{
  "name": "Tall Tales: How Chinese Actors Use Impersonation and Stolen Narratives to Perpetuate Digital Transnational Repression",
  "slug": "tall-tales-how-chinese-actors-use-impersonation-and-stolen-narratives-to-perpetuate-digital-transnational-repression",
  "description": "In collaboration with the International Consortium of Investigative Journalists (ICIJ), two distinct actor clusters aligned with the People's Republic of China were identified targeting journalists and civil society members. GLITTER CARP conducted widespread credential harvesting campaigns against Uyghur, Tibetan, Taiwanese, and Hong Kong diaspora activists, as well as journalists covering these communities, employing digital impersonation and fake security alerts while frequently reusing infrastructure. SEQUIN CARP specifically targeted journalists involved in ICIJ's China Targets investigation using sophisticated OAuth consent phishing attacks with well-developed personas based on co-opted narratives, though operational mistakes revealed poor persona management. Both campaigns demonstrate China's Military-Civil Fusion system leveraging private contractors to conduct digital transnational repression at scale, with targeting intensifying following the China Targets publication that exposed Chinese governme...",
  "published": "2026-04-28T07:09:29.540000+00:00",
  "created_at": "2026-04-28T14:36:31.730000+00:00",
  "modified_at": "2026-04-28T12:36:31+00:00",
  "created_at_opencti": "2026-04-28T14:36:31.730000+00:00",
  "author": "AlienVault",
  "confidence": 100,
  "report_types": [
    "threat-report"
  ],
  "labels": [
    "chinese contractors",
    "credential harvesting",
    "digital transnational repression",
    "glitter carp",
    "govershell",
    "healthkick",
    "impersonation campaigns",
    "journalist targeting",
    "oauth phishing",
    "sequin carp",
    "tibetan activists",
    "uyghur targeting"
  ],
  "tags": [
    "2026-04-28",
    "chinese contractors",
    "credential harvesting",
    "digital transnational repression",
    "glitter carp",
    "govershell",
    "healthkick",
    "impersonation campaigns",
    "journalist targeting",
    "oauth phishing",
    "sequin carp",
    "tibetan activists",
    "uyghur targeting"
  ],
  "related_entities": {
    "indicators": [
      {
        "id": "e162770e-3672-4d85-aedb-4b5789fd30a8",
        "name": "sharelinks.info"
      },
      {
        "id": "e12736b2-1237-4825-801b-143db9e1336a",
        "name": "entpoinat.com"
      },
      {
        "id": "3dca4f36-188d-4e34-b0f4-27483f287a85",
        "name": "myidsafety.com"
      },
      {
        "id": "cd3f7a97-6165-4264-b25a-51d734b46c57",
        "name": "userconsola.com"
      },
      {
        "id": "82727768-67a1-4043-b645-c9cc9318665e",
        "name": "https://a.web.oauth2-signal.com"
      },
      {
        "id": "0e409db3-f31a-4966-80a3-760ccf09c59d",
        "name": "dentialvault.com"
      },
      {
        "id": "8f7bb8b7-29e8-4384-8027-c77d1240c916",
        "name": "uzrconect.com"
      },
      {
        "id": "916cf36f-7e88-4f6a-a9da-3a67d7723537",
        "name": "gitlab-ai.com"
      },
      {
        "id": "547a6948-c874-4416-8f97-6506328a90be",
        "name": "accpanelcenter.com"
      },
      {
        "id": "85eb9fff-fb30-41c8-97c3-9e9aa7d31945",
        "name": "coincarp.cash"
      },
      {
        "id": "775b082a-05a4-4e4a-9ea8-9baa5dc2f3f6",
        "name": "useverifcation.com"
      },
      {
        "id": "a671b1ee-ded1-441a-b589-179eaebda951",
        "name": "profilesetup.com"
      },
      {
        "id": "f1080b35-7256-431a-b0e0-3f71a2a3f58d",
        "name": "startentry.com"
      },
      {
        "id": "d2091847-e778-4736-96ea-8004c214cae9",
        "name": "gearhelix.com"
      },
      {
        "id": "62269433-68db-4842-964d-e523d737ec18",
        "name": "identhubs.com"
      },
      {
        "id": "54a7031a-71ee-4b5e-b941-faf9cc8ed6de",
        "name": "signalgroup.me"
      },
      {
        "id": "147ca246-e7fa-4d9e-ba7c-de48baa61227",
        "name": "logncntr.com"
      },
      {
        "id": "8cb107ab-f008-4b13-9a47-710c44d4264a",
        "name": "controlprofile.com"
      },
      {
        "id": "5ab6754e-09d7-455f-bfc0-77d25f7b6518",
        "name": "mlinks.info"
      },
      {
        "id": "e2443179-b7b3-4906-8c5b-943c077225ca",
        "name": "syandbly.online"
      },
      {
        "id": "94bc7e11-d557-4042-87de-13d883b7f51e",
        "name": "memburcenter.com"
      },
      {
        "id": "2922cc0a-80d5-45c3-8fa1-730eb6843f2e",
        "name": "chinadigitaltime.net"
      },
      {
        "id": "7daadb70-d031-41b3-a242-606ca94b45c3",
        "name": "loginnetal.com"
      },
      {
        "id": "9edfaa02-65be-4331-b101-22f6fc8dabaf",
        "name": "accountcentar.com"
      },
      {
        "id": "913a0e72-74eb-4793-9879-a908269c9277",
        "name": "usrcntr.com"
      },
      {
        "id": "e6f7cd14-2de3-4344-a7cb-26382559992d",
        "name": "odview.live"
      },
      {
        "id": "9b65c298-e148-48cd-a406-9ddb750c30e2",
        "name": "https://a.web.oauth2-signal.com/gm-oauth2-callback"
      },
      {
        "id": "58ed70c7-aab0-4a0f-b14a-2362cc57b014",
        "name": "icjiorg.org"
      },
      {
        "id": "ea818cfd-47e8-47aa-ae1f-f28fa0abbf45",
