{"type":"bundle","id":"bundle--b79abf78-0ec0-52d2-aa08-c72942501e06","objects":[{"type":"identity","spec_version":"2.1","id":"identity--499c7359-365c-5e31-aa02-f3ab973d7621","created":"2026-08-19T16:55:06.000Z","modified":"2026-08-19T16:55:06.000Z","name":"hexfield","identity_class":"organization"},{"type":"indicator","spec_version":"2.1","id":"indicator--1d8eb4e2-f84e-5368-9294-6510197292f6","created":"2026-06-16T00:00:00Z","modified":"2026-06-16T00:00:00Z","created_by_ref":"identity--499c7359-365c-5e31-aa02-f3ab973d7621","name":"hexfield indicator url http://146.56.180.42:3333/","description":"VT-confirmed malware dropper URL \u2014 VirusTotal flagged by 3 engine(s), seen on 1 sensor(s).","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://146.56.180.42:3333/']","pattern_type":"stix","valid_from":"2026-06-16T00:00:00Z","valid_until":"2026-07-16T00:00:00Z","labels":["hexfield","honeypot","malicious-activity","url-watchlist","hexfield-confidence-low"],"external_references":[{"source_name":"hexfield","url":"https://hexfield.io/"},{"source_name":"hexfield-feed-manifest","url":"https://hexfield.io/api/v1/feed-manifest"},{"source_name":"hexfield-integrations","url":"https://hexfield.io/integrations"},{"source_name":"hexfield-indicator-lookup","url":"https://hexfield.io/api/v1/indicator/url/http%3A%2F%2F146.56.180.42%3A3333%2F"}],"x_hexfield_indicator_type":"url","x_hexfield_confidence_tier":"low","x_hexfield_trust_basis":"vt-confirmed-payload-capture","x_hexfield_sightings":1,"x_hexfield_sensors":1,"x_hexfield_vt_malicious":3,"x_hexfield_first_seen":"2026-06-16","x_hexfield_last_seen":"2026-06-16","x_hexfield_evidence":"VT-confirmed malware dropper URL","confidence":48},{"type":"indicator","spec_version":"2.1","id":"indicator--6182524c-1fdc-5c13-a694-70a6aec5b5a0","created":"2026-06-13T00:00:00Z","modified":"2026-06-13T00:00:00Z","created_by_ref":"identity--499c7359-365c-5e31-aa02-f3ab973d7621","name":"hexfield indicator url https://14.46.136.77/sh","description":"VT-confirmed malware dropper URL \u2014 VirusTotal flagged by 16 engine(s), seen on 1 sensor(s).","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://14.46.136.77/sh']","pattern_type":"stix","valid_from":"2026-06-13T00:00:00Z","valid_until":"2026-07-13T00:00:00Z","labels":["hexfield","honeypot","malicious-activity","url-watchlist","hexfield-confidence-medium"],"external_references":[{"source_name":"hexfield","url":"https://hexfield.io/"},{"source_name":"hexfield-feed-manifest","url":"https://hexfield.io/api/v1/feed-manifest"},{"source_name":"hexfield-integrations","url":"https://hexfield.io/integrations"},{"source_name":"hexfield-indicator-lookup","url":"https://hexfield.io/api/v1/indicator/url/https%3A%2F%2F14.46.136.77%2Fsh"}],"x_hexfield_indicator_type":"url","x_hexfield_confidence_tier":"medium","x_hexfield_trust_basis":"vt-confirmed-payload-capture","x_hexfield_sightings":1,"x_hexfield_sensors":1,"x_hexfield_vt_malicious":16,"x_hexfield_first_seen":"2026-06-13","x_hexfield_last_seen":"2026-06-13","x_hexfield_evidence":"VT-confirmed malware dropper URL","confidence":69},{"type":"indicator","spec_version":"2.1","id":"indicator--480a55c9-57e5-5fbb-89e7-337b37a205f7","created":"2026-06-13T00:00:00Z","modified":"2026-06-16T00:00:00Z","created_by_ref":"identity--499c7359-365c-5e31-aa02-f3ab973d7621","name":"hexfield indicator url https://217.60.195.113/sh","description":"VT-confirmed malware dropper URL \u2014 VirusTotal flagged by 14 engine(s), seen on 6 sensor(s).","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://217.60.195.113/sh']","pattern_type":"stix","valid_from":"2026-06-13T00:00:00Z","valid_until":"2026-07-16T00:00:00Z","labels":["hexfield","honeypot","malicious-activity","url-watchlist","hexfield-confidence-high"],"external_references":[{"source_name":"hexfield","url":"https://hexfield.io/"},{"source_name":"hexfield-feed-manifest","url":"https://hexfield.io/api/v1/feed-manifest"},{"source_name":"hexfield-integrations","url":"https://hexfield.io/integrations"},{"source_name":"hexfield-indicator-lookup","url":"https://hexfield.io/api/v1/indicator/url/https%3A%2F%2F217.60.195.113%2Fsh"}],"x_hexfield_indicator_type":"url","x_hexfield_confidence_tier":"high","x_hexfield_trust_basis":"vt-confirmed-payload-capture","x_hexfield_sightings":16,"x_hexfield_sensors":6,"x_hexfield_vt_malicious":14,"x_hexfield_first_seen":"2026-06-13","x_hexfield_last_seen":"2026-06-16","x_hexfield_evidence":"VT-confirmed