From 837a7ec18498389d6e51dfbc9263e9d4b974ce5a Mon Sep 17 00:00:00 2001
From: StasonJatham <karl@karlcloud.de>
Date: Mon, 5 Oct 2026 16:54:16 +0200
Subject: [PATCH] Add public search indicators to default catalog and Sigma
 rules

---
 README.md                                   |   8 +
 THREAT_INTELLIGENCE.txt                     |  11 +-
 VALIDATION.txt                              |  14 +
 config/threat_intel.json                    | 466 +++++++++++++++++++-
 pyproject.toml                              |   2 +-
 src/netscaler_triage/__init__.py            |   2 +-
 src/netscaler_triage/data/public_sigma.yml  | 413 ++++++++++++++++-
 src/netscaler_triage/data/threat_intel.json | 466 +++++++++++++++++++-
 tests/test_intel_inventory.py               |  10 +
 uv.lock                                     |   2 +-
 10 files changed, 1384 insertions(+), 10 deletions(-)

diff --git a/README.md b/README.md
index 3da4455..d824d09 100644
--- a/README.md
+++ b/README.md
@@ -335,3 +335,11 @@ netscaler-triage filesystem ./export-root --ioc-file ./private/indicators.csv --
 Nicht unabhängig bestätigte Indikatoren als `reference_only` kennzeichnen.
 Sie werden gesucht, aber nicht automatisch als bösartig bewertet oder als
 öffentliche Threat Intelligence weitergegeben.
+
+### Additional public search indicators
+
+Version 1.0.3 adds seven IP addresses and nine SHA-256 hashes to the default
+indicator catalog and Sigma rules. No extra IOC file is needed. These additions
+have no published attribution in the inventory and remain low-confidence search
+candidates. Review surrounding evidence before classifying a hit as malicious.
+Existing source attribution is preserved for previously documented indicators.
diff --git a/THREAT_INTELLIGENCE.txt b/THREAT_INTELLIGENCE.txt
index 8b3728b..5e20469 100644
--- a/THREAT_INTELLIGENCE.txt
+++ b/THREAT_INTELLIGENCE.txt
@@ -1,15 +1,20 @@
 PUBLIC THREAT INTELLIGENCE INVENTORY
 
-Review date: 2026-10-01
+Source review date: 2026-10-01
+Catalog update: 2026-10-05
 
 52 source records; all 37 distinct URLs supplied for this review checked.
-246 unique indicator values; 41 behavior patterns; 47 Sigma rules.
+262 unique indicator values; 41 behavior patterns; 57 Sigma rules.
 
 CANONICAL DATA AND TRACEABILITY
 
 config/threat_intel.json is the complete inventory in the source release.
 The installed package includes identical data/threat_intel.json and public_sigma.yml.
-Each IOC has a stable ID, literal type/value and all source observations. Those
+Each IOC has a stable ID and literal type/value. Sixteen additional public search
+candidates have no published attribution in this inventory: their source lists
+are empty and provenance is unattributed_public_indicator. They are low-confidence
+reference_only candidates, not independently verified malicious indicators.
+The other indicators retain their existing source observations. Those
 observations retain reporting context, confidence, source dates and roles. MISP
 attribute types, comments and to_ids flags are retained even when they conflict.
 Each source links to the indicator IDs and Sigma rule IDs derived from it.
diff --git a/VALIDATION.txt b/VALIDATION.txt
index 01d9f7a..6d911e6 100644
--- a/VALIDATION.txt
+++ b/VALIDATION.txt
@@ -243,3 +243,17 @@ The streaming recheck agreed with the standard engine on raw, Base64, URL-encode
 process-list and benign fixtures. Saved process/permission collection records
 were reviewed separately. Private rules, indicators, records and evidence remain
 outside the public repository. These results do not establish absence of compromise.
+
+PUBLIC INDICATOR UPDATE 1.0.3 - 2026-10-05
+
+Added seven IPv4 addresses and nine SHA-256 search candidates to the default
+catalog and Sigma selectors. Nine duplicate supplied indicators retain their
+existing metadata. New entries are reference_only with explicitly empty source
+lists; no malicious attribution is asserted. Total: 262 indicators, 57 rules.
