[
    {
        "date": "2026-04-23 00:09:03",
        "user": "PhishStats",
        "type": "domain",
        "value": "pedagiodigital-automatico.com",
        "tags": [
            "#phishing"
        ],
        "tweet": "https://x.com/PhishStats/status/2047105433081397411"
    },
    {
        "date": "2026-04-23 00:14:33",
        "user": "Merlax_",
        "type": "domain",
        "value": "onlinemediascifras.lat",
        "tags": [
            "#phishing"
        ],
        "tweet": "https://x.com/Merlax_/status/2047106819974169055"
    },
    {
        "date": "2026-04-23 00:14:33",
        "user": "Merlax_",
        "type": "domain",
        "value": "bcondinoclientes.online",
        "tags": [
            "#phishing"
        ],
        "tweet": "https://x.com/Merlax_/status/2047106819974169055"
    },
    {
        "date": "2026-04-23 00:14:33",
        "user": "Merlax_",
        "type": "domain",
        "value": "abc-acessoseguro.site",
        "tags": [
            "#phishing"
        ],
        "tweet": "https://x.com/Merlax_/status/2047106819974169055"
    },
    {
        "date": "2026-04-23 00:14:33",
        "user": "Merlax_",
        "type": "domain",
        "value": "de-kunden-sicherheit.com",
        "tags": [
            "#phishing"
        ],
        "tweet": "https://x.com/Merlax_/status/2047106819974169055"
    },
    {
        "date": "2026-04-23 00:46:26",
        "user": "masaomi346",
        "type": "domain",
        "value": "macclean-storage.gitlab.io",
        "tags": [
            "#malware"
        ],
        "tweet": "https://x.com/masaomi346/status/2047114841899626502"
    },
    {
        "date": "2026-04-23 00:46:26",
        "user": "masaomi346",
        "type": "domain",
        "value": "arkypc.com",
        "tags": [
            "#malware"
        ],
        "tweet": "https://x.com/masaomi346/status/2047114841899626502"
    },
    {
        "date": "2026-04-23 05:36:48",
        "user": "ishivtripathi",
        "type": "domain",
        "value": "additioniqqwu.shop",
        "tags": [
            "#malware"
        ],
        "tweet": "https://x.com/ishivtripathi/status/2047187915395281292"
    },
    {
        "date": "2026-04-23 05:36:48",
        "user": "ishivtripathi",
        "type": "domain",
        "value": "coneogz.cyou",
        "tags": [
            "#malware"
        ],
        "tweet": "https://x.com/ishivtripathi/status/2047187915395281292"
    },
    {
        "date": "2026-04-23 05:36:48",
        "user": "ishivtripathi",
        "type": "domain",
        "value": "grannndjtaom.shop",
        "tags": [
            "#malware"
        ],
        "tweet": "https://x.com/ishivtripathi/status/2047187915395281292"
    },
    {
        "date": "2026-04-23 05:36:48",
        "user": "ishivtripathi",
        "type": "domain",
        "value": "jhardwaredwi.buzz",
        "tags": [
            "#malware"
        ],
        "tweet": "https://x.com/ishivtripathi/status/2047187915395281292"
    },
    {
        "date": "2026-04-23 05:36:48",
        "user": "ishivtripathi",
        "type": "domain",
        "value": "leypuuq.cyou",
        "tags": [
            "#malware"
        ],
        "tweet": "https://x.com/ishivtripathi/status/2047187915395281292"
    },
    {
        "date": "2026-04-23 05:36:48",
        "user": "ishivtripathi",
        "type": "domain",
        "value": "overwrougemny.shop",
        "tags": [
            "#malware"
        ],
        "tweet": "https://x.com/ishivtripathi/status/2047187915395281292"
    },
    {
        "date": "2026-04-23 05:36:48",
        "user": "ishivtripathi",
        "type": "domain",
        "value": "sep0.filetip.shop",
        "tags": [
            "#malware"
        ],
        "tweet": "https://x.com/ishivtripathi/status/2047187915395281292"
    },
    {
        "date": "2026-04-23 06:03:46",
        "user": "skocherhan",
        "type": "domain",
        "value": "leypuuq.cy",
        "tags": [],
        "tweet": "https://x.com/skocherhan/status/2047194700109517205"
    },
    {
        "date": "2026-04-23 06:26:03",
        "user": "Metemcyber",
        "type": "domain",
        "value": "yrcwaptq.x13hm8.cn",
        "tags": [],
        "tweet": "https://x.com/Metemcyber/status/2047200310414942400"
    },
    {
        "date": "2026-04-23 06:36:07",
        "user": "Metemcyber",
        "type": "domain",
        "value": "meekys.mtffx.cn",
        "tags": [],
        "tweet": "https://x.com/Metemcyber/status/2047202842575052876"
    },
    {
        "date": "2026-04-23 07:12:21",
        "user": "skocherhan",
        "type": "domain",
        "value": "FranceVerif.fr",
        "tags": [],
        "tweet": "https://x.com/skocherhan/status/2047211959875936301"
    },
    {
        "date": "2026-04-23 07:16:00",
        "user": "skocherhan",
        "type": "domain",
        "value": "vk6t8m2.travelmarkbd.com",
        "tags": [],
        "tweet": "https://x.com/skocherhan/status/2047212879460417908"
    },
    {
        "date": "2026-04-23 07:22:15",
        "user": "Metemcyber",
        "type": "domain",
        "value": "rbxmnbuzo.ksfmdqq.cn",
        "tags": [],
        "tweet": "https://x.com/Metemcyber/status/2047214450617524456"
    },
    {
        "date": "2026-04-23 08:49:09",
        "user": "malwrhunterteam",
        "type": "domain",
        "value": "paksecurity.org",
        "tags": [],
        "tweet": "https://x.com/malwrhunterteam/status/2047236320410374389"
    },
    {
        "date": "2026-04-23 09:02:46",
        "user": "smica83",
        "type": "domain",
        "value": "visaimage-storage.icu",
        "tags": [],
        "tweet": "https://x.com/smica83/status/2047239747685249414"
    },
    {
        "date": "2026-04-23 11:58:55",
        "user": "smica83",
        "type": "domain",
        "value": "myrawupdate.duckdns.org:2404",
        "tags": [],
        "tweet": "https://x.com/smica83/status/2047284078748074151"
    },
    {
        "date": "2026-04-23 14:05:54",
        "user": "smica83",
        "type": "domain",
        "value": "quote-texas-son-manufactured.trycloudflare.com",
        "tags": [],
        "tweet": "https://x.com/smica83/status/2047316034114183459"
    },
    {
        "date": "2026-04-23 15:59:56",
        "user": "luke92881",
        "type": "domain",
        "value": "www-rarlab.com",
        "tags": [],
        "tweet": "https://x.com/luke92881/status/2047344730992742758"
    },
    {
        "date": "2026-04-23 16:51:27",
        "user": "skocherhan",
        "type": "domain",
        "value": "authorities-vessel-denver-indie.trycloudflare.com",
        "tags": [],
        "tweet": "https://x.com/skocherhan/status/2047357694210617570"
    },
    {
        "date": "2026-04-23 18:00:04",
        "user": "phatomcandle",
        "type": "domain",
        "value": "nid.navmercorp.n-e.kr",
        "tags": [
            "#APT",
            "#C2",
            "#Kimsuky",
            "#malware"
        ],
        "tweet": "https://x.com/phatomcandle/status/2047374964760949174"
    },
    {
        "date": "2026-04-23 18:28:45",
        "user": "skocherhan",
        "type": "domain",
        "value": "oercm-3load.dynv6.net",
        "tags": [
            "#Kimsuky"
        ],
        "tweet": "https://x.com/skocherhan/status/2047382182000312798"
    },
    {
        "date": "2026-04-23 18:28:45",
        "user": "skocherhan",
        "type": "domain",
        "value": "nhpolercm25v.dynv6.net",
        "tags": [
            "#Kimsuky"
        ],
        "tweet": "https://x.com/skocherhan/status/2047382182000312798"
    },
    {
        "date": "2026-04-23 18:28:45",
        "user": "skocherhan",
        "type": "domain",
        "value": "nhpolercm58v.dynv6.net",
        "tags": [
            "#Kimsuky"
        ],
        "tweet": "https://x.com/skocherhan/status/2047382182000312798"
    },
    {
        "date": "2026-04-23 18:28:45",
        "user": "skocherhan",
        "type": "domain",
        "value": "nhpolercm96v.dynv6.net",
        "tags": [
            "#Kimsuky"
        ],
        "tweet": "https://x.com/skocherhan/status/2047382182000312798"
    },
    {
        "date": "2026-04-23 18:28:45",
        "user": "skocherhan",
        "type": "domain",
        "value": "nopdoc69load.dynv6.net",
        "tags": [
            "#Kimsuky"
        ],
        "tweet": "https://x.com/skocherhan/status/2047382182000312798"
    },
    {
        "date": "2026-04-23 18:28:45",
