[
  {
    "id": 1616536,
    "indicator": "account-aljazeera.net",
    "type": "domain",
    "created": "2017-03-30T09:53:40",
    "content": "",
    "title": "",
    "description": "",
    "expiration": null,
    "is_active": 1
  },
  {
    "id": 8403791,
    "indicator": "actblues.com",
    "type": "domain",
    "created": "2017-03-30T09:53:40",
    "content": "",
    "title": "",
    "description": "",
    "expiration": null,
    "is_active": 1
  },
  {
    "id": 8403792,
    "indicator": "anadolu-ajansi.com",
    "type": "domain",
    "created": "2017-03-30T09:53:40",
    "content": "",
    "title": "",
    "description": "",
    "expiration": null,
    "is_active": 1
  },
  {
    "id": 8403793,
    "indicator": "dansa.bg",
    "type": "domain",
    "created": "2017-03-30T09:53:40",
    "content": "",
    "title": "",
    "description": "",
    "expiration": null,
    "is_active": 1
  },
  {
    "id": 2179450,
    "indicator": "fkit-mil.dk",
    "type": "domain",
    "created": "2017-03-30T09:53:40",
    "content": "",
    "title": "",
    "description": "",
    "expiration": null,
    "is_active": 1
  },
  {
    "id": 8403794,
    "indicator": "fortele.ro",
    "type": "domain",
    "created": "2017-03-30T09:53:40",
    "content": "",
    "title": "",
    "description": "",
    "expiration": null,
    "is_active": 1
  },
  {
    "id": 5282,
    "indicator": "login-osce.org",
    "type": "domain",
    "created": "2017-03-30T09:53:40",
    "content": "",
    "title": "",
    "description": "",
    "expiration": null,
    "is_active": 1
  },
  {
    "id": 1561978,
    "indicator": "mail-aljazeera.net",
    "type": "domain",
    "created": "2017-03-30T09:53:40",
    "content": "",
    "title": "",
    "description": "",
    "expiration": null,
    "is_active": 1
  },
  {
    "id": 8403795,
    "indicator": "mail-gov.me",
    "type": "domain",
    "created": "2017-03-30T09:53:40",
    "content": "",
    "title": "",
    "description": "",
    "expiration": null,
    "is_active": 1
  },
  {
    "id": 364338,
    "indicator": "mail-hurriyet.com",
    "type": "domain",
    "created": "2017-03-30T09:53:40",
    "content": "",
    "title": "",
    "description": "",
    "expiration": null,
    "is_active": 1
  },
  {
    "id": 364335,
    "indicator": "mail-navy.ro",
    "type": "domain",
    "created": "2017-03-30T09:53:40",
    "content": "",
    "title": "",
    "description": "",
    "expiration": null,
    "is_active": 1
  },
  {
    "id": 8403796,
    "indicator": "mail-pims.org",
    "type": "domain",
    "created": "2017-03-30T09:53:40",
    "content": "",
    "title": "",
    "description": "",
    "expiration": null,
    "is_active": 1
  },
  {
    "id": 8403797,
    "indicator": "mail-skupstina.me",
    "type": "domain",
    "created": "2017-03-30T09:53:40",
    "content": "",
    "title": "",
    "description": "",
    "expiration": null,
    "is_active": 1
  },
  {
    "id": 955263,
    "indicator": "mailpho.com",
    "type": "domain",
    "created": "2017-03-30T09:53:40",
    "content": "",
    "title": "",
    "description": "",
    "expiration": null,
    "is_active": 1
  },
  {
    "id": 364359,
    "indicator": "mobile-sanoma.net",
    "type": "domain",
    "created": "2017-03-30T09:53:40",
    "content": "",
    "title": "",
    "description": "",
    "expiration": null,
    "is_active": 1
  },
  {
    "id": 364363,
    "indicator": "posta-hurriyet.com",
    "type": "domain",
    "created": "2017-03-30T09:53:40",
    "content": "",
    "title": "",
    "description": "",
    "expiration": null,
    "is_active": 1
  },
  {
    "id": 4557,
    "indicator": "privacy-yahoo.com",
    "type": "domain",
    "created": "2017-03-30T09:53:40",
    "content": "",
    "title": "",
    "description": "",
    "expiration": null,
    "is_active": 1
  },
  {
    "id": 1616530,
    "indicator": "sset-aljazeera.com",
    "type": "domain",
    "created": "2017-03-30T09:53:40",
    "content": "",
    "title": "",
    "description": "",
    "expiration": null,
    "is_active": 1
  },
  {
    "id": 1916173,
    "indicator": "sset-aljazeera.net",
    "type": "domain",
    "created": "2017-03-30T09:53:40",
    "content": "",
    "title": "",
