{
  "metadata": {
    "generator": "Bulwark Black IOC Extractor",
    "source": "https://bulwarkblack.com/captivecrunch-travel-wifi-identity-attack-surface/",
    "fang": "live",
    "exported_at": "2026-08-01T01:03:47Z",
    "total": 30,
    "categories": 4
  },
  "iocs": {
    "IPv4": [
      "104.194.159.150",
      "107.189.26.194",
      "213.145.86.112",
      "31.57.243.154",
      "38.146.28.132",
      "38.146.28.75"
    ],
    "Domains": [
      "cloudflarecp.com",
      "cloudflareok.com",
      "cloudflareportal.com",
      "connectivity.cloudflareclient.com",
      "detectportal.brave-http-only.com",
      "detectportal.firefox.com",
      "m365-owa.com",
      "ms365-device.com",
      "ms365-live.com",
      "msftconnecttest.com",
      "msftncsi.com",
      "nmcheck.gnome.org",
      "owa-ms365.com",
      "www.volexity.com"
    ],
    "URLs": [
      "https://213.145.86.112/cdn/chunks/polyfill-7e2b.min.js",
      "https://213.145.86.112/t/event",
      "https://213.145.86.112/t/pixel.gif",
      "https://www.volexity.com/blog/2025/02/13/multiple-russian-threat-actors-targeting-microsoft-device-code-authentication",
      "m365-owa.com",
      "ms365-device.com",
      "ms365-live.com",
      "owa-ms365.com"
    ],
    "sha256": [
      "918fa52ae45ed60ba7cc8bdc99c3cbe9ab92e0375ec31fc05d0d4513be11c593",
      "be99857449d2856dd5a84e21c8a3d5e0e01456adb44062ddec5a6b4970d8d42c"
    ]
  }
}