[
 {
  "value": "brmconfig.com",
  "type": "domain",
  "first_seen": "2026-09-01",
  "last_seen": "2026-09-01",
  "status": "expired",
  "confidence": "reported",
  "n_sources": 1,
  "stories": [
   "hackers-abuse-chatgpt-shared-links-and-fake-cloudflare-captcha-t"
  ],
  "sources": [
   "https://cyberpress.org/chatgpt-links-spread-netsupport-rat/"
  ],
  "reason": "C2 domain serving PowerShell loader in ChatGPT shared-links abuse campaign deploying NetSupport RAT"
 },
 {
  "value": "openai-backup.one",
  "type": "domain",
  "first_seen": "2026-09-01",
  "last_seen": "2026-09-01",
  "status": "expired",
  "confidence": "reported",
  "n_sources": 1,
  "stories": [
   "hackers-abuse-chatgpt-shared-links-and-fake-cloudflare-captcha-t"
  ],
  "sources": [
   "https://cyberpress.org/chatgpt-links-spread-netsupport-rat/"
  ],
  "reason": "Fake OpenAI backup site distributing NetSupport RAT via fake Cloudflare CAPTCHA ClickFix"
 }
]