{
  "aliases": [],
  "attack_id": null,
  "attack_name": null,
  "attack_url": null,
  "counts": {
    "domain": 32,
    "ipv4": 1,
    "url": 2
  },
  "first_seen": {
    "domain": {
      "account.office365update.live": "2022-08-18",
      "account.sdfsfsdf.office365update.live": "2022-08-18",
      "ads.celebritylife.news": "2022-08-18",
      "aspiremovecentraldays.net": "2022-08-18",
      "celebritylife.news": "2022-08-18",
      "com.office365update.live": "2022-08-18",
      "fileupload.shop": "2022-08-18",
      "i.login.office365update.live": "2022-08-18",
      "login.office365update.live": "2022-08-18",
      "login.rnfacebook.com": "2022-08-18",
      "login.sdfsfsdf.office365update.live": "2022-08-18",
      "logincdn.sdfsfsdf.office365update.live": "2022-08-18",
      "m.login.office365update.live": "2022-08-18",
      "m.login.rnfacebook.com": "2022-08-18",
      "m.site.rnfacebook.com": "2022-08-18",
      "microsoft.office365update.live": "2022-08-18",
      "microsoftonline.office365update.live": "2022-08-18",
      "naturaldolls.store": "2022-08-18",
      "ns1.office365update.live": "2022-08-18",
      "ns2.office365update.live": "2022-08-18",
      "office365update.live": "2022-08-18",
      "outlook.office365update.live": "2022-08-18",
      "outlook.sdfsfsdf.office365update.live": "2022-08-18",
      "pfizerpoll.com": "2022-08-18",
      "rnfacebook.com": "2022-08-18",
      "sdfsfsdf.office365update.live": "2022-08-18",
      "site.rnfacebook.com": "2022-08-18",
      "static.login.rnfacebook.com": "2022-08-18",
      "static.site.rnfacebook.com": "2022-08-18",
      "test.office365update.live": "2022-08-18",
      "xn--lirkedin-vkb.com": "2022-08-18",
      "xxx-doll.com": "2022-08-18"
    },
    "ipv4": {
      "161.35.123.176:4585": "2022-08-18"
    },
    "url": {
      "http://128.199.6.246": "2022-08-18",
      "http://144.202.123.248": "2022-08-18"
    }
  },
  "first_seen_precision": {
    "domain": {},
    "ipv4": {},
    "url": {}
  },
  "first_seen_range": {
    "earliest": "2022-08-18",
    "latest": "2022-08-18"
  },
  "generated_at": "2026-08-08T03:26:30+00:00",
  "indicators": {
    "domain": [
      "account.office365update.live",
      "account.sdfsfsdf.office365update.live",
      "ads.celebritylife.news",
      "aspiremovecentraldays.net",
      "celebritylife.news",
      "com.office365update.live",
      "fileupload.shop",
      "i.login.office365update.live",
      "login.office365update.live",
      "login.rnfacebook.com",
      "login.sdfsfsdf.office365update.live",
      "logincdn.sdfsfsdf.office365update.live",
      "m.login.office365update.live",
      "m.login.rnfacebook.com",
      "m.site.rnfacebook.com",
      "microsoft.office365update.live",
      "microsoftonline.office365update.live",
      "naturaldolls.store",
      "ns1.office365update.live",
      "ns2.office365update.live",
      "office365update.live",
      "outlook.office365update.live",
      "outlook.sdfsfsdf.office365update.live",
      "pfizerpoll.com",
      "rnfacebook.com",
      "sdfsfsdf.office365update.live",
      "site.rnfacebook.com",
      "static.login.rnfacebook.com",
      "static.site.rnfacebook.com",
      "test.office365update.live",
      "xn--lirkedin-vkb.com",
      "xxx-doll.com"
    ],
    "ipv4": [
      "161.35.123.176:4585"
    ],
    "url": [
      "http://128.199.6.246",
      "http://144.202.123.248"
    ]
  },
  "last_modified": "2026-01-02T23:10:15+00:00",
  "maltrail_groups": [
    "UNC3890"
  ],
  "references": [
    "https://www.mandiant.com/resources/suspected-iranian-actor-targeting-israeli-shipping",
    "https://www.virustotal.com/gui/ip-address/128.199.6.246/relations",
    "https://www.virustotal.com/gui/ip-address/143.110.155.195/relations",
    "https://www.virustotal.com/gui/ip-address/159.223.164.185/relations",
    "https://www.virustotal.com/gui/ip-address/161.35.123.176/relations",
    "https://www.virustotal.com/gui/ip-address/185.170.215.170/relations"
  ],
  "related": [],
  "slug": "UNC3890",
  "timeline": [
    {
      "counts": {
        "domain": 32,
        "ipv4": 1,
        "url": 2
      },
      "first_seen": "2022-08-18",
      "indicators": {
        "domain": [
          "account.office365update.live",
          "account.sdfsfsdf.office365update.live",
          "ads.celebritylife.news",
          "aspiremovecentraldays.net",
          "celebritylife.news",
          "com.office365update.live",
          "fileupload.shop",
          "i.login.office365update.live",
          "login.office365update.live",
          "login.rnfacebook.com",
          "login.sdfsfsdf.office365update.live",
          "logincdn.sdfsfsdf.office365update.live",
          "m.login.office365update.live",
          "m.login.rnfacebook.com",
          "m.site.rnfacebook.com",
          "microsoft.office365update.live",
          "microsoftonline.office365update.live",
          "naturaldolls.store",
          "ns1.office365update.live",
          "ns2.office365update.live",
          "office365update.live",
          "outlook.office365update.live",
          "outlook.sdfsfsdf.office365update.live",
          "pfizerpoll.com",
          "rnfacebook.com",
          "sdfsfsdf.office365update.live",
          "site.rnfacebook.com",
          "static.login.rnfacebook.com",
          "static.site.rnfacebook.com",
          "test.office365update.live",
          "xn--lirkedin-vkb.com",
          "xxx-doll.com"
        ],
        "ipv4": [
          "161.35.123.176:4585"
        ],
        "url": [
          "http://128.199.6.246",
          "http://144.202.123.248"
        ]
      },
      "precision": "exact",
      "references": [
        "https://www.mandiant.com/resources/suspected-iranian-actor-targeting-israeli-shipping",
        "https://www.virustotal.com/gui/ip-address/128.199.6.246/relations",
        "https://www.virustotal.com/gui/ip-address/143.110.155.195/relations",
        "https://www.virustotal.com/gui/ip-address/159.223.164.185/relations",
        "https://www.virustotal.com/gui/ip-address/161.35.123.176/relations",
        "https://www.virustotal.com/gui/ip-address/185.170.215.170/relations"
      ],
      "total": 35
    }
  ]
}