[
 {
  "value": "company.onmicrosoft.com",
  "type": "domain",
  "first_seen": "2026-08-24",
  "last_seen": "2026-08-24",
  "status": "expired",
  "confidence": "reported",
  "n_sources": 1,
  "stories": [
   "synkloader-malware-spreads-through-microsoft-teams-phishing-and"
  ],
  "sources": [
   "https://cyberpress.org/synkloader-malware-spreads-through-microsoft-teams/"
  ],
  "reason": "Attacker-registered Teams account domain pattern in email-bombing phishing campaign"
 }
]