[
 {
  "value": "third-party.com",
  "type": "domain",
  "first_seen": "2026-05-02",
  "last_seen": "2026-09-23",
  "status": "active",
  "confidence": "reported",
  "n_sources": 1,
  "stories": [
   "placeholder-domain-used-in-dev-docs-now-serves-clickfix-attacks"
  ],
  "sources": [
   "https://www.bleepingcomputer.com/news/security/placeholder-domain-used-in-dev-docs-now-serves-clickfix-attacks/",
   "https://www.virustotal.com/gui/file/daf619aa8cc74dab02c360f46f9f4b7b1654ba478ee89992a3512a46f1f4c209/relations",
   "https://www.ipfire.org/dbl/lists/malware/domains/third-party.com",
   "https://www.manifold.security/blog/third-party-com-placeholder-clickfix"
  ],
  "reason": "ClickFix phishing domain serving fake Cloudflare verification page"
 },
 {
  "value": "daf619aa8cc74dab02c360f46f9f4b7b1654ba478ee89992a3512a46f1f4c209",
  "type": "sha256",
  "first_seen": "2026-05-02",
  "last_seen": "2026-05-02",
  "status": "expired",
  "confidence": "reported",
  "n_sources": 1,
  "stories": [
   "placeholder-domain-used-in-dev-docs-now-serves-clickfix-attacks"
  ],
  "sources": [
   "https://www.virustotal.com/gui/file/daf619aa8cc74dab02c360f46f9f4b7b1654ba478ee89992a3512a46f1f4c209/relations"
  ],
  "reason": "ClickFix second-stage archive from elxxvvx.xyz"
 }
]