        "name": "akountcenter.com"
      },
      {
        "id": "e45658d9-67a4-4b4a-8cbe-855f2a5b67b7",
        "name": "configuramgr.com"
      },
      {
        "id": "774bc978-36e7-47c2-b439-4b9473fee43d",
        "name": "useradjust.com"
      },
      {
        "id": "08d8a118-dccc-4051-a426-df734510fa99",
        "name": "logifycenter.com"
      },
      {
        "id": "4fc6ae36-9523-4c4c-866d-0fdd50079308",
        "name": "showthetrick.com"
      },
      {
        "id": "48ad4df1-8871-421b-9397-7156e468eb17",
        "name": "guidefixit.com"
      },
      {
        "id": "2c3c44c7-c8fb-41e1-b6ff-ccc2d5254e28",
        "name": "epochtimes.entryfortify.com"
      },
      {
        "id": "d0f99b0c-6d3f-4ee9-889c-8598badcb153",
        "name": "entrnow.com"
      },
      {
        "id": "09e7d7f3-77e2-4b64-a22a-4700d846088c",
        "name": "oauth2-signal.com"
      },
      {
        "id": "4a647f2d-735d-4253-8f2a-e16577e90455",
        "name": "verifcredentia.com"
      },
      {
        "id": "79626d2f-2819-46cc-98e7-15e15d1649f4",
        "name": "accopanel.com"
      },
      {
        "id": "6fa66116-76d2-4b1e-8bba-6094e55abf22",
        "name": "entryfortify.com"
      },
      {
        "id": "55701cde-3a53-46ca-b044-6f0f69b30ee6",
        "name": "browsernotifications.info"
      },
      {
        "id": "a83fb35d-cb98-40fe-af7c-52f4bf47a3d4",
        "name": "setuppanel.com"
      },
      {
        "id": "4456180d-2319-4fd7-b37f-65cdc3b8e68e",
        "name": "vibshare.me"
      },
      {
        "id": "dceaf441-78ef-4699-b669-be781c867391",
        "name": "hsf898.com"
      },
      {
        "id": "d6a37e13-c09d-43c1-a8ad-19c0e34e2fa0",
        "name": "profilemgr.com"
      },
      {
        "id": "3c784482-1c51-4665-a4ea-bf98771b4742",
        "name": "acctune.com"
      },
      {
        "id": "40474412-858a-4fb8-9d66-3d3f2d56684c",
        "name": "logncenter.com"
      },
      {
        "id": "fa774b0a-fec4-4b78-81a0-9eb68aa7d634",
        "name": "touzhele.fun"
      },
      {
        "id": "16b9a6ec-c1c0-4188-a033-1b5fb44c000f",
        "name": "ifans.online"
      },
      {
        "id": "e2ae3dfc-8dd9-4d4f-8f26-9f0ed33bdbdc",
        "name": "guardaccount.com"
      },
      {
        "id": "b7673e6b-1baf-4f78-91a5-5162c549b869",
        "name": "userhup.com"
      },
      {
        "id": "e798b4e8-dd06-4c73-9973-c8da35ba0ea8",
        "name": "controhub.com"
      },
      {
        "id": "a0f2e607-17f8-4b29-a0cf-a398351eb970",
        "name": "acespoint.com"
      },
      {
        "id": "9c043abd-57d8-49d6-9204-c8ce565df5f0",
        "name": "megaview.click"
      },
      {
        "id": "bf85c1e6-131b-49ee-8143-a595b38a17b8",
        "name": "breachforums.fit"
      },
      {
        "id": "aecf513b-d9bb-49f5-8702-ca04239c07e0",
        "name": "myacceshub.com"
      },
      {
        "id": "ae8a972b-a672-4304-a46b-ba0ab431c156",
        "name": "siginpro.com"
      },
      {
        "id": "b2135af3-f481-4342-ae5f-140ef0730288",
        "name": "usrkonnect.com"
      },
      {
        "id": "49b468f3-a6da-41e2-af67-e3491c178113",
        "name": "epechtimes0.org"
      },
      {
        "id": "b4e662ed-0748-4626-8825-61839308d798",
        "name": "sharedrive.cloud"
      },
      {
        "id": "9eb46dda-e997-4c65-abb2-8b88a0744f9a",
        "name": "lineman.live"
      },
      {
        "id": "85dd952f-b5f4-49d4-89a2-e8895228e2b0",
        "name": "linkshub.info"
      },
      {
        "id": "9d4270d9-2171-4f52-855c-11d0a3c45602",
        "name": "profileub.com"
      },
      {
        "id": "387f0e60-f6a7-4b75-8474-a4095a755988",
        "name": "signncenter.com"
      },
      {
        "id": "ecab6bc8-a5db-4c8f-a244-fa573dce8673",
        "name": "ocspilots.com"
      },
      {
        "id": "c5925c1c-2478-4c4c-9f1c-96f6f5f605f1",
        "name": "vonxnews.com"
      },
      {
        "id": "91afc648-d4a0-4b16-b817-5b01db908a77",
        "name": "acesportal.com"
      },
      {
        "id": "9c8ed047-7ccf-4445-989f-f9bd455255ae",
        "name": "userhubz.com"
      },
      {
        "id": "e2ac6da1-3057-4bcc-81a7-e12ac2764ab6",
        "name": "identihive.com"
      },
      {
        "id": "b189c3e7-0aa4-4628-b512-47cebc898dc6",
        "name": "fileprev.com"
      },
      {
        "id": "9a5ee868-4cdd-4428-a476-221524058451",
        "name": "odsync.cloud"
      },
      {
        "id": "e9845f78-5251-4a83-917b-fb36a61f07f6",
        "name": "2fa.web.oauth2-signal.com"
      },
      {
        "id": "501f7d86-b6e9-4cd4-ab73-28947c734d08",
        "name": "voinewz.com"
      },
      {
        "id": "51981598-bf84-4970-abd4-792b5da2dea1",
        "name": "loginshiled.com"
      },
      {
        "id": "f4983827-87c4-4b65-89ab-e509a7175642",
        "name": "google-document.com"
      },
      {
        "id": "4d81f169-e53f-4b58-ab61-1950a8d605d1",
        "name": "signinacesspoint.com"
      },
      {
        "id": "52442b68-16b2-4756-9ba6-a56b3580e21a",
        "name": "usercontropanel.com"
      },
      {
        "id": "51bcfb5e-c967-417a-81cb-318d004771ee",
        "name": "neuralgiavista.com"
      },
      {
        "id": "a853c44a-07a0-40a7-b841-5bc96c2a16ba",
        "name": "brighterora.com"
      },
      {
