{"type":"bundle","id":"bundle--2de030b2-b579-4778-8f74-9e197088f7ca","objects":[{"type":"identity","spec_version":"2.1","id":"identity--0d8b8f2e-imwatching-0000-0000-000000000001","created":"2026-08-31T20:40:04.995Z","modified":"2026-08-31T20:40:04.995Z","name":"imwatching XRPL drainer watch","identity_class":"system"},{"type":"indicator","spec_version":"2.1","id":"indicator--ab00a71f-9286-8c45-449a-51045341808d","created":"2026-08-31T20:40:04.995Z","modified":"2026-08-31T20:40:04.995Z","created_by_ref":"identity--0d8b8f2e-imwatching-0000-0000-000000000001","name":"XRPL funder rMC88REjRw2xoTDUZPD6854Jbwbo5Gki8U","description":"Operation funder — seeds collectors","indicator_types":["malicious-activity"],"pattern_type":"stix","pattern":"[x-xrpl-account:address = 'rMC88REjRw2xoTDUZPD6854Jbwbo5Gki8U']","valid_from":"2026-08-31T20:40:04.995Z","labels":["tier-3","funder","confirmed"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ed0308e9-32ce-1454-49b7-4299951f1b93","created":"2026-08-31T20:40:04.995Z","modified":"2026-08-31T20:40:04.995Z","created_by_ref":"identity--0d8b8f2e-imwatching-0000-0000-000000000001","name":"XRPL collector rEyop8DksntK5cyQdGGY6XBcbxZz9yrLZz","description":"Attacker collector (single-use)","indicator_types":["malicious-activity"],"pattern_type":"stix","pattern":"[x-xrpl-account:address = 'rEyop8DksntK5cyQdGGY6XBcbxZz9yrLZz']","valid_from":"2026-08-31T20:40:04.995Z","labels":["tier-1","collector","confirmed"]},{"type":"indicator","spec_version":"2.1","id":"indicator--612a7a55-a785-8ac1-18c6-fd8a2c80358f","created":"2026-08-31T20:40:04.995Z","modified":"2026-08-31T20:40:04.995Z","created_by_ref":"identity--0d8b8f2e-imwatching-0000-0000-000000000001","name":"XRPL consolidation rsywqoc8zzs6dpRPzskytmn6Q38tMqNmVt","description":"Consolidation hub","indicator_types":["malicious-activity"],"pattern_type":"stix","pattern":"[x-xrpl-account:address = 'rsywqoc8zzs6dpRPzskytmn6Q38tMqNmVt']","valid_from":"2026-08-31T20:40:04.995Z","labels":["tier-2","consolidation","confirmed"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1749314e-58ee-1e3a-dfd1-7c90003b9692","created":"2026-08-31T20:40:04.995Z","modified":"2026-08-31T20:40:04.995Z","created_by_ref":"identity--0d8b8f2e-imwatching-0000-0000-000000000001","name":"XRPL pool rNkt2ZDRu5K91v11HgGV3kRgE7yVtxyyTT","description":"Laundering pool","indicator_types":["malicious-activity"],"pattern_type":"stix","pattern":"[x-xrpl-account:address = 'rNkt2ZDRu5K91v11HgGV3kRgE7yVtxyyTT']","valid_from":"2026-08-31T20:40:04.995Z","labels":["tier-2","pool","confirmed"]},{"type":"indicator","spec_version":"2.1","id":"indicator--581a046a-a887-da89-8056-1f4d0cbed0ee","created":"2026-08-31T20:40:04.995Z","modified":"2026-08-31T20:40:04.995Z","created_by_ref":"identity--0d8b8f2e-imwatching-0000-0000-000000000001","name":"XRPL pool rM27yzkCw6WA3T4g1sPaeC1kpxHUhuxRWn","description":"Intermediary pool","indicator_types":["malicious-activity"],"pattern_type":"stix","pattern":"[x-xrpl-account:address = 'rM27yzkCw6WA3T4g1sPaeC1kpxHUhuxRWn']","valid_from":"2026-08-31T20:40:04.995Z","labels":["tier-2","pool","confirmed"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f514616a-fed0-13d5-89c2-9e54baad9d28","created":"2026-08-31T20:40:04.995Z","modified":"2026-08-31T20:40:04.995Z","created_by_ref":"identity--0d8b8f2e-imwatching-0000-0000-000000000001","name":"XRPL