{
  "name": "Impersonation, Click Hijacking, and TDS: Inside a Malware Distribution Ecosystem",
  "slug": "impersonation-click-hijacking-and-tds-inside-a-malware-distribution-ecosystem",
  "description": "A large-scale operation impersonates open-source and freeware projects to capture search traffic, targeting tools such as Ghidra, dnSpy, and SpiderFoot. The professionally designed sites load CloudFront-hosted JavaScript that converts download button clicks into handoffs to a Traffic Distribution System (TDS), which enforces strict gating including first-visit state, click confirmation, anti-bot logic, VPN filtering, and frequency capping. The ecosystem appears primarily built for traffic acquisition and monetization using legitimate ad-tech, but downstream redirect chains repeatedly led selected users to malware delivery infrastructure. The observed payloads include SessionGate (a multi-stage loader with heavy obfuscation delivering potentially unwanted applications), RemusStealer (an infostealer targeting over 20 browsers and hundreds of extensions), and AnimateClipper (a cryptocurrency clipper supporting 20+ blockchain ecosystems). Over 5,000 VirusTotal submissions indicate substantial reach across the ...",
  "published": "2026-06-03T17:42:55.521000+00:00",
  "created_at": "2026-06-04T09:09:24.759000+00:00",
  "modified_at": "2026-06-04T07:09:24+00:00",
  "created_at_opencti": "2026-06-04T09:09:24.759000+00:00",
  "author": "AlienVault",
  "confidence": 100,
  "report_types": [
    "threat-report"
  ],
  "labels": [
    "animateclipper",
    "click hijacking",
    "cryptocurrency clipper",
    "infostealer",
    "remusstealer",
    "sessiongate",
    "traffic distribution system"
  ],
  "tags": [
    "2026-06-03",
    "animateclipper",
    "click hijacking",
    "cryptocurrency clipper",
    "infostealer",
    "remusstealer",
    "sessiongate",
    "traffic distribution system"
  ],
  "related_entities": {
    "indicators": [
      {
        "id": "40d5373b-0152-439e-a93f-39eff34aea90",
        "name": "mobileversioncrc.com"
      },
      {
        "id": "58cedfc1-96ca-41d6-9e37-a13633f52abc",
        "name": "http://intem.lat:9592"
      },
      {
        "id": "734cca8d-48ea-42b6-896e-47322ab307d4",
        "name": "cdn-1415.brightcanvas.digital"
      },
      {
        "id": "06d579a1-3907-4ab3-9bf2-193d6056b69a",
        "name": "kr.hugo-lapp.co"
      },
      {
        "id": "989e2687-ea58-4443-b7be-fe205c1b3362",
        "name": "st.hugo-lapp.lat"
      },
      {
        "id": "2fdb06c3-8a77-4a26-b5d6-b1dc12bdccf4",
        "name": "http://baxe.pics:48261"
      },
      {
        "id": "d7aaec0c-14f3-427e-a048-5b37483e765a",
        "name": "flame-guard.cc"
      },
      {
        "id": "88f15492-fd00-4fd0-a5af-f7605b79417b",
        "name": "598b023e56c45b19173e8f96c1c88036d732fec305cf6bf1b9cf4dbe304beb7f"
      },
      {
        "id": "8c60dc77-e666-4321-81de-690b6dbd4fe7",
        "name": "cbad672d9bd06ce91ce465d049e50696fbaec9d209ca0ab1fd814d993d04bc9b"
      },
      {
        "id": "bc49b359-7cca-4e68-8a9e-a2f22ebf996f",
        "name": "ilspy.org"
      },
      {
        "id": "e3413e42-1493-4dc3-bfd8-74ecbc887d11",
        "name": "3bb92771e287aa0a8bdd8e5b5bb697427223eaefded3d9b64b5d5c32ad40f3c2"
      },
      {
        "id": "57cfb54a-4937-45d3-a429-f8c154aaf7d1",