        "id": "40aba7a8-28d2-4c02-af9e-1b0a11b94f31",
        "name": "fileprev.info"
      },
      {
        "id": "261b84b0-48a9-4924-80e6-350b1874ee3a",
        "name": "a.web.oauth2-signal.com"
      },
      {
        "id": "eb9c356f-0776-4c97-803f-aac8118e6747",
        "name": "globalobject.console.info"
      },
      {
        "id": "317b998f-048b-4294-beb0-2b4b9356fd18",
        "name": "signcenterr.com"
      },
      {
        "id": "bd0c77a2-8a7f-4bd6-b90f-7a4038830c52",
        "name": "interfacily.com"
      },
      {
        "id": "422647ba-f3d8-4362-99aa-81d59c4043b0",
        "name": "uzrcenter.com"
      },
      {
        "id": "47fb2a96-5ef0-48a9-9c5f-b36d734d1683",
        "name": "mercatdegirona.com"
      },
      {
        "id": "71278d94-dbf4-47f8-903c-3599375fbab5",
        "name": "useracess.com"
      },
      {
        "id": "8a378173-2d8e-4ee9-8497-f1bcf383fc4b",
        "name": "openlabc.com"
      },
      {
        "id": "f1b23b5b-4ea2-4b08-8ef6-61661617c513",
        "name": "signinacessint.com"
      },
      {
        "id": "1fbce35c-027c-4d12-81ea-995978a7b8b9",
        "name": "coupangrank.kr"
      },
      {
        "id": "fa608c33-f232-4701-89d6-00d6d0b6e5d1",
        "name": "proflcntr.com"
      },
      {
        "id": "8b8c2c62-8df1-4b66-9133-d81868f1247e",
        "name": "youtubenet.com"
      },
      {
        "id": "ed6c6ed5-26fc-452e-98b0-269e140d83e3",
        "name": "configalign.com"
      },
      {
        "id": "84334a86-c120-4c4a-8ba8-158923e7d758",
        "name": "1drv.one"
      },
      {
        "id": "bb84d057-161d-4707-800d-b84ff161877a",
        "name": "akounthub.com"
      },
      {
        "id": "0d19dfdf-5b74-4906-a664-09e8198a2fc4",
        "name": "pornhub-net.com"
      },
      {
        "id": "729d39d7-0c49-466d-b64f-985ebd94ab93",
        "name": "feelitnov.com"
      },
      {
        "id": "05fd5aa2-2179-4b3e-95d5-6d53e270a40b",
        "name": "profilesetop.com"
      },
      {
        "id": "f1f0770f-becb-46fd-9e2d-0c462602edd7",
        "name": "authinityapp.com"
      },
      {
        "id": "e0e87250-8fa2-42ba-bc6d-4ebb9c7a3615",
        "name": "personalsafezone.com"
      },
      {
        "id": "ed94398f-87af-445b-ba39-8c5ab177c34d",
        "name": "https://sctapi.ftqq.com:443/SCT96188ToxRyYX7UWYhASIGRXfL7AAzv.send?title=Gmail&desp=Mozilla%2F5.0%20"
      },
      {
        "id": "c59f5612-5e59-405f-82b4-74cd6c4b6fe9",
        "name": "gnews.news"
      },
      {
        "id": "c15a683c-2f86-42ee-bf4c-5ea6fb7f833d",
        "name": "redi.ink"
      },
      {
        "id": "3e89a81c-4c46-4f13-b087-a53bf06882d8",
        "name": "passionateboomers.com"
      },
      {
        "id": "9702f3ed-207f-493f-9035-e2d19a101b08",
        "name": "accntcntr.com"
      },
      {
        "id": "cc5a155f-393e-4124-98be-ff59914257ab",
        "name": "usergateaccess.com"
      },
      {
        "id": "2aa7cd34-d100-4121-97ce-0acf16cbd9ac",
        "name": "lgtymp.fit"
      },
      {
        "id": "7deb2010-6c51-4433-b14d-8a2465ede77e",
        "name": "uzrconnect.com"
      },
      {
        "id": "6dee9866-e02c-4681-aaf2-034742624606",
        "name": "oneclickautht.com"
      },
      {
        "id": "1605b070-ac4b-4dc5-be04-c5ec2608c3c7",
        "name": "evtreview.com"
      },
      {
        "id": "e259ba38-87c6-4375-ba55-774963377aee",
        "name": "novamecha.com"
      },
      {
        "id": "aa6bd9e9-e844-4afe-8e43-dc6eedaa3582",
        "name": "userpref.com"
      },
      {
        "id": "207d1c57-f690-4dcb-b8d9-09b8bf366942",
        "name": "deeporbiton.com"
      },
      {
        "id": "12b8bb41-5bbf-43df-8ecc-bf771175d49f",
        "name": "https://megaview.click/pdf_to_scilla"
      },
      {
        "id": "927a4fe1-7390-48b9-8bbd-5a274e853b8e",
        "name": "entrzone.com"
      },
      {
        "id": "9666d346-bea7-4833-be40-d2d8233d6132",
        "name": "ivycemnp.com"
      },
      {
        "id": "4fa6549c-e583-4d3b-a22a-be7b30d775ba",
        "name": "userportl.wine"
      },
      {
        "id": "9a31def8-b59e-46a5-93b7-37c5af416801",
        "name": "secureagate.com"
      },
      {
        "id": "92ea3cb1-4fa7-42b0-a495-017659f8e370",
        "name": "telegra.live"
      },
      {
        "id": "a6a30d10-c1f6-4f67-af2e-0d30bf6db821",
        "name": "https://sctapi.ftqq.com"
      },
      {
        "id": "99f59c82-3ecd-480a-a12d-d549ffb3f766",
        "name": "lineme.live"
      },
      {
        "id": "7c65cdfb-9dec-4ac5-b582-f9d2d5c198e0",
        "name": "https://sctapi.ftqq.com:443/SCT269149TJZWARwQ76bEWeM6Vjrgih583.send?title=Gmail&desp=3D[TARGET"
      },
      {
        "id": "eaed0b7d-46aa-4eae-ba4b-62f68b3ad210",
        "name": "mmbrhub.com"
      },
      {
        "id": "a87fae78-6c36-466e-9aa3-15f9c91c9d15",
        "name": "signivaullt.com"
      },
      {
        "id": "a0e80e5d-84ce-477c-b770-1f1a8dee0241",
        "name": "odsync.live"
      },
      {
        "id": "db2128a3-b0a2-4c15-a429-0b33d9ec007f",
        "name": "oauth-api.com"
      },
      {
        "id": "a54c1c6f-154a-4e1c-81f7-97187a0c252a",
        "name": "entruhub.com"
      },
      {
        "id": "9ebe252e-e17b-48b6-b40b-f60a9be8a23f",
        "name": "givemethedge.com"
      },
      {
        "id": "2a09ad54-c5ff-4a1d-aede-c147f961cc8c",