+
+Validation: 152 tests passed with warnings treated as errors. Full catalog
+matching tests cover raw and decoded views and IP boundaries. Ruff check, Ruff
+format check and mypy passed. Wheel and source distribution built successfully;
+the wheel contains all 262 indicators. Added lines were checked for customer
+identifiers, local user paths and common secret markers. No case evidence or
+private files were included. Existing source records remain unchanged.
diff --git a/config/threat_intel.json b/config/threat_intel.json
index 53c39f8..4b32562 100644
--- a/config/threat_intel.json
+++ b/config/threat_intel.json
@@ -1,6 +1,6 @@
 {
   "schema_version": 2,
-  "updated": "2026-10-01",
+  "updated": "2026-10-05",
   "sources": [
     {
       "id": "cisa-direct",
@@ -10798,6 +10798,209 @@
       "matching": "exact",
       "context_only": false
     },
+    {
+      "id": "ioc-9ec7945d-865e-596c-a7f4-0a6da1c81f0a",
+      "type": "ipv4",
+      "value": "107.172.221.57",
+      "status": "reference_only",
+      "provenance": "unattributed_public_indicator",
+      "source_ids": [],
+      "source_urls": [],
+      "observations": [
+        {
+          "status": "reference_only",
+          "original_status": "reference_only",
+          "role": "search_candidate",
+          "confidence": "low",
+          "description": "Public search candidate without published attribution in this inventory. Malicious attribution has not been independently verified; a match does not establish compromise.",
+          "source_ids": [],
+          "source_urls": [],
+          "source_dates": []
+        }
+      ],
+      "source": [],
+      "roles": [
+        "search_candidate"
+      ],
+      "role": "search_candidate",
+      "description": "Public search candidate without published attribution in this inventory. Malicious attribution has not been independently verified; a match does not establish compromise.",
+      "matching": "exact",
+      "context_only": false
+    },
+    {
+      "id": "ioc-50fff1fb-6c39-5b8a-a596-308e3eaf6a1e",
+      "type": "ipv4",
+      "value": "144.126.221.237",
+      "status": "reference_only",
+      "provenance": "unattributed_public_indicator",
+      "source_ids": [],
+      "source_urls": [],
+      "observations": [
+        {
+          "status": "reference_only",
+          "original_status": "reference_only",
+          "role": "search_candidate",
+          "confidence": "low",
+          "description": "Public search candidate without published attribution in this inventory. Malicious attribution has not been independently verified; a match does not establish compromise.",
+          "source_ids": [],
+          "source_urls": [],
+          "source_dates": []
+        }
+      ],
+      "source": [],
+      "roles": [
+        "search_candidate"
+      ],
+      "role": "search_candidate",
+      "description": "Public search candidate without published attribution in this inventory. Malicious attribution has not been independently verified; a match does not establish compromise.",
+      "matching": "exact",
+      "context_only": false
+    },
+    {
+      "id": "ioc-3c6a1c17-8362-5c47-82d2-2d43e6daccef",
+      "type": "ipv4",
+      "value": "149.248.21.5",
+      "status": "reference_only",
+      "provenance": "unattributed_public_indicator",
+      "source_ids": [],
+      "source_urls": [],
+      "observations": [
+        {
+          "status": "reference_only",
+          "original_status": "reference_only",
+          "role": "search_candidate",
+          "confidence": "low",
+          "description": "Public search candidate without published attribution in this inventory. Malicious attribution has not been independently verified; a match does not establish compromise.",
+          "source_ids": [],
+          "source_urls": [],
+          "source_dates": []
+        }
+      ],
+      "source": [],
+      "roles": [
+        "search_candidate"
+      ],
+      "role": "search_candidate",
+      "description": "Public search candidate without published attribution in this inventory. Malicious attribution has not been independently verified; a match does not establish compromise.",
+      "matching": "exact",
+      "context_only": false
+    },
+    {
+      "id": "ioc-0dc83b54-5562-5446-9fec-5d2114810676",
+      "type": "ipv4",
+      "value": "149.28.121.199",
+      "status": "reference_only",
+      "provenance": "unattributed_public_indicator",
+      "source_ids": [],
+      "source_urls": [],
+      "observations": [
+        {
+          "status": "reference_only",
+          "original_status": "reference_only",
+          "role": "search_candidate",
+          "confidence": "low",
+          "description": "Public search candidate without published attribution in this inventory. Malicious attribution has not been independently verified; a match does not establish compromise.",
+          "source_ids": [],
+          "source_urls": [],
+          "source_dates": []
+        }
+      ],
+      "source": [],
+      "roles": [
+        "search_candidate"