        "name": "forestoaker.com"
      },
      {
        "id": "a6766da8-8fb8-437c-bb7b-0f7633b297ff",
        "name": "javascriptapiusa.com"
      },
      {
        "id": "a9832488-4318-4af1-8443-dfbd6f194fcc",
        "name": "webinnosetup.com"
      },
      {
        "id": "faff4bf5-428b-4b34-83e5-c1e4f0d5590c",
        "name": "integritycrc.com"
      },
      {
        "id": "b4acd050-589b-4bf7-bb8c-d1f2e4b98fca",
        "name": "http://oundhertobeconsist.org/"
      },
      {
        "id": "953c48f2-5d1d-435d-988b-91d1d938cfed",
        "name": "originaldownloads.info"
      },
      {
        "id": "abf1b1e7-6453-46cb-87b0-1943ef2ef734",
        "name": "buccstanor.pics"
      },
      {
        "id": "5172dd1a-3a17-41c5-83c2-ac8baa9b200c",
        "name": "winsetupfromusb.org"
      },
      {
        "id": "5895a15c-fc83-47cb-b7d9-b514c52f78c0",
        "name": "guiformat.com"
      },
      {
        "id": "389fc68a-e995-42fc-a579-6bd05356bee9",
        "name": "ce0888df5e28716432013a8ae002437bd3e993fbe8362c5ff9efbddabfe0ab77"
      },
      {
        "id": "3d33d398-61f3-4b53-9f40-5bfcc48f9732",
        "name": "grpcurl.com"
      },
      {
        "id": "99d6b2a2-fc42-4472-a191-e947d91b0fe9",
        "name": "http://ropea.top:28313"
      },
      {
        "id": "53994537-c6c6-42f7-bb24-3658170eaba0",
        "name": "http://gluckcreek.online:48261"
      },
      {
        "id": "73e4746c-6aba-4739-ba3d-1c82ce4d3a2f",
        "name": "ghidralite.com"
      },
      {
        "id": "121195cd-8bf6-4172-a9d9-8d73a44c3ff4",
        "name": "ropea.top"
      },
      {
        "id": "11103e25-dfaf-4401-9936-23bf5662709b",
        "name": "webcrcprove.com"
      },
      {
        "id": "1ccd1bc7-8093-45e7-a9fb-28c7b14df499",
        "name": "74091f5a8746a1c68d73e1fc1e4e1ff514632ee3f632a8b306f35dabae2d2b64"
      },
      {
        "id": "86d42c11-a824-4aaa-84dc-5da37e33292d",
        "name": "crystaldiskmark.org"
      },
      {
        "id": "f65e5cc5-ed3a-448b-901f-f060d1a2e386",
        "name": "fd.hugo-lapp.lat"
      },
      {
        "id": "bb8f4ef3-51e1-4f2f-a06e-713e40d8ad5c",
        "name": "87361ba2bb412dcf49f8738f3b8b9b7dccb557ad2e76ea8d98ffa5b098ae3886"
      },
      {
        "id": "0e562024-f999-4ab4-9850-6252639b9454",
        "name": "appfreshstart.com"
      },
      {
        "id": "5b498030-b5c1-484a-98be-bf500dce083a",
        "name": "intem.lat"
      },
      {
        "id": "a4fed202-b301-433e-bd7f-06141b49799c",
        "name": "26f2abfc254a59c2386dd46dca16744f7147a0f0366cb6008e1d53219175f44c"
      },
      {
        "id": "bd10397d-c46e-4fc4-9818-ee3e24f10471",
        "name": "e6a1a428a7c09c9946f7c0179d89b263f442dc3208b5144a9146c200e4185bd6"
      },
      {
        "id": "14652e49-5d82-4701-b3ab-e7cf7120d205",
        "name": "http://forestoaker.com:6290"
      },
      {
        "id": "ce2be1b3-5dbf-40e0-89a7-3cdb02622249",
        "name": "15e6df0c95f2147952308e640d55270e9d097639eaebb34d4b352415f1c6bceb"
      },
      {
        "id": "d4738809-b41a-4d5c-bcf3-d680b865281f",
        "name": "https://javascriptapiusa.com/lic"
      },
      {
        "id": "5a105eb0-ae2d-4c15-8dd7-f8242f13620f",
        "name": "mfcmapi.com"
      },
      {
        "id": "06da03ba-d581-4032-96de-18bcd77b2469",
        "name": "io.hugo-lapp.lat"