        "name": "sctapi.ftqq.com"
      },
      {
        "id": "29f77f35-011c-412c-baac-fe5d91404c48",
        "name": "protectehub.com"
      },
      {
        "id": "af483733-2d18-4780-96e8-fc3a033f7f89",
        "name": "userpanell.com"
      },
      {
        "id": "1284aaed-f0bd-4137-aed7-5ada4a421f61",
        "name": "entgate.com"
      }
    ],
    "attack_patterns": [
      {
        "id": "00430919-9257-403b-8a1b-958d4c3613aa",
        "name": "T1557"
      },
      {
        "id": "2ab37c37-62b9-4750-bfb0-c692ccdd36ac",
        "name": "T1114.002"
      },
      {
        "id": "6ccd4566-e15e-40cf-b7df-4a3f737ce5cd",
        "name": "T1036.005"
      },
      {
        "id": "5c67e5d2-bc85-4ce0-822d-f2f5d3b0ae4e",
        "name": "T1185"
      },
      {
        "id": "0b2b1ecd-d52e-492a-af08-050954bc03e5",
        "name": "T1056"
      },
      {
        "id": "7e3e3784-9547-42ca-b888-482972d14be3",
        "name": "T1528"
      },
      {
        "id": "7d7ac733-6442-416f-8669-c302dd0843b9",
        "name": "T1036"
      },
      {
        "id": "63567f6b-fd33-4e9f-b631-48dd6fd02c21",
        "name": "T1557.002"
      },
      {
        "id": "d9b45b3b-d093-4016-89e9-48f31ff4d05d",
        "name": "T1566"
      },
      {
        "id": "2969e5a7-1049-4df8-b1ba-8a0675de6b94",
        "name": "T1589"
      },
      {
        "id": "c10eac8a-a5d7-465a-b557-8a1f7fc6ef99",
        "name": "T1598.003"
      },
      {
        "id": "dc410646-9cdd-427b-92e7-179a54f78f90",
        "name": "T1566.001"
      },
      {
        "id": "5bab4974-1fc2-4144-b093-28ebcb8767dc",
        "name": "T1114"
      },
      {
        "id": "b7c6c1ad-f183-4128-8427-3891029c73dc",
        "name": "T1539"
      },
      {
        "id": "74d5f31c-5e2d-4aed-b8b9-4fabdde76dfa",
        "name": "T1598"
      },
      {
        "id": "6efb8bea-11d7-418d-a429-9f4a3e6c50f6",
        "name": "T1087"
      },
      {
        "id": "52b92395-d3d3-4e05-976a-0fccccfce8d2",
        "name": "T1566.002"
      },
      {
        "id": "e263a16c-ab5b-4196-8194-1906be1fabc4",
        "name": "T1056.003"
      },
      {
        "id": "a6b6df0a-93c1-4ddf-8403-2bc47590f9fe",
        "name": "T1087.001"
      },
      {
        "id": "e948db36-930d-4013-99ed-fdf14b65907e",
        "name": "T1589.002"
      },
      {
        "id": "7c497590-4975-4cec-b8c6-e94966b6e9c3",
        "name": "T1087.004"
      }
    ],
    "malware": [
      {
        "id": "c8c7c31d-b66a-4c2a-ad65-fcd1dbc6593f",
        "name": "GOVERSHELL",
        "slug": "govershell"
      },
      {
        "id": "c65b8693-ee10-47e9-a2be-8832d190e262",
        "name": "HealthKick",
        "slug": "healthkick"
      }
    ],
    "observables": [
      {
        "id": "2eb29387-e373-4d66-8ee4-2dfc10c5a78d",
        "name": "identhubs.com"
      },
      {
        "id": "0d82b8cb-3ee8-4170-86b3-aef06e71a4df",
        "name": "usrkonnect.com"
      },
      {
        "id": "fd066a9a-6af0-4234-9593-271d4d0b3872",
        "name": "odview.live"
      },
      {
        "id": "377b5bb1-4846-4523-af53-20ba8c4460f1",
        "name": "google-document.com"
      },
      {
        "id": "17d91dbd-ae80-4662-bbc4-133b397cb178",
        "name": "dentialvault.com"
      },
      {
        "id": "3eb26856-6ad4-425e-b9bb-b2217f044c1d",
        "name": "ocspilots.com"
      },
      {
        "id": "5cf16e36-66b6-44de-9737-9473a467fdcd",
        "name": "usergateaccess.com"
      },
      {
        "id": "840b0945-71bf-4cff-968f-9653e460515e",
        "name": "gitlab-ai.com"
      },
      {
        "id": "28be7648-8a46-4721-8658-9453ae16595d",
        "name": "profilesetup.com"
      },
      {
        "id": "40081dfd-6dec-41d9-b0b3-26c844c5a992",
        "name": "signncenter.com"
      },
      {
        "id": "0cdb2492-576b-4b41-b177-dec063bc008b",
        "name": "chinadigitaltime.net"
      },
      {
        "id": "c6a15e27-2d27-4476-b2c1-eee0a7c6c7ce",
        "name": "givemethedge.com"
      },
      {
        "id": "6e27d5b0-b71b-4459-9fb7-743b40d226f5",
        "name": "gearhelix.com"
      },
      {
        "id": "48dab0d1-0a6f-496b-a388-aff43fdf147e",
        "name": "mmbrhub.com"
      },
      {
        "id": "d172fe4a-4c69-4a30-a91a-9689d2d9b685",
        "name": "usercontropanel.com"
      },
      {
        "id": "9c37adff-e36a-479d-9e42-91f1ff6eeeac",
        "name": "useverifcation.com"
      },
      {
        "id": "51b4a199-61f2-4744-9611-d47fdb1f5f32",
        "name": "uzrconnect.com"
      },
      {
        "id": "bb03b554-3023-4f07-906e-853a14454e17",
        "name": "signalgroup.me"
      },
      {
        "id": "6e6eddb4-12b3-4456-9bc4-ed6f2d1078e8",
        "name": "interfacily.com"
      },
      {
        "id": "26fedba9-b4fd-4bd0-9df8-bab5cb918d8c",
        "name": "1drv.one"
      },
      {
        "id": "ed0b45a5-6cd5-4de5-a03c-32240f6caa91",
        "name": "neuralgiavista.com"
      },
      {
        "id": "004d372d-fcab-47ba-a6ec-8f725ab07936",
        "name": "profilesetop.com"
      },
      {
        "id": "5f072262-1236-4f76-a696-0d9e552df6e7",
        "name": "verifcredentia.com"
      },
      {
        "id": "a4c50592-03a9-4220-98ff-ecba886e21ee",
        "name": "openlabc.com"
      },
      {
        "id": "96d1c829-8082-4c6f-9fd4-a1b8b4fb3e7a",