pool rpp6xd3qZsxDktZNLJ9RUjuK8tE595EExN","description":"Laundering pool (live-discovered)","indicator_types":["malicious-activity"],"pattern_type":"stix","pattern":"[x-xrpl-account:address = 'rpp6xd3qZsxDktZNLJ9RUjuK8tE595EExN']","valid_from":"2026-08-31T20:40:04.995Z","labels":["tier-2","pool","confirmed"]},{"type":"indicator","spec_version":"2.1","id":"indicator--55084b80-f328-c6a8-a485-ccfc265e2abe","created":"2026-08-31T20:40:04.995Z","modified":"2026-08-31T20:40:04.995Z","created_by_ref":"identity--0d8b8f2e-imwatching-0000-0000-000000000001","name":"XRPL cashout rJzNqvafEN6mPXykTTWz7f2Xfz5uXHAsRF","description":"Cash-out — custodial service (dest tag 2186127168)","indicator_types":["malicious-activity"],"pattern_type":"stix","pattern":"[x-xrpl-account:address = 'rJzNqvafEN6mPXykTTWz7f2Xfz5uXHAsRF']","valid_from":"2026-08-31T20:40:04.995Z","labels":["tier-0","cashout","endpoint"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8fdf79ab-244a-cf66-e05a-45990a4d0805","created":"2026-08-31T20:40:04.995Z","modified":"2026-08-31T20:40:04.995Z","created_by_ref":"identity--0d8b8f2e-imwatching-0000-0000-000000000001","name":"XRPL cashout rwxvzhydd8uK3wYBFSjzVKzzTDM4cdFwDc","description":"Cash-out — custodial service (dest tag 1668)","indicator_types":["malicious-activity"],"pattern_type":"stix","pattern":"[x-xrpl-account:address = 'rwxvzhydd8uK3wYBFSjzVKzzTDM4cdFwDc']","valid_from":"2026-08-31T20:40:04.995Z","labels":["tier-0","cashout","endpoint"]},{"type":"indicator","spec_version":"2.1","id":"indicator--468e17a4-1e9b-5b2a-8933-36899bf6632b","created":"2026-08-31T20:40:04.995Z","modified":"2026-08-31T20:40:04.995Z","created_by_ref":"identity--0d8b8f2e-imwatching-0000-0000-000000000001","name":"XRPL discovered rng4Si7CKCJfdJF7feJHE2T7ZkAoiYvCLq","description":"Discovered hop (from Intermediary pool)","indicator_types":["malicious-activity"],"pattern_type":"stix","pattern":"[x-xrpl-account:address = 'rng4Si7CKCJfdJF7feJHE2T7ZkAoiYvCLq']","valid_from":"2026-08-31T20:40:04.995Z","labels":["tier-1","discovered","unconfirmed"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ba27f67f-f4c1-1a8f-2e92-919bdc003e9a","created":"2026-08-31T20:40:04.995Z","modified":"2026-08-31T20:40:04.995Z","created_by_ref":"identity--0d8b8f2e-imwatching-0000-0000-000000000001","name":"XRPL discovered rPkgjy1BbrWfSNWFHoRn4ZE7gPt4aoRc2D","description":"Discovered hop (from Intermediary pool)","indicator_types":["malicious-activity"],"pattern_type":"stix","pattern":"[x-xrpl-account:address = 'rPkgjy1BbrWfSNWFHoRn4ZE7gPt4aoRc2D']","valid_from":"2026-08-31T20:40:04.995Z","labels":["tier-1","discovered","unconfirmed"]},{"type":"indicator","spec_version":"2.1","id":"indicator--01617610-9a7f-b437-d922-6ca174d4b495","created":"2026-08-31T20:40:04.995Z","modified":"2026-08-31T20:40:04.995Z","created_by_ref":"identity--0d8b8f2e-imwatching-0000-0000-000000000001","name":"XRPL discovered r9cXUj4B41jopnVZopSvDGEvkw7UU1ZRmL","description":"Discovered hop (from Intermediary pool)","indicator_types":["malicious-activity"],"pattern_type":"stix","pattern":"[x-xrpl-account:address = 'r9cXUj4B41jopnVZopSvDGEvkw7UU1ZRmL']","valid_from":"2026-08-31T20:40:04.995Z","labels":["tier-1","discovered","unconfirmed"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5d282016-79e2-9459-8275-b756d71dfc49","created":"2026-08-31T20:40:04.995Z","modified":"2026-08-31T20:40:04.995Z","created_by_ref":"identity--0d8b8f2e-imwatching-0000-0000-000000000001","name":"XRPL discovered rnDGxzUM2snx58Bvyn72xhJKqvkDxo2tQm","description":"Discovered hop (from cash-out)","indicator_types":["malicious-activity"],"pattern_type":"stix","pattern":"[x-xrpl-account:address = 'rnDGxzUM2snx58Bvyn72xhJKqvkDxo2tQm']","valid_from":"2026-08-31T20:40:04.995Z","labels":["tier-1","discovered","endpoint"]},{"type":"indicator","spec_version":"2.1","id":"indicator--004c78a9-68ee-f1fc-5a5b-c32060179799","created":"2026-08-31T20:40:04.995Z","modified":"2026-08-31T20:40:04.995Z","created_by_ref":"identity--0d8b8f2e-imwatching-0000-0000-000000000001","name":"XRPL discovered r4WdvT9kphHHKFtQmFX8DBB8uE1JTnqWkX","description":"Discovered hop (from Intermediary pool)","indicator_types":["malicious-activity"],"pattern_type":"stix","pattern":"[x-xrpl-account:address = 'r4WdvT9kphHHKFtQmFX8DBB8uE1JTnqWkX']","valid_from":"2026-08-31T20:40:04.995Z","labels":["tier-1","discovered","unconfirmed"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0f60d081-cfa3-c20b-db44-82307f2579ec","created":"2026-08-31T20:40:04.995Z","modified":"2026-08-31T20:40:04.995Z","created_by_ref":"identity--0d8b8f2e-imwatching-0000-0000-000000000001","name":"XRPL discovered rK5AwwAdTN4jn2jXnwHixjjSbeMHzNEbPJ","description":"Discovered hop (from Intermediary pool)","indicator_types":["malicious-activity"],"pattern_type":"stix","pattern":"[x-xrpl-account:address = 'rK5AwwAdTN4jn2jXnwHixjjSbeMHzNEbPJ']","valid_from":"2026-08-31T20:40:04.995Z","labels":["tier-1","discovered","unconfirmed"]},{"type":"indicator","spec_version":"2.1","id":"indicator--89751a0a-f7cc-3854-0003-35cb048fca8c","created":"2026-08-31T20:40:04.995Z","modified":"2026-08-31T20:40:04.995Z","created_by_ref":"identity--0d8b8f2e-imwatching-0000-0000-000000000001","name":"XRPL discovered rMCthTwXX2CqWWS6EnXm1nUcXTSvDVr9i","description":"Discovered hop (from Intermediary pool)","indicator_types":["malicious-activity"],"pattern_type":"stix","pattern":"[x-xrpl-account:address = 'rMCthTwXX2CqWWS6EnXm1nUcXTSvDVr9i']","valid_from":"2026-08-31T20:40:04.995Z","labels":["tier-1","discovered","unconfirmed"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a047ae3a-6c3c-5d8f-1448-0e31fe3b1cd8","created":"2026-08-31T20:40:04.995Z","modified":"2026-08-31T20:40:04.995Z","created_by_ref":"identity--0d8b8f2e-imwatching-0000-0000-000000000001","name":"XRPL discovered rDZWPJ8DFzzUoZ4BvFy1747QeeRo25JbwH","description":"Discovered hop (from Discovered hop (from Intermediary pool))","indicator_types":["malicious-activity"],"pattern_type":"stix","pattern":"[x-xrpl-account:address = 'rDZWPJ8DFzzUoZ4BvFy1747QeeRo25JbwH']","valid_from":"2026-08-31T20:40:04.995Z","labels":["tier-1","discovered","unconfirmed"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5540df3d-e12a-80fb-c640-a666e9e8bb5c","created":"2026-08-31T20:40:04.995Z","modified":"2026-08-31T20:40:04.995Z","created_by_ref":"identity--0d8b8f2e-imwatching-0000-0000-000000000001","name":"XRPL