[Title Here]

OID: [OID-XXX25-01]
Domain: [Domain Code e.g. DSN, NET, BOT]
Status: [active|dormant|disrupted|archived]
Confidence: [low|medium|high|verified]
Region: [US, EU, etc.]

A public-safe record of an investigative object.
Sensitive indicators are withheld from this version.

1. Executive Summary

Provide a 4-6 sentence neutral summary:

• What object this OID covers
• What activity or infrastructure it represents
• Key technical characteristics
• Who is targeted (if applicable)
• Why it is relevant to threat analysis
• Any notifications or disclosures already made

2. Background

Contextual description:

• When this activity/object was first observed
• Observable behavior or operational flow
• Known precedents
• Similarities to historical patterns

Example:

This object represents a smishing distribution network leveraging logistics-themed SMS lures targeting EU consumers.

3. Public-Safe Indicators

Redacted for public version.
Only non-sensitive, safe indicators should appear here.

• Domain (partial): hxxps://[redacted].com
• WhatsApp endpoint (partial): wa.me/<redacted>
• Hosting ASN (name only): “Offshore hosting provider”
• Email lure patterns: “[brand] delivery update needed”

4. Technical Analysis

4.1 Domain / DNS

• Domain age
• Registrar
• DNS structure
• Passive DNS cluster summary (non-sensitive)

4.2 Hosting Infrastructure

• ASN (no IPs)
• Geolocation (country only)
• SSL certificate patterns
• Connected infrastructure (redacted)

4.3 Behavioral Flow

• Redirect notes
• URLScan summaries
• Script fingerprint observation
• User flow (e.g., credential → payment request)

4.4 Content & Template Analysis

• HTML structure
• Template reuse
• Kit signatures
• JavaScript fingerprint

1
# Passive DNS + basic phishing heuristic test
2

3
import re
4

5
raw_urls = [
6
    "hxxp://update-delivery-secure[.]com/login",
7
    "hxxps://account-verify[.]net/auth",
8
]
9

10
SUSPICIOUS_TERMS = ["verify", "secure", "update", "login", "auth"]
11

12
def score_url(url: str) -> int:
13
    score = 0
14
    for term in SUSPICIOUS_TERMS:
15
        if re.search(term, url.lower()):
16
            score += 2
17
    if "[.]" in url or "hxxp" in url:
18
        score += 3
19
    return score
20

21
for u in raw_urls:
22
    print(f"{u} -> risk score: {score_url(u)}")

5. Infrastructure Cluster (Public-Safe)

Sensitive graph redacted.
This object connects several landing domains, rotating sender ID SMS lures, and a WhatsApp endpoint.
The infrastructure resembles known fraud kits active since 2023.

[Redacted Graph]

6. MITRE ATT&CK Mapping

7. Threat Actor Assessment

(Low-confidence public version)

• Financially motivated
• Operational security low
• Infrastructure similar to Brazilian-origin fraud groups
• Rapid churn suggests kit or service model

8. Risk Assessment

Victim Impact

• Credential theft
• Identity fraud
• Payment capture attempts

National Impact

• High victim volume possible
• Low technical sophistication

9. Disclosure Notes

Full technical indicators including:

• IPs
• Full domains
• Redirect chains
• Kit paths
• Hosting provider abuse complaints
• Contacted CERT reports

were submitted privately to:

<Authority/Organization>
Date: YYYY-MM-DD