mirror of
https://github.com/CyberMonitor/APT_CyberCriminal_Campagin_Collections
synced 2024-06-29 18:31:36 +00:00
12992 lines
1.3 MiB
Executable File
12992 lines
1.3 MiB
Executable File
<!-- Generated by excel2stix 0.1w on 06/09/2017 -->
|
|
<stix:STIX_Package xmlns:cyboxCommon="http://cybox.mitre.org/common-2" xmlns:cybox="http://cybox.mitre.org/cybox-2" xmlns:cyboxVocabs="http://cybox.mitre.org/default_vocabularies-2" xmlns:AddressObj="http://cybox.mitre.org/objects#AddressObject-2" xmlns:FileObj="http://cybox.mitre.org/objects#FileObject-2" xmlns:marking="http://data-marking.mitre.org/Marking-1" xmlns:tlpMarking="http://data-marking.mitre.org/extensions/MarkingStructure#TLP-1" xmlns:TOUMarking="http://data-marking.mitre.org/extensions/MarkingStructure#Terms_Of_Use-1" xmlns:indicator="http://stix.mitre.org/Indicator-2" xmlns:stixCommon="http://stix.mitre.org/common-1" xmlns:stixVocabs="http://stix.mitre.org/default_vocabularies-1" xmlns:stix="http://stix.mitre.org/stix-1" xmlns:NCCIC="http://www.us-cert.gov/nccic" xmlns:CISCP="http://us-cert.gov/ciscp" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation=" http://cybox.mitre.org/common-2 http://cybox.mitre.org/XMLSchema/common/2.1/cybox_common.xsd http://cybox.mitre.org/cybox-2 http://cybox.mitre.org/XMLSchema/core/2.1/cybox_core.xsd http://cybox.mitre.org/default_vocabularies-2 http://cybox.mitre.org/XMLSchema/default_vocabularies/2.1/cybox_default_vocabularies.xsd http://cybox.mitre.org/objects#AddressObject-2 http://cybox.mitre.org/XMLSchema/objects/Address/2.1/Address_Object.xsd http://cybox.mitre.org/objects#FileObject-2 http://cybox.mitre.org/XMLSchema/objects/File/2.1/File_Object.xsd http://data-marking.mitre.org/Marking-1 http://stix.mitre.org/XMLSchema/data_marking/1.1.1/data_marking.xsd http://data-marking.mitre.org/extensions/MarkingStructure#TLP-1 http://stix.mitre.org/XMLSchema/extensions/marking/tlp/1.1.1/tlp_marking.xsd http://data-marking.mitre.org/extensions/MarkingStructure#Terms_Of_Use-1 http://stix.mitre.org/XMLSchema/extensions/marking/terms_of_use/1.0.1/terms_of_use_marking.xsd http://stix.mitre.org/Indicator-2 http://stix.mitre.org/XMLSchema/indicator/2.1.1/indicator.xsd http://stix.mitre.org/common-1 http://stix.mitre.org/XMLSchema/common/1.1.1/stix_common.xsd http://stix.mitre.org/default_vocabularies-1 http://stix.mitre.org/XMLSchema/default_vocabularies/1.1.1/stix_default_vocabularies.xsd http://stix.mitre.org/stix-1 http://stix.mitre.org/XMLSchema/core/1.1.1/stix_core.xsd http://us-cert.gov/ciscp http://www.us-cert.gov/sites/default/files/STIX_Namespace/ciscp_vocab_v1.1.1.xsd" id="TA-17-165A.xml" version="1.1.1" timestamp="2017-06-09T16:17:43+00:00">
|
|
<stix:STIX_Header>
|
|
<stix:Title>TA-17-165A</stix:Title>
|
|
<stix:Description>HIDDEN COBRA – North Korean Malicious Cyber Activity</stix:Description>
|
|
<stix:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>//node() | //@*</marking:Controlled_Structure>
|
|
<marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</stix:Handling>
|
|
<stix:Information_Source>
|
|
<stixCommon:Time>
|
|
<cyboxCommon:Produced_Time>2017-06-09T00:00:00</cyboxCommon:Produced_Time>
|
|
</stixCommon:Time>
|
|
</stix:Information_Source>
|
|
</stix:STIX_Header>
|
|
<stix:Indicators>
|
|
<stix:Indicator id="NCCIC:indicator-d6c7089e-4d50-11e7-887c-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6c708a0-4d50-11e7-aa6b-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6c7089f-4d50-11e7-afc0-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">103.15.232.168</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6c708a1-4d50-11e7-b1de-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6c708a3-4d50-11e7-8ada-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6c708a2-4d50-11e7-b35c-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">105.184.19.161</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6c708a4-4d50-11e7-a6f8-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6c708a6-4d50-11e7-912f-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6c708a5-4d50-11e7-92a6-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">105.184.229.17</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6c708a7-4d50-11e7-8574-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6c708a9-4d50-11e7-bd59-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6c708a8-4d50-11e7-bbb1-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">105.184.229.80</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6c708aa-4d50-11e7-9c60-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6c708ac-4d50-11e7-8d68-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6c708ab-4d50-11e7-adba-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">105.184.231.17</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6c708ad-4d50-11e7-b6e4-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6c708af-4d50-11e7-9566-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6c708ae-4d50-11e7-99a4-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">105.184.255.194</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6c708b0-4d50-11e7-892c-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6c708b2-4d50-11e7-83f1-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6c708b1-4d50-11e7-8073-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">105.225.112.221</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6c708b3-4d50-11e7-9f74-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6c708b5-4d50-11e7-836b-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6c708b4-4d50-11e7-9b2e-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">109.160.91.135</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6c708b6-4d50-11e7-a03d-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6c708b8-4d50-11e7-9cdf-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6c708b7-4d50-11e7-bf63-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">109.162.196.130</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6c708b9-4d50-11e7-920c-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6c708bb-4d50-11e7-895b-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6c708ba-4d50-11e7-b4e3-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">109.166.233.132</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6c708bc-4d50-11e7-b86f-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6c708be-4d50-11e7-8440-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6c708bd-4d50-11e7-b8e6-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">109.201.8.60</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6c708bf-4d50-11e7-ad64-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6c708c1-4d50-11e7-b3ab-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6c708c0-4d50-11e7-b1fc-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">109.219.30.47</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6c708c2-4d50-11e7-8474-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6c708c4-4d50-11e7-8d76-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6c708c3-4d50-11e7-9e03-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">109.224.54.74</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6c708c5-4d50-11e7-b2ab-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6c708c7-4d50-11e7-9223-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6c708c6-4d50-11e7-a9e4-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">109.229.229.227</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6c708c8-4d50-11e7-a685-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6c708ca-4d50-11e7-80df-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6c708c9-4d50-11e7-ba61-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">109.69.25.37</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6c708cb-4d50-11e7-b491-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6c708cd-4d50-11e7-a7b4-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6c708cc-4d50-11e7-8525-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">109.69.31.12</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6c708ce-4d50-11e7-aa8e-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6c708d0-4d50-11e7-a092-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6c708cf-4d50-11e7-9d91-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">109.72.63.94</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6c708d1-4d50-11e7-9b51-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6c708d3-4d50-11e7-99d0-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6c708d2-4d50-11e7-89c5-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">111.68.97.105</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6c708d4-4d50-11e7-8a5b-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6c708d6-4d50-11e7-8b39-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6c708d5-4d50-11e7-9794-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">111.93.182.170</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6c708d7-4d50-11e7-8d51-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6c708d9-4d50-11e7-82a2-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6c708d8-4d50-11e7-a207-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">116.74.71.205</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6c708da-4d50-11e7-8eb4-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6c708dc-4d50-11e7-ad3e-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6c708db-4d50-11e7-a567-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">117.103.69.134</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6c708dd-4d50-11e7-a3a1-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6c708df-4d50-11e7-951e-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6c708de-4d50-11e7-8678-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">117.202.50.205</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6c708e0-4d50-11e7-b52e-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6c708e2-4d50-11e7-b7a9-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6c708e1-4d50-11e7-8b77-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">117.203.65.126</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6c708e3-4d50-11e7-b025-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6c708e5-4d50-11e7-bfcb-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6c708e4-4d50-11e7-b1a4-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">117.203.65.207</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6c708e6-4d50-11e7-944a-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6c708e8-4d50-11e7-bedd-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6c708e7-4d50-11e7-a213-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">117.203.66.157</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6c708e9-4d50-11e7-ac7f-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6c708eb-4d50-11e7-a628-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6c708ea-4d50-11e7-b1fd-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">117.203.66.92</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6c708ec-4d50-11e7-a0ab-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6c708ee-4d50-11e7-b01a-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6c708ed-4d50-11e7-8760-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">117.203.70.76</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6c708ef-4d50-11e7-a245-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6c708f1-4d50-11e7-8775-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6c708f0-4d50-11e7-9827-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">117.203.71.116</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6c708f2-4d50-11e7-89ff-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6c708f4-4d50-11e7-a535-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6c708f3-4d50-11e7-9992-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">117.206.0.34</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6c708f5-4d50-11e7-afbf-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6c708f7-4d50-11e7-9ccd-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6c708f6-4d50-11e7-9695-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">117.206.10.13</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6c708f8-4d50-11e7-87d1-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6c708fa-4d50-11e7-bc27-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6c708f9-4d50-11e7-a9c6-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">117.206.10.98</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6c708fb-4d50-11e7-9b91-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6c708fd-4d50-11e7-bcb3-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6c708fc-4d50-11e7-9544-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">117.206.11.1</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6c708fe-4d50-11e7-beb8-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6c70900-4d50-11e7-bcda-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6c708ff-4d50-11e7-a4cd-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">117.206.12.44</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6c70901-4d50-11e7-9f85-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6c70903-4d50-11e7-94d4-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6c70902-4d50-11e7-a7aa-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">117.206.13.8</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6c70904-4d50-11e7-8b84-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6c70906-4d50-11e7-a07f-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6c70905-4d50-11e7-a424-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">117.206.14.139</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6c70907-4d50-11e7-8d7b-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6c70909-4d50-11e7-98d4-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6c70908-4d50-11e7-8549-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">117.206.15.41</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6c7090a-4d50-11e7-a62b-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6c7090c-4d50-11e7-b8ba-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6c7090b-4d50-11e7-96cf-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">117.206.2.212</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6c7090d-4d50-11e7-886d-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6c7090f-4d50-11e7-a93d-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6c7090e-4d50-11e7-954b-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">117.206.2.246</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6c70910-4d50-11e7-bc82-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6c70912-4d50-11e7-b436-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6c70911-4d50-11e7-a27c-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">117.206.3.88</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6c70913-4d50-11e7-a489-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6c70915-4d50-11e7-8cae-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6c70914-4d50-11e7-84af-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">117.206.4.236</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6c70916-4d50-11e7-81c0-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6c70918-4d50-11e7-a647-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6c70917-4d50-11e7-94c7-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">117.206.5.1</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6c70919-4d50-11e7-a0e7-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6c7091b-4d50-11e7-9619-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6c7091a-4d50-11e7-9491-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">117.206.5.186</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6cbc38f-4d50-11e7-973e-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6cbc391-4d50-11e7-ac8f-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6cbc390-4d50-11e7-be31-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">117.206.5.52</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6cbc392-4d50-11e7-9615-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6cbc394-4d50-11e7-9e61-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6cbc393-4d50-11e7-aef8-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">117.206.6.101</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6cbc395-4d50-11e7-a982-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6cbc397-4d50-11e7-86a9-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6cbc396-4d50-11e7-8711-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">117.206.6.192</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6cbc398-4d50-11e7-832a-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6cbc39a-4d50-11e7-9d5b-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6cbc399-4d50-11e7-b424-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">117.206.7.209</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6cbc39b-4d50-11e7-8f17-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6cbc39d-4d50-11e7-aa4d-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6cbc39c-4d50-11e7-b386-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">117.206.8.137</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6cbc39e-4d50-11e7-90f5-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6cbc3a0-4d50-11e7-8993-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6cbc39f-4d50-11e7-80e9-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">117.206.8.4</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6cbc3a1-4d50-11e7-925d-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6cbc3a3-4d50-11e7-9444-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6cbc3a2-4d50-11e7-a65d-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">117.206.9.65</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6cbc3a4-4d50-11e7-adf1-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6cbc3a6-4d50-11e7-bf18-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6cbc3a5-4d50-11e7-bf81-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">117.207.168.68</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6cbc3a7-4d50-11e7-af40-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6cbc3a9-4d50-11e7-9b5c-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6cbc3a8-4d50-11e7-8c36-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">117.207.169.61</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6cbc3aa-4d50-11e7-9408-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6cbc3ac-4d50-11e7-b592-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6cbc3ab-4d50-11e7-97d8-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">117.207.171.18</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6cbc3ad-4d50-11e7-886b-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6cbc3af-4d50-11e7-bd01-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6cbc3ae-4d50-11e7-a275-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">117.208.216.182</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6cbc3b0-4d50-11e7-935c-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6cbc3b2-4d50-11e7-b4fa-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6cbc3b1-4d50-11e7-9a05-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">117.208.218.14</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6cbc3b3-4d50-11e7-9142-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6cbc3b5-4d50-11e7-8715-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6cbc3b4-4d50-11e7-9bcc-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">117.208.218.204</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6cbc3b6-4d50-11e7-b453-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6cbc3b8-4d50-11e7-9910-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6cbc3b7-4d50-11e7-8aab-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">117.208.218.231</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6cbc3b9-4d50-11e7-81d8-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6cbc3bb-4d50-11e7-a339-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6cbc3ba-4d50-11e7-b8fe-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">117.208.219.104</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6cbc3bc-4d50-11e7-b7e5-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6cbc3be-4d50-11e7-a9f5-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6cbc3bd-4d50-11e7-9099-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">117.208.219.97</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6cbc3bf-4d50-11e7-abfa-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6cbc3c1-4d50-11e7-a9f1-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6cbc3c0-4d50-11e7-89c8-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">117.208.220.26</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6cbc3c2-4d50-11e7-91b3-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6cbc3c4-4d50-11e7-be94-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6cbc3c3-4d50-11e7-b0b3-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">117.208.221.181</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6cbc3c5-4d50-11e7-b93d-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6cbc3c7-4d50-11e7-9c42-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6cbc3c6-4d50-11e7-a821-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">117.208.222.136</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6cbc3c8-4d50-11e7-814a-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6cbc3ca-4d50-11e7-ab9b-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6cbc3c9-4d50-11e7-acf5-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">117.208.222.247</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6cbc3cb-4d50-11e7-a366-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6cbc3cd-4d50-11e7-9d54-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6cbc3cc-4d50-11e7-8168-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">117.208.222.50</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6cbc3ce-4d50-11e7-ae7d-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6cbc3d0-4d50-11e7-8952-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6cbc3cf-4d50-11e7-be38-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">117.208.223.132</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6cbc3d1-4d50-11e7-8210-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6cbc3d3-4d50-11e7-868a-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6cbc3d2-4d50-11e7-86b6-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">117.208.223.28</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6cbc3d4-4d50-11e7-a7fe-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6cbc3d6-4d50-11e7-9052-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6cbc3d5-4d50-11e7-8ae2-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">117.213.24.225</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6cbc3d7-4d50-11e7-b720-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6cbc3d9-4d50-11e7-9871-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6cbc3d8-4d50-11e7-9471-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">117.213.24.81</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6cbc3da-4d50-11e7-b278-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6cbc3dc-4d50-11e7-b833-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6cbc3db-4d50-11e7-b92b-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">117.213.25.162</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6cbc3dd-4d50-11e7-a725-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6cbc3df-4d50-11e7-b5a2-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6cbc3de-4d50-11e7-b1ed-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">117.213.25.25</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6cbc3e0-4d50-11e7-899b-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6cbc3e2-4d50-11e7-ab34-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6cbc3e1-4d50-11e7-8fa6-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">117.213.28.113</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6cbc3e3-4d50-11e7-857d-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6cbc3e5-4d50-11e7-a17f-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6cbc3e4-4d50-11e7-964f-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">117.213.28.118</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6cbc3e6-4d50-11e7-8f31-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6cbc3e8-4d50-11e7-9428-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6cbc3e7-4d50-11e7-9b85-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">117.213.29.1</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6cbc3e9-4d50-11e7-b286-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6cbc3eb-4d50-11e7-9fad-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6cbc3ea-4d50-11e7-870a-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">117.213.31.129</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6cbc3ec-4d50-11e7-813f-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6cbc3ee-4d50-11e7-81b1-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6cbc3ed-4d50-11e7-9bc7-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">117.213.31.42</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