      },
      {
        "id": "a72b43cc-b128-4079-adb9-c86947f409da",
        "name": "ukentaspectsofc.org"
      },
      {
        "id": "9cdc2889-31b5-4c61-bd97-11d58bc69471",
        "name": "unlockcontent.org"
      },
      {
        "id": "71e573ec-8592-46a6-a181-1ca449f5d417",
        "name": "yourfastcrc.com"
      },
      {
        "id": "83e6a2e6-8336-40c1-89e4-a629cdaa6bb6",
        "name": "http://194.150.220.218/4SLEYpfAk57hGubo/fo0suc2ki2.rtf"
      },
      {
        "id": "d731a118-5273-4b6e-96f1-40e6885991b4",
        "name": "https://cdn-1415.brightcanvas.digital/fo0suc2ki2.rtf"
      },
      {
        "id": "bc8abebe-b9d9-41bb-9d45-36832b9fc6c8",
        "name": "http://buccstanor.pics:28313"
      },
      {
        "id": "a6f5a101-5da8-4e53-a751-36aff3dee331",
        "name": "cw.hugo-lapp.lat"
      },
      {
        "id": "9e475c23-8add-40eb-8f4c-4d8f4a37c7e2",
        "name": "carlessclapped.com"
      },
      {
        "id": "d1d4f356-67a4-43d9-b0a1-ae9d80697cca",
        "name": "ed.hugo-lapp.lat"
      },
      {
        "id": "fde05bdf-e41d-489d-94e4-3abe0bf4e580",
        "name": "td.hugo-lapp.lat"
      },
      {
        "id": "c7666efd-8178-4256-878e-c2c065207f1e",
        "name": "arch2.maxdatahost1.cyou"
      },
      {
        "id": "362fd682-a7ec-4b98-ac93-34b6f38381e3",
        "name": "39dc2327fe1e5a56ac5ad9dc02f0386cff3d83dcfdc558cacba42ebb9dcc5ec2"
      },
      {
        "id": "89820056-aeb8-4716-bafd-38139b898ff3",
        "name": "217.156.122.75"
      },
      {
        "id": "ba7bffdf-26ea-4bb3-b18c-3d1eb7fa1014",
        "name": "appmakingcenter.com"
      },
      {
        "id": "19c99be8-d80a-4bdc-b32c-669fade5bf38",
        "name": "gluckcreek.online"
      },
      {
        "id": "a7b23922-0bc4-47ff-b5f9-976847e28013",
        "name": "processing-in-progress-x4.t3.storage.dev"
      },
      {
        "id": "6861cd49-8a92-4297-8ea3-0d5ab1552b1c",
        "name": "194.150.220.218"
      },
      {
        "id": "8cd76984-9c7a-454f-bebc-26910828d07c",
        "name": "media.stellarcloudhub1.cfd"
      },
      {
        "id": "88a80ed6-1b54-4ca9-bc7e-ecfa278c2fe3",
        "name": "2e842eab0c16ddd1a2ec4a56610adb58d115b65a1e08e9b67e7e375f8eed0873"
      },
      {
        "id": "508f9ea0-9107-415a-a4bd-077f405e4922",
        "name": "mqttexplorer.com"
      },
      {
        "id": "8900794f-b489-46ba-b03c-c0d85cbe7384",
        "name": "dnspy.org"
      },
      {
        "id": "7dc10832-31de-42b6-9b48-e7a6892e14d3",
        "name": "appgetonline.com"
      },
      {
        "id": "68f01c35-e4fd-4a58-9eba-f95288caa3a5",
        "name": "http://buccstanor.pics:48261"
      },
      {
        "id": "2b2f6ac2-f1c6-4b5f-9482-940d3a195a61",
        "name": "4cdb1f7ac502289119f7f8256f00baaa994e6ecfb4000dcf5e1c46073508fcb3"
      }
    ],
    "attack_patterns": [
      {
        "id": "6ccd4566-e15e-40cf-b7df-4a3f737ce5cd",
        "name": "T1036.005"
      },
      {
        "id": "32817170-4c07-427e-b8a5-80a733ae2550",
        "name": "T1497"
      },
      {
        "id": "c3af9fd7-d307-4df4-9220-cc627938fb85",
        "name": "T1055"
      },
      {
        "id": "a72ebeae-8e62-4039-8135-e9c611011fdc",
        "name": "T1573"
      },
      {
        "id": "b7ba0db0-7d4f-436f-8d5f-c431d690b048",