+      ],
+      "role": "search_candidate",
+      "description": "Public search candidate without published attribution in this inventory. Malicious attribution has not been independently verified; a match does not establish compromise.",
+      "matching": "exact",
+      "context_only": false
+    },
+    {
+      "id": "ioc-6704dc2d-7a73-51bc-8d3b-feaba5d8ac8f",
+      "type": "ipv4",
+      "value": "172.98.178.104",
+      "status": "reference_only",
+      "provenance": "unattributed_public_indicator",
+      "source_ids": [],
+      "source_urls": [],
+      "observations": [
+        {
+          "status": "reference_only",
+          "original_status": "reference_only",
+          "role": "search_candidate",
+          "confidence": "low",
+          "description": "Public search candidate without published attribution in this inventory. Malicious attribution has not been independently verified; a match does not establish compromise.",
+          "source_ids": [],
+          "source_urls": [],
+          "source_dates": []
+        }
+      ],
+      "source": [],
+      "roles": [
+        "search_candidate"
+      ],
+      "role": "search_candidate",
+      "description": "Public search candidate without published attribution in this inventory. Malicious attribution has not been independently verified; a match does not establish compromise.",
+      "matching": "exact",
+      "context_only": false
+    },
+    {
+      "id": "ioc-60aac534-cde8-50b3-bb2d-798f451acb8d",
+      "type": "ipv4",
+      "value": "66.55.159.67",
+      "status": "reference_only",
+      "provenance": "unattributed_public_indicator",
+      "source_ids": [],
+      "source_urls": [],
+      "observations": [
+        {
+          "status": "reference_only",
+          "original_status": "reference_only",
+          "role": "search_candidate",
+          "confidence": "low",
+          "description": "Public search candidate without published attribution in this inventory. Malicious attribution has not been independently verified; a match does not establish compromise.",
+          "source_ids": [],
+          "source_urls": [],
+          "source_dates": []
+        }
+      ],
+      "source": [],
+      "roles": [
+        "search_candidate"
+      ],
+      "role": "search_candidate",
+      "description": "Public search candidate without published attribution in this inventory. Malicious attribution has not been independently verified; a match does not establish compromise.",
+      "matching": "exact",
+      "context_only": false
+    },
+    {
+      "id": "ioc-51b89e76-fb7a-5eae-9f05-06413d0e3db2",
+      "type": "ipv4",
+      "value": "88.218.105.254",
+      "status": "reference_only",
+      "provenance": "unattributed_public_indicator",
+      "source_ids": [],
+      "source_urls": [],
+      "observations": [
+        {
+          "status": "reference_only",
+          "original_status": "reference_only",
+          "role": "search_candidate",
+          "confidence": "low",
+          "description": "Public search candidate without published attribution in this inventory. Malicious attribution has not been independently verified; a match does not establish compromise.",
+          "source_ids": [],
+          "source_urls": [],
+          "source_dates": []
+        }
+      ],
+      "source": [],
+      "roles": [
+        "search_candidate"
+      ],
+      "role": "search_candidate",
+      "description": "Public search candidate without published attribution in this inventory. Malicious attribution has not been independently verified; a match does not establish compromise.",
+      "matching": "exact",
+      "context_only": false
+    },
     {
       "id": "ioc-41d198a3-3a03-5082-b7fb-8181df570fee",
       "type": "literal",
@@ -16556,6 +16759,267 @@
       "matching": "exact",
       "context_only": false
     },
+    {
+      "id": "ioc-6ac8fcee-0ae5-52e9-b3e0-e5b3b0f9313f",
+      "type": "sha256",
+      "value": "53f923284f286715df2c7993e4e65228d3f78d9c6594714be5c4da276b01ad15",
+      "status": "reference_only",
+      "provenance": "unattributed_public_indicator",
+      "source_ids": [],
+      "source_urls": [],
+      "observations": [
+        {
+          "status": "reference_only",
+          "original_status": "reference_only",
+          "role": "search_candidate",
+          "confidence": "low",
+          "description": "Public search candidate without published attribution in this inventory. Malicious attribution has not been independently verified; a match does not establish compromise.",
+          "source_ids": [],
+          "source_urls": [],
+          "source_dates": []
+        }
+      ],
+      "source": [],
+      "roles": [
+        "search_candidate"
+      ],
+      "role": "search_candidate",
+      "description": "Public search candidate without published attribution in this inventory. Malicious attribution has not been independently verified; a match does not establish compromise.",
+      "matching": "exact",
+      "context_only": false