        "name": "authinityapp.com"
      },
      {
        "id": "8835d30f-8777-4dbb-a277-5eee34f745e9",
        "name": "mercatdegirona.com"
      },
      {
        "id": "5199cd7d-5ca4-4762-bf82-8152c410ecad",
        "name": "sharedrive.cloud"
      },
      {
        "id": "6b3f919d-be47-43c3-a37e-abc966ab7943",
        "name": "telegra.live"
      },
      {
        "id": "0481e852-2f50-4267-aa4b-7495c036b7e1",
        "name": "userhubz.com"
      },
      {
        "id": "49da4a15-1ebd-433d-b4ea-e11f18573edf",
        "name": "profilemgr.com"
      },
      {
        "id": "7ca311c4-bc39-469c-88be-14d640a1413d",
        "name": "vonxnews.com"
      },
      {
        "id": "250e0e94-9a62-4b77-8113-62cdc0c30e9a",
        "name": "passionateboomers.com"
      },
      {
        "id": "fd844609-0ce0-417c-a73b-ab142ecdaa22",
        "name": "guardaccount.com"
      },
      {
        "id": "62db1a9f-d380-40aa-b9b5-16760e1e0da7",
        "name": "accopanel.com"
      },
      {
        "id": "1063fe23-f28f-4079-8370-a93d4b590472",
        "name": "coupangrank.kr"
      },
      {
        "id": "b260b2bc-5fb6-4c66-8110-82f09def2b9f",
        "name": "megaview.click"
      },
      {
        "id": "1a837819-dc45-4bf2-ad1d-121ae9364edc",
        "name": "userconsola.com"
      },
      {
        "id": "3042ac3e-3ab4-498b-a992-48abf4f50bed",
        "name": "fileprev.info"
      },
      {
        "id": "3f2a0874-6b90-4ba1-a906-4925afe45d60",
        "name": "entryfortify.com"
      },
      {
        "id": "19f2ee05-6e24-443f-9747-a47d54a50aa6",
        "name": "odsync.live"
      },
      {
        "id": "3bfbf07c-942a-41be-b175-428209df254e",
        "name": "secureagate.com"
      },
      {
        "id": "e87f8287-dd83-4da0-9313-9f8173d1eb68",
        "name": "akounthub.com"
      },
      {
        "id": "f6565a50-c51b-44f4-b7f1-6a88dd4f49f2",
        "name": "logifycenter.com"
      },
      {
        "id": "50ad0f86-9ab1-4fdb-aed2-98219d1fdf70",
        "name": "signcenterr.com"
      },
      {
        "id": "38c70766-509e-4f53-9d36-19399390e87b",
        "name": "usrcntr.com"
      },
      {
        "id": "a82323f9-5c28-45d9-a4e2-c39ce564b816",
        "name": "acctune.com"
      },
      {
        "id": "f5aa36f8-ff8a-4693-bb9b-31cb9d0abe0e",
        "name": "loginnetal.com"
      },
      {
        "id": "a4ec416c-f795-4a1c-a1d9-81a1a7c91e74",
        "name": "siginpro.com"
      },
      {
        "id": "406c547d-04d1-4cfd-bcbc-e504b3a0477b",
        "name": "configalign.com"
      },
      {
        "id": "2b155164-2c3e-449e-9b65-ade67847f1ed",
        "name": "proflcntr.com"
      },
      {
        "id": "54c72962-ef65-4378-a23b-7124323eb409",
        "name": "guidefixit.com"
      },
      {
        "id": "5f9ed33b-987b-45d7-9585-31e2b7532778",
        "name": "uzrcenter.com"
      },
      {
        "id": "1544bac9-7604-4133-bda6-c818cd0a8e7f",
        "name": "entpoinat.com"
      },
      {
        "id": "3078ada8-acbd-4c1c-a2dd-41126db5495a",
        "name": "coincarp.cash"
      },
      {
        "id": "93eb72d5-a3ab-42d9-8c4a-fedb7afcb75a",
        "name": "loginshiled.com"
      },
      {
        "id": "9557d7c3-d806-4777-9131-3faa7b2b5b3f",
        "name": "breachforums.fit"
      },
      {
        "id": "a4b1c32d-daad-4f67-adeb-c80b7196b68b",
        "name": "ifans.online"
      },
      {
        "id": "eecb4097-7c7e-44a0-b808-c3a2e8c80a8c",
        "name": "pornhub-net.com"
      },
      {
        "id": "2804c129-141b-4e17-ab5f-44fb35146803",
        "name": "lgtymp.fit"
      },
      {
        "id": "dbdc6cba-33d4-40b4-872d-e38ed7d366a8",
        "name": "lineme.live"
      },
      {
        "id": "4b203482-e4a7-4c43-870d-2ccfd0d6cc18",
        "name": "signinacessint.com"
      },
      {
        "id": "3150c9ff-b582-4c72-92cd-18f0f47cc23a",
        "name": "personalsafezone.com"
      },
      {
        "id": "b3fd9e1b-255b-45e5-90ce-e281f7f5a98a",
        "name": "myacceshub.com"
      },
      {
        "id": "d7ec4bd5-8b46-42e6-8710-29d9115454c9",
        "name": "deeporbiton.com"
      },
      {
        "id": "2376a4fa-1c85-498a-924e-bb3800e836a6",
        "name": "myidsafety.com"
      },
      {
        "id": "66da58f4-ceab-4276-a74c-7c376f628d55",
        "name": "linkshub.info"
      },
      {
        "id": "e111a8c5-1497-45ec-8cba-14b8b279ebeb",
        "name": "userpref.com"
      },
      {
        "id": "b75c26a0-6832-4980-8770-2160b4e003d2",
        "name": "oneclickautht.com"
      },
      {
        "id": "fff93b94-a8b2-4cf0-a8e4-957ba9494678",
        "name": "entrnow.com"
      },
      {
        "id": "9c252e84-f6c0-4048-be1d-c98d83370961",
        "name": "evtreview.com"
      },
      {
        "id": "74abfdb6-11d5-47ac-afc4-2824c4f5a1f6",
        "name": "uzrconect.com"
      },
      {
        "id": "7c7925c4-1140-405f-bdae-3c29271d1413",
        "name": "userpanell.com"
      },
      {
        "id": "3d2f0798-b08d-4cde-9319-006ea342cfac",
        "name": "signinacesspoint.com"
      },
      {
        "id": "32d4ce5f-a45d-40f3-97f8-ac5a899a49d0",
        "name": "vibshare.me"
      },
      {
        "id": "7a1d9612-d876-4c6b-9df9-c02c375ae884",
        "name": "gnews.news"
      },
      {
        "id": "2496ac7f-5527-4be8-b39f-46e3d60a04ce",
        "name": "useradjust.com"
      },