malware dropper URL","confidence":82},{"type":"indicator","spec_version":"2.1","id":"indicator--3f73b0a6-1947-5b12-95d5-1ee37cc510b6","created":"2026-06-13T00:00:00Z","modified":"2026-06-16T00:00:00Z","created_by_ref":"identity--499c7359-365c-5e31-aa02-f3ab973d7621","name":"hexfield indicator url https://217.60.195.113/sh)","description":"VT-confirmed malware dropper URL \u2014 VirusTotal flagged by 11 engine(s), seen on 5 sensor(s).","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://217.60.195.113/sh)']","pattern_type":"stix","valid_from":"2026-06-13T00:00:00Z","valid_until":"2026-07-16T00:00:00Z","labels":["hexfield","honeypot","malicious-activity","url-watchlist","hexfield-confidence-medium"],"external_references":[{"source_name":"hexfield","url":"https://hexfield.io/"},{"source_name":"hexfield-feed-manifest","url":"https://hexfield.io/api/v1/feed-manifest"},{"source_name":"hexfield-integrations","url":"https://hexfield.io/integrations"},{"source_name":"hexfield-indicator-lookup","url":"https://hexfield.io/api/v1/indicator/url/https%3A%2F%2F217.60.195.113%2Fsh%29"}],"x_hexfield_indicator_type":"url","x_hexfield_confidence_tier":"medium","x_hexfield_trust_basis":"vt-confirmed-payload-capture","x_hexfield_sightings":14,"x_hexfield_sensors":5,"x_hexfield_vt_malicious":11,"x_hexfield_first_seen":"2026-06-13","x_hexfield_last_seen":"2026-06-16","x_hexfield_evidence":"VT-confirmed malware dropper URL","confidence":74},{"type":"threat-actor","spec_version":"2.1","id":"threat-actor--f00320b1-29cc-5b8e-a9bd-216417b12821","created":"2026-06-13T00:00:00Z","modified":"2026-06-16T00:00:00Z","created_by_ref":"identity--499c7359-365c-5e31-aa02-f3ab973d7621","name":"hexfield cluster 0a8efa167d81","description":"Analytical cluster of mass-scanning sources grouped by shared infrastructure and behaviour. An internal correlation, NOT real-world attribution.","threat_actor_types":["unknown"],"labels":["scanning-activity"],"confidence":0,"external_references":[{"source_name":"hexfield","url":"https://hexfield.io/"}],"x_hexfield_member_count":0,"x_hexfield_sightings":539,"x_hexfield_first_seen":"2026-06-13 03:50:28.470559","x_hexfield_last_seen":"2026-06-16 03:53:19.629999"},{"type":"attack-pattern","spec_version":"2.1","id":"attack-pattern--b85a39b2-4a6c-50a8-a2fc-9caabddca453","created":"2020-01-01T00:00:00Z","modified":"2020-01-01T00:00:00Z","created_by_ref":"identity--499c7359-365c-5e31-aa02-f3ab973d7621","name":"T1086","external_references":[{"source_name":"mitre-attack","external_id":"T1086","url":"https://attack.mitre.org/techniques/T1086/"}]},{"type":"relationship","spec_version":"2.1","id":"relationship--8a45d974-3204-51a9-b7d5-f69cb0f07c03","created":"2026-06-13T00:00:00Z","modified":"2026-06-16T00:00:00Z","created_by_ref":"identity--499c7359-365c-5e31-aa02-f3ab973d7621","relationship_type":"uses","source_ref":"threat-actor--f00320b1-29cc-5b8e-a9bd-216417b12821","target_ref":"attack-pattern--b85a39b2-4a6c-50a8-a2fc-9caabddca453"},{"type":"attack-pattern","spec_version":"2.1","id":"attack-pattern--403e21e3-890a-57a3-89df-f45d419a1fd6","created":"2020-01-01T00:00:00Z","modified":"2020-01-01T00:00:00Z","created_by_ref":"identity--499c7359-365c-5e31-aa02-f3ab973d7621","name":"T1133","external_references":[{"source_name":"mitre-attack","external_id":"T1133","url":"https://attack.mitre.org/techniques/T1133/"}]},{"type":"relationship","spec_version":"2.1","id":"relationship--aa637de1-79e7-5aca-b11e-40c701269403","created":"2026-06-13T00:00:00Z","modified":"2026-06-16T00:00:00Z","created_by_ref":"identity--499c7359-365c-5e31-aa02-f3ab973d7621","relationship_type":"uses","source_ref":"threat-actor--f00320b1-29cc-5b8e-a9bd-216417b12821","target_ref":"attack-pattern--403e21e3-890a-57a3-89df-f45d419a1fd6"}]}