6cbc3ef-4d50-11e7-9071-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6cbc3f1-4d50-11e7-98a2-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6cbc3f0-4d50-11e7-aa2b-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">117.216.64.250</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6cbc3f2-4d50-11e7-b6c5-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6cbc3f4-4d50-11e7-8fcd-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6cbc3f3-4d50-11e7-baaa-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">117.216.66.140</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6cbc3f5-4d50-11e7-98c3-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6cbc3f7-4d50-11e7-a6d0-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6cbc3f6-4d50-11e7-9880-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">117.216.67.123</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6cbc3f8-4d50-11e7-a941-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6cbc3fa-4d50-11e7-9db7-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6cbc3f9-4d50-11e7-9bd6-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">117.216.68.185</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6cbc3fb-4d50-11e7-9089-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6cbc3fd-4d50-11e7-ac46-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6cbc3fc-4d50-11e7-9100-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">117.216.68.4</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6cbc3fe-4d50-11e7-b3a6-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6cbc400-4d50-11e7-80b8-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6cbc3ff-4d50-11e7-bf53-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">117.216.69.42</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6cbc401-4d50-11e7-9904-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6cbc403-4d50-11e7-b0de-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6cbc402-4d50-11e7-8b02-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">117.216.70.199</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d07e80-4d50-11e7-b8f8-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d07e82-4d50-11e7-8cf4-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d07e81-4d50-11e7-b5af-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">117.221.224.252</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d07e83-4d50-11e7-bd8f-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d07e85-4d50-11e7-a99b-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d07e84-4d50-11e7-a187-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">117.221.227.106</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d07e86-4d50-11e7-9c56-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d07e88-4d50-11e7-8d50-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d07e87-4d50-11e7-9c89-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">117.221.228.64</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d07e89-4d50-11e7-8e2d-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d07e8b-4d50-11e7-a6b2-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d07e8a-4d50-11e7-bd7f-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">117.221.229.132</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d07e8c-4d50-11e7-b907-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d07e8e-4d50-11e7-959c-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d07e8d-4d50-11e7-9621-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">117.221.229.161</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d07e8f-4d50-11e7-b832-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d07e91-4d50-11e7-8cbe-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d07e90-4d50-11e7-a7d2-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">117.221.229.17</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d07e92-4d50-11e7-92fb-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d07e94-4d50-11e7-8115-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d07e93-4d50-11e7-82c2-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">117.221.231.178</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d07e95-4d50-11e7-9f4d-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d07e97-4d50-11e7-8771-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d07e96-4d50-11e7-9232-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">117.221.231.8</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d07e98-4d50-11e7-ab16-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d07e9a-4d50-11e7-a59b-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d07e99-4d50-11e7-9d2e-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">117.223.248.59</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d07e9b-4d50-11e7-8746-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d07e9d-4d50-11e7-a087-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d07e9c-4d50-11e7-ac07-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">117.223.249.179</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d07e9e-4d50-11e7-b6f3-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d07ea0-4d50-11e7-993d-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d07e9f-4d50-11e7-86ef-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">117.223.250.100</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d07ea1-4d50-11e7-b7cc-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d07ea3-4d50-11e7-aee9-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d07ea2-4d50-11e7-a63c-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">117.223.250.250</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d07ea4-4d50-11e7-9eb4-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d07ea6-4d50-11e7-8c13-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d07ea5-4d50-11e7-ab2b-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">117.223.251.160</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d07ea7-4d50-11e7-a978-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d07ea9-4d50-11e7-b72e-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d07ea8-4d50-11e7-8381-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">117.247.184.184</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d07eaa-4d50-11e7-a3e3-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d07eac-4d50-11e7-99d6-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d07eab-4d50-11e7-b353-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">118.47.121.251</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d07ead-4d50-11e7-a24d-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d07eaf-4d50-11e7-b3d9-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d07eae-4d50-11e7-9b0b-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">122.170.15.43</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d07eb0-4d50-11e7-8d78-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d07eb2-4d50-11e7-a125-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d07eb1-4d50-11e7-a994-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">125.209.127.198</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d07eb3-4d50-11e7-8fa9-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d07eb5-4d50-11e7-982b-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d07eb4-4d50-11e7-8b0e-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">125.209.77.99</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d07eb6-4d50-11e7-87bf-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d07eb8-4d50-11e7-ae68-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d07eb7-4d50-11e7-8968-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">128.73.185.11</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d07eb9-4d50-11e7-a494-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d07ebb-4d50-11e7-9f45-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d07eba-4d50-11e7-a0b7-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">128.73.192.126</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d07ebc-4d50-11e7-94ba-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d07ebe-4d50-11e7-90b3-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d07ebd-4d50-11e7-9471-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">128.73.192.128</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d07ebf-4d50-11e7-bf73-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d07ec1-4d50-11e7-a5b3-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d07ec0-4d50-11e7-9e15-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">128.73.192.138</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d07ec2-4d50-11e7-83af-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d07ec4-4d50-11e7-a3c3-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d07ec3-4d50-11e7-a1ec-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">128.73.192.150</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d07ec5-4d50-11e7-8ba9-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d07ec7-4d50-11e7-9961-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d07ec6-4d50-11e7-8da9-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">128.73.192.154</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d07ec8-4d50-11e7-9438-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d07eca-4d50-11e7-8d2a-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d07ec9-4d50-11e7-8ee0-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">128.73.192.164</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d07ecb-4d50-11e7-8608-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d07ecd-4d50-11e7-a096-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d07ecc-4d50-11e7-8165-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">128.73.192.175</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d07ece-4d50-11e7-a984-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d07ed0-4d50-11e7-9c84-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d07ecf-4d50-11e7-b710-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">128.73.192.182</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d07ed1-4d50-11e7-81a2-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d07ed3-4d50-11e7-9178-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d07ed2-4d50-11e7-adb1-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">128.73.192.206</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d07ed4-4d50-11e7-b269-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d07ed6-4d50-11e7-94fb-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d07ed5-4d50-11e7-910a-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">128.73.192.242</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d07ed7-4d50-11e7-a232-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d07ed9-4d50-11e7-b7aa-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d07ed8-4d50-11e7-8e7d-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">128.73.192.248</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d07eda-4d50-11e7-94fa-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d07edc-4d50-11e7-8b91-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d07edb-4d50-11e7-99b2-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">128.73.192.42</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d07edd-4d50-11e7-a735-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d07edf-4d50-11e7-ac29-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d07ede-4d50-11e7-a0ab-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">128.73.192.50</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d07ee0-4d50-11e7-a0b4-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d07ee2-4d50-11e7-b318-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d07ee1-4d50-11e7-961f-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">128.73.192.51</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d07ee3-4d50-11e7-9f49-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d07ee5-4d50-11e7-bf40-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d07ee4-4d50-11e7-9539-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">128.73.192.51</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d07ee6-4d50-11e7-b3a9-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d07ee8-4d50-11e7-85c0-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d07ee7-4d50-11e7-8e72-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">128.73.192.63</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d07ee9-4d50-11e7-892e-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d07eeb-4d50-11e7-aed0-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d07eea-4d50-11e7-affd-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">128.73.192.69</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d07eec-4d50-11e7-94fb-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d07eee-4d50-11e7-bd8f-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d07eed-4d50-11e7-ac71-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">128.73.192.82</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d07eef-4d50-11e7-bcda-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d07ef1-4d50-11e7-a425-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d07ef0-4d50-11e7-8369-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">128.73.192.90</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d07ef2-4d50-11e7-b69c-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d07ef4-4d50-11e7-b26c-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d07ef3-4d50-11e7-b585-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">128.73.192.98</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d07ef5-4d50-11e7-a6fd-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d07ef7-4d50-11e7-9f63-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d07ef6-4d50-11e7-95ac-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">129.56.2.38</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d07ef8-4d50-11e7-be29-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d07efa-4d50-11e7-9655-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d07ef9-4d50-11e7-9b95-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">134.119.36.135</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d07efb-4d50-11e7-9a1a-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d07efd-4d50-11e7-9b6e-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d07efc-4d50-11e7-b53d-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">14.140.123.179</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d07efe-4d50-11e7-b98e-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d07f00-4d50-11e7-8d31-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d07eff-4d50-11e7-aa43-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">14.141.27.100</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d07f01-4d50-11e7-88e5-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d07f03-4d50-11e7-8680-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d07f02-4d50-11e7-8c78-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">14.149.149.211</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d07f04-4d50-11e7-b9dd-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d07f06-4d50-11e7-8f85-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d07f05-4d50-11e7-8844-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">140.164.74.7</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d07f07-4d50-11e7-8a5d-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d07f09-4d50-11e7-88d6-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d07f08-4d50-11e7-9f74-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">141.136.200.71</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d07f0a-4d50-11e7-bc3b-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d07f0c-4d50-11e7-94ee-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d07f0b-4d50-11e7-b1f0-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">141.136.236.113</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d07f0d-4d50-11e7-b59f-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d07f0f-4d50-11e7-a3e1-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d07f0e-4d50-11e7-b4f2-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">141.136.236.246</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d07f10-4d50-11e7-a8c2-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d07f12-4d50-11e7-b2a7-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d07f11-4d50-11e7-b97d-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">141.136.236.74</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d07f13-4d50-11e7-affa-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d07f15-4d50-11e7-a8c4-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d07f14-4d50-11e7-bfed-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">141.136.237.133</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d07f16-4d50-11e7-aa01-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d07f18-4d50-11e7-9c90-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d07f17-4d50-11e7-81f1-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">141.136.237.209</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d07f19-4d50-11e7-bad1-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d07f1b-4d50-11e7-886d-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d07f1a-4d50-11e7-89ce-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">141.138.49.229</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d07f1c-4d50-11e7-adb1-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d07f1e-4d50-11e7-bf1e-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d07f1d-4d50-11e7-98ce-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">141.138.49.55</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d07f1f-4d50-11e7-8e98-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d07f21-4d50-11e7-8f70-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d07f20-4d50-11e7-a1ac-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">141.138.49.99</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d07f22-4d50-11e7-be46-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d07f24-4d50-11e7-a9fb-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d07f23-4d50-11e7-97ac-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">141.8.142.26</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d07f25-4d50-11e7-8a34-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d07f27-4d50-11e7-807b-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d07f26-4d50-11e7-a436-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">145.255.1.215</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d07f28-4d50-11e7-ab87-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d07f2a-4d50-11e7-a486-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d07f29-4d50-11e7-b9ea-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">145.255.1.231</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d07f2b-4d50-11e7-b249-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d07f2d-4d50-11e7-851a-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d07f2c-4d50-11e7-ade4-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">145.255.1.78</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d07f2e-4d50-11e7-b0fd-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d07f30-4d50-11e7-bffb-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d07f2f-4d50-11e7-a7a9-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">145.255.2.227</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d07f31-4d50-11e7-bbc8-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d07f33-4d50-11e7-978c-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d07f32-4d50-11e7-a2a6-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">145.255.3.148</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d07f34-4d50-11e7-bafc-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d07f36-4d50-11e7-ab23-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d07f35-4d50-11e7-a665-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">145.255.3.87</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d07f37-4d50-11e7-b4ea-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d07f39-4d50-11e7-ac7d-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d07f38-4d50-11e7-9156-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">147.213.104.51</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d07f3a-4d50-11e7-a391-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d07f3c-4d50-11e7-80cc-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d07f3b-4d50-11e7-a645-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">147.69.140.44</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d07f3d-4d50-11e7-991e-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d07f3f-4d50-11e7-a854-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d07f3e-4d50-11e7-a764-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">163.18.54.50</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d07f40-4d50-11e7-9c33-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d07f42-4d50-11e7-b1ba-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d07f41-4d50-11e7-a58e-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">178.132.102.4</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d07f43-4d50-11e7-8379-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d07f45-4d50-11e7-8f4f-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d07f44-4d50-11e7-a021-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">178.132.96.72</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d07f46-4d50-11e7-b3c2-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d07f48-4d50-11e7-b7c3-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d07f47-4d50-11e7-a696-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">178.132.97.208</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d07f49-4d50-11e7-97bb-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d07f4b-4d50-11e7-a411-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d07f4a-4d50-11e7-9be3-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">178.148.181.201</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d07f4c-4d50-11e7-b70c-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d07f4e-4d50-11e7-a142-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d07f4d-4d50-11e7-b7a8-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">178.162.193.170</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d07f4f-4d50-11e7-b8e6-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d07f51-4d50-11e7-b45d-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d07f50-4d50-11e7-b2b9-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">178.17.201.168</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d07f52-4d50-11e7-b15c-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d07f54-4d50-11e7-aa30-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d07f53-4d50-11e7-9b5e-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">182.70.240.197</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d07f55-4d50-11e7-bc3e-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d07f57-4d50-11e7-b10b-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d07f56-4d50-11e7-a68e-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">182.71.171.165</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d07f58-4d50-11e7-bdac-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d07f5a-4d50-11e7-9f76-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d07f59-4d50-11e7-b69a-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">182.73.187.2</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d07f5b-4d50-11e7-be38-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d07f5d-4d50-11e7-bc39-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d07f5c-4d50-11e7-b499-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">182.75.56.118</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d07f5e-4d50-11e7-b8cd-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d07f60-4d50-11e7-9a16-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d07f5f-4d50-11e7-aff4-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">185.19.195.118</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d07f61-4d50-11e7-8e30-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d07f63-4d50-11e7-9262-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d07f62-4d50-11e7-a8f8-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">185.34.83.4</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d07f64-4d50-11e7-8860-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d07f66-4d50-11e7-9d8a-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d07f65-4d50-11e7-b3ff-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">185.54.16.92</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d07f67-4d50-11e7-bc83-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d07f69-4d50-11e7-840a-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d07f68-4d50-11e7-9513-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">185.59.72.130</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d07f6a-4d50-11e7-8936-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d07f6c-4d50-11e7-8dd9-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d07f6b-4d50-11e7-ad4c-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