    "description": "",
    "expiration": null,
    "is_active": 1
  },
  {
    "id": 1916172,
    "indicator": "ssset-aljazeera.net",
    "type": "domain",
    "created": "2017-03-30T09:53:40",
    "content": "",
    "title": "",
    "description": "",
    "expiration": null,
    "is_active": 1
  },
  {
    "id": 8403798,
    "indicator": "support-cdu.de",
    "type": "domain",
    "created": "2017-03-30T09:53:40",
    "content": "",
    "title": "",
    "description": "",
    "expiration": null,
    "is_active": 1
  },
  {
    "id": 686223,
    "indicator": "tas-cass.org",
    "type": "domain",
    "created": "2017-03-30T09:53:40",
    "content": "",
    "title": "",
    "description": "",
    "expiration": null,
    "is_active": 1
  },
  {
    "id": 8403799,
    "indicator": "webmail-cdu.de",
    "type": "domain",
    "created": "2017-03-30T09:53:40",
    "content": "",
    "title": "",
    "description": "",
    "expiration": null,
    "is_active": 1
  },
  {
    "id": 409053,
    "indicator": "webmail-hurriyet.com",
    "type": "domain",
    "created": "2017-03-30T09:53:40",
    "content": "",
    "title": "",
    "description": "",
    "expiration": null,
    "is_active": 1
  },
  {
    "id": 2179008,
    "indicator": "webmail-mfa.am",
    "type": "domain",
    "created": "2017-03-30T09:53:40",
    "content": "",
    "title": "",
    "description": "",
    "expiration": null,
    "is_active": 1
  },
  {
    "id": 1860299,
    "indicator": "webmail-mil.dk",
    "type": "domain",
    "created": "2017-03-30T09:53:40",
    "content": "",
    "title": "",
    "description": "",
    "expiration": null,
    "is_active": 1
  },
  {
    "id": 364341,
    "indicator": "webmail-mil.gr",
    "type": "domain",
    "created": "2017-03-30T09:53:40",
    "content": "",
    "title": "",
    "description": "",
    "expiration": null,
    "is_active": 1
  },
  {
    "id": 363336,
    "indicator": "webmail-saic.com",
    "type": "domain",
    "created": "2017-03-30T09:53:40",
    "content": "",
    "title": "",
    "description": "",
    "expiration": null,
    "is_active": 1
  },
  {
    "id": 364382,
    "indicator": "e-post.byegm.web.tr",
    "type": "hostname",
    "created": "2017-03-30T09:53:40",
    "content": "",
    "title": "",
    "description": "",
    "expiration": null,
    "is_active": 1
  },
  {
    "id": 955364,
    "indicator": "e-posta.tbmm.qov.web.tr",
    "type": "hostname",
    "created": "2017-03-30T09:53:40",
    "content": "",
    "title": "",
    "description": "",
    "expiration": null,
    "is_active": 1
  },
  {
    "id": 8403800,
    "indicator": "email.mfa.qov.gs",
    "type": "hostname",
    "created": "2017-03-30T09:53:40",
    "content": "",
    "title": "",
    "description": "",
    "expiration": null,
    "is_active": 1
  },
  {
    "id": 364387,
    "indicator": "eposta.basbakanlik.qov.web.tr",
    "type": "hostname",
    "created": "2017-03-30T09:53:40",
    "content": "",
    "title": "",
    "description": "",
    "expiration": null,
    "is_active": 1
  },
  {
    "id": 8403801,
    "indicator": "inside.wada-arna.org",
    "type": "hostname",
    "created": "2017-03-30T09:53:40",
    "content": "",
    "title": "",
    "description": "",
    "expiration": null,
    "is_active": 1
  },
  {
    "id": 8403802,
    "indicator": "link.candybober.info",
    "type": "hostname",
    "created": "2017-03-30T09:53:40",
    "content": "",
    "title": "",
    "description": "",
    "expiration": null,
    "is_active": 1
  },
  {
    "id": 1918542,
    "indicator": "mail.academl.com",
    "type": "hostname",
    "created": "2017-03-30T09:53:40",
    "content": "",
    "title": "",
    "description": "",
    "expiration": null,
    "is_active": 1
  },
  {
    "id": 8403803,
    "indicator": "mail.anadoluajansi.web.tr",
    "type": "hostname",
    "created": "2017-03-30T09:53:40",
    "content": "",
    "title": "",
    "description": "",
    "expiration": null,
    "is_active": 1
  },
  {
    "id": 364377,
    "indicator": "mail.armf.bg.message-id8665213.tk",
    "type": "hostname",
    "created": "2017-03-30T09:53:40",
    "content": "",
    "title": "",
    "description": "",
    "expiration": null,
    "is_active": 1
