{
  "name": "Infrastructure of Interest: Medium Confidence Phishing",
  "slug": "infrastructure-of-interest-medium-confidence-phishing",
  "description": "These indicators of compromise (IOCs) were identified through LevelBlue Labs' proprietary collection and threat hunting processes, leveraging AI-driven heuristics to detect anomalous patterns, behavioral analysis of malicious activity, and cross-referenced intelligence from endpoint telemetry and external sources. The IOCs included in this pulse are associated with phishing campaigns, targeting credential theft and fraudulent resource access. Use this data to enhance detection rules, block malicious infrastructure, or correlate with existing incident investigations.",
  "published": "2025-08-07T05:20:01+00:00",
  "created_at": "2025-08-07T05:20:01+00:00",
  "modified_at": "2025-08-08T05:46:07+00:00",
  "created_at_opencti": "2025-08-07T05:20:01+00:00",
  "author": "",
  "confidence": null,
  "report_types": [],
  "labels": [],
  "tags": [
    "2025-08-07"
  ],
  "related_entities": {
    "observables": [
      {
        "id": "",
        "name": "www.whatsapp-im.net"
      },
      {
        "id": "",
        "name": "www.x9-whattsapp.org"
      },
      {
        "id": "",
        "name": "www.x8-whattsapp.net"
      },
      {
        "id": "",
        "name": "www.tubematedownload.org.37-49-227-160.cpanel.site"
      },
      {
        "id": "",
        "name": "www.spcentral-amazon.com"
      },
      {
        "id": "",
        "name": "www.s2-wthsaapp.org"
      },
      {
        "id": "",
        "name": "www.reverent-dubinsky.213-226-123-177.plesk.page"
      },
      {
        "id": "",
        "name": "www.rc5-whatsapp.org"
      },
      {
        "id": "",
        "name": "www.rc5-whatsapp.net"
      },
      {
        "id": "",
        "name": "www.nifty-galileo.213-226-123-177.plesk.page"
      },
      {
        "id": "",
        "name": "www.news-whatsapps.net"
      },
      {
        "id": "",
        "name": "www.microsoftnowonline.com"
      },
      {
        "id": "",
        "name": "www.m-whatsapps.net"
      },
      {
        "id": "",
        "name": "www.goxexe.top"
      },
      {
        "id": "",
        "name": "www.google-v3-signin-identifier-authuser-continue-service.ru"
      },
      {
        "id": "",
        "name": "www.flixfoxapk.app.37-49-227-160.cpanel.site"
      },
      {
        "id": "",
        "name": "www.chatbotfundraiser.com"
      },
      {
        "id": "",
        "name": "www.autoezpreso.cfd"
      },
      {
        "id": "",
        "name": "www.ww-whatsapps-chat.net"
      },
      {
        "id": "",
        "name": "www.v-whattsapp.org"
      },
      {
        "id": "",
        "name": "www.u1-whotsapp.net"
      },
      {
        "id": "",
        "name": "www.teams-web.com"
      },
      {
        "id": "",
        "name": "www.s2-wthsaapp.com"
      },
      {
        "id": "",
        "name": "www.netflix-app.com"
      },
      {
        "id": "",
        "name": "www.doctolib-remboursement.co"
      },
      {
        "id": "",
        "name": "www.cn-whatssappweblogin.com"
      },
      {
        "id": "",
        "name": "www.app8-whatsap.net"
      },
      {
        "id": "",
        "name": "www-whatsinapp.com"
      },
      {
        "id": "",
        "name": "yhbcii.com"
      },
      {
        "id": "",
        "name": "nlapp.nl"
      },
      {
        "id": "",
        "name": "multi-fresh.site"
      },
      {
        "id": "",
        "name": "jobsrozaana.com"
      },
      {
        "id": "",
        "name": "ij-scan-utility.com"
      },
      {
        "id": "",
        "name": "chetgpt.com"
      },
      {
        "id": "",
        "name": "ywnjb.login-offlce.com"
      },
      {
        "id": "",
        "name": "wildslots666.com"
      },
      {
        "id": "",
        "name": "whatsuapq.com"
      },
      {
        "id": "",
        "name": "whatilsapp.com"
      },
      {
        "id": "",
        "name": "webdisk.23-237-26-135.cprapid.com"
      },
      {
        "id": "",
        "name": "wahtsapp.cc"
      },
      {
        "id": "",
        "name": "vps-d95a1b18.vps.ovh.net"
      },
      {
        "id": "",
        "name": "vpn915794487.softether.net"
      },
      {
        "id": "",
        "name": "very.dzo8.com"
      },
      {
        "id": "",
        "name": "verify-address-partnership.top"
      },
      {
        "id": "",
        "name": "verfolg.top"
      },
      {
        "id": "",
        "name": "verifloginvancity.com"
      },
      {
        "id": "",
        "name": "usps-update06.click"
      },
      {
        "id": "",