        "name": "T1555.003"
      },
      {
        "id": "667462db-9031-48eb-893a-05d35f9330a7",
        "name": "T1056.001"
      },
      {
        "id": "c9ee9b30-ba84-4c24-95e9-e8242d42af3f",
        "name": "T1071.001"
      },
      {
        "id": "e615d5ec-8d67-4048-b21d-a5fb09925bb9",
        "name": "T1552.001"
      },
      {
        "id": "81ee4813-4f68-4984-bec1-980d7c5b56eb",
        "name": "T1132"
      },
      {
        "id": "196f2a64-c55b-47a6-8e38-beb76ba700b6",
        "name": "T1204.002"
      },
      {
        "id": "97d377d8-89c7-48f8-a79f-0f48bd60df74",
        "name": "T1005"
      },
      {
        "id": "0c836307-129e-4ff7-a532-180c633cacba",
        "name": "T1027"
      },
      {
        "id": "cbd87c8c-3bed-461a-acef-56ffc8b87571",
        "name": "T1105"
      },
      {
        "id": "b7c6c1ad-f183-4128-8427-3891029c73dc",
        "name": "T1539"
      },
      {
        "id": "52b92395-d3d3-4e05-976a-0fccccfce8d2",
        "name": "T1566.002"
      },
      {
        "id": "0156fcda-e385-4662-b388-086c3e16feec",
        "name": "T1140"
      },
      {
        "id": "45082a8e-9c79-470e-ad1b-decac7188e8f",
        "name": "T1083"
      },
      {
        "id": "8e0fea81-4d54-4e88-a7dd-3aa8b26558ed",
        "name": "T1113"
      },
      {
        "id": "70616b2f-4019-4963-b758-5d9f6f20e201",
        "name": "T1082"
      },
      {
        "id": "f4a450ef-8297-42e5-9e47-01162138baa2",
        "name": "T1115"
      }
    ],
    "malware": [
      {
        "id": "90ac84d0-e42d-4e67-b79d-bd1b00ec62c4",
        "name": "RemusStealer",
        "slug": "remusstealer"
      },
      {
        "id": "b2e3328f-424c-4b94-bb8a-a5ec9fb044b3",
        "name": "AnimateClipper",
        "slug": "animateclipper"
      },
      {
        "id": "90ff8002-848d-4b57-b878-220b523fc043",
        "name": "SessionGate",
        "slug": "sessiongate"
      }
    ],
    "observables": [
      {
        "id": "8ddde865-b344-4ca7-90bb-c2958ef7db13",
        "name": "gluckcreek.online"
      },
      {
        "id": "e6b55f9b-3073-46a1-bb12-c6f23db783ad",
        "name": "integritycrc.com"
      },
      {
        "id": "962d86e3-d3c7-4f79-8af2-cc823a9c0328",
        "name": "originaldownloads.info"
      },
      {
        "id": "aac8a4b5-a7d3-4e59-ae6b-7c806d757217",
        "name": "guiformat.com"
      },
      {
        "id": "d10de8b3-1005-4e19-aa15-ae18fa1f6e36",
        "name": "winsetupfromusb.org"
      },
      {
        "id": "e885ac59-5f78-4563-ac30-09ff1cb2493a",
        "name": "ilspy.org"
      },
      {
        "id": "4cfec924-2741-4b32-a2df-eff014816698",
        "name": "unlockcontent.org"
      },
      {
        "id": "32d0a18d-e9c2-44f0-b430-2a7205e32028",
        "name": "webcrcprove.com"
      },
      {
        "id": "964413bc-b677-4a4b-81ba-e044ef7b0ef8",
        "name": "crystaldiskmark.org"
      },
      {
        "id": "717c2379-ffb4-418d-8626-61faa28492e4",
        "name": "appgetonline.com"
      },
      {
        "id": "6125ca54-94f7-462a-a5f5-318b3c8cd361",
        "name": "ropea.top"
      },
      {
        "id": "6e3dec58-cd68-4490-ab42-6447982ce518",
        "name": "appfreshstart.com"
      },
      {
        "id": "c01cf746-a29a-4dd0-a5be-3710e5c67965",
        "name": "flame-guard.cc"
      },
      {
        "id": "f05cd870-9701-4de1-9473-093ae75236f8",