        "user": "skocherhan",
        "type": "domain",
        "value": "nhpolercm14v.dynv6.net",
        "tags": [
            "#Kimsuky"
        ],
        "tweet": "https://x.com/skocherhan/status/2047382182000312798"
    },
    {
        "date": "2026-04-23 18:28:45",
        "user": "skocherhan",
        "type": "domain",
        "value": "nhpolercm19v.dynv6.net",
        "tags": [
            "#Kimsuky"
        ],
        "tweet": "https://x.com/skocherhan/status/2047382182000312798"
    },
    {
        "date": "2026-04-23 18:28:45",
        "user": "skocherhan",
        "type": "domain",
        "value": "nhpolercm4v.dynv6.net",
        "tags": [
            "#Kimsuky"
        ],
        "tweet": "https://x.com/skocherhan/status/2047382182000312798"
    },
    {
        "date": "2026-04-23 18:28:45",
        "user": "skocherhan",
        "type": "domain",
        "value": "nhpolercm83v.dynv6.ne",
        "tags": [
            "#Kimsuky"
        ],
        "tweet": "https://x.com/skocherhan/status/2047382182000312798"
    },
    {
        "date": "2026-04-23 19:24:02",
        "user": "PhishStats",
        "type": "domain",
        "value": "michel.suiv-expd001.pro",
        "tags": [
            "#phishing"
        ],
        "tweet": "https://x.com/PhishStats/status/2047396096020824220"
    },
    {
        "date": "2026-04-24 00:17:58",
        "user": "masaomi346",
        "type": "domain",
        "value": "ar4615.cn",
        "tags": [
            "#phishing"
        ],
        "tweet": "https://x.com/masaomi346/status/2047470067794022821"
    },
    {
        "date": "2026-04-24 00:55:14",
        "user": "fbgwls245",
        "type": "domain",
        "value": "ijexszhscln27nl263lmcd7tx3jttkhm4wjhd4e3y6r4csdbfyeprvid.onion",
        "tags": [
            "#ransomware"
        ],
        "tweet": "https://x.com/fbgwls245/status/2047479442973552693"
    },
    {
        "date": "2026-04-24 02:55:31",
        "user": "masaomi346",
        "type": "domain",
        "value": "www-pay.sprots8-milem6.com",
        "tags": [
            "#phishing"
        ],
        "tweet": "https://x.com/masaomi346/status/2047509714301522364"
    },
    {
        "date": "2026-04-24 02:55:31",
        "user": "masaomi346",
        "type": "domain",
        "value": "www2-pay.news-178zhibo.com",
        "tags": [
            "#phishing"
        ],
        "tweet": "https://x.com/masaomi346/status/2047509714301522364"
    },
    {
        "date": "2026-04-24 02:55:31",
        "user": "masaomi346",
        "type": "domain",
        "value": "www-pay.uy5722.com",
        "tags": [
            "#phishing"
        ],
        "tweet": "https://x.com/masaomi346/status/2047509714301522364"
    },
    {
        "date": "2026-04-24 04:45:44",
        "user": "JAMESWT_WT",
        "type": "domain",
        "value": "sensitive-olive-alligator.31-22-7-7.cpanel.site",
        "tags": [
            "#phishing"
        ],
        "tweet": "https://x.com/JAMESWT_WT/status/2047537450449273239"
    },
    {
        "date": "2026-04-24 06:59:12",
        "user": "skocherhan",
        "type": "domain",
        "value": "esevasecurefile.store",
        "tags": [],
        "tweet": "https://x.com/skocherhan/status/2047571039501115410"
    },
    {
        "date": "2026-04-24 08:05:46",
        "user": "skocherhan",
        "type": "domain",
        "value": "www2-pay.news-178zhibo.co",
        "tags": [],
        "tweet": "https://x.com/skocherhan/status/2047587790771179905"
    },
    {
        "date": "2026-04-24 08:57:13",
        "user": "fbgwls245",
        "type": "domain",
        "value": "u6lieui2dakbctcjea2bz4r4q32r7t36nwljovqbv7mxs6o2smgxixid.onion",
        "tags": [
            "#ransomware"
        ],
        "tweet": "https://x.com/fbgwls245/status/2047600738344550679"
    },
    {
        "date": "2026-04-24 10:25:13",
        "user": "masaomi346",
        "type": "domain",
        "value": "buzxsmv.cn",
        "tags": [
            "#phishing"
        ],
        "tweet": "https://x.com/masaomi346/status/2047622884882079831"
    },
    {
        "date": "2026-04-24 13:08:58",
        "user": "JAMESWT_WT",
        "type": "domain",
        "value": "halfmillion-iq.com",
        "tags": [
            "#ClickFix"
        ],
        "tweet": "https://x.com/JAMESWT_WT/status/2047664093541048542"
    },
    {
        "date": "2026-04-24 13:48:31",
        "user": "skocherhan",
        "type": "domain",
        "value": "audit.checkmarx.cx",
        "tags": [],
        "tweet": "https://x.com/skocherhan/status/2047674047115252152"
    },
    {
        "date": "2026-04-24 15:48:41",
        "user": "0xPEMB",
        "type": "domain",
        "value": "passkeyactivate.com",
        "tags": [
            "#phishing"
        ],
        "tweet": "https://x.com/0xPEMB/status/2047704287912898963"
    },
    {
        "date": "2026-04-24 16:28:04",
        "user": "Malwarehunterr",
        "type": "domain",
        "value": "incometax.onlinegov.in.net",
        "tags": [
            "#phishing"
        ],
        "tweet": "https://x.com/Malwarehunterr/status/2047714198055186643"
    },
    {
        "date": "2026-04-24 20:11:24",
        "user": "smica83",
        "type": "domain",
        "value": "discretion-barrel-formed-vault.trycloudflare.com",
        "tags": [
            "#opendir"
        ],
        "tweet": "https://x.com/smica83/status/2047770402743632327"
    },
    {
        "date": "2026-04-25 00:02:08",
        "user": "PhishStats",
        "type": "domain",
        "value": "imaxstores.cfd",
        "tags": [
            "#phishing"
        ],
        "tweet": "https://x.com/PhishStats/status/2047828468948238771"
    },
    {
        "date": "2026-04-25 05:17:00",
        "user": "skocherhan",
        "type": "domain",
        "value": "oscatower.n-e.kr",
        "tags": [
            "#DPRK",
            "#Kimsuky"
        ],
        "tweet": "https://x.com/skocherhan/status/2047907939814388089"
    },
    {
        "date": "2026-04-25 05:17:00",
        "user": "skocherhan",
        "type": "domain",
        "value": "nooraeso.r-e.kr",
        "tags": [
            "#DPRK",
            "#Kimsuky"
        ],
        "tweet": "https://x.com/skocherhan/status/2047907939814388089"
    },
    {
        "date": "2026-04-25 05:17:00",
        "user": "skocherhan",
        "type": "domain",
        "value": "bermates.n-e.kr",
        "tags": [
            "#DPRK",
            "#Kimsuky"
        ],
        "tweet": "https://x.com/skocherhan/status/2047907939814388089"
    },
    {
        "date": "2026-04-25 05:17:00",
        "user": "skocherhan",
        "type": "domain",
        "value": "jungop.n-e.kr",
        "tags": [
            "#DPRK",
            "#Kimsuky"
        ],
        "tweet": "https://x.com/skocherhan/status/2047907939814388089"
    },
    {
        "date": "2026-04-25 05:17:00",
        "user": "skocherhan",
        "type": "domain",
        "value": "brimo.n-e.kr",
        "tags": [
            "#DPRK",
            "#Kimsuky"
        ],
        "tweet": "https://x.com/skocherhan/status/2047907939814388089"
    },
    {
        "date": "2026-04-25 05:17:00",
        "user": "skocherhan",
        "type": "domain",
        "value": "queosera2.n-e.kr",
        "tags": [
            "#DPRK",
            "#Kimsuky"
        ],
        "tweet": "https://x.com/skocherhan/status/2047907939814388089"
    },
    {
        "date": "2026-04-25 05:17:00",
        "user": "skocherhan",
        "type": "domain",
        "value": "morotomot.r-e.kr",
        "tags": [
            "#DPRK",
            "#Kimsuky"
        ],
        "tweet": "https://x.com/skocherhan/status/2047907939814388089"
    },
    {
        "date": "2026-04-25 05:17:00",
        "user": "skocherhan",
        "type": "domain",
        "value": "hayoungju.n-e.kr",
        "tags": [
            "#DPRK",
            "#Kimsuky"
        ],
        "tweet": "https://x.com/skocherhan/status/2047907939814388089"
    },
    {
        "date": "2026-04-25 05:17:00",
        "user": "skocherhan",
        "type": "domain",
        "value": "jujeong.n-e.kr",
        "tags": [
            "#DPRK",
            "#Kimsuky"
        ],
        "tweet": "https://x.com/skocherhan/status/2047907939814388089"
    },
    {
        "date": "2026-04-25 05:17:00",
        "user": "skocherhan",
        "type": "domain",
        "value": "docotot.o-r.kr",
        "tags": [
            "#DPRK",
