[
 {
  "value": "env-check.daemontools",
  "type": "domain",
  "first_seen": "2026-05-05",
  "last_seen": "2026-05-05",
  "status": "expired",
  "confidence": "reported",
  "n_sources": 1,
  "stories": [
   "needymantis-unpacking-a-post-compromise-malware-family-used-in-t"
  ],
  "sources": [
   "https://securelist.com/tr/daemon-tools-backdoor/119654/"
  ],
  "reason": "C2 domain in Daemon Tools backdoor (typosquat of daemon-tools.cc)"
 }
]