[
 {
  "value": "api.weatherlive",
  "type": "domain",
  "first_seen": "2026-10-08",
  "last_seen": "2026-10-08",
  "status": "active",
  "confidence": "reported",
  "n_sources": 1,
  "stories": [
   "midnight-mimosa-ad-fraud-malware-preinstalled-in-cheap-android-p"
  ],
  "sources": [
   "https://www.bitdefender.com/en-us/blog/labs/midnight-mimosa-malware"
  ],
  "reason": "C2 domain (api.weatherlive[.]world) of Midnight Mimosa Android firmware malware"
 },
 {
  "value": "com.android.sys.bcprot",
  "type": "domain",
  "first_seen": "2026-10-08",
  "last_seen": "2026-10-08",
  "status": "active",
  "confidence": "reported",
  "n_sources": 1,
  "stories": [
   "midnight-mimosa-ad-fraud-malware-preinstalled-in-cheap-android-p"
  ],
  "sources": [
   "https://www.bitdefender.com/en-us/blog/labs/midnight-mimosa-malware"
  ],
  "reason": "Rotating payload package name of Midnight Mimosa Android malware"
 },
 {
  "value": "com.android.sys.gmsprot",
  "type": "domain",
  "first_seen": "2026-10-08",
  "last_seen": "2026-10-08",
  "status": "active",
  "confidence": "reported",
  "n_sources": 1,
  "stories": [
   "midnight-mimosa-ad-fraud-malware-preinstalled-in-cheap-android-p"
  ],
  "sources": [
   "https://www.bitdefender.com/en-us/blog/labs/midnight-mimosa-malware"
  ],
  "reason": "Rotating payload package name of Midnight Mimosa Android malware"
 },
 {
  "value": "com.android.sys.prot",
  "type": "domain",
  "first_seen": "2026-10-08",
  "last_seen": "2026-10-08",
  "status": "active",
  "confidence": "reported",
  "n_sources": 1,
  "stories": [
   "midnight-mimosa-ad-fraud-malware-preinstalled-in-cheap-android-p"
  ],
  "sources": [
   "https://www.bitdefender.com/en-us/blog/labs/midnight-mimosa-malware"
  ],
  "reason": "Rotating payload package name of Midnight Mimosa Android malware"
 },
 {
  "value": "com.android.system.lite",
  "type": "domain",
  "first_seen": "2026-10-08",
  "last_seen": "2026-10-08",
  "status": "active",
  "confidence": "reported",
  "n_sources": 1,
  "stories": [
   "midnight-mimosa-ad-fraud-malware-preinstalled-in-cheap-android-p"
  ],
  "sources": [
   "https://www.bitdefender.com/en-us/blog/labs/midnight-mimosa-malware"
  ],
  "reason": "Preinstalled payload package name of Midnight Mimosa Android malware"
 }
]