  },
  {
    "id": 8403804,
    "indicator": "mail.arnf.bg",
    "type": "hostname",
    "created": "2017-03-30T09:53:40",
    "content": "",
    "title": "",
    "description": "",
    "expiration": null,
    "is_active": 1
  },
  {
    "id": 2606259,
    "indicator": "mail.bostondynamlcs.com",
    "type": "hostname",
    "created": "2017-03-30T09:53:40",
    "content": "",
    "title": "",
    "description": "",
    "expiration": null,
    "is_active": 1
  },
  {
    "id": 364376,
    "indicator": "mail.byegm.web.tr",
    "type": "hostname",
    "created": "2017-03-30T09:53:40",
    "content": "",
    "title": "",
    "description": "",
    "expiration": null,
    "is_active": 1
  },
  {
    "id": 8403805,
    "indicator": "mail.fach.rnil.cl",
    "type": "hostname",
    "created": "2017-03-30T09:53:40",
    "content": "",
    "title": "",
    "description": "",
    "expiration": null,
    "is_active": 1
  },
  {
    "id": 364385,
    "indicator": "mail.g0v.me",
    "type": "hostname",
    "created": "2017-03-30T09:53:40",
    "content": "",
    "title": "",
    "description": "",
    "expiration": null,
    "is_active": 1
  },
  {
    "id": 601394,
    "indicator": "mail.hm.qov.hu",
    "type": "hostname",
    "created": "2017-03-30T09:53:40",
    "content": "",
    "title": "",
    "description": "",
    "expiration": null,
    "is_active": 1
  },
  {
    "id": 364388,
    "indicator": "mail.kuwaitarmy.gov-kw.com",
    "type": "hostname",
    "created": "2017-03-30T09:53:40",
    "content": "",
    "title": "",
    "description": "",
    "expiration": null,
    "is_active": 1
  },
  {
    "id": 955351,
    "indicator": "mail.mod.qov.af",
    "type": "hostname",
    "created": "2017-03-30T09:53:40",
    "content": "",
    "title": "",
    "description": "",
    "expiration": null,
    "is_active": 1
  },
  {
    "id": 8403806,
    "indicator": "mail.mod.qov.es",
    "type": "hostname",
    "created": "2017-03-30T09:53:40",
    "content": "",
    "title": "",
    "description": "",
    "expiration": null,
    "is_active": 1
  },
  {
    "id": 8403807,
    "indicator": "mail.moda.qov.sa.com",
    "type": "hostname",
    "created": "2017-03-30T09:53:40",
    "content": "",
    "title": "",
    "description": "",
    "expiration": null,
    "is_active": 1
  },
  {
    "id": 364381,
    "indicator": "mail.mofa.g0v.qa",
    "type": "hostname",
    "created": "2017-03-30T09:53:40",
    "content": "",
    "title": "",
    "description": "",
    "expiration": null,
    "is_active": 1
  },
  {
    "id": 363443,
    "indicator": "mail.rnil.am",
    "type": "hostname",
    "created": "2017-03-30T09:53:40",
    "content": "",
    "title": "",
    "description": "",
    "expiration": null,
    "is_active": 1
  },
  {
    "id": 364379,
    "indicator": "mail.rsaf.qov.sa.com",
    "type": "hostname",
    "created": "2017-03-30T09:53:40",
    "content": "",
    "title": "",
    "description": "",
    "expiration": null,
    "is_active": 1
  },
  {
    "id": 8403808,
    "indicator": "mail.university-tartu.info",
    "type": "hostname",
    "created": "2017-03-30T09:53:40",
    "content": "",
    "title": "",
    "description": "",
    "expiration": null,
    "is_active": 1
  },
  {
    "id": 8403809,
    "indicator": "mail.wada-awa.org",
    "type": "hostname",
    "created": "2017-03-30T09:53:40",
    "content": "",
    "title": "",
    "description": "",
    "expiration": null,
    "is_active": 1
  },
  {
    "id": 8403810,
    "indicator": "mod.qov.al",
    "type": "hostname",
    "created": "2017-03-30T09:53:40",
    "content": "",
    "title": "",
    "description": "",
    "expiration": null,
    "is_active": 1
  },
  {
    "id": 2179871,
    "indicator": "myaccount.google.com-changepasswordmyaccount-idx8jxcn4ufdmncudd.gq",
    "type": "hostname",
    "created": "2017-03-30T09:53:40",
    "content": "",
    "title": "",
    "description": "",
    "expiration": null,
    "is_active": 1
  },
  {
    "id": 2179834,
    "indicator": "myaccount.google.com-securitysettingpage.gq",
    "type": "hostname",
    "created": "2017-03-30T09:53:40",
    "content": "",
    "title": "",
    "description": "",
    "expiration": null,
    "is_active": 1