      {
        "id": "85a692be-2b17-457b-8f7c-9fa9e787948d",
        "name": "ivycemnp.com"
      },
      {
        "id": "1d2cdc0e-4443-45e8-bd77-9c5042ad1e87",
        "name": "userhup.com"
      },
      {
        "id": "0c17e4b6-fea0-4c1a-8da8-1a89ac8d2d72",
        "name": "brighterora.com"
      },
      {
        "id": "6517958a-4019-49e1-9745-cb34181d9a7b",
        "name": "acespoint.com"
      },
      {
        "id": "fcde2ed2-f8a8-4ba6-b98c-3a104a65ee6b",
        "name": "akountcenter.com"
      },
      {
        "id": "0e97fb16-648b-485b-b19b-bc2cc3d7c04c",
        "name": "lineman.live"
      },
      {
        "id": "d61d2079-d3c6-4bdd-bb76-fd852ddfe1c5",
        "name": "entgate.com"
      },
      {
        "id": "404f6814-418c-4e88-8609-3648949faf97",
        "name": "showthetrick.com"
      },
      {
        "id": "2fb16e22-3b8a-40f3-b00b-e8cdad4e37a5",
        "name": "voinewz.com"
      },
      {
        "id": "519ecdb1-1a12-436b-bcdf-d20fe1e37390",
        "name": "accountcentar.com"
      },
      {
        "id": "bca01f41-912f-4f5d-b187-8f3895a40b5c",
        "name": "oauth2-signal.com"
      },
      {
        "id": "3e2c20b5-b694-485e-8ee3-c318f6909313",
        "name": "acesportal.com"
      },
      {
        "id": "7e31d5b0-cbf7-4fbc-abd6-a2215ab6fb34",
        "name": "logncntr.com"
      },
      {
        "id": "de542140-d55f-4e4c-b0bd-59df90a11184",
        "name": "hsf898.com"
      },
      {
        "id": "6234d67d-655d-4007-8b4a-7bb1b3757334",
        "name": "identihive.com"
      },
      {
        "id": "9e82955f-5e95-40aa-8012-c72912568141",
        "name": "mlinks.info"
      },
      {
        "id": "26f2e9f7-2c5e-4462-9c8e-8dd19037367f",
        "name": "sharelinks.info"
      },
      {
        "id": "4d2b6cef-4475-461e-a931-84ec7d799f2f",
        "name": "entrzone.com"
      },
      {
        "id": "9dded246-465e-492f-9748-c7dac2bc51de",
        "name": "novamecha.com"
      },
      {
        "id": "fe8811b2-4060-47d3-ad01-a6b0b706394c",
        "name": "oauth-api.com"
      },
      {
        "id": "8bc07b8f-bb94-435e-8f3f-cefbd0190cf4",
        "name": "epechtimes0.org"
      },
      {
        "id": "9dcfe216-39cb-4cc3-8507-19452b7617f1",
        "name": "accntcntr.com"
      },
      {
        "id": "7dee7bb3-8275-4371-aeff-ba82e10e96bb",
        "name": "configuramgr.com"
      },
      {
        "id": "fb3816ea-e489-4583-84e9-507c3ef87c30",
        "name": "useracess.com"
      },
      {
        "id": "3255c919-7ec8-42e4-9b07-c6df82234307",
        "name": "protectehub.com"
      },
      {
        "id": "a7034545-f1ea-4648-a6a4-0a2bb694ea6b",
        "name": "controlprofile.com"
      },
      {
        "id": "7c57c7e2-69ec-434d-b970-0cb273d19660",
        "name": "entruhub.com"
      },
      {
        "id": "702ee5ef-8f41-41f1-9943-336baf8deaab",
        "name": "syandbly.online"
      },
      {
        "id": "51a4d9b1-053c-4ecc-a35d-31484363be33",
        "name": "fileprev.com"
      },
      {
        "id": "bb42c579-af5b-442e-98ac-e5b7c54a42d4",
        "name": "memburcenter.com"
      },
      {
        "id": "f37764bf-a91b-413b-8af0-5773f1a9205a",
        "name": "controhub.com"
      },
      {
        "id": "254501dd-ab3b-485e-b3fa-fab4e2927afc",
        "name": "setuppanel.com"
      },
      {
        "id": "cf10a84b-c3cf-4411-8544-391d2d888595",
        "name": "icjiorg.org"
      },
      {
        "id": "8efcd585-29af-4142-8bd2-d1faa3dd43fc",
        "name": "browsernotifications.info"
      },
      {
        "id": "b51073d1-999c-4429-9d06-c7d06da0865f",
        "name": "signivaullt.com"
      },
      {
        "id": "56105119-af46-4a18-b30e-77548725eed8",
        "name": "accpanelcenter.com"
      },
      {
        "id": "9b6d0dd5-8c68-4d1b-b4d9-edee1160ee1c",
        "name": "touzhele.fun"
      },
      {
        "id": "21b30b88-4781-448b-aae3-863ab3d9f3e4",
        "name": "startentry.com"
      },
      {
        "id": "b87cfd30-ce88-4970-873b-62728ecbea6e",
        "name": "redi.ink"
      },
      {
        "id": "562b0e7e-3783-41a1-ac42-d6786252a76c",
        "name": "odsync.cloud"
      },
      {
        "id": "c73dd2bb-70d5-43cd-8669-b29ee009e1b2",
        "name": "logncenter.com"
      },
      {
        "id": "2a42a94a-bf57-4074-9d5a-fa72eea99f0c",
        "name": "feelitnov.com"
      },
      {
        "id": "5c850e2e-afe8-41b1-91ae-1b253321e99a",
        "name": "youtubenet.com"
      },
      {
        "id": "87f3a560-1136-4d83-98b9-daf0aab192eb",
        "name": "userportl.wine"
      },
      {
        "id": "7ba89430-de83-4ab5-b25f-058f65bb5dba",
        "name": "profileub.com"
      },
      {
        "id": "009024c1-8982-4661-9d02-00c8cb48c97b",
        "name": "sctapi.ftqq.com"
      },
      {
        "id": "86c7d8b8-2dd0-4ddd-99a5-9b62fe14a024",
        "name": "globalobject.console.info"
      },
      {
        "id": "5e96d23f-2a95-41b0-8d91-0893bc0d9831",
        "name": "2fa.web.oauth2-signal.com"
      },
      {
        "id": "733c2864-dd0e-4b39-9099-5f410e8ab84f",
        "name": "epochtimes.entryfortify.com"
      },
      {
        "id": "8cc0e144-3a72-4d22-8fde-bfda0da9f5a3",
        "name": "a.web.oauth2-signal.com"
      },
      {
        "id": "f654b0ce-fea7-4984-8d36-16ece2b4303c",
        "name": "https://megaview.click/pdf_to_scilla"
