{
  "Event": {
    "analysis": "1",
    "date": "2019-07-09",
    "extends_uuid": "",
    "info": "Sea Turtle keeps on swimming, finds new victims, DNS hijacking techniques",
    "publish_timestamp": "1562826763",
    "published": true,
    "threat_level_id": "2",
    "timestamp": "1562826754",
    "uuid": "5d26d766-5d64-4dc1-b8b2-0904c0a8ab16",
    "Orgc": {
      "name": "CUDESO",
      "uuid": "56c42374-fdb8-4544-a218-41ffc0a8ab16"
    },
    "Tag": [
      {
        "colour": "#ffffff",
        "local": false,
        "name": "tlp:white",
        "relationship_type": ""
      }
    ],
    "Attribute": [
      {
        "category": "Network activity",
        "comment": "Operational Node",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1562826688",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "5d26d7c0-4fc8-4204-ae76-03c3c0a8ab16",
        "value": "185.64.105.100"
      },
      {
        "category": "Network activity",
        "comment": "Operational Node",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1562826688",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "5d26d7c0-e410-4f0a-86dc-03c3c0a8ab16",
        "value": "178.17.167.51"
      },
      {
        "category": "Network activity",
        "comment": "Mitm Node",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1562826688",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "5d26d7c0-0dd8-47e0-bc79-03c3c0a8ab16",
        "value": "95.179.131.225"
      },
      {
        "category": "Network activity",
        "comment": "Mitm Node",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1562826688",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "5d26d7c0-4dc8-479e-80c3-03c3c0a8ab16",
        "value": "140.82.58.253"
      },
      {
        "category": "Network activity",
        "comment": "Mitm Node",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1562826688",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "5d26d7c0-403c-4c09-ae33-03c3c0a8ab16",
        "value": "95.179.156.61"
      },
      {
        "category": "Network activity",
        "comment": "Mitm Node",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1562826688",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "5d26d7c0-81a0-4d2c-9cea-03c3c0a8ab16",
        "value": "196.29.187.100"
      },
      {
        "category": "Network activity",
        "comment": "Mitm Node",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1562826688",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "5d26d7c0-a0dc-4573-b38d-03c3c0a8ab16",
        "value": "188.226.192.35"
      },
      {
        "category": "Network activity",
        "comment": "Actor-controlled nameserver",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1562826688",
        "to_ids": true,
        "type": "hostname",
        "uuid": "5d26d7c0-8c08-4e88-81d0-03c3c0a8ab16",
        "value": "ns1.rootdnservers.com"
      },
      {
        "category": "Network activity",
        "comment": "Actor-controlled nameserver",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1562826688",
        "to_ids": true,
        "type": "hostname",
        "uuid": "5d26d7c0-3cc0-43e4-8b77-03c3c0a8ab16",
        "value": "ns2.rootdnservers.com"
      },
      {
        "category": "Network activity",
        "comment": "Hosted malicious nameserver",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1562826688",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "5d26d7c0-3ec0-4d41-8431-03c3c0a8ab16",
        "value": "45.32.100.62"
      },
      {
        "category": "Network activity",
        "comment": "Actor-controlled nameserver",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1562826688",
        "to_ids": true,
        "type": "hostname",
        "uuid": "5d26d7c0-8dc0-4298-95c2-03c3c0a8ab16",
        "value": "ns1.intersecdns.com"
      },
      {
        "category": "Network activity",
        "comment": "Actor-controlled nameserver",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1562826688",
        "to_ids": true,
        "type": "hostname",
        "uuid": "5d26d7c0-bae8-4bcc-9e76-03c3c0a8ab16",
        "value": "ns2.intersecdns.com"
      },
      {
        "category": "Network activity",
        "comment": "Hosted malicious nameserver",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1562826688",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "5d26d7c0-6200-4b6f-91bb-03c3c0a8ab16",
        "value": "95.179.150.101"
      },
      {
        "category": "External analysis",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1562826746",
        "to_ids": false,
        "type": "link",
        "uuid": "5d26d7fa-f218-4d68-81e6-1285c0a8ab16",
        "value": "https://blog.talosintelligence.com/2019/07/sea-turtle-keeps-on-swimming.html"
      },
      {
        "category": "External analysis",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1562826746",
        "to_ids": false,
        "type": "link",
        "uuid": "5d26d7fa-9af4-4f32-ae5d-1285c0a8ab16",
        "value": "https://techblog.gr/internet/kyvernoepithesi-ypesti-to-mitroo-onomaton-internet-katalixi-gr-el/"
      }
    ]
  }
}