+    },
+    {
+      "id": "ioc-a9d5f5c9-336e-5f2d-bfb5-db7b373a8a35",
+      "type": "sha256",
+      "value": "62f4c9972f86346585b1f1dc22c065769d5c8391f24aa9811819b30bf628c9f4",
+      "status": "reference_only",
+      "provenance": "unattributed_public_indicator",
+      "source_ids": [],
+      "source_urls": [],
+      "observations": [
+        {
+          "status": "reference_only",
+          "original_status": "reference_only",
+          "role": "search_candidate",
+          "confidence": "low",
+          "description": "Public search candidate without published attribution in this inventory. Malicious attribution has not been independently verified; a match does not establish compromise.",
+          "source_ids": [],
+          "source_urls": [],
+          "source_dates": []
+        }
+      ],
+      "source": [],
+      "roles": [
+        "search_candidate"
+      ],
+      "role": "search_candidate",
+      "description": "Public search candidate without published attribution in this inventory. Malicious attribution has not been independently verified; a match does not establish compromise.",
+      "matching": "exact",
+      "context_only": false
+    },
+    {
+      "id": "ioc-135b9d7d-6619-5cee-ba16-548196e71999",
+      "type": "sha256",
+      "value": "8115f306dfa15483cd990a36ee3acd19aff335a26a555c4e5113e99fc5e381a4",
+      "status": "reference_only",
+      "provenance": "unattributed_public_indicator",
+      "source_ids": [],
+      "source_urls": [],
+      "observations": [
+        {
+          "status": "reference_only",
+          "original_status": "reference_only",
+          "role": "search_candidate",
+          "confidence": "low",
+          "description": "Public search candidate without published attribution in this inventory. Malicious attribution has not been independently verified; a match does not establish compromise.",
+          "source_ids": [],
+          "source_urls": [],
+          "source_dates": []
+        }
+      ],
+      "source": [],
+      "roles": [
+        "search_candidate"
+      ],
+      "role": "search_candidate",
+      "description": "Public search candidate without published attribution in this inventory. Malicious attribution has not been independently verified; a match does not establish compromise.",
+      "matching": "exact",
+      "context_only": false
+    },
+    {
+      "id": "ioc-52059bbe-4c5d-5494-8b87-c91252d67c65",
+      "type": "sha256",
+      "value": "81b0bcf945c08ebfa9e10276bd19f554c62e42a458efaf2b91b416b0c9da829d",
+      "status": "reference_only",
+      "provenance": "unattributed_public_indicator",
+      "source_ids": [],
+      "source_urls": [],
+      "observations": [
+        {
+          "status": "reference_only",
+          "original_status": "reference_only",
+          "role": "search_candidate",
+          "confidence": "low",
+          "description": "Public search candidate without published attribution in this inventory. Malicious attribution has not been independently verified; a match does not establish compromise.",
+          "source_ids": [],
+          "source_urls": [],
+          "source_dates": []
+        }
+      ],
+      "source": [],
+      "roles": [
+        "search_candidate"
+      ],
+      "role": "search_candidate",
+      "description": "Public search candidate without published attribution in this inventory. Malicious attribution has not been independently verified; a match does not establish compromise.",
+      "matching": "exact",
+      "context_only": false
+    },
+    {
+      "id": "ioc-a9cb81f2-189f-56c5-9e51-e5dba0618386",
+      "type": "sha256",
+      "value": "ac7cc79df320df6d7a954d32fe1638dac5b12e134369becf7342869f98a98c81",
+      "status": "reference_only",
+      "provenance": "unattributed_public_indicator",
+      "source_ids": [],
+      "source_urls": [],
+      "observations": [
+        {
+          "status": "reference_only",
+          "original_status": "reference_only",
+          "role": "search_candidate",
+          "confidence": "low",
+          "description": "Public search candidate without published attribution in this inventory. Malicious attribution has not been independently verified; a match does not establish compromise.",
+          "source_ids": [],
+          "source_urls": [],
+          "source_dates": []
+        }
+      ],
+      "source": [],
+      "roles": [
+        "search_candidate"
+      ],
+      "role": "search_candidate",
+      "description": "Public search candidate without published attribution in this inventory. Malicious attribution has not been independently verified; a match does not establish compromise.",
+      "matching": "exact",
+      "context_only": false
+    },
+    {
+      "id": "ioc-9976f53c-b6bf-5aa7-bd36-40565777f617",
+      "type": "sha256",
+      "value": "b094bd5e34ed2bb96d289b8e26a1e0de1a87796f8047bb45a61dac03b47c617d",
+      "status": "reference_only",
+      "provenance": "unattributed_public_indicator",
+      "source_ids": [],
+      "source_urls": [],
+      "observations": [
