[
 {
  "value": "usher.ttvnw",
  "type": "domain",
  "first_seen": "2026-09-14",
  "last_seen": "2026-09-14",
  "status": "expired",
  "confidence": "reported",
  "n_sources": 1,
  "stories": [
   "malicious-twitch-extension-exposes-30-000-users-oauth-tokens-to"
  ],
  "sources": [
   "https://www.bleepingcomputer.com/news/security/twitch-extension-with-30k-installs-exposes-users-oauth-tokens/"
  ],
  "reason": "Malicious Twitch extension C2 domain harvesting 30K users' OAuth tokens for Russian bot service"
 }
]