOITED VULNERABILITY)" } }, "indicator--00000000-00000005-0000-0000-0000-000000000000": { "type": "indicator", "id": "indicator--00000000-00000005-0000-0000-0000-000000000000", "created": "2026-11-10T12:15:57.614363Z", "modified": "2026-11-10T12:15:57.614363Z", "name": "CVE-2026-19868", "description": "SonicWall SonicOS SSLVPN contains a use of single-factor authentication vulnerability that may allow a user with valid credentials for an alternate authentication method to bypass SAML authentication controls. Successful exploitation may also bypass", "indicator_types": [ "CISA KEV (KNOWN EXPLOITED VULNERABILITY)", "malicious-activity" ], "pattern": "[x-oca-asset:id = 'CVE-2026-19868']", "pattern_type": "stix", "pattern_version": "2.0", "valid_from": "2026-11-10T12:15:57.614363Z", "confidence": "high", "labels": [ "indicator", "cve", "kev", "cisa", "active-exploitation" ], "created_by_ref": "identity--00000000-0000-0000-0000-000000000001", "object_marking_refs": [ "marking-definition--00000000-0000-0000-0000-000000000002" ], "x_custom": { "severity": "CRITICAL", "product": "SonicOS SSLVPN (SonicWall)", "source": "CISA KEV Catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "date": "2026-11-06", "original_section": "CISA KEV (KNOWN EXPLOITED VULNERABILITY)" } }, "indicator--00000000-00000006-0000-0000-0000-000000000000": { "type": "indicator", "id": "indicator--00000000-00000006-0000-0000-0000-000000000000", "created": "2026-11-10T12:15:57.614363Z", "modified": "2026-11-10T12:15:57.614363Z", "name": "CVE-2024-27834", "description": "Apple iOS, iPadOS, macOS, Safari, tvOS and watchOS 10.5 contain an improper authentication vulnerability which could allow an attacker with arbitrary read and write capability to bypass pointer authentication.", "indicator_types": [ "CISA KEV (KNOWN EXPLOITED VULNERABILITY)", "malicious-activity" ], "pattern": "[x-oca-asset:id = 'CVE-2024-27834']", "pattern_type": "stix", "pattern_version": "2.0", "valid_from": "2026-11-10T12:15:57.614363Z", "confidence": "high", "labels": [ "indicator", "cve", "kev", "cisa", "active-exploitation" ], "created_by_ref": "identity--00000000-0000-0000-0000-000000000001", "object_marking_refs": [ "marking-definition--00000000-0000-0000-0000-000000000002" ], "x_custom": { "severity": "CRITICAL", "product": "Multiple Products (Apple)", "source": "CISA KEV Catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "date": "2026-11-04", "original_section": "CISA KEV (KNOWN EXPLOITED VULNERABILITY)" } }, "indicator--00000000-00000007-0000-0000-0000-000000000000": { "type": "indicator", "id": "indicator--00000000-00000007-0000-0000-0000-000000000000", "created": "2026-11-10T12:15:57.614363Z", "modified": "2026-11-10T12:15:57.614363Z", "name": "CVE-2026-119977", "description": "WordPress WordPress Core contains a time-of-check time-of-use (TOCTOU) race condition vulnerability that could allow unauthenticated attackers to execute code on the server during the upgrade window. This is due to predictable, web-accessible staging", "indicator_types": [ "CISA KEV (KNOWN EXPLOITED VULNERABILITY)", "malicious-activity" ], "pattern": "[x-oca-asset:id = 'CVE-2026-119977']", "pattern_type": "stix", "pattern_version": "2.0", "valid_from": "2026-11-10T12:15:57.614363Z", "confidence": "high", "labels": [ "indicator", "cve", "kev", "cisa", "active-exploitation" ], "created_by_ref": "identity--00000000-0000-0000-0000-000000000001", "object_marking_refs": [ "marking-definition--00000000-0000-0000-0000-000000000002" ], "x_custom": { "severity": "CRITICAL", "product": "WordPress Core (WordPress)", "source": "CISA KEV Catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "date": "2026-11-03", "original_section": "CISA KEV (KNOWN EXPLOITED VULNERABILITY)" } }, "indicator--00000000-00000008-0000-0000-0000-000000000000": { "type": "indicator", "id": "indicator--00000000-00000008-0000-0000-0000-000000000000", "created": "2026-11-10T12:15:57.614363Z", "modified": "2026-11-10T12:15:57.614363Z", "name": "CVE-2026-118527", "description": "Ivanti Connect Secure contains a generation of predictable numbers or identifiers vulnerability that allows a remote authenticated attacker to upload files with attacker-controlled content to a known location on disk. This vulnerability can be chaine", "indicator_types": [ "CISA KEV (KNOWN EXPLOITED VULNERABILITY)", "malicious-activity" ], "pattern": "[x-oca-asset:id = 'CVE-2026-118527']", "pattern_type": "stix", "pattern_version": "2.0", "valid_from": "2026-11-10T12:15:57.614363Z", "confidence": "high", "labels": [ "indicator", "cve", "kev", "cisa", "active-exploitation" ], "created_by_ref": "identity--00000000-0000-0000-0000-000000000001", "object_marking_refs": [ "marking-definition--00000000-0000-0000-0000-000000000002" ], "x_custom": { "severity": "CRITICAL", "product": "Connect Secure (Ivanti)", "source": "CISA KEV Catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "date": "2026-10-30", "original_section": "CISA KEV (KNOWN EXPLOITED VULNERABILITY)" } }, "indicator--00000000-00000009-0000-0000-0000-000000000000": { "type": "indicator", "id": "indicator--00000000-00000009-0000-0000-0000-000000000000", "created": "2026-11-10T12:15:57.614363Z", "modified": "2026-11-10T12:15:57.614363Z", "name": "CVE-2026-111357", "description": "Ivanti Connect Secure contains a missing authentication for critical function vulnerability that could allow a local authenticated attacker to escalate their privileges. This vulnerability can be chained with CVE-2026-104935 and CVE-2026-118527.", "indicator_types": [ "CISA KEV (KNOWN EXPLOITED VULNERABILITY)", "malicious-activity" ], "pattern": "[x-oca-asset:id = 'CVE-2026-111357']", "pattern_type": "stix", "pattern_version": "2.0", "valid_from": "2026-11-10T12:15:57.614363Z", "confidence": "high", "labels": [ "indicator", "cve", "kev", "cisa", "active-exploitation" ], "created_by_ref": "identity--00000000-0000-0000-0000-000000000001", "object_marking_refs": [ "marking-definition--00000000-0000-0000-0000-000000000002" ], "x_custom": { "severity": "CRITICAL", "product": "Connect Secure (Ivanti)", "source": "CISA KEV Catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "date": "2026-10-30", "original_section": "CISA KEV (KNOWN EXPLOITED VULNERABILITY)" } }, "indicator--00000000-00000010-0000-0000-0000-000000000000": { "type": "indicator", "id": "indicator--00000000-00000010-0000-0000-0000-000000000000", "created": "2026-11-10T12:15:57.614363Z", "modified": "2026-11-10T12:15:57.614363Z", "name": "CVE-2026-97229", "description": "GitLab Community Edition and Enterprise Edition contain a integer overflow or wraparound vulnerability that could allow an unauthenticated user to execute arbitrary code on the GitLab server via a specially crafted regular expression in a CI/CD confi", "indicator_types": [ "PHISHING URL", "malicious-activity" ], "pattern": "[x-oca-asset:id = 'CVE-2026-97229']", "pattern_type": "stix", "pattern_version": "2.0", "valid_from": "2026-11-10T12:15:57.614363Z", "confidence": "high", "labels": [ "indicator", "cve", "kev", "cisa", "active-exploitation" ], "created_by_ref": "identity--00000000-0000-0000-0000-000000000001", "object_marking_refs": [ "marking-definition--00000000-0000-0000-0000-000000000002" ], "x_custom": { "severity": "CRITICAL", "product": "Community