            "#Kimsuky"
        ],
        "tweet": "https://x.com/skocherhan/status/2047907939814388089"
    },
    {
        "date": "2026-04-25 05:17:00",
        "user": "skocherhan",
        "type": "domain",
        "value": "neratras2.kro.kr",
        "tags": [
            "#DPRK",
            "#Kimsuky"
        ],
        "tweet": "https://x.com/skocherhan/status/2047907939814388089"
    },
    {
        "date": "2026-04-25 05:17:00",
        "user": "skocherhan",
        "type": "domain",
        "value": "tradoam.n-e.kr",
        "tags": [
            "#DPRK",
            "#Kimsuky"
        ],
        "tweet": "https://x.com/skocherhan/status/2047907939814388089"
    },
    {
        "date": "2026-04-25 05:17:00",
        "user": "skocherhan",
        "type": "domain",
        "value": "artisgo.n-e.kr",
        "tags": [
            "#DPRK",
            "#Kimsuky"
        ],
        "tweet": "https://x.com/skocherhan/status/2047907939814388089"
    },
    {
        "date": "2026-04-25 05:53:00",
        "user": "Malwarehunterr",
        "type": "domain",
        "value": "access-sharepoint-exchange.d2a8tpeb2129r7.amplifyapp.com",
        "tags": [
            "#phishing"
        ],
        "tweet": "https://x.com/Malwarehunterr/status/2047916824717860990"
    },
    {
        "date": "2026-04-25 05:53:00",
        "user": "Malwarehunterr",
        "type": "domain",
        "value": "secure-share-r1y7.p-cebompw5.workers.dev",
        "tags": [
            "#phishing"
        ],
        "tweet": "https://x.com/Malwarehunterr/status/2047916824717860990"
    },
    {
        "date": "2026-04-25 05:59:41",
        "user": "Malwarehunterr",
        "type": "domain",
        "value": "sharepoint-files-download.pages.dev",
        "tags": [
            "#phishing"
        ],
        "tweet": "https://x.com/Malwarehunterr/status/2047918451440922886"
    },
    {
        "date": "2026-04-25 05:59:41",
        "user": "Malwarehunterr",
        "type": "domain",
        "value": "rsmixed.com",
        "tags": [
            "#phishing"
        ],
        "tweet": "https://x.com/Malwarehunterr/status/2047918451440922886"
    },
    {
        "date": "2026-04-25 07:49:00",
        "user": "Sekurak",
        "type": "domain",
        "value": "zondanewsletter.pl",
        "tags": [],
        "tweet": "https://x.com/Sekurak/status/2047946091040002215"
    },
    {
        "date": "2026-04-25 08:26:32",
        "user": "Malwarehunterr",
        "type": "domain",
        "value": "graph.org",
        "tags": [
            "#phishing"
        ],
        "tweet": "https://x.com/Malwarehunterr/status/2047955407109533742"
    },
    {
        "date": "2026-04-25 08:26:32",
        "user": "Malwarehunterr",
        "type": "domain",
        "value": "97ee4.catex.at",
        "tags": [
            "#phishing"
        ],
        "tweet": "https://x.com/Malwarehunterr/status/2047955407109533742"
    },
    {
        "date": "2026-04-25 09:43:00",
        "user": "skocherhan",
        "type": "domain",
        "value": "youtude-dl.pro",
        "tags": [],
        "tweet": "https://x.com/skocherhan/status/2047974809154343022"
    },
    {
        "date": "2026-04-25 10:14:00",
        "user": "PhishStats",
        "type": "domain",
        "value": "secureactivitysett726411.li",
        "tags": [
            "#phishing"
        ],
        "tweet": "https://x.com/PhishStats/status/2047982655778525480"
    },
    {
        "date": "2026-04-25 10:59:45",
        "user": "Malwarehunterr",
        "type": "domain",
        "value": "wordplumbprotectstairs.autos",
        "tags": [
            "#phishing"
        ],
        "tweet": "https://x.com/Malwarehunterr/status/2047993964595388805"
    },
    {
        "date": "2026-04-25 10:59:45",
        "user": "Malwarehunterr",
        "type": "domain",
        "value": "bowl-fire-ceil-found.autos",
        "tags": [
            "#phishing"
        ],
        "tweet": "https://x.com/Malwarehunterr/status/2047993964595388805"
    },
    {
        "date": "2026-04-25 10:59:45",
        "user": "Malwarehunterr",
        "type": "domain",
        "value": "candle-plumb-found-ceil.autos",
        "tags": [
            "#phishing"
        ],
        "tweet": "https://x.com/Malwarehunterr/status/2047993964595388805"
    },
    {
        "date": "2026-04-25 10:59:45",
        "user": "Malwarehunterr",
        "type": "domain",
        "value": "floor-interior-fire-found.autos",
        "tags": [
            "#phishing"
        ],
        "tweet": "https://x.com/Malwarehunterr/status/2047993964595388805"
    },
    {
        "date": "2026-04-25 10:59:45",
        "user": "Malwarehunterr",
        "type": "domain",
        "value": "plumb-table-floor-protect.autos",
        "tags": [
            "#phishing"
        ],
        "tweet": "https://x.com/Malwarehunterr/status/2047993964595388805"
    },
    {
        "date": "2026-04-25 10:59:45",
        "user": "Malwarehunterr",
        "type": "domain",
        "value": "bowl-interior-word-plumb.autos",
        "tags": [
            "#phishing"
        ],
        "tweet": "https://x.com/Malwarehunterr/status/2047993964595388805"
    },
    {
        "date": "2026-04-25 13:12:00",
        "user": "harugasumi",
        "type": "domain",
        "value": "nufesafew.z1.web.core.windows.net",
        "tags": [],
        "tweet": "https://x.com/harugasumi/status/2048027347069358122"
    },
    {
        "date": "2026-04-25 13:54:59",
        "user": "masaomi346",
        "type": "domain",
        "value": "zamknj.xagnnx.cn",
        "tags": [
            "#phishing"
        ],
        "tweet": "https://x.com/masaomi346/status/2048038064321331477"
    },
    {
        "date": "2026-04-25 14:50:00",
        "user": "blackorbird",
        "type": "domain",
        "value": "hostednowhere.com",
        "tags": [],
        "tweet": "https://x.com/blackorbird/status/2048052130192507293"
    },
    {
        "date": "2026-04-25 15:00:00",
        "user": "volrant136",
        "type": "domain",
        "value": "webapp-getdocumentodwnload-pacapp.malik-jaani786.workers.dev",
        "tags": [
            "#APT"
        ],
        "tweet": "https://x.com/volrant136/status/2048054426078724126"
    },
    {
        "date": "2026-04-25 16:17:00",
        "user": "Malwarehunterr",
        "type": "domain",
        "value": "nmc.govonline.online",
        "tags": [
            "#phishing"
        ],
        "tweet": "https://x.com/Malwarehunterr/status/2048073842187436201"
    },
    {
        "date": "2026-04-25 16:17:00",
        "user": "Malwarehunterr",
        "type": "domain",
        "value": "mp.pwd.govonline.online",
        "tags": [
            "#phishing"
        ],
        "tweet": "https://x.com/Malwarehunterr/status/2048073842187436201"
    },
    {
        "date": "2026-04-25 16:17:00",
        "user": "Malwarehunterr",
        "type": "domain",
        "value": "rpf.hrms.govonline.online",
        "tags": [
            "#phishing"
        ],
        "tweet": "https://x.com/Malwarehunterr/status/2048073842187436201"
    },
    {
        "date": "2026-04-25 16:17:00",
        "user": "Malwarehunterr",
        "type": "domain",
        "value": "irctc.govonline.online",
        "tags": [
            "#phishing"
        ],
        "tweet": "https://x.com/Malwarehunterr/status/2048073842187436201"
    },
    {
        "date": "2026-04-25 18:00:00",
        "user": "phatomcandle",
        "type": "domain",
        "value": "bigfile.navcloudstorage.n-e.kr",
        "tags": [
            "#APT",
            "#C2",
            "#Kimsuky",
            "#malware"
        ],
        "tweet": "https://x.com/phatomcandle/status/2048099743025541384"
    },
    {
        "date": "2026-04-25 21:01:00",
        "user": "skocherhan",
        "type": "domain",
        "value": "cj597826.tw1.ru",
        "tags": [
            "#AgentTesla"
        ],
        "tweet": "https://x.com/skocherhan/status/2048145505524289720"
    },
    {
        "date": "2026-04-25 21:17:00",
        "user": "skocherhan",
        "type": "domain",
        "value": "authorities-vessel-denver-indie.trycloudflare.com",
        "tags": [],
        "tweet": "https://x.com/skocherhan/status/2048149423058833783"
    },
    {
        "date": "2026-04-25 21:32:00",
        "user": "skocherhan",
        "type": "domain",
        "value": "uofficialerc5v.dynuddns.com",
        "tags": [
            "#DPRK",
            "#Kimsuky"