        "name": "webinnosetup.com"
      },
      {
        "id": "40409fb5-09bf-4d0b-bfa7-828fc141759e",
        "name": "appmakingcenter.com"
      },
      {
        "id": "b37297a9-d1eb-4f32-84f9-b6bbc5773189",
        "name": "mobileversioncrc.com"
      },
      {
        "id": "1b599a84-b6c1-4a12-bfc1-5307d10cb7b9",
        "name": "intem.lat"
      },
      {
        "id": "48ed0d4a-8e57-41f8-a4e9-e1cf7b7231de",
        "name": "javascriptapiusa.com"
      },
      {
        "id": "325698d1-0961-4283-8ebd-198ba9d0853d",
        "name": "mfcmapi.com"
      },
      {
        "id": "a3882c33-c994-4e58-9d19-21d13ce05f72",
        "name": "mqttexplorer.com"
      },
      {
        "id": "9defa2ee-bcf9-4b51-bd0e-be9340e5811c",
        "name": "carlessclapped.com"
      },
      {
        "id": "0c8ec1d5-bc47-40e2-80ab-d81e9b2a5111",
        "name": "forestoaker.com"
      },
      {
        "id": "16d5b105-0f04-479d-866a-02eb6ddec6eb",
        "name": "grpcurl.com"
      },
      {
        "id": "213f5ae6-023d-4343-84f5-c61ac981a4d7",
        "name": "ukentaspectsofc.org"
      },
      {
        "id": "96fa8acb-81aa-4fc7-83f8-b96f2d6ab92d",
        "name": "yourfastcrc.com"
      },
      {
        "id": "3c98e0d7-4e5c-4a28-b1de-0ad923dc886a",
        "name": "buccstanor.pics"
      },
      {
        "id": "bab48e6f-e50f-45a7-80d4-8f548d1b2753",
        "name": "ghidralite.com"
      },
      {
        "id": "312a929d-64d6-4c43-9fe1-a3078c3ae5f9",
        "name": "dnspy.org"
      },
      {
        "id": "00410f86-33bd-425a-ad24-575ba97f5bb4",
        "name": "cdn-1415.brightcanvas.digital"
      },
      {
        "id": "c75292ec-4b51-49b1-82cc-49a673214b48",
        "name": "td.hugo-lapp.lat"
      },
      {
        "id": "9e7635df-3c12-4cc5-97d8-367ba4be9856",
        "name": "st.hugo-lapp.lat"
      },
      {
        "id": "8b8a5297-6970-47c3-af86-8fd318d5cd21",
        "name": "fd.hugo-lapp.lat"
      },
      {
        "id": "37c47303-d2b3-408d-aca3-635586d029fa",
        "name": "media.stellarcloudhub1.cfd"
      },
      {
        "id": "14ae36c3-280a-4db1-a1be-6dd68dc094a6",
        "name": "ed.hugo-lapp.lat"
      },
      {
        "id": "0b051398-5709-41fc-8a11-b81e1e364954",
        "name": "arch2.maxdatahost1.cyou"
      },
      {
        "id": "af2a3fca-4e9e-46a5-a5c9-849359eff34d",
        "name": "cw.hugo-lapp.lat"
      },
      {
        "id": "ec7a48d1-92ae-4d3a-a0a1-3a9475c898bf",
        "name": "processing-in-progress-x4.t3.storage.dev"
      },
      {
        "id": "e7f14b19-ebc9-49b9-a648-7fb0fd314819",
        "name": "kr.hugo-lapp.co"
      },
      {
        "id": "25f85550-15d4-4618-aee3-54e8c287e6ae",
        "name": "io.hugo-lapp.lat"
      },
      {
        "id": "fed6d8a7-f10f-4287-b410-bbb619a02086",
        "name": "217.156.122.75"
      },
      {
        "id": "ecc1fc7e-db91-4624-8b65-4cc42dc9f35e",
        "name": "194.150.220.218"
      },
      {
        "id": "568ad180-0bd4-408d-bffe-d58ae46092b9",
        "name": "https://cdn-1415.brightcanvas.digital/fo0suc2ki2.rtf"
      },
      {
        "id": "f3e0066f-52bd-4e08-9542-48f71ae358e7",
        "name": "http://ropea.top:28313"
      },
      {
        "id": "0f34d54d-b929-4d17-a200-75eca9533662",
        "name": "http://oundhertobeconsist.org/"
      },