        "name": "usps-checkupdate.info"
      },
      {
        "id": "",
        "name": "uscgv.cn"
      },
      {
        "id": "",
        "name": "us05webzoomus.life"
      },
      {
        "id": "",
        "name": "us.quooa.com"
      },
      {
        "id": "",
        "name": "us.y5ys.com"
      },
      {
        "id": "",
        "name": "us.dzcmw.com"
      },
      {
        "id": "",
        "name": "univarsolutlons.co"
      },
      {
        "id": "",
        "name": "ulys-impaye.com"
      },
      {
        "id": "",
        "name": "uksan.top"
      },
      {
        "id": "",
        "name": "trusting-ritchie.191-96-207-56.plesk.page"
      },
      {
        "id": "",
        "name": "takeoffexperts.ca"
      },
      {
        "id": "",
        "name": "support-idevices-found.com"
      },
      {
        "id": "",
        "name": "slackchannels.co.uk"
      },
      {
        "id": "",
        "name": "sambapoker.club"
      },
      {
        "id": "",
        "name": "roselinph.com"
      },
      {
        "id": "",
        "name": "redsq.fotografkalasky.cz"
      },
      {
        "id": "",
        "name": "rastreament.ink"
      },
      {
        "id": "",
        "name": "quepos.freeboxos.fr"
      },
      {
        "id": "",
        "name": "quickq-pc.com"
      },
      {
        "id": "",
        "name": "qae4324.duckdns.org"
      },
      {
        "id": "",
        "name": "postofficeinza.life"
      },
      {
        "id": "",
        "name": "postoffsa.icu"
      },
      {
        "id": "",
        "name": "posts-tracktrace.top"
      },
      {
        "id": "",
        "name": "posstnli.sbs"
      },
      {
        "id": "",
        "name": "posstnli.cfd"
      },
      {
        "id": "",
        "name": "poosst.top"
      },
      {
        "id": "",
        "name": "orico.index.co.jp.poakjma7.shop"
      },
      {
        "id": "",
        "name": "paypal-ii.com"
      },
      {
        "id": "",
        "name": "online-secureaccess.com"
      },
      {
        "id": "",
        "name": "ns3.nicehosting.in"
      },
      {
        "id": "",
        "name": "ogs.login-offlce.com"
      },
      {
        "id": "",
        "name": "ns2.companyrolinc.pro"
      },
      {
        "id": "",
        "name": "ns2.alramiqa.sa.com"
      },
      {
        "id": "",
        "name": "ns1.box.post-bobs.co.uk"
      },
      {
        "id": "",
        "name": "mydietanalysis-cert.pearson.com"
      },
      {
        "id": "",
        "name": "nachver.top"
      },
      {
        "id": "",
        "name": "my.axonalia.com"
      },
      {
        "id": "",
        "name": "mcs.agvip222.com"
      },
      {
        "id": "",
        "name": "microsoft365page.live"
      },
      {
        "id": "",
        "name": "mail.facebookalert.com"
      },
      {
        "id": "",
        "name": "kmsorguyapalimhemenqae.duckdns.org"
      },
      {
        "id": "",
        "name": "login-upps.shop"
      },
      {
        "id": "",
        "name": "kmsorgulartamsanlarshuzkyler.duckdns.org"
      },
      {
        "id": "",
        "name": "k5892.com"
      },
      {
        "id": "",
        "name": "itsablessing.cfd"
      },
      {
        "id": "",
        "name": "intelligent-bouman.185-196-10-166.plesk.page"
      },
      {
        "id": "",
        "name": "installer.login-xero.com"
      },
      {
        "id": "",
        "name": "inspiring-matsumoto.213-226-123-177.plesk.page"
      },
      {
        "id": "",
        "name": "inpost-go.click"
      },
      {
        "id": "",
        "name": "gzmantu.com"
      },
      {
        "id": "",
        "name": "hasfdyta.fwlanmsl.co"
      },
      {
        "id": "",
        "name": "great-borg.34-175-60-117.plesk.page"
      },
      {
        "id": "",
        "name": "gls-hk.help"
      },
      {
        "id": "",
        "name": "fullcopesel.top"
      },
      {
        "id": "",
        "name": "fullcopesss.top"
      },
      {
        "id": "",
        "name": "fullcopeca.top"
      },
      {
        "id": "",
        "name": "fuilcopui.cc"
      },
      {
        "id": "",
        "name": "frosty-wright.3-87-0-221.plesk.page"
      },
      {
        "id": "",
        "name": "fedexpayments.com"
      },
      {
        "id": "",
        "name": "fedex-update01.ink"
      },
      {
        "id": "",
        "name": "estafeta.city"
      },
      {
        "id": "",
        "name": "esqws.top"
      },
      {
        "id": "",
        "name": "es-amazon.com"
      },
      {
        "id": "",
        "name": "egypteposts.cfd"
      },
      {
        "id": "",
        "name": "eggypttpost.top"
      },