Edition and Enterprise Edition (GitLab)", "source": "CISA KEV Catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "date": "2026-10-29", "original_section": "PHISHING URL" } }, "indicator--00000000-00000011-0000-0000-0000-000000000000": { "type": "indicator", "id": "indicator--00000000-00000011-0000-0000-0000-000000000000", "created": "2026-11-10T12:15:57.614363Z", "modified": "2026-11-10T12:15:57.614363Z", "name": "https://streamlined-three-995346.framer.app/", "description": "Active phishing URL: https://streamlined-three-995346.framer.app/", "indicator_types": [ "PHISHING URL", "malicious-activity" ], "pattern": "[indicator:pattern = 'https://streamlined-three-995346.framer.app/']", "pattern_type": "stix", "pattern_version": "2.0", "valid_from": "2026-11-10T12:15:57.614363Z", "confidence": "high", "labels": [ "indicator", "other", "phishing", "openphish" ], "created_by_ref": "identity--00000000-0000-0000-0000-000000000001", "object_marking_refs": [ "marking-definition--00000000-0000-0000-0000-000000000002" ], "x_custom": { "severity": "CRITICAL", "product": "", "source": "OpenPhish", "url": "https://streamlined-three-995346.framer.app/", "date": "", "original_section": "PHISHING URL" } }, "indicator--00000000-00000012-0000-0000-0000-000000000000": { "type": "indicator", "id": "indicator--00000000-00000012-0000-0000-0000-000000000000", "created": "2026-11-10T12:15:57.614363Z", "modified": "2026-11-10T12:15:57.614363Z", "name": "https://fanpage-case.vercel.app/", "description": "Active phishing URL: https://fanpage-case.vercel.app/", "indicator_types": [ "PHISHING URL", "malicious-activity" ], "pattern": "[indicator:pattern = 'https://fanpage-case.vercel.app/']", "pattern_type": "stix", "pattern_version": "2.0", "valid_from": "2026-11-10T12:15:57.614363Z", "confidence": "high", "labels": [ "indicator", "other", "phishing", "openphish" ], "created_by_ref": "identity--00000000-0000-0000-0000-000000000001", "object_marking_refs": [ "marking-definition--00000000-0000-0000-0000-000000000002" ], "x_custom": { "severity": "CRITICAL", "product": "", "source": "OpenPhish", "url": "https://fanpage-case.vercel.app/", "date": "", "original_section": "PHISHING URL" } }, "indicator--00000000-00000013-0000-0000-0000-000000000000": { "type": "indicator", "id": "indicator--00000000-00000013-0000-0000-0000-000000000000", "created": "2026-11-10T12:15:57.614363Z", "modified": "2026-11-10T12:15:57.614363Z", "name": "http://pagina-inicial-instagram.vercel.app/", "description": "Active phishing URL: http://pagina-inicial-instagram.vercel.app/", "indicator_types": [ "PHISHING URL", "malicious-activity" ], "pattern": "[indicator:pattern = 'http://pagina-inicial-instagram.vercel.app/']", "pattern_type": "stix", "pattern_version": "2.0", "valid_from": "2026-11-10T12:15:57.614363Z", "confidence": "high", "labels": [ "indicator", "other", "phishing", "openphish" ], "created_by_ref": "identity--00000000-0000-0000-0000-000000000001", "object_marking_refs": [ "marking-definition--00000000-0000-0000-0000-000000000002" ], "x_custom": { "severity": "CRITICAL", "product": "", "source": "OpenPhish", "url": "http://pagina-inicial-instagram.vercel.app/", "date": "", "original_section": "PHISHING URL" } }, "indicator--00000000-00000014-0000-0000-0000-000000000000": { "type": "indicator", "id": "indicator--00000000-00000014-0000-0000-0000-000000000000", "created": "2026-11-10T12:15:57.614363Z", "modified": "2026-11-10T12:15:57.614363Z", "name": "https://pagina-inicial-instagram-anesoledar.vercel.app/", "description": "Active phishing URL: https://pagina-inicial-instagram-anesoledar.vercel.app/", "indicator_types": [ "PHISHING