discovered rBWpYJhuJWBPAkzJ4kYQqHShSkkF3rgeD","description":"Discovered hop (from Discovered hop (from Intermediary pool))","indicator_types":["malicious-activity"],"pattern_type":"stix","pattern":"[x-xrpl-account:address = 'rBWpYJhuJWBPAkzJ4kYQqHShSkkF3rgeD']","valid_from":"2026-08-31T20:40:04.995Z","labels":["tier-1","discovered","unconfirmed"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f83b4ee5-3199-2930-0691-5a7a9981358a","created":"2026-08-31T20:40:04.995Z","modified":"2026-08-31T20:40:04.995Z","created_by_ref":"identity--0d8b8f2e-imwatching-0000-0000-000000000001","name":"XRPL discovered rw9isBiVw3M2dt2KKHePVuUUmHxix9VY35","description":"Discovered hop (from Discovered hop (from Discovered hop (from Intermediary pool)))","indicator_types":["malicious-activity"],"pattern_type":"stix","pattern":"[x-xrpl-account:address = 'rw9isBiVw3M2dt2KKHePVuUUmHxix9VY35']","valid_from":"2026-08-31T20:40:04.995Z","labels":["tier-1","discovered","unconfirmed"]},{"type":"indicator","spec_version":"2.1","id":"indicator--eebca367-3e32-8c8d-fccb-efe0d0e52a54","created":"2026-08-31T20:40:04.995Z","modified":"2026-08-31T20:40:04.995Z","created_by_ref":"identity--0d8b8f2e-imwatching-0000-0000-000000000001","name":"XRPL discovered rKCXWY6q3eeqjNySV4WETnTnYY3b3whdpk","description":"Discovered hop (from Intermediary pool)","indicator_types":["malicious-activity"],"pattern_type":"stix","pattern":"[x-xrpl-account:address = 'rKCXWY6q3eeqjNySV4WETnTnYY3b3whdpk']","valid_from":"2026-08-31T20:40:04.995Z","labels":["tier-1","discovered","unconfirmed"]},{"type":"indicator","spec_version":"2.1","id":"indicator--331bcfba-c295-8db0-ab73-86218b2f8ad1","created":"2026-08-31T20:40:04.995Z","modified":"2026-08-31T20:40:04.995Z","created_by_ref":"identity--0d8b8f2e-imwatching-0000-0000-000000000001","name":"XRPL discovered rs2dgzYeqYqsk8bvkQR5YPyqsXYcA24MP2","description":"Discovered hop (from cash-out)","indicator_types":["malicious-activity"],"pattern_type":"stix","pattern":"[x-xrpl-account:address = 'rs2dgzYeqYqsk8bvkQR5YPyqsXYcA24MP2']","valid_from":"2026-08-31T20:40:04.995Z","labels":["tier-1","discovered","endpoint"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7021a917-3b26-1c41-8896-c0b591de60b7","created":"2026-08-31T20:40:04.995Z","modified":"2026-08-31T20:40:04.995Z","created_by_ref":"identity--0d8b8f2e-imwatching-0000-0000-000000000001","name":"XRPL discovered rPHbX554MTGBkwgEGbVVqYniM5dVQ1scs1","description":"Discovered hop (from Intermediary pool)","indicator_types":["malicious-activity"],"pattern_type":"stix","pattern":"[x-xrpl-account:address = 'rPHbX554MTGBkwgEGbVVqYniM5dVQ1scs1']","valid_from":"2026-08-31T20:40:04.995Z","labels":["tier-1","discovered","unconfirmed"]},{"type":"indicator","spec_version":"2.1","id":"indicator--19e5e605-51cf-3aea-91de-a83b05f8258b","created":"2026-08-31T20:40:04.995Z","modified":"2026-08-31T20:40:04.995Z","created_by_ref":"identity--0d8b8f2e-imwatching-0000-0000-000000000001","name":"XRPL discovered rU2MuzRnouaaEJcFLBcXvzMtQtnZB7znt7","description":"Discovered hop (from Intermediary