        ],
        "tweet": "https://x.com/skocherhan/status/2048153192563613921"
    },
    {
        "date": "2026-04-25 21:32:00",
        "user": "skocherhan",
        "type": "domain",
        "value": "nmethodsrc21v.dynuddns.com",
        "tags": [
            "#DPRK",
            "#Kimsuky"
        ],
        "tweet": "https://x.com/skocherhan/status/2048153192563613921"
    },
    {
        "date": "2026-04-25 21:32:00",
        "user": "skocherhan",
        "type": "domain",
        "value": "erpolicies-21v.dynv6.net",
        "tags": [
            "#DPRK",
            "#Kimsuky"
        ],
        "tweet": "https://x.com/skocherhan/status/2048153192563613921"
    },
    {
        "date": "2026-04-25 21:32:00",
        "user": "skocherhan",
        "type": "domain",
        "value": "polercm-55v.dynv6.net",
        "tags": [
            "#DPRK",
            "#Kimsuky"
        ],
        "tweet": "https://x.com/skocherhan/status/2048153192563613921"
    },
    {
        "date": "2026-04-25 21:32:00",
        "user": "skocherhan",
        "type": "domain",
        "value": "uofficialerc34v.dynuddns.com",
        "tags": [
            "#DPRK",
            "#Kimsuky"
        ],
        "tweet": "https://x.com/skocherhan/status/2048153192563613921"
    },
    {
        "date": "2026-04-25 21:32:00",
        "user": "skocherhan",
        "type": "domain",
        "value": "uofficialerc20v.dynuddns.com",
        "tags": [
            "#DPRK",
            "#Kimsuky"
        ],
        "tweet": "https://x.com/skocherhan/status/2048153192563613921"
    },
    {
        "date": "2026-04-25 21:32:00",
        "user": "skocherhan",
        "type": "domain",
        "value": "uofficialerc33v.dynuddns.com",
        "tags": [
            "#DPRK",
            "#Kimsuky"
        ],
        "tweet": "https://x.com/skocherhan/status/2048153192563613921"
    },
    {
        "date": "2026-04-25 21:32:00",
        "user": "skocherhan",
        "type": "domain",
        "value": "uofficialerc45v.dynuddns.com",
        "tags": [
            "#DPRK",
            "#Kimsuky"
        ],
        "tweet": "https://x.com/skocherhan/status/2048153192563613921"
    },
    {
        "date": "2026-04-25 21:34:00",
        "user": "skocherhan",
        "type": "domain",
        "value": "agfsddfdfdfndesfr.forum",
        "tags": [],
        "tweet": "https://x.com/skocherhan/status/2048153684840796379"
    },
    {
        "date": "2026-04-26 01:07:00",
        "user": "PhishStats",
        "type": "domain",
        "value": "cmdvitorborges.com",
        "tags": [
            "#phishing"
        ],
        "tweet": "https://x.com/PhishStats/status/2048207321625497714"
    },
    {
        "date": "2026-04-26 06:03:00",
        "user": "skocherhan",
        "type": "domain",
        "value": "greenwoodsinvestmentsltd.pro",
        "tags": [
            "#phishing"
        ],
        "tweet": "https://x.com/skocherhan/status/2048281696961745290"
    },
    {
        "date": "2026-04-26 09:17:00",
        "user": "masaomi346",
        "type": "domain",
        "value": "dsoqqcfd.vjxjrfyu.cn",
        "tags": [
            "#phishing"
        ],
        "tweet": "https://x.com/masaomi346/status/2048330734994420149"
    },
    {
        "date": "2026-04-26 11:24:00",
        "user": "fbgwls245",
        "type": "domain",
        "value": "4k6plf4h2cm2nco6ae3inrsxnmqgl6lllmwefydhnlcq4tuhwbj4qpad.onion",
        "tags": [
            "#ransomware"
        ],
        "tweet": "https://x.com/fbgwls245/status/2048362508742975738"
    },
    {
        "date": "2026-04-26 13:25:00",
        "user": "Malwarehunterr",
        "type": "domain",
        "value": "zon123.online",
        "tags": [
            "#phishing"
        ],
        "tweet": "https://x.com/Malwarehunterr/status/2048392934865916244"
    },
    {
        "date": "2026-04-26 14:04:00",
        "user": "AlvieriD",
        "type": "domain",
        "value": "pippahtohg6qgioqu3ixrsueefuw7thythmmeanyrgwn3eixcuu6jvqd.onion",
        "tags": [],
        "tweet": "https://x.com/AlvieriD/status/2048402779467620710"
    },
    {
        "date": "2026-04-26 14:15:00",
        "user": "Malwarehunterr",
        "type": "domain",
        "value": "notifications.googleapis.com",
        "tags": [
            "#phishing"
        ],
        "tweet": "https://x.com/Malwarehunterr/status/2048405527336738920"
    },
    {
        "date": "2026-04-26 14:15:00",
        "user": "Malwarehunterr",
        "type": "domain",
        "value": "markhamkidsclinic.com",
        "tags": [
            "#phishing"
        ],
        "tweet": "https://x.com/Malwarehunterr/status/2048405527336738920"
    },
    {
        "date": "2026-04-26 14:15:00",
        "user": "Malwarehunterr",
        "type": "domain",
        "value": "maxbarkod.com",
        "tags": [
            "#phishing"
        ],
        "tweet": "https://x.com/Malwarehunterr/status/2048405527336738920"
    },
    {
        "date": "2026-04-26 14:26:00",
        "user": "Malwarehunterr",
        "type": "domain",
        "value": "monopizzapos.online",
        "tags": [
            "#phishing"
        ],
        "tweet": "https://x.com/Malwarehunterr/status/2048408321703731274"
    },
    {
        "date": "2026-04-26 16:00:00",
        "user": "volrant136",
        "type": "domain",
        "value": "zimbra-nyatel-production.up.railway.app",
        "tags": [
            "#APT"
        ],
        "tweet": "https://x.com/volrant136/status/2048431910871875851"
    },
    {
        "date": "2026-04-26 18:10:00",
        "user": "skocherhan",
        "type": "domain",
        "value": "jer.piexlt.com",
        "tags": [],
        "tweet": "https://x.com/skocherhan/status/2048464654775541779"
    },
    {
        "date": "2026-04-26 18:10:00",
        "user": "skocherhan",
        "type": "domain",
        "value": "main.zeosshop.ir",
        "tags": [],
        "tweet": "https://x.com/skocherhan/status/2048464654775541779"
    },
    {
        "date": "2026-04-26 18:10:00",
        "user": "skocherhan",
        "type": "domain",
        "value": "master.zeosshop.ir",
        "tags": [],
        "tweet": "https://x.com/skocherhan/status/2048464654775541779"
    },
    {
        "date": "2026-04-26 18:10:00",
        "user": "skocherhan",
        "type": "domain",
        "value": "servers.zeosshop.ir",
        "tags": [],
        "tweet": "https://x.com/skocherhan/status/2048464654775541779"
    },
    {
        "date": "2026-04-26 18:18:00",
        "user": "skocherhan",
        "type": "domain",
        "value": "ncodccpass.dynv6.net",
        "tags": [
            "#DPRK",
            "#Kimsuky"
        ],
        "tweet": "https://x.com/skocherhan/status/2048466653331988537"
    },
    {
        "date": "2026-04-26 18:18:00",
        "user": "skocherhan",
        "type": "domain",
        "value": "ncodcbpass.dynv6.net",
        "tags": [
            "#DPRK",
            "#Kimsuky"
        ],
        "tweet": "https://x.com/skocherhan/status/2048466653331988537"
    },
    {
        "date": "2026-04-26 18:18:00",
        "user": "skocherhan",
        "type": "domain",
        "value": "ncodcapass.dynv6.net",
        "tags": [
            "#DPRK",
            "#Kimsuky"
        ],
        "tweet": "https://x.com/skocherhan/status/2048466653331988537"
    },
    {
        "date": "2026-04-26 18:18:00",
        "user": "skocherhan",
        "type": "domain",
        "value": "ncodbspass.dynv6.net",
        "tags": [
            "#DPRK",
            "#Kimsuky"
        ],
        "tweet": "https://x.com/skocherhan/status/2048466653331988537"
    },
    {
        "date": "2026-04-26 18:18:00",
        "user": "skocherhan",
        "type": "domain",
        "value": "nid.ncodbspass.dynv6.net",
        "tags": [
            "#DPRK",
            "#Kimsuky"
        ],
        "tweet": "https://x.com/skocherhan/status/2048466653331988537"
    },
    {
        "date": "2026-04-26 18:18:00",
        "user": "skocherhan",
        "type": "domain",
        "value": "nid.ncodbzpass.dynv6.net",
        "tags": [
            "#DPRK",
            "#Kimsuky"
        ],
        "tweet": "https://x.com/skocherhan/status/2048466653331988537"
    },
    {
        "date": "2026-04-26 18:18:00",
        "user": "skocherhan",
        "type": "domain",
        "value": "ncodbypass.dynv6.net",
        "tags": [
            "#DPRK",
            "#Kimsuky"
        ],
