[
 {
  "value": "23.225.52.67",
  "type": "ipv4",
  "first_seen": "2026-03-12",
  "last_seen": "2026-03-12",
  "status": "expired",
  "confidence": "reported",
  "n_sources": 1,
  "stories": [
   "packagist-themes-exploit-iphone-visitors-to-steal-messages-passw"
  ],
  "sources": [
   "https://socket.dev/blog/6-malicious-packagist-themes-ship-trojanized-jquery"
  ],
  "reason": "Ad-injection C2 in FUNNULL Packagist jQuery supply-chain attack"
 },
 {
  "value": "cre-ads.com",
  "type": "domain",
  "first_seen": "2026-03-12",
  "last_seen": "2026-03-12",
  "status": "expired",
  "confidence": "reported",
  "n_sources": 1,
  "stories": [
   "packagist-themes-exploit-iphone-visitors-to-steal-messages-passw"
  ],
  "sources": [
   "https://socket.dev/blog/6-malicious-packagist-themes-ship-trojanized-jquery"
  ],
  "reason": "Click-hijacking domain in FUNNULL trojanized jQuery"
 },
 {
  "value": "nqsaaskw.com",
  "type": "domain",
  "first_seen": "2026-03-12",
  "last_seen": "2026-03-12",
  "status": "expired",
  "confidence": "reported",
  "n_sources": 1,
  "stories": [
   "packagist-themes-exploit-iphone-visitors-to-steal-messages-passw"
  ],
  "sources": [
   "https://socket.dev/blog/6-malicious-packagist-themes-ship-trojanized-jquery"
  ],
  "reason": "FUNNULL CDN CNAME domain in trojanized jQuery attack"
 },
 {
  "value": "userstat.net",
  "type": "domain",
  "first_seen": "2026-03-12",
  "last_seen": "2026-03-12",
  "status": "expired",
  "confidence": "reported",
  "n_sources": 1,
  "stories": [
   "packagist-themes-exploit-iphone-visitors-to-steal-messages-passw"
  ],
  "sources": [
   "https://socket.dev/blog/6-malicious-packagist-themes-ship-trojanized-jquery"
  ],
  "reason": "Data exfiltration domain in FUNNULL trojanized jQuery"
 },
 {
  "value": "xemphimlau.com",
  "type": "domain",
  "first_seen": "2026-03-12",
  "last_seen": "2026-03-12",
  "status": "expired",
  "confidence": "reported",
  "n_sources": 1,
  "stories": [
   "packagist-themes-exploit-iphone-visitors-to-steal-messages-passw"
  ],
  "sources": [
   "https://socket.dev/blog/6-malicious-packagist-themes-ship-trojanized-jquery"
  ],
  "reason": "Anti-analysis redirect domain in FUNNULL trojanized jQuery"
 }
]