URL", "malicious-activity" ], "pattern": "[indicator:pattern = 'https://pagina-inicial-instagram-anesoledar.vercel.app/']", "pattern_type": "stix", "pattern_version": "2.0", "valid_from": "2026-11-10T12:15:57.614363Z", "confidence": "high", "labels": [ "indicator", "other", "phishing", "openphish" ], "created_by_ref": "identity--00000000-0000-0000-0000-000000000001", "object_marking_refs": [ "marking-definition--00000000-0000-0000-0000-000000000002" ], "x_custom": { "severity": "CRITICAL", "product": "", "source": "OpenPhish", "url": "https://pagina-inicial-instagram-anesoledar.vercel.app/", "date": "", "original_section": "PHISHING URL" } }, "indicator--00000000-00000015-0000-0000-0000-000000000000": { "type": "indicator", "id": "indicator--00000000-00000015-0000-0000-0000-000000000000", "created": "2026-11-10T12:15:57.614363Z", "modified": "2026-11-10T12:15:57.614363Z", "name": "http://tokeimx-cdnnode-sg16.xyz/", "description": "Active phishing URL: http://tokeimx-cdnnode-sg16.xyz/", "indicator_types": [ "PHISHING URL", "malicious-activity" ], "pattern": "[indicator:pattern = 'http://tokeimx-cdnnode-sg16.xyz/']", "pattern_type": "stix", "pattern_version": "2.0", "valid_from": "2026-11-10T12:15:57.614363Z", "confidence": "high", "labels": [ "indicator", "other", "phishing", "openphish" ], "created_by_ref": "identity--00000000-0000-0000-0000-000000000001", "object_marking_refs": [ "marking-definition--00000000-0000-0000-0000-000000000002" ], "x_custom": { "severity": "CRITICAL", "product": "", "source": "OpenPhish", "url": "http://tokeimx-cdnnode-sg16.xyz/", "date": "", "original_section": "PHISHING URL" } }, "indicator--00000000-00000016-0000-0000-0000-000000000000": { "type": "indicator", "id": "indicator--00000000-00000016-0000-0000-0000-000000000000", "created": "2026-11-10T12:15:57.614363Z", "modified": "2026-11-10T12:15:57.614363Z", "name": "http://gjmrv53hwu-wznxb81fyn-3e1f8g-dm755c.pages.dev/", "description": "Active phishing URL: http://gjmrv53hwu-wznxb81fyn-3e1f8g-dm755c.pages.dev/", "indicator_types": [ "PHISHING URL", "malicious-activity" ], "pattern": "[indicator:pattern = 'http://gjmrv53hwu-wznxb81fyn-3e1f8g-dm755c.pages.dev/']", "pattern_type": "stix", "pattern_version": "2.0", "valid_from": "2026-11-10T12:15:57.614363Z", "confidence": "high", "labels": [ "indicator", "other", "phishing", "openphish" ], "created_by_ref": "identity--00000000-0000-0000-0000-000000000001", "object_marking_refs": [ "marking-definition--00000000-0000-0000-0000-000000000002" ], "x_custom": { "severity": "CRITICAL", "product": "", "source": "OpenPhish", "url": "http://gjmrv53hwu-wznxb81fyn-3e1f8g-dm755c.pages.dev/", "date": "", "original_section": "PHISHING URL" } }, "indicator--00000000-00000017-0000-0000-0000-000000000000": { "type": "indicator", "id": "indicator--00000000-00000017-0000-0000-0000-000000000000", "created": "2026-11-10T12:15:57.614363Z", "modified": "2026-11-10T12:15:57.614363Z", "name": "http://instagram-session.vercel.app/", "description": "Active phishing URL: http://instagram-session.vercel.app/", "indicator_types": [ "PHISHING URL", "malicious-activity" ], "pattern": "[indicator:pattern = 'http://instagram-session.vercel.app/']", "pattern_type": "stix", "pattern_version": "2.0", "valid_from": "2026-11-10T12:15:57.614363Z", "confidence": "high", "labels": [ "indicator", "other", "phishing", "openphish" ], "created_by_ref": "identity--00000000-0000-0000-0000-000000000001", "object_marking_refs": [ "marking-definition--00000000-0000-0000-0000-000000000002" ], "x_custom": { "severity": "CRITICAL", "product": "", "source": "OpenPhish", "url": "http://instagram-session.vercel.app/", "date": "", "original_section": "PHISHING