">188.49.86.129</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d07f6d-4d50-11e7-909a-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d07f6f-4d50-11e7-80ab-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d07f6e-4d50-11e7-8064-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">188.50.196.49</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d07f70-4d50-11e7-910b-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d07f72-4d50-11e7-9c1c-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d07f71-4d50-11e7-bdb0-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">188.50.213.67</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d07f73-4d50-11e7-936e-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d07f75-4d50-11e7-91d2-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d07f74-4d50-11e7-a37b-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">188.50.242.30</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d07f76-4d50-11e7-b53f-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d07f78-4d50-11e7-91cb-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d07f77-4d50-11e7-bd92-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">188.75.74.203</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d07f79-4d50-11e7-9589-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d07f7b-4d50-11e7-91ed-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d07f7a-4d50-11e7-84bd-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">191.252.119.67</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d07f7c-4d50-11e7-926e-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d07f7e-4d50-11e7-950f-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d07f7d-4d50-11e7-9a7b-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">193.10.226.48</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d07f7f-4d50-11e7-9dc5-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d07f81-4d50-11e7-9947-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d07f80-4d50-11e7-955f-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">193.161.13.129</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d07f82-4d50-11e7-bacc-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d07f84-4d50-11e7-9e70-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d07f83-4d50-11e7-a65c-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">193.161.13.55</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d07f85-4d50-11e7-a7ee-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d07f87-4d50-11e7-949e-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d07f86-4d50-11e7-af63-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">193.170.235.119</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d07f88-4d50-11e7-8cb5-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d07f8a-4d50-11e7-94e8-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d07f89-4d50-11e7-ab4f-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">193.206.239.215</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d07f8b-4d50-11e7-aa62-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d07f8d-4d50-11e7-80c8-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d07f8c-4d50-11e7-976f-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">193.248.211.180</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d07f8e-4d50-11e7-88eb-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d07f90-4d50-11e7-b561-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d07f8f-4d50-11e7-847a-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">193.252.169.36</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d07f91-4d50-11e7-87a0-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d07f93-4d50-11e7-ba5d-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d07f92-4d50-11e7-91d9-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">194.141.96.10</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d07f94-4d50-11e7-a07f-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d07f96-4d50-11e7-acea-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d07f95-4d50-11e7-a560-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">194.141.96.218</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d07f97-4d50-11e7-96ec-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d07f99-4d50-11e7-9759-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d07f98-4d50-11e7-98d7-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">194.141.96.246</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d07f9a-4d50-11e7-b218-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d07f9c-4d50-11e7-a348-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d07f9b-4d50-11e7-9138-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">194.141.96.42</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d07f9d-4d50-11e7-a100-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d07f9f-4d50-11e7-8488-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d07f9e-4d50-11e7-a66f-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">194.141.96.47</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d07fa0-4d50-11e7-9b33-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d07fa2-4d50-11e7-b0bf-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d07fa1-4d50-11e7-b162-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">194.141.96.64</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d07fa3-4d50-11e7-908f-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d07fa5-4d50-11e7-b6ff-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d07fa4-4d50-11e7-9e3f-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">194.50.128.119</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d07fa6-4d50-11e7-a3b2-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d07fa8-4d50-11e7-8adc-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d07fa7-4d50-11e7-bf24-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">195.16.72.135</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d07fa9-4d50-11e7-9655-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d07fab-4d50-11e7-ab9c-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d07faa-4d50-11e7-8ef4-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">195.218.139.178</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d07fac-4d50-11e7-b1be-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d07fae-4d50-11e7-8290-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d07fad-4d50-11e7-a5e2-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">195.218.139.178</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d07faf-4d50-11e7-b89c-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d07fb1-4d50-11e7-a43f-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d07fb0-4d50-11e7-b847-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">195.218.153.66</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d07fb2-4d50-11e7-adc3-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d07fb4-4d50-11e7-8c4a-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d07fb3-4d50-11e7-9150-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">195.218.6.209</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d07fb5-4d50-11e7-9493-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d07fb7-4d50-11e7-9853-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d07fb6-4d50-11e7-a31b-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">195.22.208.110</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d07fb8-4d50-11e7-9d4a-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d07fba-4d50-11e7-8ad4-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d07fb9-4d50-11e7-9751-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">195.39.169.162</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d07fbb-4d50-11e7-ac8d-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d07fbd-4d50-11e7-8e4a-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d07fbc-4d50-11e7-8ffb-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">195.43.11.66</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d07fbe-4d50-11e7-858c-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d07fc0-4d50-11e7-90d5-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d07fbf-4d50-11e7-ba21-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">195.95.158.155</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d07fc1-4d50-11e7-9973-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d07fc3-4d50-11e7-ac53-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d07fc2-4d50-11e7-800d-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">196.202.101.18</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d07fc4-4d50-11e7-96aa-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d07fc6-4d50-11e7-a829-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d07fc5-4d50-11e7-b0f6-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">196.210.18.132</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d07fc7-4d50-11e7-bf70-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d07fc9-4d50-11e7-9559-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d07fc8-4d50-11e7-af77-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">196.210.194.98</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d07fca-4d50-11e7-9726-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d07fcc-4d50-11e7-b917-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d07fcb-4d50-11e7-a30b-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">196.210.28.196</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d07fcd-4d50-11e7-8b69-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d07fcf-4d50-11e7-a9b6-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d07fce-4d50-11e7-bdaf-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">196.210.40.53</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d07fd0-4d50-11e7-bc76-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d07fd2-4d50-11e7-a301-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d07fd1-4d50-11e7-a85d-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">196.210.41.91</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d07fd3-4d50-11e7-9034-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d07fd5-4d50-11e7-92ed-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d07fd4-4d50-11e7-8e1d-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">196.210.74.34</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d07fd6-4d50-11e7-9ebd-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d07fd8-4d50-11e7-b0fe-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d07fd7-4d50-11e7-8178-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">196.215.36.235</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d07fd9-4d50-11e7-b205-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d07fdb-4d50-11e7-9e64-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d07fda-4d50-11e7-92d8-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">196.215.45.75</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d07fdc-4d50-11e7-88f2-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d07fde-4d50-11e7-999e-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d07fdd-4d50-11e7-8b15-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">196.219.169.2</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d07fdf-4d50-11e7-831a-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d07fe1-4d50-11e7-92c2-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d07fe0-4d50-11e7-afc9-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">196.228.75.121</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d07fe2-4d50-11e7-bfb6-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d07fe4-4d50-11e7-8cf7-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d07fe3-4d50-11e7-a2a9-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">197.160.59.36</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d07fe5-4d50-11e7-8077-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d07fe7-4d50-11e7-a47a-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d07fe6-4d50-11e7-8281-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">197.163.132.194</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d07fe8-4d50-11e7-bc1d-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d07fea-4d50-11e7-8ba6-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d07fe9-4d50-11e7-9770-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">197.81.195.104</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d07feb-4d50-11e7-8339-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d07fed-4d50-11e7-96c8-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d07fec-4d50-11e7-a36c-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">2.187.99.180</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d07fee-4d50-11e7-80a6-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d07ff0-4d50-11e7-8dc3-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d07fef-4d50-11e7-91b6-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">2.50.22.137</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d07ff1-4d50-11e7-b5a0-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d07ff3-4d50-11e7-a17f-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d07ff2-4d50-11e7-bac3-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">2.50.22.189</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d07ff4-4d50-11e7-98c1-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d07ff6-4d50-11e7-8bab-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d07ff5-4d50-11e7-bc6c-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">2.50.25.205</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d07ff7-4d50-11e7-a07c-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d07ff9-4d50-11e7-abfb-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d07ff8-4d50-11e7-846b-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">2.50.27.239</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d07ffa-4d50-11e7-b132-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d07ffc-4d50-11e7-81b0-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d07ffb-4d50-11e7-8195-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">2.50.40.245</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d07ffd-4d50-11e7-bab6-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d07fff-4d50-11e7-90f0-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d07ffe-4d50-11e7-ba37-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">2.93.131.116</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d08000-4d50-11e7-8dd6-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d08002-4d50-11e7-84df-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d08001-4d50-11e7-8ea2-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">2.93.131.179</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d08003-4d50-11e7-b965-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d08005-4d50-11e7-8217-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d08004-4d50-11e7-ac14-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">2.93.238.12</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d08006-4d50-11e7-a711-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d08008-4d50-11e7-8964-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d08007-4d50-11e7-acdf-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">2.93.238.146</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d08009-4d50-11e7-a2a5-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d0800b-4d50-11e7-8ff6-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d0800a-4d50-11e7-a416-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">2.93.238.167</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d0800c-4d50-11e7-ab1a-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d0800e-4d50-11e7-ad80-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d0800d-4d50-11e7-b835-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">2.93.238.176</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d0800f-4d50-11e7-8e68-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d08011-4d50-11e7-b571-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d08010-4d50-11e7-9b14-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">2.93.238.183</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d08012-4d50-11e7-b4e0-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d08014-4d50-11e7-a353-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d08013-4d50-11e7-a985-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">2.93.238.199</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d08015-4d50-11e7-b2e8-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d08017-4d50-11e7-af64-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d08016-4d50-11e7-8115-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">2.93.238.2</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d08018-4d50-11e7-9998-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d0801a-4d50-11e7-9d07-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d08019-4d50-11e7-b183-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">2.93.238.20</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d0801b-4d50-11e7-b508-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d0801d-4d50-11e7-99a1-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d0801c-4d50-11e7-9997-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">2.93.238.213</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d0801e-4d50-11e7-8063-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d08020-4d50-11e7-b4a7-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d0801f-4d50-11e7-a670-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">2.93.238.215</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d08021-4d50-11e7-8610-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d08023-4d50-11e7-8fad-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d08022-4d50-11e7-9e87-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">2.93.238.222</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d08024-4d50-11e7-8d60-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d08026-4d50-11e7-aaa0-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d08025-4d50-11e7-b7a7-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">2.93.238.252</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d08027-4d50-11e7-b9e4-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d08029-4d50-11e7-a6da-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d08028-4d50-11e7-b347-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">2.93.238.253</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d0802a-4d50-11e7-9959-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d0802c-4d50-11e7-8bac-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d0802b-4d50-11e7-a351-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">2.93.238.26</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d0802d-4d50-11e7-8797-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d0802f-4d50-11e7-b87e-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d0802e-4d50-11e7-bbc7-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">2.93.238.35</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d08030-4d50-11e7-b0fa-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d08032-4d50-11e7-97a4-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d08031-4d50-11e7-bb51-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">2.93.238.93</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d08033-4d50-11e7-9620-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d08035-4d50-11e7-8478-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d08034-4d50-11e7-a8eb-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">2.93.248.46</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d08036-4d50-11e7-a12a-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d08038-4d50-11e7-94e2-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d08037-4d50-11e7-bcec-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">2.93.248.5</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d08039-4d50-11e7-8b56-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d0803b-4d50-11e7-b7f9-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d0803a-4d50-11e7-b454-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">2.93.86.106</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d0803c-4d50-11e7-9f61-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d0803e-4d50-11e7-bf18-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d0803d-4d50-11e7-a0f2-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">2.93.86.136</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d0803f-4d50-11e7-afb0-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d08041-4d50-11e7-a7a9-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d08040-4d50-11e7-9192-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">2.93.86.150</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d08042-4d50-11e7-b57b-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d08044-4d50-11e7-9ad0-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d08043-4d50-11e7-a772-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">2.93.86.194</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d08045-4d50-11e7-9433-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d08047-4d50-11e7-a075-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d08046-4d50-11e7-b8a9-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">2.93.86.197</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d08048-4d50-11e7-a931-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d0804a-4d50-11e7-8bae-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d08049-4d50-11e7-b695-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">2.93.86.224</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d0804b-4d50-11e7-9969-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d0804d-4d50-11e7-a0be-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d0804c-4d50-11e7-9e97-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">2.93.86.226</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d0804e-4d50-11e7-bffc-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d08050-4d50-11e7-bf5a-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d0804f-4d50-11e7-840a-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">2.93.86.247</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d08051-4d50-11e7-94e1-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d08053-4d50-11e7-b50d-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d08052-4d50-11e7-8a2f-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">2.93.86.247</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d08054-4d50-11e7-8479-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d08056-4d50-11e7-8d8a-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d08055-4d50-11e7-96af-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">2.93.86.251</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d08057-4d50-11e7-940a-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d08059-4d50-11e7-9e3d-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d08058-4d50-11e7-bab8-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">2.93.86.253</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d0805a-4d50-11e7-8872-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d0805c-4d50-11e7-a252-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d0805b-4d50-11e7-92d9-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">2.93.86.36</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d0805d-4d50-11e7-9fa3-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d0805f-4d50-11e7-b302-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d0805e-4d50-11e7-b4a1-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">2.93.86.38</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d08060-4d50-11e7-beaa-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d08062-4d50-11e7-a605-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d08061-4d50-11e7-b7da-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">2.93.86.65</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d08063-4d50-11e7-aa60-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d08065-4d50-11e7-9370-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d08064-4d50-11e7-959c-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">2.93.86.89</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d08066-4d50-11e7-9801-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d08068-4d50-11e7-8e7e-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d08067-4d50-11e7-a277-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">2.94.117.30</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d08069-4d50-11e7-b87f-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d0806b-4d50-11e7-a8b3-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d0806a-4d50-11e7-aaa4-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">2.94.117.46</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d0806c-4d50-11e7-aa27-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d0806e-4d50-11e7-9c1b-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d0806d-4d50-11e7-98ff-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">2.94.117.47</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