        "tweet": "https://x.com/skocherhan/status/2048466653331988537"
    },
    {
        "date": "2026-04-26 18:18:00",
        "user": "skocherhan",
        "type": "domain",
        "value": "ncodbzpass.dynv6.net",
        "tags": [
            "#DPRK",
            "#Kimsuky"
        ],
        "tweet": "https://x.com/skocherhan/status/2048466653331988537"
    },
    {
        "date": "2026-04-26 18:18:00",
        "user": "skocherhan",
        "type": "domain",
        "value": "ncodbvpass.dynv6.net",
        "tags": [
            "#DPRK",
            "#Kimsuky"
        ],
        "tweet": "https://x.com/skocherhan/status/2048466653331988537"
    },
    {
        "date": "2026-04-26 19:56:34",
        "user": "skocherhan",
        "type": "domain",
        "value": "previous-everywhere-achieving-bobby.trycloudflare.com",
        "tags": [
            "#phishing"
        ],
        "tweet": "https://x.com/skocherhan/status/2048491443971305619"
    },
    {
        "date": "2026-04-26 20:01:00",
        "user": "skocherhan",
        "type": "domain",
        "value": "deposit-crew-appointed-princess.trycloudflare.com",
        "tags": [
            "#phishing"
        ],
        "tweet": "https://x.com/skocherhan/status/2048492627096404397"
    },
    {
        "date": "2026-04-26 20:41:00",
        "user": "Malwarehunterr",
        "type": "domain",
        "value": "smartbenefits.site",
        "tags": [
            "#phishing"
        ],
        "tweet": "https://x.com/Malwarehunterr/status/2048502759331389910"
    },
    {
        "date": "2026-04-26 20:41:00",
        "user": "Malwarehunterr",
        "type": "domain",
        "value": "cartspecials.com",
        "tags": [
            "#phishing"
        ],
        "tweet": "https://x.com/Malwarehunterr/status/2048502759331389910"
    },
    {
        "date": "2026-04-26 23:28:00",
        "user": "Priv8Shops",
        "type": "domain",
        "value": "iepvirgendecopacabana.com",
        "tags": [
            "#phishing"
        ],
        "tweet": "https://x.com/Priv8Shops/status/2048544885494747285"
    },
    {
        "date": "2026-04-27 01:28:00",
        "user": "masaomi346",
        "type": "domain",
        "value": "login.b9l6kfqw.shop",
        "tags": [
            "#phishing"
        ],
        "tweet": "https://x.com/masaomi346/status/2048574924068118575"
    },
    {
        "date": "2026-04-27 02:54:00",
        "user": "Cyberteam008",
        "type": "domain",
        "value": "mofa-go-np.direct880.net",
        "tags": [
            "#APT"
        ],
        "tweet": "https://x.com/Cyberteam008/status/2048596656141340906"
    },
    {
        "date": "2026-04-27 02:54:00",
        "user": "Cyberteam008",
        "type": "domain",
        "value": "mofa-gov-np.direct880.net",
        "tags": [
            "#APT"
        ],
        "tweet": "https://x.com/Cyberteam008/status/2048596656141340906"
    },
    {
        "date": "2026-04-27 02:54:00",
        "user": "Cyberteam008",
        "type": "domain",
        "value": "pakun-org.direct880.net",
        "tags": [
            "#APT"
        ],
        "tweet": "https://x.com/Cyberteam008/status/2048596656141340906"
    },
    {
        "date": "2026-04-27 04:37:00",
        "user": "PhishStats",
        "type": "domain",
        "value": "nodu1718.odns.fr",
        "tags": [
            "#phishing"
        ],
        "tweet": "https://x.com/PhishStats/status/2048622601094742217"
    },
    {
        "date": "2026-04-27 05:20:00",
        "user": "romonlyht",
        "type": "domain",
        "value": "rushadventure.com",
        "tags": [
            "#phishing"
        ],
        "tweet": "https://x.com/romonlyht/status/2048633302719058241"
    },
    {
        "date": "2026-04-27 05:33:00",
        "user": "romonlyht",
        "type": "domain",
        "value": "bwymenu.com",
        "tags": [
            "#phishing"
        ],
        "tweet": "https://x.com/romonlyht/status/2048636617435525508"
    },
    {
        "date": "2026-04-27 05:34:00",
        "user": "romonlyht",
        "type": "domain",
        "value": "haikek.com",
        "tags": [
            "#phishing"
        ],
        "tweet": "https://x.com/romonlyht/status/2048636940279595352"
    },
    {
        "date": "2026-04-27 05:34:00",
        "user": "romonlyht",
        "type": "domain",
        "value": "sfht.mobi",
        "tags": [
            "#phishing"
        ],
        "tweet": "https://x.com/romonlyht/status/2048636940279595352"
    },
    {
        "date": "2026-04-27 05:35:11",
        "user": "skocherhan",
        "type": "domain",
        "value": "iepvirgendecopacabana.com",
        "tags": [],
        "tweet": "https://x.com/skocherhan/status/2048637060919996814"
    },
    {
        "date": "2026-04-27 05:38:00",
        "user": "masaomi346",
        "type": "domain",
        "value": "login.guf792lp.shop",
        "tags": [
            "#phishing"
        ],
        "tweet": "https://x.com/masaomi346/status/2048637920891072891"
    },
    {
        "date": "2026-04-27 05:45:00",
        "user": "romonlyht",
        "type": "domain",
        "value": "dhlnorth.com",
        "tags": [
            "#phishing"
        ],
        "tweet": "https://x.com/romonlyht/status/2048639773473182103"
    },
    {
        "date": "2026-04-27 06:42:00",
        "user": "romonlyht",
        "type": "domain",
        "value": "mountainviewnursery.online",
        "tags": [
            "#phishing"
        ],
        "tweet": "https://x.com/romonlyht/status/2048654115849617635"
    },
    {
        "date": "2026-04-27 06:42:00",
        "user": "romonlyht",
        "type": "domain",
        "value": "ktoshi110.github.io",
        "tags": [
            "#phishing"
        ],
        "tweet": "https://x.com/romonlyht/status/2048654115849617635"
    },
    {
        "date": "2026-04-27 06:44:00",
        "user": "romonlyht",
        "type": "domain",
        "value": "beachwearcostumi.com",
        "tags": [
            "#phishing"
        ],
        "tweet": "https://x.com/romonlyht/status/2048654601835221159"
    },
    {
        "date": "2026-04-27 06:46:00",
        "user": "romonlyht",
        "type": "domain",
        "value": "yxwhzmysgs.com",
        "tags": [
            "#phishing"
        ],
        "tweet": "https://x.com/romonlyht/status/2048655094305243268"
    },
    {
        "date": "2026-04-27 06:48:00",
        "user": "romonlyht",
        "type": "domain",
        "value": "hongkewood.com",
        "tags": [
            "#phishing"
        ],
        "tweet": "https://x.com/romonlyht/status/2048655579259040035"
    },
    {
        "date": "2026-04-27 06:50:00",
        "user": "romonlyht",
        "type": "domain",
        "value": "gamingchaircheap.com",
        "tags": [
            "#phishing"
        ],
        "tweet": "https://x.com/romonlyht/status/2048656033980280955"
    },
    {
        "date": "2026-04-27 06:52:00",
        "user": "romonlyht",
        "type": "domain",
        "value": "hombreropa.com",
        "tags": [
            "#phishing"
        ],
        "tweet": "https://x.com/romonlyht/status/2048656414722408553"
    },
    {
        "date": "2026-04-27 06:59:00",
        "user": "romonlyht",
        "type": "domain",
        "value": "www-pay.zhn-wap-hth.com",
        "tags": [
            "#phishing"
        ],
        "tweet": "https://x.com/romonlyht/status/2048658152523272698"
    },
    {
        "date": "2026-04-27 07:05:00",
        "user": "romonlyht",
        "type": "domain",
        "value": "www2-pay.download-home-kaiyun.com",
        "tags": [
            "#phishing"
        ],
        "tweet": "https://x.com/romonlyht/status/2048659743636676743"
    },
    {
        "date": "2026-04-27 07:10:00",
        "user": "romonlyht",
        "type": "domain",
        "value": "toothbased.com",
        "tags": [
            "#phishing"
        ],
        "tweet": "https://x.com/romonlyht/status/2048661169339305996"
    },
    {
        "date": "2026-04-27 07:52:00",
        "user": "malwrhunterteam",
        "type": "domain",
        "value": "zyisykm.shop",
        "tags": [],
        "tweet": "https://x.com/malwrhunterteam/status/2048671502443180444"
    },
    {
        "date": "2026-04-27 08:48:00",
        "user": "Malwarehunterr",
        "type": "domain",
        "value": "indiagov.shop",
        "tags": [],
        "tweet": "https://x.com/Malwarehunterr/status/2048685639403774218"
    },
    {
