{
  "metadata": {
    "generator": "Bulwark Black IOC Extractor",
    "source": "https://bulwarkblack.com/device-code-phishing-oauth-token-theft-defense/",
    "fang": "live",
    "exported_at": "2026-07-15T22:30:59Z",
    "total": 88,
    "categories": 2
  },
  "iocs": {
    "Domains": [
      "019d442a-endpoint.com",
      "019d442e-endpoint.com",
      "019d6860-endpoint.com",
      "0fdba029e6a5-endpoint.com",
      "2dc62559e005-endpoint.com",
      "4daa2aea93db-endpoint.com",
      "6dd5fd945b34-endpoint.com",
      "7740f766-8d1d-46ad-a6bc-onedrive.p-9jluifuu.workers.dev",
      "7806d4cf9366-endpoint.com",
      "audit-report-9767d3.fullerjp09.workers.dev",
      "consistentdigital.de",
      "crediblebizextension.de",
      "digitalcontinuity.de",
      "digitalreliability.de",
      "ed5ce47d835f-endpoint.com",
      "ee10bbf6c689-endpoint.com",
      "euromarketsignal.de",
      "europesignaltrust.de",
      "europetrustwave.de",
      "extendyourcredibility.de",
      "f36c2774f013-endpoint.com",
      "f8uh-dwam-j4l5.pvasquez-princetonpartners-com-s-account.workers.dev",
      "heilbronner-fruehlingssymposium.de",
      "hewktree.net",
      "hs-sites-na2.com",
      "hti-245401512.hs-sites-na2.com",
      "jo2c9ada427c6-endpoint.com",
      "kohlhoff-edelstahlverarbeitung.de",
      "marketcredibilitysignals.de",
      "marktkarree-langenfeld.de",
      "methodicalness.de",
      "onedrive-7tu.techroboticslabmade-techie-com-s-account.workers.dev",
      "panel.hewktree.net",
      "reliableinteractions.de",
      "reliablesupport.de",
      "servicewithoutinterruption.de",
      "stablewebsystems.de",
      "trustedengagement.de",
      "uninterruptedperformance.de",
      "voicemail-59f.admin-treyripple-com-s-account.workers.dev",
      "voicemail-lyr.nbuckley-cambek-com-s-account.workers.dev",
      "voicemail-wx7.mark-squires-expressrancnes-com-s-account.workers.dev",
      "workers.dev",
      "yaga9b286ae2c101-endpoint.com",
      "ytgw-9n30-xlwd.pvasquez-princetonpartners-com-s-account.workers.dev",
      "z6e43e5886fe-endpoint.com"
    ],
    "URLs": [
      "019d442a-endpoint.com",
      "019d442e-endpoint.com",
      "019d6860-endpoint.com",
      "0fdba029e6a5-endpoint.com",
      "2dc62559e005-endpoint.com",
      "4daa2aea93db-endpoint.com",
      "6dd5fd945b34-endpoint.com",
      "7740f766-8d1d-46ad-a6bc-onedrive.p-9jluifuu.workers.dev",
      "7806d4cf9366-endpoint.com",
      "consistentdigital.de",
      "crediblebizextension.de",
      "digitalcontinuity.de",
      "digitalreliability.de",
      "ed5ce47d835f-endpoint.com",
      "ee10bbf6c689-endpoint.com",
      "euromarketsignal.de",
      "europesignaltrust.de",
      "europetrustwave.de",
      "extendyourcredibility.de",
      "f36c2774f013-endpoint.com",
      "f8uh-dwam-j4l5.pvasquez-princetonpartners-com-s-account.workers.dev",
      "heilbronner-fruehlingssymposium.de",
      "hti-245401512.hs-sites-na2.com",
      "jo2c9ada427c6-endpoint.com",
      "kohlhoff-edelstahlverarbeitung.de",
      "marketcredibilitysignals.de",
      "marktkarree-langenfeld.de",
      "methodicalness.de",
      "onedrive-7tu.techroboticslabmade-techie-com-s-account.workers.dev",
      "panel.hewktree.net",
      "reliableinteractions.de",
      "reliablesupport.de",
      "servicewithoutinterruption.de",
      "stablewebsystems.de",
      "trustedengagement.de",
      "uninterruptedperformance.de",
      "voicemail-59f.admin-treyripple-com-s-account.workers.dev",
      "voicemail-lyr.nbuckley-cambek-com-s-account.workers.dev",
      "voicemail-wx7.mark-squires-expressrancnes-com-s-account.workers.dev",
      "yaga9b286ae2c101-endpoint.com",
      "ytgw-9n30-xlwd.pvasquez-princetonpartners-com-s-account.workers.dev",
      "z6e43e5886fe-endpoint.com"
    ]
  }
}