+        {
+          "status": "reference_only",
+          "original_status": "reference_only",
+          "role": "search_candidate",
+          "confidence": "low",
+          "description": "Public search candidate without published attribution in this inventory. Malicious attribution has not been independently verified; a match does not establish compromise.",
+          "source_ids": [],
+          "source_urls": [],
+          "source_dates": []
+        }
+      ],
+      "source": [],
+      "roles": [
+        "search_candidate"
+      ],
+      "role": "search_candidate",
+      "description": "Public search candidate without published attribution in this inventory. Malicious attribution has not been independently verified; a match does not establish compromise.",
+      "matching": "exact",
+      "context_only": false
+    },
+    {
+      "id": "ioc-849554d4-80a5-51bf-933f-d597aa130138",
+      "type": "sha256",
+      "value": "e96049b559fc028d2dbbf5761d01124362957264fcd342f7133b055318480945",
+      "status": "reference_only",
+      "provenance": "unattributed_public_indicator",
+      "source_ids": [],
+      "source_urls": [],
+      "observations": [
+        {
+          "status": "reference_only",
+          "original_status": "reference_only",
+          "role": "search_candidate",
+          "confidence": "low",
+          "description": "Public search candidate without published attribution in this inventory. Malicious attribution has not been independently verified; a match does not establish compromise.",
+          "source_ids": [],
+          "source_urls": [],
+          "source_dates": []
+        }
+      ],
+      "source": [],
+      "roles": [
+        "search_candidate"
+      ],
+      "role": "search_candidate",
+      "description": "Public search candidate without published attribution in this inventory. Malicious attribution has not been independently verified; a match does not establish compromise.",
+      "matching": "exact",
+      "context_only": false
+    },
+    {
+      "id": "ioc-78aac967-820a-59f8-9dd7-99a5511de4e3",
+      "type": "sha256",
+      "value": "e9c3760e3afaa713710cf6d7669cbf2024ff81c3707ad8f141951812e22f8eb9",
+      "status": "reference_only",
+      "provenance": "unattributed_public_indicator",
+      "source_ids": [],
+      "source_urls": [],
+      "observations": [
+        {
+          "status": "reference_only",
+          "original_status": "reference_only",
+          "role": "search_candidate",
+          "confidence": "low",
+          "description": "Public search candidate without published attribution in this inventory. Malicious attribution has not been independently verified; a match does not establish compromise.",
+          "source_ids": [],
+          "source_urls": [],
+          "source_dates": []
+        }
+      ],
+      "source": [],
+      "roles": [
+        "search_candidate"
+      ],
+      "role": "search_candidate",
+      "description": "Public search candidate without published attribution in this inventory. Malicious attribution has not been independently verified; a match does not establish compromise.",
+      "matching": "exact",
+      "context_only": false
+    },
+    {
+      "id": "ioc-8b74a63c-e8d2-5f86-8fc0-b2d8b2a2a81d",
+      "type": "sha256",
+      "value": "ec894d6ac7d0e11dd4aae9e74e101490c8fcbf52afaf4b2a35f840086eaeee6b",
+      "status": "reference_only",
+      "provenance": "unattributed_public_indicator",
+      "source_ids": [],
+      "source_urls": [],
+      "observations": [
+        {
+          "status": "reference_only",
+          "original_status": "reference_only",
+          "role": "search_candidate",
+          "confidence": "low",
+          "description": "Public search candidate without published attribution in this inventory. Malicious attribution has not been independently verified; a match does not establish compromise.",
+          "source_ids": [],
+          "source_urls": [],
+          "source_dates": []
+        }
+      ],
+      "source": [],
+      "roles": [
+        "search_candidate"
+      ],
+      "role": "search_candidate",
+      "description": "Public search candidate without published attribution in this inventory. Malicious attribution has not been independently verified; a match does not establish compromise.",
+      "matching": "exact",
+      "context_only": false
+    },
     {
       "id": "ioc-ed202314-1f91-5a66-8c36-502623bdbfd3",
       "type": "url",
diff --git a/pyproject.toml b/pyproject.toml
index 9c74adf..9c0b33e 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "netscaler-triage"
-version = "1.0.2"
+version = "1.0.3"
 description = "Offline NetScaler evidence analysis with inspectable decoding and provenance"
 readme = "README.md"
 license = "MIT"
diff --git a/src/netscaler_triage/__init__.py b/src/netscaler_triage/__init__.py
index 136c207..4253006 100644
--- a/src/netscaler_triage/__init__.py
+++ b/src/netscaler_triage/__init__.py
@@ -1,3 +1,3 @@
 """Offline analysis; no discovered payload is ever executed."""
