rule bulwark_https_bulwarkblack_com_smartapesg_okendo_widget_supply_chain_risk
{
    meta:
        author = "Bulwark Black LLC"
        source = "https://bulwarkblack.com/smartapesg-okendo-widget-supply-chain-risk/"
        description = "Auto-extracted indicators. Verify before use; not a behavioral detection rule."
        generated = "2026-08-27T05:26:13Z"
        tlp = "TLP:CLEAR"
        indicator_count = "9"
    strings:
        $s0 = "api.wigetticks.com" ascii wide nocase  // Domains
        $s1 = "api.wizzleticks.com" ascii wide nocase  // Domains
        $s2 = "cdn-static.okendo.io" ascii wide nocase  // Domains
        $s3 = "okendo.io" ascii wide nocase  // Domains
        $s4 = "wigetticks.com" ascii wide nocase  // Domains
        $s5 = "wizzleticks.com" ascii wide nocase  // Domains
        $s6 = "http://cdn-static.okendo.io/reviews-widget-plus/js/okendo-reviews.js" ascii wide nocase  // URLs
        $s7 = "https://api.wigetticks.com/logout/private-response.php?8D1V4th3" ascii wide nocase  // URLs
        $s8 = "https://api.wizzleticks.com/claims/scope-schema.php?4ManBBdA" ascii wide nocase  // URLs
    condition:
        any of ($s*)
}