URL" } }, "indicator--00000000-00000018-0000-0000-0000-000000000000": { "type": "indicator", "id": "indicator--00000000-00000018-0000-0000-0000-000000000000", "created": "2026-11-10T12:15:57.614363Z", "modified": "2026-11-10T12:15:57.614363Z", "name": "https://chp-courriersdomicile.bolt.host/", "description": "Active phishing URL: https://chp-courriersdomicile.bolt.host/", "indicator_types": [ "PHISHING URL", "malicious-activity" ], "pattern": "[indicator:pattern = 'https://chp-courriersdomicile.bolt.host/']", "pattern_type": "stix", "pattern_version": "2.0", "valid_from": "2026-11-10T12:15:57.614363Z", "confidence": "high", "labels": [ "indicator", "other", "phishing", "openphish" ], "created_by_ref": "identity--00000000-0000-0000-0000-000000000001", "object_marking_refs": [ "marking-definition--00000000-0000-0000-0000-000000000002" ], "x_custom": { "severity": "CRITICAL", "product": "", "source": "OpenPhish", "url": "https://chp-courriersdomicile.bolt.host/", "date": "", "original_section": "PHISHING URL" } }, "indicator--00000000-00000019-0000-0000-0000-000000000000": { "type": "indicator", "id": "indicator--00000000-00000019-0000-0000-0000-000000000000", "created": "2026-11-10T12:15:57.614363Z", "modified": "2026-11-10T12:15:57.614363Z", "name": "https://coinbaseplogininin.gitbook.io/us", "description": "Active phishing URL: https://coinbaseplogininin.gitbook.io/us", "indicator_types": [ "DOMAIN", "malicious-activity" ], "pattern": "[indicator:pattern = 'https://coinbaseplogininin.gitbook.io/us']", "pattern_type": "stix", "pattern_version": "2.0", "valid_from": "2026-11-10T12:15:57.614363Z", "confidence": "high", "labels": [ "indicator", "other", "phishing", "openphish" ], "created_by_ref": "identity--00000000-0000-0000-0000-000000000001", "object_marking_refs": [ "marking-definition--00000000-0000-0000-0000-000000000002" ], "x_custom": { "severity": "CRITICAL", "product": "", "source": "OpenPhish", "url": "https://coinbaseplogininin.gitbook.io/us", "date": "", "original_section": "DOMAIN" } }, "indicator--00000000-00000020-0000-0000-0000-000000000000": { "type": "indicator", "id": "indicator--00000000-00000020-0000-0000-0000-000000000000", "created": "2026-11-10T12:15:57.614363Z", "modified": "2026-11-10T12:15:57.614363Z", "name": "streamlined-three-995346.framer", "description": "Phishing domain: streamlined-three-995346.framer", "indicator_types": [ "DOMAIN", "malicious-activity" ], "pattern": "[domain-name:value = 'streamlined-three-995346.framer']", "pattern_type": "stix", "pattern_version": "2.0", "valid_from": "2026-11-10T12:15:57.614363Z", "confidence": "high", "labels": [ "indicator", "domain-name", "phishing", "openphish", "domain" ], "created_by_ref": "identity--00000000-0000-0000-0000-000000000001", "object_marking_refs": [ "marking-definition--00000000-0000-0000-0000-000000000002" ], "x_custom": { "severity": "CRITICAL", "product": "", "source": "OpenPhish", "url": "https://streamlined-three-995346.framer.app/", "date": "", "original_section": "DOMAIN" } }, "indicator--00000000-00000021-0000-0000-0000-000000000000": { "type": "indicator", "id": "indicator--00000000-00000021-0000-0000-0000-000000000000", "created": "2026-11-10T12:15:57.614363Z", "modified": "2026-11-10T12:15:57.614363Z", "name": "fanpage-case.vercel", "description": "Phishing domain: fanpage-case.vercel", "indicator_types": [ "DOMAIN", "malicious-activity" ], "pattern": "[domain-name:value = 'fanpage-case.vercel']", "pattern_type": "stix", "pattern_version": "2.0", "valid_from": "2026-11-10T12:15:57.614363Z", "confidence": "high", "labels": [ "indicator", "domain-name", "phishing", "openphish", "domain" ], "created_by_ref": "identity--00000000-0000-0000-0000-000000000001", "object_marking_refs": [ "marking-definition--00000000-0000-0000-0000-000000000002" ], "x_custom": { "severity": "CRITICAL", "product": "", "source": "OpenPhish", "url": "https://fanpage-case.vercel.app/", "date": "", "original_section": "DOMAIN" } }, "indicator--00000000-00000022-0000-0000-0000-000000000000": { "type": "indicator", "id": "indicator--00000000-00000022-0000-0000-0000-000000000000", "created": "2026-11-10T12:15:57.614363Z", "modified": "2026-11-10T12:15:57.614363Z", "name": "pagina-inicial-instagram.vercel", "description": "Phishing domain: pagina-inicial-instagram.vercel", "indicator_types": [ "DOMAIN", "malicious-activity" ], "pattern": "[domain-name:value = 'pagina-inicial-instagram.vercel']", "pattern_type": "stix", "pattern_version": "2.0", "valid_from": "2026-11-10T12:15:57.614363Z", "confidence": "high", "labels": [ "indicator", "domain-name", "phishing", "openphish", "domain" ], "created_by_ref": "identity--00000000-0000-0000-0000-000000000001", "object_marking_refs": [ "marking-definition--00000000-0000-0000-0000-000000000002" ], "x_custom": { "severity": "CRITICAL", "product": "", "source": "OpenPhish", "url": "http://pagina-inicial-instagram.vercel.app/", "date": "", "original_section": "DOMAIN" } }, "indicator--00000000-00000023-0000-0000-0000-000000000000": { "type": "indicator", "id": "indicator--00000000-00000023-0000-0000-0000-000000000000", "created": "2026-11-10T12:15:57.614363Z", "modified": "2026-11-10T12:15:57.614363Z", "name": "pagina-inicial-instagram-anesoledar.vercel", "description": "Phishing domain: pagina-inicial-instagram-anesoledar.vercel", "indicator_types": [ "DOMAIN", "malicious-activity" ], "pattern": "[domain-name:value = 'pagina-inicial-instagram-anesoledar.vercel']", "pattern_type": "stix", "pattern_version": "2.0", "valid_from": "2026-11-10T12:15:57.614363Z", "confidence": "high", "labels": [ "indicator", "domain-name", "phishing", "openphish", "domain" ], "created_by_ref": "identity--00000000-0000-0000-0000-000000000001", "object_marking_refs": [ "marking-definition--00000000-0000-0000-0000-000000000002" ], "x_custom": { "severity": "CRITICAL", "product": "", "source": "OpenPhish", "url": "https://pagina-inicial-instagram-anesoledar.vercel.app/", "date": "", "original_section": "DOMAIN" } }, "indicator--00000000-00000024-0000-0000-0000-000000000000": { "type": "indicator", "id": "indicator--00000000-00000024-0000-0000-0000-000000000000", "created": "2026-11-10T12:15:57.614363Z", "modified": "2026-11-10T12:15:57.614363Z", "name": "tokeimx-cdnnode-sg16.xyz", "description": "Phishing domain: tokeimx-cdnnode-sg16.xyz", "indicator_types": [ "DOMAIN", "malicious-activity" ], "pattern": "[domain-name:value = 'tokeimx-cdnnode-sg16.xyz']", "pattern_type": "stix", "pattern_version": "2.0", "valid_from": "2026-11-10T12:15:57.614363Z", "confidence": "high", "labels": [ "indicator", "domain-name", "phishing", "openphish", "domain" ], "created_by_ref": "identity--00000000-0000-0000-0000-000000000001", "object_marking_refs": [ "marking-definition--00000000-0000-0000-0000-000000000002" ], "x_custom": { "severity": "CRITICAL", "product": "", "source": "OpenPhish", "url": "http://tokeimx-cdnnode-sg16.xyz/", "date": "", "original_section": "DOMAIN" } }, "indicator--00000000-00000025-0000-0000-0000-000000000000": { "type": "indicator", "id": "indicator--00000000-00000025-0000-0000-0000-000000000000", "created": "2026-11-10T12:15:57.614363Z", "modified": "2026-11-10T12:15:57.614363Z", "name": "gjmrv53hwu-wznxb81fyn-3e1f8g-dm755c.pages", "description": "Phishing