 
-__version__ = "1.0.2"
+__version__ = "1.0.3"
diff --git a/src/netscaler_triage/data/public_sigma.yml b/src/netscaler_triage/data/public_sigma.yml
index 37faf69..516a9c9 100644
--- a/src/netscaler_triage/data/public_sigma.yml
+++ b/src/netscaler_triage/data/public_sigma.yml
@@ -1807,7 +1807,7 @@ logsource:
   product: netscaler
 detection:
   selection:
-    raw|re: (?<![\w.])(?:101\.99\.91\.107|104\.203\.50\.26|104\.248\.244\.66|104\.248\.74\.206|104\.28\.215\.136|104\.28\.215\.137|104\.28\.247\.136|104\.28\.247\.137|113\.137\.102\.68|120\.28\.233\.211|125\.122\.56\.47|130\.94\.106\.141|130\.94\.42\.226|134\.175\.71\.50|137\.184\.91\.207|137\.220\.53\.135|138\.199\.200\.90|138\.28\.234\.38|138\.68\.21\.29|139\.180\.152\.138|142\.93\.205\.229|142\.93\.85\.227|143\.198\.7\.94|144\.172\.108\.78|149\.104\.78\.141|149\.104\.78\.208|149\.28\.29\.221|149\.28\.58\.71|153\.75\.82\.220|154\.217\.251\.226|157\.254\.167\.12|158\.94\.209\.12|159\.26\.103\.184|159\.65\.104\.231|162\.243\.36\.88|162\.33\.178\.9|165\.227\.201\.112|167\.99\.111\.203|170\.64\.176\.26|171\.106\.10\.118|172\.247\.44\.85|173\.231\.39\.244|173\.40\.135\.209|176\.65\.148\.54|177\.4\.12\.11|178\.218\.40\.232|178\.66\.43\.241|180\.242\.113\.168|182\.101\.54\.57|185\.156\.46\.162|185\.170\.55\.89|185\.209\.15\.246|185\.243\.41\.247|191\.37\.30\.194|193\.149\.176\.207|194\.242\.130\.193|194\.26\.29\.88|194\.28\.195\.90|194\.36\.37\.5|197\.52\.9\.138|198\.13\.159\.233|206\.232\.71\.215|209\.250\.236\.77|216\.203\.21\.233|216\.245\.184\.164|23\.132\.164\.35|23\.234\.111\.22|23\.234\.74\.48|23\.27\.143\.20|31\.13\.192\.160|31\.56\.197\.72|34\.90\.151\.231|37\.19\.221\.171|38\.60\.245\.99|4\.246\.63\.96|44\.226\.128\.41|44\.252\.255\.141|45\.141\.21\.130|45\.143\.167\.96|45\.249\.89\.172|45\.61\.136\.143|45\.76\.34\.141|46\.150\.68\.55|47\.230\.224\.154|47\.239\.205\.29|47\.243\.125\.255|47\.76\.102\.1|47\.76\.132\.65|47\.76\.63\.52|47\.76\.92\.109|49\.36\.107\.103|5\.188\.206\.226|54\.70\.59\.128|58\.187\.56\.89|62\.133\.62\.80|64\.177\.93\.71|64\.225\.103\.14|64\.94\.85\.67|66\.135\.19\.18|66\.227\.183\.84|68\.178\.160\.183|68\.46\.140\.222|70\.172\.58\.168|72\.73\.231\.73|73\.43\.85\.7|77\.83\.199\.39|78\.128\.113\.10|78\.135\.96\.136|78\.47\.24\.217|8\.210\.119\.74|8\.210\.67\.91|8\.217\.173\.25|8\.218\.219\.56|80\.240\.22\.229|82\.167\.14\.7|82\.24\.212\.15|84\.55\.67\.133|85\.117\.117\.248|85\.203\.46\.191|85\.221\.203\.85|87\.224\.84\.82|88\.119\.169\.150|88\.180\.103\.22|89\.36\.231\.206|89\.44\.80\.7|91\.107\.190\.236|91\.195\.240\.123|92\.118\.204\.229|93\.177\.60\.233|94\.190\.77\.195|95\.229\.84\.239|95\.63\.246\.50)(?![\w.])