      },
      {
        "id": "364e6780-8b30-478a-b8cd-d9159f7dfa92",
        "name": "https://sctapi.ftqq.com:443/SCT269149TJZWARwQ76bEWeM6Vjrgih583.send?title=Gmail&desp=3D[TARGET"
      },
      {
        "id": "7dbb293e-ce1c-4c7e-81c6-c361f4f2d37f",
        "name": "https://a.web.oauth2-signal.com"
      },
      {
        "id": "602897ad-962a-41e0-ba6f-71ad75bac4c8",
        "name": "https://sctapi.ftqq.com:443/SCT96188ToxRyYX7UWYhASIGRXfL7AAzv.send?title=Gmail&desp=Mozilla%2F5.0%20"
      },
      {
        "id": "fb51f32a-e5c7-4ea4-bba8-75f329af45df",
        "name": "https://a.web.oauth2-signal.com/gm-oauth2-callback"
      },
      {
        "id": "4087f185-e6fe-41a8-bbd6-c7db5a98b9e4",
        "name": "https://sctapi.ftqq.com"
      }
    ],
    "others": [
      {
        "id": "",
        "name": "Media"
      },
      {
        "id": "",
        "name": "NGO"
      },
      {
        "id": "",
        "name": "sharelinks.info"
      },
      {
        "id": "",
        "name": "entpoinat.com"
      },
      {
        "id": "",
        "name": "myidsafety.com"
      },
      {
        "id": "",
        "name": "userconsola.com"
      },
      {
        "id": "",
        "name": "dentialvault.com"
      },
      {
        "id": "",
        "name": "uzrconect.com"
      },
      {
        "id": "",
        "name": "gitlab-ai.com"
      },
      {
        "id": "",
        "name": "accpanelcenter.com"
      },
      {
        "id": "",
        "name": "coincarp.cash"
      },
      {
        "id": "",
        "name": "useverifcation.com"
      },
      {
        "id": "",
        "name": "profilesetup.com"
      },
      {
        "id": "",
        "name": "startentry.com"
      },
      {
        "id": "",
        "name": "gearhelix.com"
      },
      {
        "id": "",
        "name": "identhubs.com"
      },
      {
        "id": "",
        "name": "signalgroup.me"
      },
      {
        "id": "",
        "name": "logncntr.com"
      },
      {
        "id": "",
        "name": "controlprofile.com"
      },
      {
        "id": "",
        "name": "mlinks.info"
      },
      {
        "id": "",
        "name": "syandbly.online"
      },
      {
        "id": "",
        "name": "memburcenter.com"
      },
      {
        "id": "",
        "name": "chinadigitaltime.net"
      },
      {
        "id": "",
        "name": "loginnetal.com"
      },
      {
        "id": "",
        "name": "accountcentar.com"
      },
      {
        "id": "",
        "name": "usrcntr.com"
      },
      {
        "id": "",
        "name": "odview.live"
      },
      {
        "id": "",
        "name": "icjiorg.org"
      },
      {
        "id": "",
        "name": "akountcenter.com"
      },
      {
        "id": "",
        "name": "configuramgr.com"
      },
      {
        "id": "",
        "name": "useradjust.com"
      },
      {
        "id": "",
        "name": "logifycenter.com"
      },
      {
        "id": "",
        "name": "showthetrick.com"
      },
      {
        "id": "",
        "name": "guidefixit.com"
      },
      {
        "id": "",
        "name": "epochtimes.entryfortify.com"
      },
      {
        "id": "",
        "name": "entrnow.com"
      },
      {
        "id": "",
        "name": "oauth2-signal.com"
      },
      {
        "id": "",
        "name": "verifcredentia.com"
      },
      {
        "id": "",
        "name": "accopanel.com"
      },
      {
        "id": "",
        "name": "entryfortify.com"
      },
      {
        "id": "",
        "name": "browsernotifications.info"
      },
      {
        "id": "",
        "name": "setuppanel.com"
      },
      {
        "id": "",
        "name": "vibshare.me"
      },
      {
        "id": "",
        "name": "hsf898.com"
      },
      {
        "id": "",
        "name": "profilemgr.com"
      },
      {
        "id": "",
        "name": "acctune.com"
      },
      {
        "id": "",
        "name": "logncenter.com"
      },
      {
        "id": "",
        "name": "touzhele.fun"
      },
      {
        "id": "",
        "name": "ifans.online"
      },
      {
        "id": "",
        "name": "guardaccount.com"
      },
      {
        "id": "",
        "name": "userhup.com"
      },
      {
        "id": "",
        "name": "controhub.com"
      },
      {
        "id": "",
        "name": "acespoint.com"
      },
      {
        "id": "",
        "name": "megaview.click"
      },
      {
        "id": "",
        "name": "breachforums.fit"
      },
      {
        "id": "",
        "name": "myacceshub.com"
      },
      {
        "id": "",
        "name": "siginpro.com"
      },
      {
        "id": "",
        "name": "usrkonnect.com"
      },
      {
        "id": "",
        "name": "epechtimes0.org"
      },
      {
        "id": "",
        "name": "sharedrive.cloud"
      },
      {
        "id": "",
        "name": "lineman.live"
      },
      {
        "id": "",
        "name": "linkshub.info"
      },
      {
        "id": "",
        "name": "profileub.com"
      },
      {
        "id": "",
        "name": "signncenter.com"
      },
      {
        "id": "",
        "name": "ocspilots.com"
      },
      {
        "id": "",
        "name": "vonxnews.com"
      },
      {
        "id": "",