pool)","indicator_types":["malicious-activity"],"pattern_type":"stix","pattern":"[x-xrpl-account:address = 'rU2MuzRnouaaEJcFLBcXvzMtQtnZB7znt7']","valid_from":"2026-08-31T20:40:04.995Z","labels":["tier-1","discovered","unconfirmed"]},{"type":"indicator","spec_version":"2.1","id":"indicator--690c7847-1927-3211-254d-98a6bb93b0b5","created":"2026-08-31T20:40:04.995Z","modified":"2026-08-31T20:40:04.995Z","created_by_ref":"identity--0d8b8f2e-imwatching-0000-0000-000000000001","name":"XRPL discovered rfzXMziGejYL4qQry6QpmNnBxdLSs679gd","description":"Discovered hop (from Intermediary pool)","indicator_types":["malicious-activity"],"pattern_type":"stix","pattern":"[x-xrpl-account:address = 'rfzXMziGejYL4qQry6QpmNnBxdLSs679gd']","valid_from":"2026-08-31T20:40:04.995Z","labels":["tier-1","discovered","unconfirmed"]},{"type":"indicator","spec_version":"2.1","id":"indicator--eb9b0f3a-e7a6-37f4-0b8a-8f1ea5c64c0a","created":"2026-08-31T20:40:04.995Z","modified":"2026-08-31T20:40:04.995Z","created_by_ref":"identity--0d8b8f2e-imwatching-0000-0000-000000000001","name":"XRPL discovered r4Ng4ra5xjmH8PWcqLmZ5ezGymtrv8ysP1","description":"Discovered hop (from Intermediary pool)","indicator_types":["malicious-activity"],"pattern_type":"stix","pattern":"[x-xrpl-account:address = 'r4Ng4ra5xjmH8PWcqLmZ5ezGymtrv8ysP1']","valid_from":"2026-08-31T20:40:04.995Z","labels":["tier-1","discovered","unconfirmed"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2873f123-4a10-9d31-f10a-106774188822","created":"2026-08-31T20:40:04.995Z","modified":"2026-08-31T20:40:04.995Z","created_by_ref":"identity--0d8b8f2e-imwatching-0000-0000-000000000001","name":"XRPL discovered rnqZnvzoJjdg7n1P9pmumJ7FQ5wxNH3gYC","description":"Discovered hop (from cash-out)","indicator_types":["malicious-activity"],"pattern_type":"stix","pattern":"[x-xrpl-account:address = 'rnqZnvzoJjdg7n1P9pmumJ7FQ5wxNH3gYC']","valid_from":"2026-08-31T20:40:04.995Z","labels":["tier-1","discovered","endpoint"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7c11d584-75b2-d365-e13d-8bfad366fbdd","created":"2026-08-31T20:40:04.995Z","modified":"2026-08-31T20:40:04.995Z","created_by_ref":"identity--0d8b8f2e-imwatching-0000-0000-000000000001","name":"XRPL discovered r9p8GoNBiULCYqWZDgxkkXPXLyXxUiCY6t","description":"Discovered hop (from Intermediary pool)","indicator_types":["malicious-activity"],"pattern_type":"stix","pattern":"[x-xrpl-account:address = 'r9p8GoNBiULCYqWZDgxkkXPXLyXxUiCY6t']","valid_from":"2026-08-31T20:40:04.995Z","labels":["tier-1","discovered","unconfirmed"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3be04809-6465-754e-9142-6495d9e8d6eb","created":"2026-08-31T20:40:04.995Z","modified":"2026-08-31T20:40:04.995Z","created_by_ref":"identity--0d8b8f2e-imwatching-0000-0000-000000000001","name":"XRPL discovered rJ8hb4jMHgRNhEQ7BTGz6vt14kWn2z6H78","description":"Discovered hop (from cash-out)","indicator_types":["malicious-activity"],"pattern_type":"stix","pattern":"[x-xrpl-account:address = 'rJ8hb4jMHgRNhEQ7BTGz6vt14kWn2z6H78']","valid_from":"2026-08-31T20:40:04.995Z","labels":["tier-1","discovered","endpoint"]},{"type":"indicator","spec_version":"2.1","id":"indicator--71b07f82-5a79-9aae-75be-6351581766c4","created":"2026-08-31T20:40:04.995Z","modified":"2026-08-31T20:40:04.995Z","created_by_ref":"identity--0d8b8f2e-imwatching-0000-0000-000000000001","name":"XRPL