        "date": "2026-04-27 08:48:00",
        "user": "Malwarehunterr",
        "type": "domain",
        "value": "xhxz.info",
        "tags": [],
        "tweet": "https://x.com/Malwarehunterr/status/2048685639403774218"
    },
    {
        "date": "2026-04-27 08:48:00",
        "user": "Malwarehunterr",
        "type": "domain",
        "value": "kjrywrzx.shop",
        "tags": [],
        "tweet": "https://x.com/Malwarehunterr/status/2048685639403774218"
    },
    {
        "date": "2026-04-27 08:48:00",
        "user": "Malwarehunterr",
        "type": "domain",
        "value": "gooomld.top",
        "tags": [],
        "tweet": "https://x.com/Malwarehunterr/status/2048685639403774218"
    },
    {
        "date": "2026-04-27 08:48:00",
        "user": "Malwarehunterr",
        "type": "domain",
        "value": "goolmor.cyou",
        "tags": [],
        "tweet": "https://x.com/Malwarehunterr/status/2048685639403774218"
    },
    {
        "date": "2026-04-27 08:48:00",
        "user": "Malwarehunterr",
        "type": "domain",
        "value": "fgsdol.icu",
        "tags": [],
        "tweet": "https://x.com/Malwarehunterr/status/2048685639403774218"
    },
    {
        "date": "2026-04-27 08:48:00",
        "user": "Malwarehunterr",
        "type": "domain",
        "value": "vsdnk.top",
        "tags": [],
        "tweet": "https://x.com/Malwarehunterr/status/2048685639403774218"
    },
    {
        "date": "2026-04-27 08:48:00",
        "user": "Malwarehunterr",
        "type": "domain",
        "value": "gooomoel.shop",
        "tags": [],
        "tweet": "https://x.com/Malwarehunterr/status/2048685639403774218"
    },
    {
        "date": "2026-04-27 08:48:00",
        "user": "Malwarehunterr",
        "type": "domain",
        "value": "Letter.zip",
        "tags": [],
        "tweet": "https://x.com/Malwarehunterr/status/2048685639403774218"
    },
    {
        "date": "2026-04-27 08:48:00",
        "user": "Malwarehunterr",
        "type": "domain",
        "value": "Check.zip",
        "tags": [],
        "tweet": "https://x.com/Malwarehunterr/status/2048685639403774218"
    },
    {
        "date": "2026-04-27 09:56:00",
        "user": "smica83",
        "type": "domain",
        "value": "lesoulkir.info",
        "tags": [],
        "tweet": "https://x.com/smica83/status/2048702700435411434"
    },
    {
        "date": "2026-04-27 10:07:00",
        "user": "smica83",
        "type": "domain",
        "value": "imgresim.net",
        "tags": [],
        "tweet": "https://x.com/smica83/status/2048705522451271688"
    },
    {
        "date": "2026-04-27 10:26:00",
        "user": "smica83",
        "type": "domain",
        "value": "d.tmpfile.link",
        "tags": [
            "#AsyncRAT"
        ],
        "tweet": "https://x.com/smica83/status/2048710333724860927"
    },
    {
        "date": "2026-04-27 10:26:00",
        "user": "smica83",
        "type": "domain",
        "value": "lapoire6.hopto.org",
        "tags": [
            "#AsyncRAT"
        ],
        "tweet": "https://x.com/smica83/status/2048710333724860927"
    },
    {
        "date": "2026-04-27 10:26:00",
        "user": "smica83",
        "type": "domain",
        "value": "lapoire7.hopto.org",
        "tags": [
            "#AsyncRAT"
        ],
        "tweet": "https://x.com/smica83/status/2048710333724860927"
    },
    {
        "date": "2026-04-27 10:26:00",
        "user": "smica83",
        "type": "domain",
        "value": "lapoire8.hopto.org",
        "tags": [
            "#AsyncRAT"
        ],
        "tweet": "https://x.com/smica83/status/2048710333724860927"
    },
    {
        "date": "2026-04-27 11:17:00",
        "user": "smica83",
        "type": "domain",
        "value": "telecom-exceed-aid-charts.trycloudflare.com",
        "tags": [],
        "tweet": "https://x.com/smica83/status/2048723094185934944"
    },
    {
        "date": "2026-04-27 12:24:00",
        "user": "masaomi346",
        "type": "domain",
        "value": "paragon.goodfellasdiner.com",
        "tags": [
            "#malware"
        ],
        "tweet": "https://x.com/masaomi346/status/2048740155817930807"
    },
    {
        "date": "2026-04-27 12:29:00",
        "user": "Metemcyber",
        "type": "domain",
        "value": "nzrcovqs.nvasz.cn",
        "tags": [
            "#phishing"
        ],
        "tweet": "https://x.com/Metemcyber/status/2048741218151240179"
    },
    {
        "date": "2026-04-27 12:34:00",
        "user": "Malwarehunterr",
        "type": "domain",
        "value": "netflix-home.info",
        "tags": [
            "#phishing"
        ],
        "tweet": "https://x.com/Malwarehunterr/status/2048742556083925203"
    },
    {
        "date": "2026-04-27 12:34:49",
        "user": "Metemcyber",
        "type": "domain",
        "value": "dfumbu.fytwfj.cn",
        "tags": [],
        "tweet": "https://x.com/Metemcyber/status/2048742665014157584"
    },
    {
        "date": "2026-04-27 12:37:00",
        "user": "masaomi346",
        "type": "domain",
        "value": "mac-cleantool.gitlab.io",
        "tags": [
            "#infostealer",
            "#malware"
        ],
        "tweet": "https://x.com/masaomi346/status/2048743434689949721"
    },
    {
        "date": "2026-04-27 12:37:00",
        "user": "masaomi346",
        "type": "domain",
        "value": "dpsmuz.com",
        "tags": [
            "#infostealer",
            "#malware"
        ],
        "tweet": "https://x.com/masaomi346/status/2048743434689949721"
    },
    {
        "date": "2026-04-27 12:38:00",
        "user": "Metemcyber",
        "type": "domain",
        "value": "stultiern.iceaz.cn",
        "tags": [
            "#phishing"
        ],
        "tweet": "https://x.com/Metemcyber/status/2048743709538431467"
    },
    {
        "date": "2026-04-27 17:50:00",
        "user": "brkalbyrk7",
        "type": "domain",
        "value": "filehappytomato.com",
        "tags": [],
        "tweet": "https://x.com/brkalbyrk7/status/2048822026450657391"
    },
    {
        "date": "2026-04-27 17:50:00",
        "user": "brkalbyrk7",
        "type": "domain",
        "value": "mendalik.com",
        "tags": [],
        "tweet": "https://x.com/brkalbyrk7/status/2048822026450657391"
    },
    {
        "date": "2026-04-27 17:50:00",
        "user": "brkalbyrk7",
        "type": "domain",
        "value": "cvetochek75.com",
        "tags": [],
        "tweet": "https://x.com/brkalbyrk7/status/2048822026450657391"
    },
    {
        "date": "2026-04-27 18:30:00",
        "user": "g0njxa",
        "type": "domain",
        "value": "chocolatey.co.com",
        "tags": [],
        "tweet": "https://x.com/g0njxa/status/2048832122618847252"
    },
    {
        "date": "2026-04-27 18:30:00",
        "user": "g0njxa",
        "type": "domain",
        "value": "chocolatey.net",
        "tags": [],
        "tweet": "https://x.com/g0njxa/status/2048832122618847252"
    },
    {
        "date": "2026-04-27 18:30:00",
        "user": "g0njxa",
        "type": "domain",
        "value": "api.bio9438.com",
        "tags": [],
        "tweet": "https://x.com/g0njxa/status/2048832122618847252"
    },
    {
        "date": "2026-04-27 18:30:00",
        "user": "g0njxa",
        "type": "domain",
        "value": "olive3451.com",
        "tags": [],
        "tweet": "https://x.com/g0njxa/status/2048832122618847252"
    },
    {
        "date": "2026-04-27 18:30:00",
        "user": "g0njxa",
        "type": "domain",
        "value": "community.chocolatey.net",
        "tags": [],
        "tweet": "https://x.com/g0njxa/status/2048832122618847252"
    },
    {
        "date": "2026-04-27 18:59:00",
        "user": "skocherhan",
        "type": "domain",
        "value": "unlockeblog12s.dynuddns.net",
        "tags": [
            "#DPRK",
            "#Kimsuky"
        ],
        "tweet": "https://x.com/skocherhan/status/2048839411962396813"
    },
    {
        "date": "2026-04-27 18:59:00",
        "user": "skocherhan",
        "type": "domain",
        "value": "unlockeblog15s.dynuddns.net",
        "tags": [
            "#DPRK",
            "#Kimsuky"
        ],
        "tweet": "https://x.com/skocherhan/status/2048839411962396813"
    },
    {
        "date": "2026-04-27 18:59:00",
        "user": "skocherhan",
        "type": "domain",
        "value": "eboardreport5s.dynuddns.net",
        "tags": [
            "#DPRK",
            "#Kimsuky"
