[
 {
  "value": "api.claudeopus",
  "type": "domain",
  "first_seen": "2026-08-05",
  "last_seen": "2026-08-05",
  "status": "expired",
  "confidence": "reported",
  "n_sources": 1,
  "stories": [
   "infostealer-logs-expose-replayable-ai-session-tokens-lumma-steal"
  ],
  "sources": [
   "https://thehackernews.com/2026/08/poison-claude-sells-discounted-claude.html"
  ],
  "reason": "Criminal API endpoint api.claudeopus[.]shop of Poison Claude underground AI service"
 },
 {
  "value": "poison-claude.bitsender",
  "type": "domain",
  "first_seen": "2026-08-04",
  "last_seen": "2026-08-04",
  "status": "expired",
  "confidence": "reported",
  "n_sources": 1,
  "stories": [
   "infostealer-logs-expose-replayable-ai-session-tokens-lumma-steal"
  ],
  "sources": [
   "https://www.okta.com/blog/threat-intelligence/free_tokens_for_sale/"
  ],
  "reason": "Phishing domain serving fake Claude session login (Cloudflare warned)"
 }
]