{
  "Event": {
    "analysis": "2",
    "date": "2025-04-07",
    "extends_uuid": "",
    "info": "Fake trademark-related invoice",
    "publish_timestamp": "1744025535",
    "published": true,
    "threat_level_id": "3",
    "timestamp": "1744025457",
    "uuid": "e1e99c15-81b9-440f-9bc3-3ce9b3a079c1",
    "Orgc": {
      "name": "CIRCL",
      "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"
    },
    "Tag": [
      {
        "colour": "#004646",
        "local": false,
        "name": "type:OSINT",
        "relationship_type": ""
      },
      {
        "colour": "#0071c3",
        "local": false,
        "name": "osint:lifetime=\"perpetual\"",
        "relationship_type": ""
      },
      {
        "colour": "#ffffff",
        "local": false,
        "name": "tlp:white",
        "relationship_type": ""
      },
      {
        "colour": "#ffffff",
        "local": false,
        "name": "tlp:clear",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:financial-fraud=\"Buying/Renting Fraud\"",
        "relationship_type": ""
      }
    ],
    "Object": [
      {
        "comment": "domain mentioned in the fake trademark publication.",
        "deleted": false,
        "description": "A domain/hostname and IP address seen as a tuple in a specific time frame.",
        "meta-category": "network",
        "name": "domain-ip",
        "template_uuid": "43b3b146-77eb-4931-b4cc-b66c60f28734",
        "template_version": "11",
        "timestamp": "1744014103",
        "uuid": "390858d1-0139-402b-a2d7-84835ec7d82d",
        "Attribute": [
          {
            "category": "Network activity",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "domain",
            "timestamp": "1744014103",
            "to_ids": true,
            "type": "domain",
            "uuid": "b469d64e-2771-41e0-95b5-88c26d4544a7",
            "value": "register-wps.com"
          },
          {
            "category": "Network activity",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ip",
            "timestamp": "1744014103",
            "to_ids": true,
            "type": "ip-dst",
            "uuid": "4b759ee1-9430-445e-b075-4b1e7cefd262",
            "value": "5.44.111.164"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "Email object describing an email with meta-information",
        "meta-category": "network",
        "name": "email",
        "template_uuid": "a0c666e0-fc65-4be8-b48f-3423d788b552",
        "template_version": "19",
        "timestamp": "1744014178",
        "uuid": "584b4326-fb53-4d94-9d10-34de992abd5c",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "reply-to",
            "timestamp": "1744014178",
            "to_ids": false,
            "type": "email-reply-to",
            "uuid": "119df50a-3c32-47c3-9370-9c69a1a6ee2f",
            "value": "info@register-wps.com"
          }
        ]
      }
    ],
    "EventReport": [
      {
        "name": "Event report (1744025130)",
        "content": "### Introduction\r\n\r\nFake invoice under the name Trademark Publication (WPS) for organisation having trademark registered.\r\n\r\nThe fake invoice includes the trademark reference along with the logo. There is no organisation mentioned in the document beside a domain name and an email address.\r\n\r\n### Objects\r\n  - @[object](390858d1-0139-402b-a2d7-84835ec7d82d)\r\n  - @[object](584b4326-fb53-4d94-9d10-34de992abd5c)",
        "id": "1158",
        "event_id": "285444",
        "timestamp": "1744025457",
        "uuid": "180e1047-0f23-433f-a9fc-d67c8261e976",
        "deleted": false
      }
    ]
  }
}