+    raw|re: (?:(?<![\w.])(?:101\.99\.91\.107|104\.203\.50\.26|104\.248\.244\.66|104\.248\.74\.206|104\.28\.215\.136|104\.28\.215\.137|104\.28\.247\.136|104\.28\.247\.137|113\.137\.102\.68|120\.28\.233\.211|125\.122\.56\.47|130\.94\.106\.141|130\.94\.42\.226|134\.175\.71\.50|137\.184\.91\.207|137\.220\.53\.135|138\.199\.200\.90|138\.28\.234\.38|138\.68\.21\.29|139\.180\.152\.138|142\.93\.205\.229|142\.93\.85\.227|143\.198\.7\.94|144\.172\.108\.78|149\.104\.78\.141|149\.104\.78\.208|149\.28\.29\.221|149\.28\.58\.71|153\.75\.82\.220|154\.217\.251\.226|157\.254\.167\.12|158\.94\.209\.12|159\.26\.103\.184|159\.65\.104\.231|162\.243\.36\.88|162\.33\.178\.9|165\.227\.201\.112|167\.99\.111\.203|170\.64\.176\.26|171\.106\.10\.118|172\.247\.44\.85|173\.231\.39\.244|173\.40\.135\.209|176\.65\.148\.54|177\.4\.12\.11|178\.218\.40\.232|178\.66\.43\.241|180\.242\.113\.168|182\.101\.54\.57|185\.156\.46\.162|185\.170\.55\.89|185\.209\.15\.246|185\.243\.41\.247|191\.37\.30\.194|193\.149\.176\.207|194\.242\.130\.193|194\.26\.29\.88|194\.28\.195\.90|194\.36\.37\.5|197\.52\.9\.138|198\.13\.159\.233|206\.232\.71\.215|209\.250\.236\.77|216\.203\.21\.233|216\.245\.184\.164|23\.132\.164\.35|23\.234\.111\.22|23\.234\.74\.48|23\.27\.143\.20|31\.13\.192\.160|31\.56\.197\.72|34\.90\.151\.231|37\.19\.221\.171|38\.60\.245\.99|4\.246\.63\.96|44\.226\.128\.41|44\.252\.255\.141|45\.141\.21\.130|45\.143\.167\.96|45\.249\.89\.172|45\.61\.136\.143|45\.76\.34\.141|46\.150\.68\.55|47\.230\.224\.154|47\.239\.205\.29|47\.243\.125\.255|47\.76\.102\.1|47\.76\.132\.65|47\.76\.63\.52|47\.76\.92\.109|49\.36\.107\.103|5\.188\.206\.226|54\.70\.59\.128|58\.187\.56\.89|62\.133\.62\.80|64\.177\.93\.71|64\.225\.103\.14|64\.94\.85\.67|66\.135\.19\.18|66\.227\.183\.84|68\.178\.160\.183|68\.46\.140\.222|70\.172\.58\.168|72\.73\.231\.73|73\.43\.85\.7|77\.83\.199\.39|78\.128\.113\.10|78\.135\.96\.136|78\.47\.24\.217|8\.210\.119\.74|8\.210\.67\.91|8\.217\.173\.25|8\.218\.219\.56|80\.240\.22\.229|82\.167\.14\.7|82\.24\.212\.15|84\.55\.67\.133|85\.117\.117\.248|85\.203\.46\.191|85\.221\.203\.85|87\.224\.84\.82|88\.119\.169\.150|88\.180\.103\.22|89\.36\.231\.206|89\.44\.80\.7|91\.107\.190\.236|91\.195\.240\.123|92\.118\.204\.229|93\.177\.60\.233|94\.190\.77\.195|95\.229\.84\.239|95\.63\.246\.50)(?![\w.])|(?i:(?<![\w.])(?:107\.172\.221\.57|144\.126\.221\.237|149\.248\.21\.5|149\.28\.121\.199|172\.98\.178\.104|66\.55\.159\.67|88\.218\.105\.254)(?![\w.])))
   condition: selection
 falsepositives:
 - Authorized testing, shared infrastructure, legitimate references, and quoted threat intelligence.
@@ -8080,6 +8080,181 @@ indicators:
     A match does not establish compromise.
   matching: exact
   context_only: false
+- id: ioc-9ec7945d-865e-596c-a7f4-0a6da1c81f0a
+  type: ipv4
+  value: 107.172.221.57
+  status: reference_only
+  provenance: unattributed_public_indicator
+  source_ids: []
+  source_urls: []
+  observations:
+  - status: reference_only
+    original_status: reference_only
+    role: search_candidate
+    confidence: low
+    description: Public search candidate without published attribution in this inventory. Malicious attribution
+      has not been independently verified; a match does not establish compromise.