d0806f-4d50-11e7-8409-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d08071-4d50-11e7-8423-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d08070-4d50-11e7-bc51-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">2.94.117.56</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d08072-4d50-11e7-b62e-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d08074-4d50-11e7-8221-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d08073-4d50-11e7-a82f-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">2.94.209.30</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d08075-4d50-11e7-bce3-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d08077-4d50-11e7-8bc3-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d08076-4d50-11e7-ad43-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">2.94.53.139</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d08078-4d50-11e7-82af-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d0807a-4d50-11e7-a050-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d08079-4d50-11e7-8d48-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">2.94.65.211</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d0807b-4d50-11e7-9553-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d0807d-4d50-11e7-806c-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d0807c-4d50-11e7-a27f-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">2.94.65.246</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d0807e-4d50-11e7-aa62-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d08080-4d50-11e7-8fb9-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d0807f-4d50-11e7-b0d2-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">2.94.82.42</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d08081-4d50-11e7-8832-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d08083-4d50-11e7-85b6-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d08082-4d50-11e7-8c63-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">201.56.219.194</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d08084-4d50-11e7-a61d-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d08086-4d50-11e7-b5b9-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d08085-4d50-11e7-9f1d-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">201.57.146.28</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d08087-4d50-11e7-81b3-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d08089-4d50-11e7-8e18-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d08088-4d50-11e7-b4d7-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">202.142.153.237</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d0808a-4d50-11e7-903a-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d0808c-4d50-11e7-9cfb-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d0808b-4d50-11e7-841e-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">202.142.166.34</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d0808d-4d50-11e7-82bd-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d0808f-4d50-11e7-b6fc-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d0808e-4d50-11e7-b4e0-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">212.10.6.86</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d08090-4d50-11e7-bf68-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d08092-4d50-11e7-a038-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d08091-4d50-11e7-b819-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">212.111.196.9</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d08093-4d50-11e7-8a26-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d08095-4d50-11e7-9aee-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d08094-4d50-11e7-9870-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">212.126.97.106</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d08096-4d50-11e7-824e-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d08098-4d50-11e7-b93c-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d08097-4d50-11e7-9e86-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">212.250.163.188</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d08099-4d50-11e7-a4cd-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d0809b-4d50-11e7-ab3f-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d0809a-4d50-11e7-9fb1-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">212.34.233.6</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d0809c-4d50-11e7-adf9-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d0809e-4d50-11e7-b392-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d0809d-4d50-11e7-8737-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">213.131.56.110</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d0809f-4d50-11e7-ae26-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d080a1-4d50-11e7-bbdb-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d080a0-4d50-11e7-92ab-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">213.160.235.93</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d080a2-4d50-11e7-bbf5-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d080a4-4d50-11e7-b9cb-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d080a3-4d50-11e7-b983-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">213.163.65.158</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d080a5-4d50-11e7-aa55-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d080a7-4d50-11e7-8a40-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d080a6-4d50-11e7-9979-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">213.186.183.179</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d080a8-4d50-11e7-bb12-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d080aa-4d50-11e7-8d50-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d080a9-4d50-11e7-a18e-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">213.202.81.46</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d080ab-4d50-11e7-addd-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d080ad-4d50-11e7-b822-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d080ac-4d50-11e7-8b4b-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">213.33.142.90</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d080ae-4d50-11e7-8c9e-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d080b0-4d50-11e7-9981-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d080af-4d50-11e7-a94a-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">213.42.158.42</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d080b1-4d50-11e7-bff4-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d080b3-4d50-11e7-917e-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d080b2-4d50-11e7-abe7-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">217.126.253.248</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d080b4-4d50-11e7-9efc-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d080b6-4d50-11e7-af59-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d080b5-4d50-11e7-bb7c-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">217.145.23.121</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d080b7-4d50-11e7-94b9-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d080b9-4d50-11e7-a574-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d080b8-4d50-11e7-8301-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">217.165.4.5</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d080ba-4d50-11e7-b728-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d080bc-4d50-11e7-8533-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d080bb-4d50-11e7-b513-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">217.165.9.163</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d080bd-4d50-11e7-9af0-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d080bf-4d50-11e7-b205-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d080be-4d50-11e7-9e57-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">217.165.9.209</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d080c0-4d50-11e7-803d-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d080c2-4d50-11e7-a88c-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d080c1-4d50-11e7-b268-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">217.197.244.170</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d080c3-4d50-11e7-aca7-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d080c5-4d50-11e7-bb1f-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d080c4-4d50-11e7-bfe4-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">217.197.245.22</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d080c6-4d50-11e7-8ec6-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d080c8-4d50-11e7-b70a-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d080c7-4d50-11e7-985a-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">217.86.202.86</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d080c9-4d50-11e7-9279-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d080cb-4d50-11e7-a707-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d080ca-4d50-11e7-861f-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">220.151.32.214</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d080cc-4d50-11e7-94e9-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d080ce-4d50-11e7-a683-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d080cd-4d50-11e7-8d44-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">222.158.217.115</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d080cf-4d50-11e7-8624-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d080d1-4d50-11e7-b03a-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d080d0-4d50-11e7-be90-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">223.30.78.100</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d080d2-4d50-11e7-8e86-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d080d4-4d50-11e7-a3c7-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d080d3-4d50-11e7-bd00-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">27.125.35.229</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d080d5-4d50-11e7-a167-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d080d7-4d50-11e7-8d3a-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d080d6-4d50-11e7-8838-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">27.96.110.130</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d080d8-4d50-11e7-b2cc-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d080da-4d50-11e7-bf43-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d080d9-4d50-11e7-9dbe-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">31.146.136.6</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d080db-4d50-11e7-9437-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d080dd-4d50-11e7-97ac-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d080dc-4d50-11e7-9948-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">31.168.203.44</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d080de-4d50-11e7-8e7e-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d080e0-4d50-11e7-87e9-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d080df-4d50-11e7-9a18-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">31.47.47.130</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d080e1-4d50-11e7-8985-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d080e3-4d50-11e7-93f6-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d080e2-4d50-11e7-bee6-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">31.54.73.156</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d080e4-4d50-11e7-bfa7-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d080e6-4d50-11e7-a456-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d080e5-4d50-11e7-8edd-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">31.54.74.176</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d080e7-4d50-11e7-bc86-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d080e9-4d50-11e7-bec3-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d080e8-4d50-11e7-9fa0-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">37.104.24.220</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d080ea-4d50-11e7-a0fb-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d080ec-4d50-11e7-828a-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d080eb-4d50-11e7-9104-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">37.104.50.144</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d080ed-4d50-11e7-a8bb-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d080ef-4d50-11e7-8f05-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d080ee-4d50-11e7-961d-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">37.104.67.33</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d080f0-4d50-11e7-b658-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d080f2-4d50-11e7-b0d3-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d080f1-4d50-11e7-af2b-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">37.105.234.200</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d080f3-4d50-11e7-bc5a-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d080f5-4d50-11e7-bafa-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d080f4-4d50-11e7-9cfd-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">37.106.115.3</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d080f6-4d50-11e7-8882-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d080f8-4d50-11e7-b401-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d080f7-4d50-11e7-bb95-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">37.143.29.10</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d080f9-4d50-11e7-b646-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d080fb-4d50-11e7-80ee-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d080fa-4d50-11e7-9c60-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">37.148.209.156</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d080fc-4d50-11e7-b192-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d080fe-4d50-11e7-be91-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d080fd-4d50-11e7-a260-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">37.216.213.70</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d080ff-4d50-11e7-ab08-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d08101-4d50-11e7-977d-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d08100-4d50-11e7-8f13-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">37.34.240.177</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d08102-4d50-11e7-b92d-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d08104-4d50-11e7-9aef-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d08103-4d50-11e7-989f-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">37.48.106.69</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d08105-4d50-11e7-a1b1-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d08107-4d50-11e7-95a4-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d08106-4d50-11e7-aa2e-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">37.71.50.2</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d08108-4d50-11e7-b8ee-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d0810a-4d50-11e7-a5cd-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d08109-4d50-11e7-be4b-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">37.75.0.98</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d0810b-4d50-11e7-8ca5-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d0810d-4d50-11e7-b40a-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d0810c-4d50-11e7-9702-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">37.75.10.194</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d0810e-4d50-11e7-9bb8-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d08110-4d50-11e7-8e66-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d0810f-4d50-11e7-82d3-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">37.75.11.162</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d08111-4d50-11e7-aa86-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d08113-4d50-11e7-acbd-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d08112-4d50-11e7-bdd2-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">37.75.2.203</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d08114-4d50-11e7-8caa-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d08116-4d50-11e7-a588-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d08115-4d50-11e7-919e-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">41.110.179.197</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d08117-4d50-11e7-99d9-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d08119-4d50-11e7-b624-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d08118-4d50-11e7-b0e0-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">41.128.226.60</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d0811a-4d50-11e7-b259-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d0811c-4d50-11e7-8820-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d0811b-4d50-11e7-bc3e-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">41.131.164.156</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d0811d-4d50-11e7-93ac-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d0811f-4d50-11e7-8151-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d0811e-4d50-11e7-815f-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">41.131.49.228</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d08120-4d50-11e7-bfba-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d08122-4d50-11e7-8528-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d08121-4d50-11e7-80cc-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">41.131.49.228</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d08123-4d50-11e7-8946-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d08125-4d50-11e7-8b45-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d08124-4d50-11e7-89b8-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">41.134.208.234</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d08126-4d50-11e7-bd0b-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d08128-4d50-11e7-b010-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d08127-4d50-11e7-a072-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">41.182.252.56</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d08129-4d50-11e7-8ebe-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d0812b-4d50-11e7-8583-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d0812a-4d50-11e7-b6fe-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">41.205.139.34</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d0812c-4d50-11e7-b90b-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d0812e-4d50-11e7-8455-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d0812d-4d50-11e7-8c90-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">41.208.106.68</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d0812f-4d50-11e7-8556-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d08131-4d50-11e7-a31e-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d08130-4d50-11e7-999c-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">41.208.106.70</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d08132-4d50-11e7-868e-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d08134-4d50-11e7-a3c3-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d08133-4d50-11e7-949d-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">41.215.250.40</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d08135-4d50-11e7-acfd-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d2ef81-4d50-11e7-ac33-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d2ef80-4d50-11e7-9571-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">41.223.30.20</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d2ef82-4d50-11e7-9d36-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d2ef84-4d50-11e7-8829-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d2ef83-4d50-11e7-b016-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">41.224.254.90</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d2ef85-4d50-11e7-bd9d-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d2ef87-4d50-11e7-948e-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d2ef86-4d50-11e7-8958-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">41.57.108.68</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d2ef88-4d50-11e7-b202-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d2ef8a-4d50-11e7-bf08-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d2ef89-4d50-11e7-be9d-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">41.67.136.38</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d2ef8b-4d50-11e7-a40d-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d2ef8d-4d50-11e7-9955-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d2ef8c-4d50-11e7-aa99-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">41.67.136.39</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d2ef8e-4d50-11e7-af92-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d2ef90-4d50-11e7-9772-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d2ef8f-4d50-11e7-99e1-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">41.72.101.138</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d2ef91-4d50-11e7-bc91-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d2ef93-4d50-11e7-aa85-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d2ef92-4d50-11e7-ba70-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">41.72.99.5</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d2ef94-4d50-11e7-b085-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d2ef96-4d50-11e7-82f3-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d2ef95-4d50-11e7-a596-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">41.72.99.5</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d2ef97-4d50-11e7-86af-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d2ef99-4d50-11e7-bbb7-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d2ef98-4d50-11e7-8d37-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">41.74.166.253</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d2ef9a-4d50-11e7-9595-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d2ef9c-4d50-11e7-a79a-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d2ef9b-4d50-11e7-b4d0-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">45.120.61.145</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d2ef9d-4d50-11e7-b63f-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d2ef9f-4d50-11e7-80f9-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d2ef9e-4d50-11e7-9ad9-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">46.121.242.180</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d2efa0-4d50-11e7-93a6-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d2efa2-4d50-11e7-a34b-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d2efa1-4d50-11e7-a239-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">46.174.116.221</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d2efa3-4d50-11e7-bc16-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d2efa5-4d50-11e7-bbd7-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d2efa4-4d50-11e7-9d6b-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">46.174.116.231</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d2efa6-4d50-11e7-97d8-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d2efa8-4d50-11e7-bfe2-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d2efa7-4d50-11e7-acbf-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">46.174.116.234</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d2efa9-4d50-11e7-874e-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d2efab-4d50-11e7-a464-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d2efaa-4d50-11e7-815c-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">46.174.116.60</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d2efac-4d50-11e7-856b-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d2efae-4d50-11e7-bee4-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d2efad-4d50-11e7-8600-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">46.174.116.87</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d2efaf-4d50-11e7-b83a-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d2efb1-4d50-11e7-95dd-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d2efb0-4d50-11e7-8a74-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">46.174.116.90</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d2efb2-4d50-11e7-8caf-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d2efb4-4d50-11e7-870a-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d2efb3-4d50-11e7-9675-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">46.174.116.99</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d2efb5-4d50-11e7-a5f4-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d2efb7-4d50-11e7-bf40-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d2efb6-4d50-11e7-a042-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">46.174.117.103</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d2efb8-4d50-11e7-9b15-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d2efba-4d50-11e7-bf63-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d2efb9-4d50-11e7-bb62-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">46.174.117.116</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d