        "name": "acesportal.com"
      },
      {
        "id": "",
        "name": "userhubz.com"
      },
      {
        "id": "",
        "name": "identihive.com"
      },
      {
        "id": "",
        "name": "fileprev.com"
      },
      {
        "id": "",
        "name": "odsync.cloud"
      },
      {
        "id": "",
        "name": "2fa.web.oauth2-signal.com"
      },
      {
        "id": "",
        "name": "voinewz.com"
      },
      {
        "id": "",
        "name": "loginshiled.com"
      },
      {
        "id": "",
        "name": "google-document.com"
      },
      {
        "id": "",
        "name": "signinacesspoint.com"
      },
      {
        "id": "",
        "name": "usercontropanel.com"
      },
      {
        "id": "",
        "name": "neuralgiavista.com"
      },
      {
        "id": "",
        "name": "brighterora.com"
      },
      {
        "id": "",
        "name": "fileprev.info"
      },
      {
        "id": "",
        "name": "a.web.oauth2-signal.com"
      },
      {
        "id": "",
        "name": "globalobject.console.info"
      },
      {
        "id": "",
        "name": "signcenterr.com"
      },
      {
        "id": "",
        "name": "interfacily.com"
      },
      {
        "id": "",
        "name": "uzrcenter.com"
      },
      {
        "id": "",
        "name": "mercatdegirona.com"
      },
      {
        "id": "",
        "name": "useracess.com"
      },
      {
        "id": "",
        "name": "openlabc.com"
      },
      {
        "id": "",
        "name": "signinacessint.com"
      },
      {
        "id": "",
        "name": "coupangrank.kr"
      },
      {
        "id": "",
        "name": "proflcntr.com"
      },
      {
        "id": "",
        "name": "youtubenet.com"
      },
      {
        "id": "",
        "name": "configalign.com"
      },
      {
        "id": "",
        "name": "1drv.one"
      },
      {
        "id": "",
        "name": "akounthub.com"
      },
      {
        "id": "",
        "name": "pornhub-net.com"
      },
      {
        "id": "",
        "name": "feelitnov.com"
      },
      {
        "id": "",
        "name": "profilesetop.com"
      },
      {
        "id": "",
        "name": "authinityapp.com"
      },
      {
        "id": "",
        "name": "personalsafezone.com"
      },
      {
        "id": "",
        "name": "gnews.news"
      },
      {
        "id": "",
        "name": "redi.ink"
      },
      {
        "id": "",
        "name": "passionateboomers.com"
      },
      {
        "id": "",
        "name": "accntcntr.com"
      },
      {
        "id": "",
        "name": "usergateaccess.com"
      },
      {
        "id": "",
        "name": "lgtymp.fit"
      },
      {
        "id": "",
        "name": "uzrconnect.com"
      },
      {
        "id": "",
        "name": "oneclickautht.com"
      },
      {
        "id": "",
        "name": "evtreview.com"
      },
      {
        "id": "",
        "name": "novamecha.com"
      },
      {
        "id": "",
        "name": "userpref.com"
      },
      {
        "id": "",
        "name": "deeporbiton.com"
      },
      {
        "id": "",
        "name": "entrzone.com"
      },
      {
        "id": "",
        "name": "ivycemnp.com"
      },
      {
        "id": "",
        "name": "userportl.wine"
      },
      {
        "id": "",
        "name": "secureagate.com"
      },
      {
        "id": "",
        "name": "telegra.live"
      },
      {
        "id": "",
        "name": "lineme.live"
      },
      {
        "id": "",
        "name": "mmbrhub.com"
      },
      {
        "id": "",
        "name": "signivaullt.com"
      },
      {
        "id": "",
        "name": "odsync.live"
      },
      {
        "id": "",
        "name": "oauth-api.com"
      },
      {
        "id": "",
        "name": "entruhub.com"
      },
      {
        "id": "",
        "name": "givemethedge.com"
      },
      {
        "id": "",
        "name": "sctapi.ftqq.com"
      },
      {
        "id": "",
        "name": "protectehub.com"
      },
      {
        "id": "",
        "name": "userpanell.com"
      },
      {
        "id": "",
        "name": "entgate.com"
      }
    ]
  },
  "external_refs": [
    {
      "id": "46c3aedc-422f-4113-9036-15b467afbd3d",
      "standard_id": "external-reference--663624f7-a246-5162-b500-b53f5e24bebc",
      "entity_type": "External-Reference",
      "source_name": "AlienVault",
      "description": null,
      "url": "https://citizenlab.ca/research/how-chinese-actors-use-impersonation-and-stolen-narratives-to-perpetuate-digital-transnational-repression/",
      "hash": null,
      "external_id": null,
      "created": "2026-04-28T14:36:28.606Z",
      "modified": "2026-04-28T14:36:28.606Z",
      "createdById": null
    },
    {
      "id": "53dddfcd-82c0-47c7-b995-db5b063eb323",
      "standard_id": "external-reference--fb769eff-618c-50a4-9d6e-c529149cc1fa",
      "entity_type": "External-Reference",
      "source_name": "AlienVault",
      "description": null,
      "url": "https://otx.alienvault.com/pulse/69f05d291d899793ddba04f9",
      "hash": null,
      "external_id": "69f05d291d899793ddba04f9",
      "created": "2026-04-28T14:36:28.566Z",
      "modified": "2026-04-28T14:36:28.566Z",
      "createdById": null
    }
  ]
}