        ],
        "tweet": "https://x.com/skocherhan/status/2048839411962396813"
    },
    {
        "date": "2026-04-27 18:59:00",
        "user": "skocherhan",
        "type": "domain",
        "value": "unlockeblog10s.dynuddns.net",
        "tags": [
            "#DPRK",
            "#Kimsuky"
        ],
        "tweet": "https://x.com/skocherhan/status/2048839411962396813"
    },
    {
        "date": "2026-04-27 18:59:00",
        "user": "skocherhan",
        "type": "domain",
        "value": "eboardreport18s.dynuddns.net",
        "tags": [
            "#DPRK",
            "#Kimsuky"
        ],
        "tweet": "https://x.com/skocherhan/status/2048839411962396813"
    },
    {
        "date": "2026-04-27 18:59:00",
        "user": "skocherhan",
        "type": "domain",
        "value": "unlockeblog19s.dynuddns.net",
        "tags": [
            "#DPRK",
            "#Kimsuky"
        ],
        "tweet": "https://x.com/skocherhan/status/2048839411962396813"
    },
    {
        "date": "2026-04-27 18:59:00",
        "user": "skocherhan",
        "type": "domain",
        "value": "enboardingreport18s.dns.army",
        "tags": [
            "#DPRK",
            "#Kimsuky"
        ],
        "tweet": "https://x.com/skocherhan/status/2048839411962396813"
    },
    {
        "date": "2026-04-27 20:54:00",
        "user": "smica83",
        "type": "domain",
        "value": "witch-skins-lip-coal.trycloudflare.com",
        "tags": [],
        "tweet": "https://x.com/smica83/status/2048868515348652107"
    },
    {
        "date": "2026-04-27 21:11:00",
        "user": "malwrhunterteam",
        "type": "domain",
        "value": "maiden-apply-looks-education.trycloudflare.com",
        "tags": [],
        "tweet": "https://x.com/malwrhunterteam/status/2048872565095936175"
    },
    {
        "date": "2026-04-27 21:17:00",
        "user": "hipdead010",
        "type": "domain",
        "value": "dianegov.co",
        "tags": [
            "#AsyncRAT",
            "#Dcrat"
        ],
        "tweet": "https://x.com/hipdead010/status/2048874206431969653"
    },
    {
        "date": "2026-04-27 21:17:00",
        "user": "hipdead010",
        "type": "domain",
        "value": "consultaprocesosramajudicialgov.run.place",
        "tags": [
            "#AsyncRAT",
            "#Dcrat"
        ],
        "tweet": "https://x.com/hipdead010/status/2048874206431969653"
    },
    {
        "date": "2026-04-27 22:54:00",
        "user": "skocherhan",
        "type": "domain",
        "value": "edeliever-address-verify.biz",
        "tags": [],
        "tweet": "https://x.com/skocherhan/status/2048898639506891100"
    },
    {
        "date": "2026-04-27 22:54:00",
        "user": "skocherhan",
        "type": "domain",
        "value": "appleviewer.sbs",
        "tags": [],
        "tweet": "https://x.com/skocherhan/status/2048898639506891100"
    },
    {
        "date": "2026-04-27 22:54:00",
        "user": "skocherhan",
        "type": "domain",
        "value": "digital-notice-kr.sbs",
        "tags": [],
        "tweet": "https://x.com/skocherhan/status/2048898639506891100"
    },
    {
        "date": "2026-04-27 22:54:00",
        "user": "skocherhan",
        "type": "domain",
        "value": "public-revenue-info.biz",
        "tags": [],
        "tweet": "https://x.com/skocherhan/status/2048898639506891100"
    },
    {
        "date": "2026-04-27 22:54:00",
        "user": "skocherhan",
        "type": "domain",
        "value": "urgent-notice-check.click",
        "tags": [],
        "tweet": "https://x.com/skocherhan/status/2048898639506891100"
    },
    {
        "date": "2026-04-27 22:54:00",
        "user": "skocherhan",
        "type": "domain",
        "value": "epdf-user-view.quest",
        "tags": [],
        "tweet": "https://x.com/skocherhan/status/2048898639506891100"
    },
    {
        "date": "2026-04-27 22:54:00",
        "user": "skocherhan",
        "type": "domain",
        "value": "digital-post.live",
        "tags": [],
        "tweet": "https://x.com/skocherhan/status/2048898639506891100"
    },
    {
        "date": "2026-04-27 22:54:00",
        "user": "skocherhan",
        "type": "domain",
        "value": "official-notice.click",
        "tags": [],
        "tweet": "https://x.com/skocherhan/status/2048898639506891100"
    },
    {
        "date": "2026-04-27 23:04:00",
        "user": "skocherhan",
        "type": "domain",
        "value": "newday.inet-mark.com",
        "tags": [],
        "tweet": "https://x.com/skocherhan/status/2048901120009880019"
    },
    {
        "date": "2026-04-27 23:04:00",
        "user": "skocherhan",
        "type": "domain",
        "value": "terazosine.fit",
        "tags": [],
        "tweet": "https://x.com/skocherhan/status/2048901120009880019"
    },
    {
        "date": "2026-04-28 00:05:00",
        "user": "PaduckLee",
        "type": "domain",
        "value": "723pt5dc2plfexrfvudhdhzvesgesqbcl4yivijjubptnogukxxv3hqd.onion",
        "tags": [
            "#ransomware"
        ],
        "tweet": "https://x.com/PaduckLee/status/2048916422630466037"
    },
    {
        "date": "2026-04-28 00:07:00",
        "user": "PhishStats",
        "type": "domain",
        "value": "6.accessbenefitscenter.com",
        "tags": [
            "#phishing"
        ],
        "tweet": "https://x.com/PhishStats/status/2048917088593461541"
    },
    {
        "date": "2026-04-28 01:01:13",
        "user": "masaomi346",
        "type": "domain",
        "value": "macclrupspace.gitlab.io",
        "tags": [
            "#infostealer",
            "#malware"
        ],
        "tweet": "https://x.com/masaomi346/status/2048930503227801657"
    },
    {
        "date": "2026-04-28 01:01:13",
        "user": "masaomi346",
        "type": "domain",
        "value": "termopasta.com",
        "tags": [
            "#infostealer",
            "#malware"
        ],
        "tweet": "https://x.com/masaomi346/status/2048930503227801657"
    },
    {
        "date": "2026-04-28 01:41:00",
        "user": "Metemcyber",
        "type": "domain",
        "value": "lcatscpzx.cz592401.cn",
        "tags": [
            "#phishing"
        ],
        "tweet": "https://x.com/Metemcyber/status/2048940649949614538"
    },
    {
        "date": "2026-04-28 01:52:00",
        "user": "Metemcyber",
        "type": "domain",
        "value": "site4-sbisec.gsy2cg1u.shop",
        "tags": [
            "#phishing"
        ],
        "tweet": "https://x.com/Metemcyber/status/2048943310602227836"
    },
    {
        "date": "2026-04-28 02:03:00",
        "user": "Metemcyber",
        "type": "domain",
        "value": "pseudotachylite.cfd",
        "tags": [
            "#phishing"
        ],
        "tweet": "https://x.com/Metemcyber/status/2048946258849808698"
    },
    {
        "date": "2026-04-28 03:37:00",
        "user": "masaomi346",
        "type": "domain",
        "value": "site4-sbisec.gtt6ss20.shop",
        "tags": [
            "#phishing"
        ],
        "tweet": "https://x.com/masaomi346/status/2048969911708602441"
    },
    {
        "date": "2026-04-28 08:05:00",
        "user": "Metemcyber",
        "type": "domain",
        "value": "vavny.oflndm.cn",
        "tags": [
            "#phishing"
        ],
        "tweet": "https://x.com/Metemcyber/status/2049037385464479769"
    },
    {
        "date": "2026-04-28 08:20:00",
        "user": "Metemcyber",
        "type": "domain",
        "value": "mhqajiz.bl8cz6.cn",
        "tags": [
            "#phishing"
        ],
        "tweet": "https://x.com/Metemcyber/status/2049041046399779218"
    },
    {
        "date": "2026-04-28 09:06:00",
        "user": "PhishStats",
        "type": "domain",
        "value": "xan3ri.cfd",
        "tags": [
            "#phishing"
        ],
        "tweet": "https://x.com/PhishStats/status/2049052715871772726"
    },
    {
        "date": "2026-04-28 09:30:00",
        "user": "smica83",
        "type": "domain",
        "value": "lotuscare.com.my",
        "tags": [],
        "tweet": "https://x.com/smica83/status/2049058768508342486"
    },
    {
        "date": "2026-04-28 09:40:00",
        "user": "smica83",
        "type": "domain",
        "value": "hx1.bounceme.net:4433",
        "tags": [],
        "tweet": "https://x.com/smica83/status/2049061239314076024"
    },
    {
        "date": "2026-04-28 10:08:00",
        "user": "malwrhunterteam",
        "type": "domain",