2efbb-4d50-11e7-98c5-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d2efbd-4d50-11e7-ae3e-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d2efbc-4d50-11e7-a70d-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">46.174.117.121</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d2efbe-4d50-11e7-beb2-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d2efc0-4d50-11e7-8770-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d2efbf-4d50-11e7-a127-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">46.174.117.129</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d2efc1-4d50-11e7-a230-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d2efc3-4d50-11e7-8ff9-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d2efc2-4d50-11e7-9157-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">46.174.117.134</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d2efc4-4d50-11e7-b8f2-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d2efc6-4d50-11e7-a74b-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d2efc5-4d50-11e7-abba-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">46.174.117.15</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d2efc7-4d50-11e7-b814-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d2efc9-4d50-11e7-a6c8-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d2efc8-4d50-11e7-9192-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">46.174.117.153</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d2efca-4d50-11e7-bd1e-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d2efcc-4d50-11e7-85dd-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d2efcb-4d50-11e7-b996-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">46.174.117.164</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d2efcd-4d50-11e7-9acf-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d2efcf-4d50-11e7-9ebb-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d2efce-4d50-11e7-b078-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">46.174.117.32</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d2efd0-4d50-11e7-b8a1-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d2efd2-4d50-11e7-83c8-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d2efd1-4d50-11e7-9621-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">46.174.117.36</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d2efd3-4d50-11e7-be41-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d2efd5-4d50-11e7-9bbc-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d2efd4-4d50-11e7-b36c-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">46.174.117.42</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d2efd6-4d50-11e7-acf3-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d2efd8-4d50-11e7-8d69-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d2efd7-4d50-11e7-9b18-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">46.174.117.44</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d2efd9-4d50-11e7-996d-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d2efdb-4d50-11e7-8d1b-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d2efda-4d50-11e7-9026-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">46.174.117.50</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d2efdc-4d50-11e7-815a-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d2efde-4d50-11e7-bbaa-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d2efdd-4d50-11e7-bd47-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">46.174.117.61</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d2efdf-4d50-11e7-8030-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d2efe1-4d50-11e7-982c-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d2efe0-4d50-11e7-a9ad-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">46.174.117.77</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d2efe2-4d50-11e7-b1ec-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d2efe4-4d50-11e7-b0a0-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d2efe3-4d50-11e7-ae21-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">46.174.117.80</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d2efe5-4d50-11e7-b39f-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d2efe7-4d50-11e7-9b2b-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d2efe6-4d50-11e7-8aab-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">46.174.117.97</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d2efe8-4d50-11e7-b2ce-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d2efea-4d50-11e7-9de9-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d2efe9-4d50-11e7-85d6-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">46.174.117.98</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d2efeb-4d50-11e7-b21e-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d2efed-4d50-11e7-a7fe-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d2efec-4d50-11e7-b52a-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">46.19.101.186</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d2efee-4d50-11e7-a056-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d2eff0-4d50-11e7-83a2-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d2efef-4d50-11e7-857b-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">46.218.127.110</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d2eff1-4d50-11e7-a998-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d2eff3-4d50-11e7-b3e7-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d2eff2-4d50-11e7-98cc-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">46.52.131.102</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d2eff4-4d50-11e7-8bef-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d2eff6-4d50-11e7-aef5-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d2eff5-4d50-11e7-91dc-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">49.206.1.61</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d2eff7-4d50-11e7-a9c9-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d2eff9-4d50-11e7-bce4-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d2eff8-4d50-11e7-a0f7-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">5.141.87.156</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d2effa-4d50-11e7-9c9f-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d2effc-4d50-11e7-89da-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d2effb-4d50-11e7-aa10-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">5.189.190.67</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d2effd-4d50-11e7-8447-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d2efff-4d50-11e7-bd63-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d2effe-4d50-11e7-ad55-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">5.200.154.208</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d2f000-4d50-11e7-9441-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d2f002-4d50-11e7-9bb0-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d2f001-4d50-11e7-8169-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">5.200.177.218</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d2f003-4d50-11e7-bb12-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d2f005-4d50-11e7-b913-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d2f004-4d50-11e7-90c0-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">5.200.191.104</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d2f006-4d50-11e7-a57e-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d2f008-4d50-11e7-b569-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d2f007-4d50-11e7-bd76-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">5.200.198.10</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d2f009-4d50-11e7-a970-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d2f00b-4d50-11e7-a84a-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d2f00a-4d50-11e7-bff4-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">5.200.202.99</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d2f00c-4d50-11e7-8428-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d2f00e-4d50-11e7-bbb4-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d2f00d-4d50-11e7-9a07-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">5.22.137.178</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d2f00f-4d50-11e7-902b-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d2f011-4d50-11e7-a515-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d2f010-4d50-11e7-81e9-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">5.22.140.93</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d2f012-4d50-11e7-97ad-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d2f014-4d50-11e7-9921-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d2f013-4d50-11e7-8c70-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">5.41.190.7</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d2f015-4d50-11e7-893c-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d2f017-4d50-11e7-9610-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d2f016-4d50-11e7-8b7e-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">5.41.201.151</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d2f018-4d50-11e7-a3dd-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d2f01a-4d50-11e7-8564-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d2f019-4d50-11e7-8f3f-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">5.41.237.214</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d2f01b-4d50-11e7-a652-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d2f01d-4d50-11e7-b420-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d2f01c-4d50-11e7-a62c-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">5.41.88.137</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d2f01e-4d50-11e7-b525-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d2f020-4d50-11e7-9a49-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d2f01f-4d50-11e7-ba40-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">5.41.89.32</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d2f021-4d50-11e7-8106-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d2f023-4d50-11e7-810f-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d2f022-4d50-11e7-81ff-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">5.41.94.221</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d2f024-4d50-11e7-a320-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d2f026-4d50-11e7-869f-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d2f025-4d50-11e7-a203-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">5.98.91.76</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d2f027-4d50-11e7-bb24-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d2f029-4d50-11e7-8255-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d2f028-4d50-11e7-a57d-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">51.235.1.216</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d2f02a-4d50-11e7-bea4-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d2f02c-4d50-11e7-b6db-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d2f02b-4d50-11e7-a850-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">51.235.13.162</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d2f02d-4d50-11e7-ab22-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d2f02f-4d50-11e7-b4ee-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d2f02e-4d50-11e7-b336-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">51.235.17.133</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d2f030-4d50-11e7-8dc2-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d2f032-4d50-11e7-94ca-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d2f031-4d50-11e7-83e4-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">51.235.19.202</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d2f033-4d50-11e7-b8ca-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d2f035-4d50-11e7-9db4-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d2f034-4d50-11e7-88d6-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">51.235.33.226</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d2f036-4d50-11e7-b7cf-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d2f038-4d50-11e7-9e57-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d2f037-4d50-11e7-ac47-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">51.235.49.202</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d2f039-4d50-11e7-8515-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d2f03b-4d50-11e7-8019-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d2f03a-4d50-11e7-a095-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">59.90.93.248</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d2f03c-4d50-11e7-812e-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d2f03e-4d50-11e7-8b86-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d2f03d-4d50-11e7-bfeb-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">59.90.93.250</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d2f03f-4d50-11e7-a25b-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d2f041-4d50-11e7-b9ce-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d2f040-4d50-11e7-b29b-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">59.90.93.253</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d2f042-4d50-11e7-a74d-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d2f044-4d50-11e7-b200-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d2f043-4d50-11e7-b217-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">59.90.93.254</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d2f045-4d50-11e7-84c2-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d2f047-4d50-11e7-8553-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d2f046-4d50-11e7-b41b-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">59.92.172.180</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d2f048-4d50-11e7-86a9-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d2f04a-4d50-11e7-ac31-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d2f049-4d50-11e7-882a-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">59.92.173.162</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d2f04b-4d50-11e7-86d8-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d2f04d-4d50-11e7-99fc-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d2f04c-4d50-11e7-b23b-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">59.96.61.252</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d2f04e-4d50-11e7-bfda-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d2f050-4d50-11e7-b373-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d2f04f-4d50-11e7-8017-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">61.199.195.132</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d2f051-4d50-11e7-8d05-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d2f053-4d50-11e7-aee6-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d2f052-4d50-11e7-8f1c-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">62.150.93.186</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d2f054-4d50-11e7-bdcb-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d2f056-4d50-11e7-ac39-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d2f055-4d50-11e7-a462-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">62.169.202.4</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d2f057-4d50-11e7-9797-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d2f059-4d50-11e7-b4d5-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d2f058-4d50-11e7-9172-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">62.212.230.9</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d2f05a-4d50-11e7-82bf-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d2f05c-4d50-11e7-bdde-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d2f05b-4d50-11e7-a9bf-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">62.232.122.11</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d2f05d-4d50-11e7-8b65-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d2f05f-4d50-11e7-badd-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d2f05e-4d50-11e7-aeae-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">62.99.86.67</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d2f060-4d50-11e7-a76f-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d2f062-4d50-11e7-8a11-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d2f061-4d50-11e7-807b-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">77.146.75.36</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d2f063-4d50-11e7-874b-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d2f065-4d50-11e7-a166-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d2f064-4d50-11e7-97e3-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">77.221.42.21</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d2f066-4d50-11e7-a104-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d2f068-4d50-11e7-b872-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d2f067-4d50-11e7-8c4b-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">77.252.37.85</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d2f069-4d50-11e7-a967-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d2f06b-4d50-11e7-b5b1-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d2f06a-4d50-11e7-8aa9-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">77.30.192.220</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d2f06c-4d50-11e7-83cf-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d2f06e-4d50-11e7-afe2-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d2f06d-4d50-11e7-92ce-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">77.30.30.254</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d2f06f-4d50-11e7-81b4-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d2f071-4d50-11e7-a66f-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d2f070-4d50-11e7-974d-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">77.31.133.176</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d2f072-4d50-11e7-b09b-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d2f074-4d50-11e7-b3ca-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d2f073-4d50-11e7-9d03-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">77.31.193.238</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d2f075-4d50-11e7-8a3c-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d2f077-4d50-11e7-a8f4-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d2f076-4d50-11e7-8e7b-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">77.31.197.19</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d2f078-4d50-11e7-a11b-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d2f07a-4d50-11e7-9be2-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d2f079-4d50-11e7-96ca-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">77.31.230.175</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d2f07b-4d50-11e7-ba59-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d2f07d-4d50-11e7-ade5-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d2f07c-4d50-11e7-8759-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">78.158.161.226</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d2f07e-4d50-11e7-8bdf-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d2f080-4d50-11e7-bfd9-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d2f07f-4d50-11e7-a420-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">78.231.30.58</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d2f081-4d50-11e7-b66f-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d2f083-4d50-11e7-8dfa-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d2f082-4d50-11e7-b9c0-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">78.38.150.25</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d2f084-4d50-11e7-b864-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d2f086-4d50-11e7-a63f-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d2f085-4d50-11e7-9375-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">78.38.156.245</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d2f087-4d50-11e7-8d8e-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d2f089-4d50-11e7-ac59-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d2f088-4d50-11e7-b298-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">79.173.253.219</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d2f08a-4d50-11e7-a060-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d2f08c-4d50-11e7-a2b4-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d2f08b-4d50-11e7-8708-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">80.122.89.226</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d2f08d-4d50-11e7-a245-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d2f08f-4d50-11e7-bef3-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d2f08e-4d50-11e7-ad5f-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">80.179.147.211</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d2f090-4d50-11e7-95d6-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d2f092-4d50-11e7-ae06-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d2f091-4d50-11e7-a8fb-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">80.237.92.242</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d2f093-4d50-11e7-b727-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d2f095-4d50-11e7-b5d0-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d2f094-4d50-11e7-8069-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">80.30.160.241</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d2f096-4d50-11e7-88c6-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d2f098-4d50-11e7-be02-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d2f097-4d50-11e7-b452-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">80.93.160.153</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d2f099-4d50-11e7-8a12-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d2f09b-4d50-11e7-a220-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d2f09a-4d50-11e7-beea-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">81.213.141.247</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d2f09c-4d50-11e7-a4fc-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d2f09e-4d50-11e7-8125-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d2f09d-4d50-11e7-982b-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">81.218.133.105</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d2f09f-4d50-11e7-a31d-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d2f0a1-4d50-11e7-a898-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d2f0a0-4d50-11e7-bcc9-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">81.30.33.101</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d2f0a2-4d50-11e7-b1c6-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d2f0a4-4d50-11e7-81ff-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d2f0a3-4d50-11e7-bc73-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">81.33.4.213</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d2f0a5-4d50-11e7-a0ed-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d2f0a7-4d50-11e7-b161-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d2f0a6-4d50-11e7-bdaf-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">82.119.142.62</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d2f0a8-4d50-11e7-91ed-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d2f0aa-4d50-11e7-a241-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d2f0a9-4d50-11e7-9396-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">82.192.71.8</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d2f0ab-4d50-11e7-a0bd-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d2f0ad-4d50-11e7-8e04-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d2f0ac-4d50-11e7-803f-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">82.71.14.87</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d2f0ae-4d50-11e7-bfbc-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d2f0b0-4d50-11e7-9919-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d2f0af-4d50-11e7-87ce-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">82.97.250.107</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d2f0b1-4d50-11e7-bbf6-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d2f0b3-4d50-11e7-89f9-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d2f0b2-4d50-11e7-ba77-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">83.110.106.50</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d2f0b4-4d50-11e7-a836-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d2f0b6-4d50-11e7-b356-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d2f0b5-4d50-11e7-a17d-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">83.110.146.238</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d2f0b7-4d50-11e7-9ed0-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d2f0b9-4d50-11e7-bf99-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d2f0b8-4d50-11e7-97b7-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">83.110.146.87</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d2f0ba-4d50-11e7-8d43-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d2f0bc-4d50-11e7-b190-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d2f0bb-4d50-11e7-800a-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">83.110.152.183</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d2f0bd-4d50-11e7-bc08-