[
 {
  "value": "index-ap3.tyler2miler-proton-me-s-account.workers.dev",
  "type": "domain",
  "first_seen": "2026-03-23",
  "last_seen": "2026-03-23",
  "status": "expired",
  "confidence": "reported",
  "n_sources": 1,
  "stories": [
   "eviltokens-phaas-disrupted-after-compromising-12-000-microsoft-a"
  ],
  "sources": [
   "https://github.com/PaloAltoNetworks/Unit42-timely-threat-intel/blob/main/2026-03-23-%20Device-Code-based-OAuth-Phishing.txt"
  ],
  "reason": "EvilTokens phishing-as-a-service infrastructure"
 }
]