domain: gjmrv53hwu-wznxb81fyn-3e1f8g-dm755c.pages", "indicator_types": [ "DOMAIN", "malicious-activity" ], "pattern": "[domain-name:value = 'gjmrv53hwu-wznxb81fyn-3e1f8g-dm755c.pages']", "pattern_type": "stix", "pattern_version": "2.0", "valid_from": "2026-11-10T12:15:57.614363Z", "confidence": "high", "labels": [ "indicator", "domain-name", "phishing", "openphish", "domain" ], "created_by_ref": "identity--00000000-0000-0000-0000-000000000001", "object_marking_refs": [ "marking-definition--00000000-0000-0000-0000-000000000002" ], "x_custom": { "severity": "CRITICAL", "product": "", "source": "OpenPhish", "url": "http://gjmrv53hwu-wznxb81fyn-3e1f8g-dm755c.pages.dev/", "date": "", "original_section": "DOMAIN" } }, "indicator--00000000-00000026-0000-0000-0000-000000000000": { "type": "indicator", "id": "indicator--00000000-00000026-0000-0000-0000-000000000000", "created": "2026-11-10T12:15:57.614363Z", "modified": "2026-11-10T12:15:57.614363Z", "name": "instagram-session.vercel", "description": "Phishing domain: instagram-session.vercel", "indicator_types": [ "DOMAIN", "malicious-activity" ], "pattern": "[domain-name:value = 'instagram-session.vercel']", "pattern_type": "stix", "pattern_version": "2.0", "valid_from": "2026-11-10T12:15:57.614363Z", "confidence": "high", "labels": [ "indicator", "domain-name", "phishing", "openphish", "domain" ], "created_by_ref": "identity--00000000-0000-0000-0000-000000000001", "object_marking_refs": [ "marking-definition--00000000-0000-0000-0000-000000000002" ], "x_custom": { "severity": "CRITICAL", "product": "", "source": "OpenPhish", "url": "http://instagram-session.vercel.app/", "date": "", "original_section": "DOMAIN" } }, "indicator--00000000-00000027-0000-0000-0000-000000000000": { "type": "indicator", "id": "indicator--00000000-00000027-0000-0000-0000-000000000000", "created": "2026-11-10T12:15:57.614363Z", "modified": "2026-11-10T12:15:57.614363Z", "name": "chp-courriersdomicile.bolt", "description": "Phishing domain: chp-courriersdomicile.bolt", "indicator_types": [ "DOMAIN", "malicious-activity" ], "pattern": "[domain-name:value = 'chp-courriersdomicile.bolt']", "pattern_type": "stix", "pattern_version": "2.0", "valid_from": "2026-11-10T12:15:57.614363Z", "confidence": "high", "labels": [ "indicator", "domain-name", "phishing", "openphish", "domain" ], "created_by_ref": "identity--00000000-0000-0000-0000-000000000001", "object_marking_refs": [ "marking-definition--00000000-0000-0000-0000-000000000002" ], "x_custom": { "severity": "CRITICAL", "product": "", "source": "OpenPhish", "url": "https://chp-courriersdomicile.bolt.host/", "date": "", "original_section": "DOMAIN" } }, "indicator--00000000-00000028-0000-0000-0000-000000000000": { "type": "indicator", "id": "indicator--00000000-00000028-0000-0000-0000-000000000000", "created": "2026-11-10T12:15:57.614363Z", "modified": "2026-11-10T12:15:57.614363Z", "name": "coinbaseplogininin.gitbook", "description": "Phishing domain: coinbaseplogininin.gitbook", "indicator_types": [ "DOMAIN", "malicious-activity" ], "pattern": "[domain-name:value = 'coinbaseplogininin.gitbook']", "pattern_type": "stix", "pattern_version": "2.0", "valid_from": "2026-11-10T12:15:57.614363Z", "confidence": "high", "labels": [ "indicator", "domain-name", "phishing", "openphish", "domain" ], "created_by_ref": "identity--00000000-0000-0000-0000-000000000001", "object_marking_refs": [ "marking-definition--00000000-0000-0000-0000-000000000002" ], "x_custom": { "severity": "CRITICAL", "product": "", "source": "OpenPhish", "url": "https://coinbaseplogininin.gitbook.io/us", "date": "", "original_section": "DOMAIN" } } } }