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d2f0bf-4d50-11e7-b7f5-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d2f0be-4d50-11e7-8433-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">83.110.154.156</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d2f0c0-4d50-11e7-a92a-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d2f0c2-4d50-11e7-a893-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d2f0c1-4d50-11e7-94f1-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">83.110.224.10</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d2f0c3-4d50-11e7-9446-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d2f0c5-4d50-11e7-b707-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d2f0c4-4d50-11e7-87f4-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">83.110.225.75</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d2f0c6-4d50-11e7-92d5-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d2f0c8-4d50-11e7-bc0c-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d2f0c7-4d50-11e7-a98f-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">83.110.225.95</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d2f0c9-4d50-11e7-bf8d-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d2f0cb-4d50-11e7-a1ca-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d2f0ca-4d50-11e7-944c-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">83.110.248.219</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d2f0cc-4d50-11e7-9419-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d2f0ce-4d50-11e7-a0cb-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d2f0cd-4d50-11e7-b878-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">83.111.24.30</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d2f0cf-4d50-11e7-965f-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d2f0d1-4d50-11e7-8880-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d2f0d0-4d50-11e7-b339-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">83.111.31.66</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d2f0d2-4d50-11e7-bb5d-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d2f0d4-4d50-11e7-b1eb-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d2f0d3-4d50-11e7-8655-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">83.111.99.206</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d2f0d5-4d50-11e7-ad81-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d2f0d7-4d50-11e7-84c0-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d2f0d6-4d50-11e7-9c56-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">83.196.248.74</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d2f0d8-4d50-11e7-8f63-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d2f0da-4d50-11e7-bbed-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d2f0d9-4d50-11e7-b552-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">83.206.242.251</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d2f0db-4d50-11e7-861d-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d2f0dd-4d50-11e7-8438-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d2f0dc-4d50-11e7-bb6c-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">83.40.45.144</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d2f0de-4d50-11e7-9124-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d2f0e0-4d50-11e7-8402-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d2f0df-4d50-11e7-907c-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">83.40.47.30</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d2f0e1-4d50-11e7-bc55-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d2f0e3-4d50-11e7-a1f6-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d2f0e2-4d50-11e7-85e0-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">83.41.45.113</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d2f0e4-4d50-11e7-9354-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d2f0e6-4d50-11e7-9957-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d2f0e5-4d50-11e7-9a06-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">84.45.133.120</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d2f0e7-4d50-11e7-a2f2-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d2f0e9-4d50-11e7-84af-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d2f0e8-4d50-11e7-a84c-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">84.58.201.3</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d2f0ea-4d50-11e7-ab14-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d2f0ec-4d50-11e7-9667-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d2f0eb-4d50-11e7-92c6-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">85.132.27.238</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d2f0ed-4d50-11e7-bb61-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d2f0ef-4d50-11e7-814b-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d2f0ee-4d50-11e7-b55b-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">85.133.129.190</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d2f0f0-4d50-11e7-bb28-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d2f0f2-4d50-11e7-b91e-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d2f0f1-4d50-11e7-b29e-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">85.133.184.21</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d2f0f3-4d50-11e7-8635-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d2f0f5-4d50-11e7-85ce-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d2f0f4-4d50-11e7-87c3-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">85.189.146.1</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d2f0f6-4d50-11e7-8800-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d2f0f8-4d50-11e7-b8da-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d2f0f7-4d50-11e7-bd05-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">85.234.218.210</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d2f0f9-4d50-11e7-b910-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d2f0fb-4d50-11e7-a27f-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d2f0fa-4d50-11e7-85e6-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">85.29.129.172</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d2f0fc-4d50-11e7-9fad-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d2f0fe-4d50-11e7-bd07-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d2f0fd-4d50-11e7-b335-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">85.9.72.30</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d2f0ff-4d50-11e7-a0e4-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d2f101-4d50-11e7-afcd-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d2f100-4d50-11e7-b64c-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">86.130.50.6</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d2f102-4d50-11e7-b1bd-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d2f104-4d50-11e7-9baf-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d2f103-4d50-11e7-bd9b-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">86.144.211.140</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d2f105-4d50-11e7-92fc-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d2f107-4d50-11e7-9c9b-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d2f106-4d50-11e7-a1ed-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">86.195.164.161</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d2f108-4d50-11e7-b496-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d2f10a-4d50-11e7-9cf3-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d2f109-4d50-11e7-a6cb-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">86.195.165.111</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d2f10b-4d50-11e7-ba3d-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d2f10d-4d50-11e7-9606-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d2f10c-4d50-11e7-bb36-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">86.195.167.6</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d2f10e-4d50-11e7-a245-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d2f110-4d50-11e7-ac36-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d2f10f-4d50-11e7-b001-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">86.195.168.234</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d2f111-4d50-11e7-af38-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d2f113-4d50-11e7-85df-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d2f112-4d50-11e7-b963-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">86.195.169.206</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d2f114-4d50-11e7-b859-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d2f116-4d50-11e7-bd27-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d2f115-4d50-11e7-84a9-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">86.195.170.104</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d2f117-4d50-11e7-a263-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d2f119-4d50-11e7-b8bc-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d2f118-4d50-11e7-940e-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">86.195.170.69</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d2f11a-4d50-11e7-a2eb-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d2f11c-4d50-11e7-8930-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d2f11b-4d50-11e7-9ca2-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">86.195.171.142</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d2f11d-4d50-11e7-a68b-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d2f11f-4d50-11e7-adf2-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d2f11e-4d50-11e7-9ef5-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">86.195.171.169</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d2f120-4d50-11e7-98d6-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d2f122-4d50-11e7-9198-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d2f121-4d50-11e7-a7e2-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">86.195.171.217</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d2f123-4d50-11e7-b131-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d2f125-4d50-11e7-ad8f-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d2f124-4d50-11e7-a003-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">86.195.36.194</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d2f126-4d50-11e7-ab72-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d2f128-4d50-11e7-8e84-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d2f127-4d50-11e7-aa1f-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">86.195.36.23</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d2f129-4d50-11e7-b9fe-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d2f12b-4d50-11e7-b8ad-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d2f12a-4d50-11e7-b31c-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">86.195.37.215</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d2f12c-4d50-11e7-a6b3-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d2f12e-4d50-11e7-9f6c-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d2f12d-4d50-11e7-bbac-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">86.195.37.34</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d2f12f-4d50-11e7-9784-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d2f131-4d50-11e7-8ba9-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d2f130-4d50-11e7-ab75-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">86.195.37.90</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d2f132-4d50-11e7-8908-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d2f134-4d50-11e7-89ed-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d2f133-4d50-11e7-8391-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">86.195.38.164</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d2f135-4d50-11e7-b47b-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d2f137-4d50-11e7-a12e-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d2f136-4d50-11e7-b5ca-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">86.195.38.214</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d2f138-4d50-11e7-9e7c-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d2f13a-4d50-11e7-b4de-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d2f139-4d50-11e7-a72b-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">86.195.39.45</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d2f13b-4d50-11e7-b1cd-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d2f13d-4d50-11e7-8d98-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d2f13c-4d50-11e7-83f1-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">86.195.39.47</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d2f13e-4d50-11e7-84e3-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d2f140-4d50-11e7-89b0-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d2f13f-4d50-11e7-a778-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">86.195.40.131</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d2f141-4d50-11e7-bb0e-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d2f143-4d50-11e7-b68c-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d2f142-4d50-11e7-9077-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">86.195.40.155</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d2f144-4d50-11e7-bdda-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d2f146-4d50-11e7-96b3-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d2f145-4d50-11e7-bb04-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">86.195.41.149</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d2f147-4d50-11e7-916f-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d2f149-4d50-11e7-9cd0-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d2f148-4d50-11e7-a3a8-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">86.195.41.154</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d2f14a-4d50-11e7-a00d-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d2f14c-4d50-11e7-b276-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d2f14b-4d50-11e7-87b4-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">86.204.180.177</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d2f14d-4d50-11e7-a9ca-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d2f14f-4d50-11e7-862c-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d2f14e-4d50-11e7-ab79-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">86.98.24.118</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d2f150-4d50-11e7-9e49-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d2f152-4d50-11e7-a0f6-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d2f151-4d50-11e7-b22f-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">86.98.24.150</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d2f153-4d50-11e7-81dd-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d2f155-4d50-11e7-ac77-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d2f154-4d50-11e7-85d4-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">86.98.24.234</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d2f156-4d50-11e7-817b-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d2f158-4d50-11e7-9d1f-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d2f157-4d50-11e7-ad5f-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">86.98.24.49</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d2f159-4d50-11e7-b3fa-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d2f15b-4d50-11e7-beeb-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d2f15a-4d50-11e7-8870-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">86.98.24.64</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d2f15c-4d50-11e7-a797-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d2f15e-4d50-11e7-8980-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d2f15d-4d50-11e7-83ad-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">86.98.25.136</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d2f15f-4d50-11e7-b9e3-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d2f161-4d50-11e7-b643-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d2f160-4d50-11e7-b716-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">86.98.25.235</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d2f162-4d50-11e7-ba46-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d2f164-4d50-11e7-9272-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d2f163-4d50-11e7-af87-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">86.98.25.244</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d2f165-4d50-11e7-a259-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d2f167-4d50-11e7-ac42-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d2f166-4d50-11e7-aa6a-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">86.98.26.192</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d2f168-4d50-11e7-8f91-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d2f16a-4d50-11e7-849a-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d2f169-4d50-11e7-91ed-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">86.98.26.231</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d2f16b-4d50-11e7-920e-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d2f16d-4d50-11e7-bc27-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d2f16c-4d50-11e7-8b45-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">86.98.26.242</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d2f16e-4d50-11e7-b4e0-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d2f170-4d50-11e7-875d-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d2f16f-4d50-11e7-b917-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">86.98.27.119</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d2f171-4d50-11e7-8cfe-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d2f173-4d50-11e7-98ac-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d2f172-4d50-11e7-bd6e-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">86.98.27.127</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d2f174-4d50-11e7-82f7-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d2f176-4d50-11e7-9289-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d2f175-4d50-11e7-873c-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">86.98.27.174</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d2f177-4d50-11e7-81df-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d2f179-4d50-11e7-8904-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d2f178-4d50-11e7-abbf-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">86.98.29.148</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d2f17a-4d50-11e7-b4b3-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d2f17c-4d50-11e7-819a-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d2f17b-4d50-11e7-9c0b-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">86.98.29.171</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d2f17d-4d50-11e7-aa9d-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d2f17f-4d50-11e7-8abf-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d2f17e-4d50-11e7-bd91-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">86.98.30.70</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d2f180-4d50-11e7-9603-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d2f182-4d50-11e7-8dea-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d2f181-4d50-11e7-a661-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">86.98.31.59</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d2f183-4d50-11e7-92a6-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d2f185-4d50-11e7-a134-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d2f184-4d50-11e7-88e3-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">86.98.31.68</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d2f186-4d50-11e7-85fe-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d2f188-4d50-11e7-89a4-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d2f187-4d50-11e7-98b7-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">86.98.40.27</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d2f189-4d50-11e7-8b0c-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d2f18b-4d50-11e7-b6ac-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d2f18a-4d50-11e7-9e0f-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">86.98.40.65</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d2f18c-4d50-11e7-8612-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d2f18e-4d50-11e7-906f-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d2f18d-4d50-11e7-a30b-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">86.98.41.100</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d2f18f-4d50-11e7-b4ab-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d2f191-4d50-11e7-abe5-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d2f190-4d50-11e7-b3e3-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">86.98.41.107</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d2f192-4d50-11e7-8c94-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d2f194-4d50-11e7-b469-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d2f193-4d50-11e7-b0be-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">86.98.42.105</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d2f195-4d50-11e7-9c76-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d2f197-4d50-11e7-b02b-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d2f196-4d50-11e7-a8e9-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">86.98.42.142</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d2f198-4d50-11e7-be04-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d2f19a-4d50-11e7-b2ed-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d2f199-4d50-11e7-9746-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">86.98.42.152</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d2f19b-4d50-11e7-ad5d-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d2f19d-4d50-11e7-89b7-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d2f19c-4d50-11e7-8d4d-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">86.98.42.232</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d2f19e-4d50-11e7-8947-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d2f1a0-4d50-11e7-be50-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d2f19f-4d50-11e7-9de2-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">86.98.43.225</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d2f1a1-4d50-11e7-ba83-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d2f1a3-4d50-11e7-95ab-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d2f1a2-4d50-11e7-a679-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">86.98.46.54</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d2f1a4-4d50-11e7-9910-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d2f1a6-4d50-11e7-820f-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d2f1a5-4d50-11e7-9869-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">86.98.80.133</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d2f1a7-4d50-11e7-aede-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d2f1a9-4d50-11e7-a57b-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d2f1a8-4d50-11e7-a232-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">86.98.80.135</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d2f1aa-4d50-11e7-ad49-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d2f1ac-4d50-11e7-9ba8-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d2f1ab-4d50-11e7-a117-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">86.98.80.222</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d2f1ad-4d50-11e7-af64-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d2f1af-4d50-11e7-8df4-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d2f1ae-4d50-11e7-a8f7-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">86.98.80.55</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d2f1b0-4d50-11e7-8b60-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d2f1b2-4d50-11e7-8645-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d2f1b1-4d50-11e7-8400-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">86.98.80.79</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d2f1b3-4d50-11e7-9a0d-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d2f1b5-4d50-11e7-bb54-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d2f1b4-4d50-11e7-90b2-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">86.98.80.8</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d2f1b6-4d50-11e7-ac51-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d2f1b8-4d50-11e7-905e-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d2f1b7-4d50-11e7-b238-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">86.98.80.88</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d2f1b9-4d50-11e7-b171-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d2f1bb-4d50-11e7-a188-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d2f1ba-4d50-11e7-9f8e-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">86.98.80.90</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d2f1bc-4d50-11e7-bc05-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d2f1be-4d50-11e7-9eb4-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d2f1bd-4d50-11e7-b678-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">86.98.81.192</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d2f1bf-4d50-11e7-9967-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d2f1c1-4d50-11e7-9d31-