      {
        "id": "1a895ba8-2990-446c-a31c-8f64ab708213",
        "name": "http://forestoaker.com:6290"
      },
      {
        "id": "f26c67d4-fa1a-4f77-a2a9-a599fc169944",
        "name": "http://baxe.pics:48261"
      },
      {
        "id": "0175a466-8ab4-46d2-a9db-cf3c4a8826bc",
        "name": "http://194.150.220.218/4SLEYpfAk57hGubo/fo0suc2ki2.rtf"
      },
      {
        "id": "135d45c1-06f4-4917-9e90-3c1d3813ee76",
        "name": "http://buccstanor.pics:28313"
      },
      {
        "id": "d8e7a530-41c1-4c93-a7eb-93c730462580",
        "name": "http://intem.lat:9592"
      },
      {
        "id": "aff15e19-d832-4cb6-b73c-68dcbce8e2d4",
        "name": "http://gluckcreek.online:48261"
      },
      {
        "id": "df638cc4-c65f-480e-a81d-cccb09d9f7cc",
        "name": "http://buccstanor.pics:48261"
      },
      {
        "id": "4d0694d5-55cd-4cdc-86a3-48a35561ba54",
        "name": "https://javascriptapiusa.com/lic"
      },
      {
        "id": "",
        "name": "598b023e56c45b19173e8f96c1c88036d732fec305cf6bf1b9cf4dbe304beb7f"
      },
      {
        "id": "",
        "name": "cbad672d9bd06ce91ce465d049e50696fbaec9d209ca0ab1fd814d993d04bc9b"
      },
      {
        "id": "",
        "name": "3bb92771e287aa0a8bdd8e5b5bb697427223eaefded3d9b64b5d5c32ad40f3c2"
      },
      {
        "id": "",
        "name": "ce0888df5e28716432013a8ae002437bd3e993fbe8362c5ff9efbddabfe0ab77"
      },
      {
        "id": "",
        "name": "74091f5a8746a1c68d73e1fc1e4e1ff514632ee3f632a8b306f35dabae2d2b64"
      },
      {
        "id": "",
        "name": "87361ba2bb412dcf49f8738f3b8b9b7dccb557ad2e76ea8d98ffa5b098ae3886"
      },
      {
        "id": "",
        "name": "26f2abfc254a59c2386dd46dca16744f7147a0f0366cb6008e1d53219175f44c"
      },
      {
        "id": "",
        "name": "e6a1a428a7c09c9946f7c0179d89b263f442dc3208b5144a9146c200e4185bd6"
      },
      {
        "id": "",
        "name": "15e6df0c95f2147952308e640d55270e9d097639eaebb34d4b352415f1c6bceb"
      },
      {
        "id": "",
        "name": "39dc2327fe1e5a56ac5ad9dc02f0386cff3d83dcfdc558cacba42ebb9dcc5ec2"
      },
      {
        "id": "",
        "name": "2e842eab0c16ddd1a2ec4a56610adb58d115b65a1e08e9b67e7e375f8eed0873"
      },
      {
        "id": "",
        "name": "4cdb1f7ac502289119f7f8256f00baaa994e6ecfb4000dcf5e1c46073508fcb3"
      }
    ],
    "others": [
      {
        "id": "",
        "name": "Brazil"
      },
      {
        "id": "",
        "name": "Poland"
      },
      {
        "id": "",
        "name": "United Kingdom of Great Britain and Northern Ireland"
      },
      {
        "id": "",
        "name": "Germany"
      },
      {
        "id": "",
        "name": "France"
      },
      {
        "id": "",
        "name": "Russian Federation"
      },
      {
        "id": "",
        "name": "mobileversioncrc.com"
      },
      {
        "id": "",
        "name": "cdn-1415.brightcanvas.digital"
      },
      {
        "id": "",
        "name": "kr.hugo-lapp.co"
      },
      {
        "id": "",
        "name": "st.hugo-lapp.lat"
      },
      {
        "id": "",
        "name": "flame-guard.cc"
      },
      {
        "id": "",
        "name": "ilspy.org"
      },
      {
        "id": "",
        "name": "forestoaker.com"
      },
      {
        "id": "",