        "value": "xtrafftrck.net:3000",
        "tags": [],
        "tweet": "https://x.com/malwrhunterteam/status/2049068289607737541"
    },
    {
        "date": "2026-04-28 10:09:00",
        "user": "smica83",
        "type": "domain",
        "value": "vpntop.com.cn",
        "tags": [],
        "tweet": "https://x.com/smica83/status/2049068445682037229"
    },
    {
        "date": "2026-04-28 12:08:00",
        "user": "suyog41",
        "type": "domain",
        "value": "glowmedaesthetics.com",
        "tags": [
            "#stealer"
        ],
        "tweet": "https://x.com/suyog41/status/2049098438089073128"
    },
    {
        "date": "2026-04-28 12:21:00",
        "user": "Slvlombardo",
        "type": "domain",
        "value": "barberspot.in",
        "tags": [
            "#phishing"
        ],
        "tweet": "https://x.com/Slvlombardo/status/2049101792466571632"
    },
    {
        "date": "2026-04-28 12:21:00",
        "user": "Slvlombardo",
        "type": "domain",
        "value": "it-me-id-pagit-id.com",
        "tags": [
            "#phishing"
        ],
        "tweet": "https://x.com/Slvlombardo/status/2049101792466571632"
    },
    {
        "date": "2026-04-28 14:59:00",
        "user": "vmray",
        "type": "domain",
        "value": "Pastee.dev",
        "tags": [],
        "tweet": "https://x.com/vmray/status/2049141348926669126"
    },
    {
        "date": "2026-04-28 15:18:40",
        "user": "Erreklamatu",
        "type": "domain",
        "value": "info@erreklamatu.com",
        "tags": [
            "#phishing"
        ],
        "tweet": "https://x.com/Erreklamatu/status/2049146287652536675"
    },
    {
        "date": "2026-04-28 15:27:00",
        "user": "harugasumi",
        "type": "domain",
        "value": "meekys.mtffx.cn",
        "tags": [
            "#phishing"
        ],
        "tweet": "https://x.com/harugasumi/status/2049148402471145825"
    },
    {
        "date": "2026-04-28 17:22:00",
        "user": "malwrhunterteam",
        "type": "domain",
        "value": "scp749.com",
        "tags": [],
        "tweet": "https://x.com/malwrhunterteam/status/2049177426706481303"
    },
    {
        "date": "2026-04-28 18:14:08",
        "user": "malwrhunterteam",
        "type": "domain",
        "value": "vayusena.online",
        "tags": [],
        "tweet": "https://x.com/malwrhunterteam/status/2049190442084835702"
    },
    {
        "date": "2026-04-28 18:33:00",
        "user": "skocherhan",
        "type": "domain",
        "value": "inlinepol1s.roxa.org",
        "tags": [
            "#DPRK",
            "#Kimsuky"
        ],
        "tweet": "https://x.com/skocherhan/status/2049195306487853319"
    },
    {
        "date": "2026-04-28 18:33:00",
        "user": "skocherhan",
        "type": "domain",
        "value": "docinfo.inlinepol1s.roxa.org",
        "tags": [
            "#DPRK",
            "#Kimsuky"
        ],
        "tweet": "https://x.com/skocherhan/status/2049195306487853319"
    },
    {
        "date": "2026-04-28 18:33:00",
        "user": "skocherhan",
        "type": "domain",
        "value": "inlinepol19s.roxa.org",
        "tags": [
            "#DPRK",
            "#Kimsuky"
        ],
        "tweet": "https://x.com/skocherhan/status/2049195306487853319"
    },
    {
        "date": "2026-04-28 18:33:00",
        "user": "skocherhan",
        "type": "domain",
        "value": "inlinepol17s.roxa.org",
        "tags": [
            "#DPRK",
            "#Kimsuky"
        ],
        "tweet": "https://x.com/skocherhan/status/2049195306487853319"
    },
    {
        "date": "2026-04-28 18:33:00",
        "user": "skocherhan",
        "type": "domain",
        "value": "edoc.inlinepol14s.roxa.org",
        "tags": [
            "#DPRK",
            "#Kimsuky"
        ],
        "tweet": "https://x.com/skocherhan/status/2049195306487853319"
    },
    {
        "date": "2026-04-28 18:33:00",
        "user": "skocherhan",
        "type": "domain",
        "value": "newaltercm42s.roxa.org",
        "tags": [
            "#DPRK",
            "#Kimsuky"
        ],
        "tweet": "https://x.com/skocherhan/status/2049195306487853319"
    },
    {
        "date": "2026-04-28 18:33:00",
        "user": "skocherhan",
        "type": "domain",
        "value": "inlinepol14s.roxa.org",
        "tags": [
            "#DPRK",
            "#Kimsuky"
        ],
        "tweet": "https://x.com/skocherhan/status/2049195306487853319"
    },
    {
        "date": "2026-04-28 18:33:00",
        "user": "skocherhan",
        "type": "domain",
        "value": "uofficialerc22v.dynuddns.com",
        "tags": [
            "#DPRK",
            "#Kimsuky"
        ],
        "tweet": "https://x.com/skocherhan/status/2049195306487853319"
    },
    {
        "date": "2026-04-28 18:33:00",
        "user": "skocherhan",
        "type": "domain",
        "value": "newpolinf48s.dynuddns.com",
        "tags": [
            "#DPRK",
            "#Kimsuky"
        ],
        "tweet": "https://x.com/skocherhan/status/2049195306487853319"
    },
    {
        "date": "2026-04-28 18:50:00",
        "user": "smica83",
        "type": "domain",
        "value": "vayusena.online:48973",
        "tags": [],
        "tweet": "https://x.com/smica83/status/2049199564901454092"
    },
    {
        "date": "2026-04-28 20:13:00",
        "user": "Malwarehunterr",
        "type": "domain",
        "value": "lace-desktop.io",
        "tags": [],
        "tweet": "https://x.com/Malwarehunterr/status/2049220391357628591"
    },
    {
        "date": "2026-04-28 20:13:00",
        "user": "Malwarehunterr",
        "type": "domain",
        "value": "store4.gofile.io",
        "tags": [],
        "tweet": "https://x.com/Malwarehunterr/status/2049220391357628591"
    },
    {
        "date": "2026-04-28 20:13:00",
        "user": "Malwarehunterr",
        "type": "domain",
        "value": "lace-desktop.live",
        "tags": [],
        "tweet": "https://x.com/Malwarehunterr/status/2049220391357628591"
    },
    {
        "date": "2026-04-28 20:23:00",
        "user": "malwrhunterteam",
        "type": "domain",
        "value": "spm-cdn-assets-dist-2026.s3.us-east-2.amazonaws.com",
        "tags": [],
        "tweet": "https://x.com/malwrhunterteam/status/2049223060062970275"
    },
    {
        "date": "2026-04-28 21:18:00",
        "user": "smica83",
        "type": "domain",
        "value": "drazyland.us",
        "tags": [],
        "tweet": "https://x.com/smica83/status/2049236774271045773"
    },
    {
        "date": "2026-04-28 21:19:00",
        "user": "malwrhunterteam",
        "type": "domain",
        "value": "centralcoretech.com",
        "tags": [],
        "tweet": "https://x.com/malwrhunterteam/status/2049237054857285793"
    },
    {
        "date": "2026-04-28 21:30:00",
        "user": "Merlax_",
        "type": "domain",
        "value": "facilitandoagora.online",
        "tags": [
            "#phishing"
        ],
        "tweet": "https://x.com/Merlax_/status/2049239733578969593"
    },
    {
        "date": "2026-04-28 21:30:00",
        "user": "Merlax_",
        "type": "domain",
        "value": "mercadolib-es.shop",
        "tags": [
            "#phishing"
        ],
        "tweet": "https://x.com/Merlax_/status/2049239733578969593"
    },
    {
        "date": "2026-04-28 21:30:00",
        "user": "Merlax_",
        "type": "domain",
        "value": "guepardodelivery-entregador.com",
        "tags": [
            "#phishing"
        ],
        "tweet": "https://x.com/Merlax_/status/2049239733578969593"
    },
    {
        "date": "2026-04-28 21:30:00",
        "user": "Merlax_",
        "type": "domain",
        "value": "ailosapp.com",
        "tags": [
            "#phishing"
        ],
        "tweet": "https://x.com/Merlax_/status/2049239733578969593"
    },
    {
        "date": "2026-04-28 21:30:00",
        "user": "Merlax_",
        "type": "domain",
        "value": "playstorelivelo.com",
        "tags": [
            "#phishing"
        ],
        "tweet": "https://x.com/Merlax_/status/2049239733578969593"
    },
    {
        "date": "2026-04-29 00:06:00",
        "user": "fbgwls245",
        "type": "domain",
        "value": "ttvbuilv5mf2wggfjgmvin22ndzghpukhsyy6coz3p4wt5nqnxah7tyd.onion",
        "tags": [
            "#ransomware"
        ],
        "tweet": "https://x.com/fbgwls245/status/2049279082215710749"
    }
]