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d2f1c0-4d50-11e7-897b-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">86.98.81.237</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d2f1c2-4d50-11e7-a35c-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d2f1c4-4d50-11e7-a9a1-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d2f1c3-4d50-11e7-9766-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">86.98.81.245</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d2f1c5-4d50-11e7-be15-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d2f1c7-4d50-11e7-8d17-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d2f1c6-4d50-11e7-a349-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">86.98.81.36</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d2f1c8-4d50-11e7-aac6-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d2f1ca-4d50-11e7-a785-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d2f1c9-4d50-11e7-8abc-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">86.98.81.46</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d2f1cb-4d50-11e7-be7f-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d2f1cd-4d50-11e7-8fc2-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d2f1cc-4d50-11e7-b539-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">86.98.82.145</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d2f1ce-4d50-11e7-8ee4-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d2f1d0-4d50-11e7-8ca9-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d2f1cf-4d50-11e7-b533-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">86.98.82.190</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d2f1d1-4d50-11e7-ae7f-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d2f1d3-4d50-11e7-9ac0-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d2f1d2-4d50-11e7-a3ad-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">86.98.82.205</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d2f1d4-4d50-11e7-82c3-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d2f1d6-4d50-11e7-ade3-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d2f1d5-4d50-11e7-a158-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">86.98.82.217</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d2f1d7-4d50-11e7-b845-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d2f1d9-4d50-11e7-9cf7-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d2f1d8-4d50-11e7-9e41-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">86.98.83.13</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d2f1da-4d50-11e7-b7da-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d2f1dc-4d50-11e7-a82d-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d2f1db-4d50-11e7-98f0-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">86.98.83.151</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d2f1dd-4d50-11e7-b473-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d2f1df-4d50-11e7-9b72-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d2f1de-4d50-11e7-aec8-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">86.98.83.191</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d2f1e0-4d50-11e7-a9f2-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d2f1e2-4d50-11e7-ab65-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d2f1e1-4d50-11e7-a8ce-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">86.98.83.245</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d2f1e3-4d50-11e7-b499-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d2f1e5-4d50-11e7-821e-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d2f1e4-4d50-11e7-aca0-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">86.98.83.251</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d2f1e6-4d50-11e7-aaea-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d2f1e8-4d50-11e7-9eb5-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d2f1e7-4d50-11e7-9840-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">86.98.83.77</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d2f1e9-4d50-11e7-971e-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d2f1eb-4d50-11e7-a2f2-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d2f1ea-4d50-11e7-bd00-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">86.98.83.84</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d2f1ec-4d50-11e7-b45d-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d2f1ee-4d50-11e7-b683-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d2f1ed-4d50-11e7-a6bd-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">86.98.84.71</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d2f1ef-4d50-11e7-8d8a-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d2f1f1-4d50-11e7-a29b-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d2f1f0-4d50-11e7-8e3b-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">86.98.84.85</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d2f1f2-4d50-11e7-a1b8-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d2f1f4-4d50-11e7-abbf-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d2f1f3-4d50-11e7-820f-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">86.98.85.165</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d2f1f5-4d50-11e7-8a32-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d2f1f7-4d50-11e7-bfa7-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d2f1f6-4d50-11e7-be73-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">86.98.86.28</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d2f1f8-4d50-11e7-8a09-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d2f1fa-4d50-11e7-b88f-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d2f1f9-4d50-11e7-a913-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">86.98.86.68</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d2f1fb-4d50-11e7-967c-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d2f1fd-4d50-11e7-beb5-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d2f1fc-4d50-11e7-94b0-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">88.149.154.81</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d2f1fe-4d50-11e7-94cc-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d2f200-4d50-11e7-8509-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d2f1ff-4d50-11e7-8a66-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">88.210.32.195</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d2f201-4d50-11e7-99b4-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d2f203-4d50-11e7-b3eb-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d2f202-4d50-11e7-894e-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">89.164.120.126</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d2f204-4d50-11e7-a3b2-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d2f206-4d50-11e7-85a8-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d2f205-4d50-11e7-8634-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">89.164.120.163</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d2f207-4d50-11e7-8eb9-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d2f209-4d50-11e7-811c-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d2f208-4d50-11e7-9685-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">89.164.120.186</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d2f20a-4d50-11e7-8dc9-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d2f20c-4d50-11e7-9b7b-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d2f20b-4d50-11e7-a70f-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">89.164.130.164</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d2f20d-4d50-11e7-8ce5-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d2f20f-4d50-11e7-a310-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d2f20e-4d50-11e7-9731-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">89.164.130.34</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d2f210-4d50-11e7-801b-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d2f212-4d50-11e7-8014-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d2f211-4d50-11e7-ba1d-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">89.164.137.139</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d2f213-4d50-11e7-8e59-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d2f215-4d50-11e7-9b45-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d2f214-4d50-11e7-9043-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">89.164.137.30</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d2f216-4d50-11e7-845a-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d2f218-4d50-11e7-aacd-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d2f217-4d50-11e7-9f76-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">89.164.137.98</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d2f219-4d50-11e7-865f-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d2f21b-4d50-11e7-b3ad-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d2f21a-4d50-11e7-8e71-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">89.164.174.111</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d2f21c-4d50-11e7-9ba0-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d2f21e-4d50-11e7-8092-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d2f21d-4d50-11e7-a70e-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">89.164.174.20</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d2f21f-4d50-11e7-b2d5-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d2f221-4d50-11e7-8272-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d2f220-4d50-11e7-bf77-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">89.164.174.236</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d2f222-4d50-11e7-aa21-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d2f224-4d50-11e7-be15-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d2f223-4d50-11e7-8b44-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">89.164.174.92</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d2f225-4d50-11e7-b1f6-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d2f227-4d50-11e7-8e98-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d2f226-4d50-11e7-8a90-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">89.164.177.121</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d2f228-4d50-11e7-872b-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d2f22a-4d50-11e7-b61d-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d2f229-4d50-11e7-a590-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">89.164.177.177</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d2f22b-4d50-11e7-a84d-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d2f22d-4d50-11e7-bdf1-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d2f22c-4d50-11e7-8977-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">89.164.177.217</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d2f22e-4d50-11e7-8774-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d2f230-4d50-11e7-8579-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d2f22f-4d50-11e7-b3dc-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">89.164.185.5</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d2f231-4d50-11e7-a567-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d2f233-4d50-11e7-9830-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d2f232-4d50-11e7-9bd0-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">89.164.194.128</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d2f234-4d50-11e7-a095-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d2f236-4d50-11e7-baaf-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d2f235-4d50-11e7-adc7-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">89.164.194.80</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d2f237-4d50-11e7-b30a-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d2f239-4d50-11e7-b0ad-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d2f238-4d50-11e7-8c2e-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">89.164.194.97</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d2f23a-4d50-11e7-a247-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d2f23c-4d50-11e7-abf4-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d2f23b-4d50-11e7-8857-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">89.164.203.200</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d2f23d-4d50-11e7-8b97-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d2f23f-4d50-11e7-b8bc-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d2f23e-4d50-11e7-94f9-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">89.164.210.249</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d5396e-4d50-11e7-99fa-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d53970-4d50-11e7-b064-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d5396f-4d50-11e7-b8f3-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">89.164.210.251</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d53971-4d50-11e7-b848-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d53973-4d50-11e7-b145-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d53972-4d50-11e7-868d-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">89.164.210.45</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d53974-4d50-11e7-b1a5-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d53976-4d50-11e7-b558-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d53975-4d50-11e7-baef-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">89.164.228.108</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d53977-4d50-11e7-a524-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d53979-4d50-11e7-a144-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d53978-4d50-11e7-80e7-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">89.164.242.105</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d5397a-4d50-11e7-8508-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d5397c-4d50-11e7-bb74-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d5397b-4d50-11e7-bc17-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">89.164.242.122</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d5397d-4d50-11e7-90ac-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d5397f-4d50-11e7-aa74-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d5397e-4d50-11e7-9b5d-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">89.164.242.55</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d53980-4d50-11e7-a705-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d53982-4d50-11e7-aaf8-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d53981-4d50-11e7-880b-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">89.164.242.95</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d53983-4d50-11e7-b4fa-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d53985-4d50-11e7-a29e-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d53984-4d50-11e7-a1b8-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">89.164.242.97</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d53986-4d50-11e7-9f64-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d53988-4d50-11e7-bcc5-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d53987-4d50-11e7-94a9-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">89.164.255.117</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d53989-4d50-11e7-baff-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d5398b-4d50-11e7-a4eb-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d5398a-4d50-11e7-abab-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">89.222.155.36</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d5398c-4d50-11e7-8021-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d5398e-4d50-11e7-8506-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d5398d-4d50-11e7-84f0-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">89.237.191.146</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d5398f-4d50-11e7-9dfe-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d53991-4d50-11e7-86a7-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d53990-4d50-11e7-ba97-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">90.1.144.142</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d53992-4d50-11e7-b51e-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d53994-4d50-11e7-82e0-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d53993-4d50-11e7-94e7-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">90.1.150.204</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d53995-4d50-11e7-9581-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d53997-4d50-11e7-b3a7-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d53996-4d50-11e7-83cd-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">90.1.156.56</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d53998-4d50-11e7-93c7-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d5399a-4d50-11e7-9579-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d53999-4d50-11e7-90b1-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">90.1.17.124</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d5399b-4d50-11e7-8309-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d5399d-4d50-11e7-b086-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d5399c-4d50-11e7-b6f1-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">90.1.20.111</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d5399e-4d50-11e7-83d2-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d539a0-4d50-11e7-84ae-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d5399f-4d50-11e7-8dd3-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">90.1.30.182</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d539a1-4d50-11e7-9afb-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d539a3-4d50-11e7-8de4-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d539a2-4d50-11e7-ba5b-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">90.1.38.178</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d539a4-4d50-11e7-a25f-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d539a6-4d50-11e7-8c01-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d539a5-4d50-11e7-b97b-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">90.18.142.100</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d539a7-4d50-11e7-8f29-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d539a9-4d50-11e7-b423-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d539a8-4d50-11e7-8d17-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">90.33.122.246</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d539aa-4d50-11e7-b474-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d539ac-4d50-11e7-98d7-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d539ab-4d50-11e7-8bd9-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">90.56.113.3</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d539ad-4d50-11e7-a58e-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d539af-4d50-11e7-b80e-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d539ae-4d50-11e7-96f3-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">90.56.185.252</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d539b0-4d50-11e7-a4bd-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d539b2-4d50-11e7-8c93-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d539b1-4d50-11e7-9296-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">90.56.188.98</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d539b3-4d50-11e7-8e7c-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d539b5-4d50-11e7-8676-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d539b4-4d50-11e7-8ad5-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">90.56.209.249</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d539b6-4d50-11e7-844c-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d539b8-4d50-11e7-859a-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d539b7-4d50-11e7-ab8c-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">90.56.232.187</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d539b9-4d50-11e7-be68-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d539bb-4d50-11e7-b7e6-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d539ba-4d50-11e7-994b-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">90.56.63.82</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d539bc-4d50-11e7-843b-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d539be-4d50-11e7-9216-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d539bd-4d50-11e7-9b36-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">90.56.99.200</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d539bf-4d50-11e7-ac6d-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d539c1-4d50-11e7-b54c-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d539c0-4d50-11e7-8a53-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">90.66.106.148</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d539c2-4d50-11e7-8992-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d539c4-4d50-11e7-842f-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d539c3-4d50-11e7-941b-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">91.195.182.235</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d539c5-4d50-11e7-917b-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d539c7-4d50-11e7-aa03-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d539c6-4d50-11e7-9e44-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">91.211.52.217</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d539c8-4d50-11e7-8eed-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d539ca-4d50-11e7-a5e5-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d539c9-4d50-11e7-9d9f-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">92.147.128.4</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d539cb-4d50-11e7-af5c-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d539cd-4d50-11e7-9e54-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d539cc-4d50-11e7-bb75-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">92.147.129.224</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d539ce-4d50-11e7-9d25-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d539d0-4d50-11e7-a841-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d539cf-4d50-11e7-a031-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">92.147.168.25</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d539d1-4d50-11e7-8f5b-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d539d3-4d50-11e7-ad50-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d539d2-4d50-11e7-8bc8-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">92.147.7.77</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d539d4-4d50-11e7-a58f-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d539d6-4d50-11e7-8551-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d539d5-4d50-11e7-b319-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">92.50.0.132</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d539d7-4d50-11e7-a4b6-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d539d9-4d50-11e7-8236-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d539d8-4d50-11e7-a5a5-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">92.50.29.102</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d539da-4d50-11e7-80de-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d539dc-4d50-11e7-aacf-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d539db-4d50-11e7-a5cd-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">92.63.217.83</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d539dd-4d50-11e7-aaa7-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d539df-4d50-11e7-9b3f-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d539de-4d50-11e7-9a24-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">93.186.184.145</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d539e0-4d50-11e7-a4f2-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d539e2-4d50-11e7-9a0d-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d539e1-4d50-11e7-891b-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">93.186.61.200</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d539e3-4d50-11e7-a4d9-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d539e5-4d50-11e7-b662-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d539e4-4d50-11e7-89d6-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">93.63.134.102</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d539e6-4d50-11e7-ad24-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d539e8-4d50-11e7-ae52-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d539e7-4d50-11e7-9dbf-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">94.18.219.36</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d539e9-4d50-11e7-bd5e-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d539eb-4d50-11e7-a6ff-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d539ea-4d50-11e7-b491-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">94.41.119.170</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d539ec-4d50-11e7-946a-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d539ee-4d50-11e7-ba4b-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d539ed-4d50-11e7-af5a-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">94.41.16.220</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d539ef-4d50-11e7-a100-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d539f1-4d50-11e7-b3d1-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