discovered rwnYLUsoBQX3ECa1A5bSKLdbPoHKnqf63J","description":"Discovered hop (from Discovered hop (from Intermediary pool))","indicator_types":["malicious-activity"],"pattern_type":"stix","pattern":"[x-xrpl-account:address = 'rwnYLUsoBQX3ECa1A5bSKLdbPoHKnqf63J']","valid_from":"2026-08-31T20:40:04.995Z","labels":["tier-1","discovered","unconfirmed"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0bd34b7f-7461-2d78-7a38-0c4ff65fc30d","created":"2026-08-31T20:40:04.995Z","modified":"2026-08-31T20:40:04.995Z","created_by_ref":"identity--0d8b8f2e-imwatching-0000-0000-000000000001","name":"XRPL discovered rMY4ZrJLVHDHLNWdx7tULsUR5Wo1WWQCaR","description":"Discovered hop (from cash-out)","indicator_types":["malicious-activity"],"pattern_type":"stix","pattern":"[x-xrpl-account:address = 'rMY4ZrJLVHDHLNWdx7tULsUR5Wo1WWQCaR']","valid_from":"2026-08-31T20:40:04.995Z","labels":["tier-1","discovered","endpoint"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3be3d9df-0c94-f831-9712-8e5dc439da0b","created":"2026-08-31T20:40:04.995Z","modified":"2026-08-31T20:40:04.995Z","created_by_ref":"identity--0d8b8f2e-imwatching-0000-0000-000000000001","name":"XRPL discovered rsy2tM3qGwL9ka4KVBALAV9eXYpd2nTWot","description":"Discovered hop (from cash-out)","indicator_types":["malicious-activity"],"pattern_type":"stix","pattern":"[x-xrpl-account:address = 'rsy2tM3qGwL9ka4KVBALAV9eXYpd2nTWot']","valid_from":"2026-08-31T20:40:04.995Z","labels":["tier-1","discovered","endpoint"]},{"type":"indicator","spec_version":"2.1","id":"indicator--03b60084-3b28-147b-d9a0-ba5113ebb04e","created":"2026-08-31T20:40:04.995Z","modified":"2026-08-31T20:40:04.995Z","created_by_ref":"identity--0d8b8f2e-imwatching-0000-0000-000000000001","name":"XRPL discovered rav4ti22NyMgD1WbGKoRy62hUL75dq8w4u","description":"Discovered hop (from cash-out)","indicator_types":["malicious-activity"],"pattern_type":"stix","pattern":"[x-xrpl-account:address = 'rav4ti22NyMgD1WbGKoRy62hUL75dq8w4u']","valid_from":"2026-08-31T20:40:04.995Z","labels":["tier-1","discovered","endpoint"]},{"type":"indicator","spec_version":"2.1","id":"indicator--40b8ce7d-7f6b-07db-b013-f795f3e7e9bf","created":"2026-08-31T20:40:04.995Z","modified":"2026-08-31T20:40:04.995Z","created_by_ref":"identity--0d8b8f2e-imwatching-0000-0000-000000000001","name":"XRPL discovered rGDreBvnHrX1get7na3J4oowN19ny4GzFn","description":"Discovered hop (from cash-out)","indicator_types":["malicious-activity"],"pattern_type":"stix","pattern":"[x-xrpl-account:address = 'rGDreBvnHrX1get7na3J4oowN19ny4GzFn']","valid_from":"2026-08-31T20:40:04.995Z","labels":["tier-1","discovered","endpoint"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4c44ed49-2a37-a6a3-931b-a1fcf132bb65","created":"2026-08-31T20:40:04.995Z","modified":"2026-08-31T20:40:04.995Z","created_by_ref":"identity--0d8b8f2e-imwatching-0000-0000-000000000001","name":"Phishing domain cafevault.info","indicator_types":["malicious-activity"],"pattern_type":"stix","pattern":"[domain-name:value = 'cafevault.info']","valid_from":"2026-08-31T20:40:04.995Z"}]}