        "name": "javascriptapiusa.com"
      },
      {
        "id": "",
        "name": "webinnosetup.com"
      },
      {
        "id": "",
        "name": "integritycrc.com"
      },
      {
        "id": "",
        "name": "originaldownloads.info"
      },
      {
        "id": "",
        "name": "buccstanor.pics"
      },
      {
        "id": "",
        "name": "winsetupfromusb.org"
      },
      {
        "id": "",
        "name": "guiformat.com"
      },
      {
        "id": "",
        "name": "grpcurl.com"
      },
      {
        "id": "",
        "name": "ghidralite.com"
      },
      {
        "id": "",
        "name": "ropea.top"
      },
      {
        "id": "",
        "name": "webcrcprove.com"
      },
      {
        "id": "",
        "name": "crystaldiskmark.org"
      },
      {
        "id": "",
        "name": "fd.hugo-lapp.lat"
      },
      {
        "id": "",
        "name": "appfreshstart.com"
      },
      {
        "id": "",
        "name": "intem.lat"
      },
      {
        "id": "",
        "name": "mfcmapi.com"
      },
      {
        "id": "",
        "name": "io.hugo-lapp.lat"
      },
      {
        "id": "",
        "name": "ukentaspectsofc.org"
      },
      {
        "id": "",
        "name": "unlockcontent.org"
      },
      {
        "id": "",
        "name": "yourfastcrc.com"
      },
      {
        "id": "",
        "name": "cw.hugo-lapp.lat"
      },
      {
        "id": "",
        "name": "carlessclapped.com"
      },
      {
        "id": "",
        "name": "ed.hugo-lapp.lat"
      },
      {
        "id": "",
        "name": "td.hugo-lapp.lat"
      },
      {
        "id": "",
        "name": "arch2.maxdatahost1.cyou"
      },
      {
        "id": "",
        "name": "appmakingcenter.com"
      },
      {
        "id": "",
        "name": "gluckcreek.online"
      },
      {
        "id": "",
        "name": "processing-in-progress-x4.t3.storage.dev"
      },
      {
        "id": "",
        "name": "media.stellarcloudhub1.cfd"
      },
      {
        "id": "",
        "name": "mqttexplorer.com"
      },
      {
        "id": "",
        "name": "dnspy.org"
      },
      {
        "id": "",
        "name": "appgetonline.com"
      }
    ]
  },
  "external_refs": [
    {
      "id": "6943f56c-c9d5-45bf-9142-4fc69541f0a7",
      "standard_id": "external-reference--a75376ad-a754-5d45-81b2-a64ed21f3f5d",
      "entity_type": "External-Reference",
      "source_name": "AlienVault",
      "description": null,
      "url": "https://research.checkpoint.com/2026/impersonation-click-hijacking-and-tds-inside-a-malware-distribution-ecosystem/",
      "hash": null,
      "external_id": null,
      "created": "2026-06-04T09:09:23.345Z",
      "modified": "2026-06-04T09:09:23.345Z",
      "createdById": null
    },
    {
      "id": "582057e1-1433-4ec6-83dd-116243015805",
      "standard_id": "external-reference--af7e1136-ef27-56d6-9bc6-c2bfd84918fa",
      "entity_type": "External-Reference",
      "source_name": "AlienVault",
      "description": null,
      "url": "https://otx.alienvault.com/pulse/6a20679f5ade869dcb4bf6b5",
      "hash": null,
      "external_id": "6a20679f5ade869dcb4bf6b5",
      "created": "2026-06-04T09:09:23.320Z",
      "modified": "2026-06-04T09:09:23.320Z",
      "createdById": null
    }
  ]
}