[
 {
  "value": "delivery.evidence",
  "type": "domain",
  "first_seen": "2026-08-11",
  "last_seen": "2026-08-11",
  "status": "expired",
  "confidence": "reported",
  "n_sources": 1,
  "stories": [
   "captivecrunch-midnight-blizzard-sub-cluster-weaponizes-hotel-wi"
  ],
  "sources": [
   "https://malware.news/t/captivecrunch-midnight-blizzard-weaponizes-hotel-wi-fi-captive-portals-to-steal-microsoft-365-credentials/124711#post_1"
  ],
  "reason": "Midnight Blizzard (APT29) hotel Wi-Fi captive portal attack infrastructure"
 }
]