      {
        "id": "",
        "name": "e-station2-axs.asia"
      },
      {
        "id": "",
        "name": "dpostr.cfd"
      },
      {
        "id": "",
        "name": "dokumentnik.si"
      },
      {
        "id": "",
        "name": "dhltracking-info.top"
      },
      {
        "id": "",
        "name": "dhlhomes-esde.cfd"
      },
      {
        "id": "",
        "name": "dhleshome-eshtml.life"
      },
      {
        "id": "",
        "name": "dhhii.cfd"
      },
      {
        "id": "",
        "name": "ctt-e.com"
      },
      {
        "id": "",
        "name": "cs4.jskcdns.net"
      },
      {
        "id": "",
        "name": "corrgodms.xyz"
      },
      {
        "id": "",
        "name": "cpcalendars.23-237-26-135.cprapid.com"
      },
      {
        "id": "",
        "name": "correo.host"
      },
      {
        "id": "",
        "name": "conta-google.com"
      },
      {
        "id": "",
        "name": "clasd.top"
      },
      {
        "id": "",
        "name": "canadapost-postescanada.store"
      },
      {
        "id": "",
        "name": "businessalerter.com"
      },
      {
        "id": "",
        "name": "belizepostalservice-gov.shop"
      },
      {
        "id": "",
        "name": "av2x.com"
      },
      {
        "id": "",
        "name": "auposteam.click"
      },
      {
        "id": "",
        "name": "aupostal.live"
      },
      {
        "id": "",
        "name": "anmpostt.top"
      },
      {
        "id": "",
        "name": "amazonvrc.co"
      },
      {
        "id": "",
        "name": "amazonztv.co"
      },
      {
        "id": "",
        "name": "amazonzgzc.co"
      },
      {
        "id": "",
        "name": "amazonzmc.co"
      },
      {
        "id": "",
        "name": "amazonzhzc.co"
      },
      {
        "id": "",
        "name": "amazonyyc.co"
      },
      {
        "id": "",
        "name": "amazonuyc.co"
      },
      {
        "id": "",
        "name": "amazontyc.co"
      },
      {
        "id": "",
        "name": "amazonoon.co"
      },
      {
        "id": "",
        "name": "amazonqmc.co"
      },
      {
        "id": "",
        "name": "amazonnetb.com"
      },
      {
        "id": "",
        "name": "amazonnec.co"
      },
      {
        "id": "",
        "name": "amazonmusiccode.com"
      },
      {
        "id": "",
        "name": "amazonfyc.co"
      },
      {
        "id": "",
        "name": "amazoncip.com"
      },
      {
        "id": "",
        "name": "amazoncot.com"
      },
      {
        "id": "",
        "name": "amazonche.com"
      },
      {
        "id": "",
        "name": "amazoncae.com"
      },
      {
        "id": "",
        "name": "amabrbr.com"
      },
      {
        "id": "",
        "name": "amabbr.com"
      },
      {
        "id": "",
        "name": "7777-bet.com"
      },
      {
        "id": "",
        "name": "us05webzoomus.world"
      },
      {
        "id": "",
        "name": "unpaid-ticket-ca.live"
      },
      {
        "id": "",
        "name": "ttrackshb.live"
      },
      {
        "id": "",
        "name": "temzdsf-burdsna-aldin-aldn.shop"
      },
      {
        "id": "",
        "name": "sogouocs.top"
      },
      {
        "id": "",
        "name": "smbccard-jp.sbs"
      },
      {
        "id": "",
        "name": "postas-mk.icu"
      },
      {
        "id": "",
        "name": "postas-md.icu"
      },
      {
        "id": "",
        "name": "posta-delivery.shop"
      },
      {
        "id": "",
        "name": "interactivebrokers-hk.icu"
      },
      {
        "id": "",
        "name": "estofetta.cfd"
      },
      {
        "id": "",
        "name": "entrpreneur.org"
      },
      {
        "id": "",
        "name": "dhill.cfd"
      },
      {
        "id": "",
        "name": "demo.bd2h.com"
      },
      {
        "id": "",
        "name": "delive-mx.top"
      },
      {
        "id": "",
        "name": "ddill.cfd"
      },
      {
        "id": "",
        "name": "correoargentina.sbs"
      },
      {
        "id": "",
        "name": "awj-waapp.top"
      },
      {
        "id": "",
        "name": "awz-waapp.top"
      },
      {
        "id": "",
        "name": "ad-telegran.shop"
      },
      {
        "id": "",
        "name": "bizlerle-endsiyi-budsaa-aldin-aldin.shop"
      },
      {
        "id": "",
        "name": "amazon-co-jp.shop"
      },
      {
        "id": "",
        "name": "townoflakelure.com"
      }
    ],
    "others": [
      {
        "id": "",
        "name": "spica.international"
      }
    ]
  },
  "external_refs": [
    "https://otx.alienvault.com/pulse/689453a1603f3d4b93557f2a"
  ]
}