  },
  {
    "id": 364380,
    "indicator": "poczta.mon-gov.pl",
    "type": "hostname",
    "created": "2017-03-30T09:53:40",
    "content": "",
    "title": "",
    "description": "",
    "expiration": null,
    "is_active": 1
  },
  {
    "id": 5284,
    "indicator": "poczta.mon.q0v.pl",
    "type": "hostname",
    "created": "2017-03-30T09:53:40",
    "content": "",
    "title": "",
    "description": "",
    "expiration": null,
    "is_active": 1
  },
  {
    "id": 8403811,
    "indicator": "sftp.onderzoekraad.nl",
    "type": "hostname",
    "created": "2017-03-30T09:53:40",
    "content": "",
    "title": "",
    "description": "",
    "expiration": null,
    "is_active": 1
  },
  {
    "id": 8403812,
    "indicator": "vpn.onderzoekraad.nl",
    "type": "hostname",
    "created": "2017-03-30T09:53:40",
    "content": "",
    "title": "",
    "description": "",
    "expiration": null,
    "is_active": 1
  },
  {
    "id": 8403813,
    "indicator": "web.mailmil.lv",
    "type": "hostname",
    "created": "2017-03-30T09:53:40",
    "content": "",
    "title": "",
    "description": "",
    "expiration": null,
    "is_active": 1
  },
  {
    "id": 8403814,
    "indicator": "webmail.exerclto.pt",
    "type": "hostname",
    "created": "2017-03-30T09:53:40",
    "content": "",
    "title": "",
    "description": "",
    "expiration": null,
    "is_active": 1
  },
  {
    "id": 8403815,
    "indicator": "webmail.mfa.qov.ae",
    "type": "hostname",
    "created": "2017-03-30T09:53:40",
    "content": "",
    "title": "",
    "description": "",
    "expiration": null,
    "is_active": 1
  },
  {
    "id": 364378,
    "indicator": "webmail.mofa.qov.ae",
    "type": "hostname",
    "created": "2017-03-30T09:53:40",
    "content": "",
    "title": "",
    "description": "",
    "expiration": null,
    "is_active": 1
  },
  {
    "id": 4556,
    "indicator": "webmail.westinqhousenuclear.com",
    "type": "hostname",
    "created": "2017-03-30T09:53:40",
    "content": "",
    "title": "",
    "description": "",
    "expiration": null,
    "is_active": 1
  },
  {
    "id": 8403816,
    "indicator": "www.mailmil.ae",
    "type": "hostname",
    "created": "2017-03-30T09:53:40",
    "content": "",
    "title": "",
    "description": "",
    "expiration": null,
    "is_active": 1
  },
  {
    "id": 30377990,
    "indicator": "c284ccf479ac77b3c41b6e9a3ee005232c9055b4",
    "type": "YARA",
    "created": "2017-07-24T12:24:48",
    "content": "rule COZY_FANCY_BEAR_pagemgr_Hunt    \n   {   \n      \n       meta:   \n           description = \"Detects a pagemgr.exe as mentioned in the CrowdStrike report\"   \n           author = \"Florian Roth\"   \n           reference = \"https://www.crowdstrike.com/blog/bears-midst-intrusion-democratic-national-committee/\"   \n           date = \"2016-06-14\"   \n      \n       strings:   \n           $s1 = \"pagemgr.exe\" wide fullword   \n      \n       condition:   \n           uint16(0) == 0x5a4d and 1 of them   \n   }",
    "title": "",
    "description": "",
    "expiration": null,
    "is_active": 1
  },
  {
    "id": 30377991,
    "indicator": "390e1109e04dbcd4a47ae508ad5beb2b9fea1c33",
    "type": "YARA",
    "created": "2017-07-24T12:24:48",
    "content": "rule COZY_FANCY_BEAR_Hunt    \n   {   \n      \n       meta:   \n           description = \"Detects Cozy Bear / Fancy Bear C2 Server IPs\"   \n           author = \"Florian Roth\"   \n           reference = \"https://www.crowdstrike.com/blog/bears-midst-intrusion-democratic-national-committee/\"   \n           date = \"2016-06-14\"   \n      \n       strings:   \n           $s1 = \"185.100.84.134\" ascii wide fullword   \n           $s2 = \"58.49.58.58\" ascii wide fullword   \n           $s3 = \"218.1.98.203\" ascii wide fullword   \n           $s4 = \"187.33.33.8\" ascii wide fullword   \n           $s5 = \"185.86.148.227\" ascii wide fullword   \n           $s6 = \"45.32.129.185\" ascii wide fullword   \n           $s7 = \"23.227.196.217\" ascii wide fullword   \n      \n       condition:   \n           uint16(0) == 0x5a4d and 1 of them   \n   }",
    "title": "",
    "description": "",
    "expiration": null,
    "is_active": 1
  }
]