d539f0-4d50-11e7-9706-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">94.41.29.226</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d539f2-4d50-11e7-96b1-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d539f4-4d50-11e7-86b7-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d539f3-4d50-11e7-9ba3-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">94.41.40.223</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d539f5-4d50-11e7-9cd2-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d539f7-4d50-11e7-9e3a-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d539f6-4d50-11e7-b4a8-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">94.41.46.142</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d539f8-4d50-11e7-af92-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d539fa-4d50-11e7-b566-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d539f9-4d50-11e7-96e9-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">94.41.64.17</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d539fb-4d50-11e7-b3a1-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d539fd-4d50-11e7-9e9a-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d539fc-4d50-11e7-b5e3-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">94.41.77.198</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d539fe-4d50-11e7-b40a-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d53a00-4d50-11e7-a1c0-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d539ff-4d50-11e7-8b6d-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">94.41.77.253</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d53a01-4d50-11e7-9a59-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d53a03-4d50-11e7-a7ff-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d53a02-4d50-11e7-8454-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">94.41.80.159</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d53a04-4d50-11e7-8289-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d53a06-4d50-11e7-9038-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d53a05-4d50-11e7-9d06-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">94.41.89.159</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d53a07-4d50-11e7-8f55-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d53a09-4d50-11e7-a5d4-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d53a08-4d50-11e7-a859-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">94.43.142.226</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d53a0a-4d50-11e7-8099-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d53a0c-4d50-11e7-90c2-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d53a0b-4d50-11e7-a67d-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">94.56.143.171</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d53a0d-4d50-11e7-aee5-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d53a0f-4d50-11e7-a18d-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d53a0e-4d50-11e7-af84-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">94.56.95.66</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d53a10-4d50-11e7-b721-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d53a12-4d50-11e7-9335-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d53a11-4d50-11e7-983b-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">94.70.161.135</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d53a13-4d50-11e7-9070-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d53a15-4d50-11e7-a577-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d53a14-4d50-11e7-a4ba-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">94.70.251.20</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d53a16-4d50-11e7-9f07-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d53a18-4d50-11e7-8307-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d53a17-4d50-11e7-bd94-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">94.97.119.186</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d53a19-4d50-11e7-a550-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d53a1b-4d50-11e7-b11e-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d53a1a-4d50-11e7-b872-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">94.98.188.224</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d53a1c-4d50-11e7-8cc8-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d53a1e-4d50-11e7-b577-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d53a1d-4d50-11e7-921d-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">94.98.232.50</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d53a1f-4d50-11e7-8879-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d53a21-4d50-11e7-aaca-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d53a20-4d50-11e7-b8d8-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">94.99.109.127</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d53a22-4d50-11e7-9b8e-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d53a24-4d50-11e7-8843-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d53a23-4d50-11e7-8721-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">94.99.115.115</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d53a25-4d50-11e7-a528-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d53a27-4d50-11e7-8b66-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d53a26-4d50-11e7-aa31-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">94.99.116.91</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d53a28-4d50-11e7-983b-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d53a2a-4d50-11e7-8163-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d53a29-4d50-11e7-86ec-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">94.99.121.138</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d53a2b-4d50-11e7-8b3e-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d53a2d-4d50-11e7-a844-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d53a2c-4d50-11e7-9975-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">94.99.31.13</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d53a2e-4d50-11e7-b7ab-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d53a30-4d50-11e7-b540-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d53a2f-4d50-11e7-847d-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">94.99.42.181</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d53a31-4d50-11e7-bf05-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d53a33-4d50-11e7-82e7-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d53a32-4d50-11e7-a17c-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">95.130.171.245</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d53a34-4d50-11e7-8606-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d53a36-4d50-11e7-bf1f-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d53a35-4d50-11e7-ae10-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">95.181.58.94</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d53a37-4d50-11e7-bbbc-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d53a39-4d50-11e7-9097-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d53a38-4d50-11e7-a738-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">95.185.117.230</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d53a3a-4d50-11e7-8781-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d53a3c-4d50-11e7-b0a6-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d53a3b-4d50-11e7-993b-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">95.185.151.187</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d53a3d-4d50-11e7-92fe-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d53a3f-4d50-11e7-baa7-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d53a3e-4d50-11e7-a816-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">95.185.184.238</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d53a40-4d50-11e7-b2f2-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d53a42-4d50-11e7-9ea8-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d53a41-4d50-11e7-9e3d-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">95.185.194.222</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d53a43-4d50-11e7-957b-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d53a45-4d50-11e7-88f7-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d53a44-4d50-11e7-ace0-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">95.185.250.166</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d53a46-4d50-11e7-9b38-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d53a48-4d50-11e7-b362-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d53a47-4d50-11e7-8c31-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">95.185.39.49</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d53a49-4d50-11e7-b85f-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d53a4b-4d50-11e7-8e60-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d53a4a-4d50-11e7-910b-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">95.185.64.247</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d53a4c-4d50-11e7-9d46-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d53a4e-4d50-11e7-a2f9-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d53a4d-4d50-11e7-af78-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">95.185.67.1</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d53a4f-4d50-11e7-8c86-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d53a51-4d50-11e7-a966-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d53a50-4d50-11e7-a306-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">95.186.126.248</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d53a52-4d50-11e7-a479-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d53a54-4d50-11e7-9ac3-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d53a53-4d50-11e7-a5bd-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">95.186.89.72</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d53a55-4d50-11e7-8e67-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d53a57-4d50-11e7-903b-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d53a56-4d50-11e7-a7b7-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">95.187.101.119</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d53a58-4d50-11e7-a33e-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d53a5a-4d50-11e7-bdd0-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d53a59-4d50-11e7-9a7d-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">95.187.37.251</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d53a5b-4d50-11e7-a640-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d53a5d-4d50-11e7-a231-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d53a5c-4d50-11e7-bc9c-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">95.187.42.184</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d53a5e-4d50-11e7-b34b-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d53a60-4d50-11e7-b06e-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d53a5f-4d50-11e7-b82e-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">95.187.43.226</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d53a61-4d50-11e7-a110-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d53a63-4d50-11e7-89d2-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d53a62-4d50-11e7-9412-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">95.187.5.53</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d53a64-4d50-11e7-b2cb-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d53a66-4d50-11e7-8fe8-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d53a65-4d50-11e7-94c8-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">95.187.70.15</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d53a67-4d50-11e7-ba0c-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d53a69-4d50-11e7-8149-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d53a68-4d50-11e7-94a3-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">95.187.99.232</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d53a6a-4d50-11e7-97d3-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious IPv4 Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this IP is associated with HIDDEN COBRA activity.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d53a6c-4d50-11e7-9797-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d53a6b-4d50-11e7-9afb-1866da081fd3">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false">
|
|
<AddressObj:Address_Value condition="Equals">95.87.25.221</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d53a6d-4d50-11e7-8c05-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious File Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">File Hash Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this is an import table used by HIDDEN COBRA actors.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d53a6f-4d50-11e7-89ef-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d53a6e-4d50-11e7-a86c-1866da081fd3">
|
|
<cybox:Properties xsi:type="FileObj:FileObjectType">
|
|
<FileObj:Hashes>
|
|
<cyboxCommon:Hash>
|
|
<cyboxCommon:Type condition="Equals" xsi:type="cyboxVocabs:HashNameVocab-1.0">MD5</cyboxCommon:Type>
|
|
<cyboxCommon:Simple_Hash_Value condition="Equals">AB4ABEE83FFD526F1975EB48DBDBC812</cyboxCommon:Simple_Hash_Value>
|
|
</cyboxCommon:Hash>
|
|
</FileObj:Hashes>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d53a70-4d50-11e7-a403-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious File Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">File Hash Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this is a client version botnet utility.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d53a72-4d50-11e7-9d19-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d53a71-4d50-11e7-ba69-1866da081fd3">
|
|
<cybox:Properties xsi:type="FileObj:FileObjectType">
|
|
<FileObj:Hashes>
|
|
<cyboxCommon:Hash>
|
|
<cyboxCommon:Type condition="Equals" xsi:type="cyboxVocabs:HashNameVocab-1.0">SHA256</cyboxCommon:Type>
|
|
<cyboxCommon:Simple_Hash_Value condition="Equals">E95C318D1B1906D57471BB524FFF128356C160132D4230DB04AB5898EC0EB145</cyboxCommon:Simple_Hash_Value>
|
|
</cyboxCommon:Hash>
|
|
</FileObj:Hashes>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d53a73-4d50-11e7-9a0a-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious File Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">File Hash Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this is a client version botnet utility.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d53a75-4d50-11e7-a7f6-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d53a74-4d50-11e7-9f76-1866da081fd3">
|
|
<cybox:Properties xsi:type="FileObj:FileObjectType">
|
|
<FileObj:Hashes>
|
|
<cyboxCommon:Hash>
|
|
<cyboxCommon:Type condition="Equals" xsi:type="cyboxVocabs:HashNameVocab-1.0">SHA1</cyboxCommon:Type>
|
|
<cyboxCommon:Simple_Hash_Value condition="Equals">3FDF856B6FBCB23E7C3372A3F53CE26C0FE6DE77</cyboxCommon:Simple_Hash_Value>
|
|
</cyboxCommon:Hash>
|
|
</FileObj:Hashes>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d53a76-4d50-11e7-a4f4-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious File Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">File Hash Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this is a client version botnet utility.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d53a78-4d50-11e7-9e0c-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d53a77-4d50-11e7-9d82-1866da081fd3">
|
|
<cybox:Properties xsi:type="FileObj:FileObjectType">
|
|
<FileObj:Hashes>
|
|
<cyboxCommon:Hash>
|
|
<cyboxCommon:Type condition="Equals" xsi:type="cyboxVocabs:HashNameVocab-1.0">MD5</cyboxCommon:Type>
|
|
<cyboxCommon:Simple_Hash_Value condition="Equals">5D29DFE2EA9CA8DA3FF7A14FB20C5E86</cyboxCommon:Simple_Hash_Value>
|
|
</cyboxCommon:Hash>
|
|
</FileObj:Hashes>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d53a79-4d50-11e7-a43d-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious File Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">File Hash Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this is a server version botnet utility.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d53a7b-4d50-11e7-b775-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d53a7a-4d50-11e7-8ce2-1866da081fd3">
|
|
<cybox:Properties xsi:type="FileObj:FileObjectType">
|
|
<FileObj:Hashes>
|
|
<cyboxCommon:Hash>
|
|
<cyboxCommon:Type condition="Equals" xsi:type="cyboxVocabs:HashNameVocab-1.0">MD5</cyboxCommon:Type>
|
|
<cyboxCommon:Simple_Hash_Value condition="Equals">8F4FC2E10B6EC15A01E0AF24529040DD</cyboxCommon:Simple_Hash_Value>
|
|
</cyboxCommon:Hash>
|
|
</FileObj:Hashes>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d53a7c-4d50-11e7-b79f-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious File Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">File Hash Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this is a 32-Bit "NPF.SYS" driver installed depending on host architechture. NPF.SYS is a WINPCAP driver used for packet capture utilities. Driver is installed if not present, or overwritten if an existing version is already present. Maps to Windows Service, "NETPLG"</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d53a7e-4d50-11e7-a0ab-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d53a7d-4d50-11e7-b5d3-1866da081fd3">
|
|
<cybox:Properties xsi:type="FileObj:FileObjectType">
|
|
<FileObj:Hashes>
|
|
<cyboxCommon:Hash>
|
|
<cyboxCommon:Type condition="Equals" xsi:type="cyboxVocabs:HashNameVocab-1.0">MD5</cyboxCommon:Type>
|
|
<cyboxCommon:Simple_Hash_Value condition="Equals">B48DC6ABCD3AEFF8618350CCBDC6B09A</cyboxCommon:Simple_Hash_Value>
|
|
</cyboxCommon:Hash>
|
|
</FileObj:Hashes>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d53a7f-4d50-11e7-b02f-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious File Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">File Hash Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this is a 64-Bit "NPF.SYS" driver installed depending on host architechture. NPF.SYS is a WINPCAP driver used for packet capture utilities. Driver is installed if not present, or overwritten if an existing version is already present. Maps to Windows Service, "NETPLG"</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d53a81-4d50-11e7-9662-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d53a80-4d50-11e7-a670-1866da081fd3">
|
|
<cybox:Properties xsi:type="FileObj:FileObjectType">
|
|
<FileObj:Hashes>
|
|
<cyboxCommon:Hash>
|
|
<cyboxCommon:Type condition="Equals" xsi:type="cyboxVocabs:HashNameVocab-1.0">MD5</cyboxCommon:Type>
|
|
<cyboxCommon:Simple_Hash_Value condition="Equals">3CEEE0BE85D24D911B9C02714817774C</cyboxCommon:Simple_Hash_Value>
|
|
</cyboxCommon:Hash>
|
|
</FileObj:Hashes>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d53a82-4d50-11e7-910d-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious File Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">File Hash Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this is a driver for a malicious NETPLG service.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d53a84-4d50-11e7-91ad-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d53a83-4d50-11e7-a132-1866da081fd3">
|
|
<cybox:Properties xsi:type="FileObj:FileObjectType">
|
|
<FileObj:File_Path condition="Equals">C:\WINDOWS\SYSTEM32\NPF.SYS</FileObj:File_Path>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d53a85-4d50-11e7-940a-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious File Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">File Hash Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this is an activity log for NETPLG service.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d53a87-4d50-11e7-8b7b-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d53a86-4d50-11e7-97e3-1866da081fd3">
|
|
<cybox:Properties xsi:type="FileObj:FileObjectType">
|
|
<FileObj:File_Path condition="Equals">C:\WINDOWS\SYSTEM32\NETPLG.LOG</FileObj:File_Path>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d53a88-4d50-11e7-9627-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious File Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">File Hash Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, this is a C2 Log for NETPLG service.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d53a8a-4d50-11e7-ac69-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d53a89-4d50-11e7-9e87-1866da081fd3">
|
|
<cybox:Properties xsi:type="FileObj:FileObjectType">
|
|
<FileObj:File_Path condition="Equals">C:\WINDOWS\SYSTEM32\CATROOT2\EDBCHK.LOG</FileObj:File_Path>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d53a8b-4d50-11e7-b718-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious File Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">File Hash Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, these are files and folders written to disk by a bot controller.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d53a8d-4d50-11e7-837e-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d53a8c-4d50-11e7-930f-1866da081fd3">
|
|
<cybox:Properties xsi:type="FileObj:FileObjectType">
|
|
<FileObj:File_Path condition="Equals">C:\WINDOWS\SYSTEM32\MIMEFILTER.XML</FileObj:File_Path>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d53a8e-4d50-11e7-849e-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious File Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">File Hash Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, these are files and folders written to disk by a bot controller.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d53a90-4d50-11e7-ad0c-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d53a8f-4d50-11e7-9dfb-1866da081fd3">
|
|
<cybox:Properties xsi:type="FileObj:FileObjectType">
|
|
<FileObj:File_Path condition="Equals">C:\AWORK\CATROOT2</FileObj:File_Path>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d53a91-4d50-11e7-a194-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious File Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">File Hash Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, these are files and folders written to disk by a bot controller.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d53a93-4d50-11e7-84e3-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d53a92-4d50-11e7-a8a4-1866da081fd3">
|
|
<cybox:Properties xsi:type="FileObj:FileObjectType">
|
|
<FileObj:File_Path condition="Equals">C:\WINDOWS\SYSTEM32\CATROOT2\{12CD0A1D-4EA2-11D1-8608-00C04F-C295EF}</FileObj:File_Path>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
<stix:Indicator id="NCCIC:indicator-d6d53a94-4d50-11e7-8485-1866da081fd3" xsi:type="indicator:IndicatorType">
|
|
<indicator:Title>Malicious File Indicator</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">File Hash Watchlist</indicator:Type>
|
|
<indicator:Description>According to a trusted third party, these are files and folders written to disk by a bot controller.</indicator:Description>
|
|
<indicator:Observable id="NCCIC:Observable-d6d53a96-4d50-11e7-baea-1866da081fd3">
|
|
<cybox:Object id="NCCIC:Object-d6d53a95-4d50-11e7-9e53-1866da081fd3">
|
|
<cybox:Properties xsi:type="FileObj:FileObjectType">
|
|
<FileObj:File_Path condition="Equals">C:\WINDOWS\SYSTEM32\CATROOT2\{A750E6C3-38EE-17D5-85E5-10D03D-A378DE}</FileObj:File_Path>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node() | ../../../descendant-or-self::node()/@*</marking:Controlled_Structure><marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/>
|
|
<marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType">
|
|
<TOUMarking:Terms_Of_Use>This Indicator Bulletin is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP: WHITE. Recipients may share TLP: WHITE information without restriction, but is subject to copyright controls. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp .</TOUMarking:Terms_Of_Use>
|
|
</marking:Marking_Structure>
|
|
</marking:Marking>
|
|
</indicator:Handling>
|
|
</stix:Indicator>
|
|
</stix:Indicators>
|
|
<stix:TTPs>
|
|
<stix:Kill_Chains>
|
|
<stixCommon:Kill_Chain reference="http://www.lockheedmartin.com/content/dam/lockheed/data/corporate/documents/LM-White-Paper-Intel-Driven-Defense.pdf" number_of_phases="7" id="stix:KillChainPhase-af3e707f-2fb9-49e5-8c37-14026ca0a5ff" definer="LMCO" name="LM Cyber Kill Chain">
|
|
<stixCommon:Kill_Chain_Phase ordinality="1" name="Reconnaissance" phase_id="stix:KillChainPhase-af1016d6-a744-4ed7-ac91-00fe2272185a"/>
|
|
<stixCommon:Kill_Chain_Phase ordinality="2" name="Weaponization" phase_id="stix:KillChainPhase-445b4827-3cca-42bd-8421-f2e947133c16"/>
|
|
<stixCommon:Kill_Chain_Phase ordinality="3" name="Delivery" phase_id="stix:KillChainPhase-79a0e041-9d5f-49bb-ada4-8322622b162d"/>
|
|
<stixCommon:Kill_Chain_Phase ordinality="4" name="Exploitation" phase_id="stix:KillChainPhase-f706e4e7-53d8-44ef-967f-81535c9db7d0"/>
|
|
<stixCommon:Kill_Chain_Phase ordinality="5" name="Installation" phase_id="stix:KillChainPhase-e1e4e3f7-be3b-4b39-b80a-a593cfd99a4f"/>
|
|
<stixCommon:Kill_Chain_Phase ordinality="6" name="Command and Control" phase_id="stix:KillChainPhase-d6dc32b9-2538-4951-8733-3cb9ef1daae2"/>
|
|
<stixCommon:Kill_Chain_Phase ordinality="7" name="Actions on Objectives" phase_id="stix:KillChainPhase-786ca8f9-2d9a-4213-b38e-399af4a2e5d6"/>
|
|
</stixCommon:Kill_Chain>
|
|
</stix:Kill_Chains>
|
|
</stix:TTPs>
|
|
</stix:STIX_Package>
|