+    source_ids: []
+    source_urls: []
+    source_dates: []
+  source: []
+  roles:
+  - search_candidate
+  role: search_candidate
+  description: Public search candidate without published attribution in this inventory. Malicious attribution has
+    not been independently verified; a match does not establish compromise.
+  matching: exact
+  context_only: false
+- id: ioc-50fff1fb-6c39-5b8a-a596-308e3eaf6a1e
+  type: ipv4
+  value: 144.126.221.237
+  status: reference_only
+  provenance: unattributed_public_indicator
+  source_ids: []
+  source_urls: []
+  observations:
+  - status: reference_only
+    original_status: reference_only
+    role: search_candidate
+    confidence: low
+    description: Public search candidate without published attribution in this inventory. Malicious attribution
+      has not been independently verified; a match does not establish compromise.
+    source_ids: []
+    source_urls: []
+    source_dates: []
+  source: []
+  roles:
+  - search_candidate
+  role: search_candidate
+  description: Public search candidate without published attribution in this inventory. Malicious attribution has
+    not been independently verified; a match does not establish compromise.
+  matching: exact
+  context_only: false
+- id: ioc-3c6a1c17-8362-5c47-82d2-2d43e6daccef
+  type: ipv4
+  value: 149.248.21.5
+  status: reference_only
+  provenance: unattributed_public_indicator
+  source_ids: []
+  source_urls: []
+  observations:
+  - status: reference_only
+    original_status: reference_only
+    role: search_candidate
+    confidence: low
+    description: Public search candidate without published attribution in this inventory. Malicious attribution
+      has not been independently verified; a match does not establish compromise.
+    source_ids: []
+    source_urls: []
+    source_dates: []
+  source: []
+  roles:
+  - search_candidate
+  role: search_candidate
+  description: Public search candidate without published attribution in this inventory. Malicious attribution has
+    not been independently verified; a match does not establish compromise.
+  matching: exact
+  context_only: false
+- id: ioc-0dc83b54-5562-5446-9fec-5d2114810676
+  type: ipv4
+  value: 149.28.121.199
+  status: reference_only
+  provenance: unattributed_public_indicator
+  source_ids: []
+  source_urls: []
+  observations:
+  - status: reference_only
+    original_status: reference_only
+    role: search_candidate
+    confidence: low
+    description: Public search candidate without published attribution in this inventory. Malicious attribution
+      has not been independently verified; a match does not establish compromise.
+    source_ids: []
+    source_urls: []
+    source_dates: []
+  source: []
+  roles:
+  - search_candidate
+  role: search_candidate
+  description: Public search candidate without published attribution in this inventory. Malicious attribution has
+    not been independently verified; a match does not establish compromise.
+  matching: exact
+  context_only: false
+- id: ioc-6704dc2d-7a73-51bc-8d3b-feaba5d8ac8f
+  type: ipv4
+  value: 172.98.178.104
+  status: reference_only
+  provenance: unattributed_public_indicator
+  source_ids: []
+  source_urls: []
+  observations:
+  - status: reference_only
+    original_status: reference_only
+    role: search_candidate
+    confidence: low
+    description: Public search candidate without published attribution in this inventory. Malicious attribution
+      has not been independently verified; a match does not establish compromise.
+    source_ids: []
+    source_urls: []
+    source_dates: []
+  source: []
+  roles:
+  - search_candidate
+  role: search_candidate
+  description: Public search candidate without published attribution in this inventory. Malicious attribution has
+    not been independently verified; a match does not establish compromise.
+  matching: exact
+  context_only: false
+- id: ioc-60aac534-cde8-50b3-bb2d-798f451acb8d
+  type: ipv4
+  value: 66.55.159.67
+  status: reference_only
+  provenance: unattributed_public_indicator
+  source_ids: []
+  source_urls: []
+  observations:
+  - status: reference_only
+    original_status: reference_only
+    role: search_candidate
+    confidence: low
+    description: Public search candidate without published attribution in this inventory. Malicious attribution
+      has not been independently verified; a match does not establish compromise.
+    source_ids: []
+    source_urls: []
+    source_dates: []
+  source: []
+  roles:
+  - search_candidate
+  role: search_candidate
+  description: Public search candidate without published attribution in this inventory. Malicious attribution has
+    not been independently verified; a match does not establish compromise.
+  matching: exact
+  context_only: false
+- id: ioc-51b89e76-fb7a-5eae-9f05-06413d0e3db2
+  type: ipv4
+  value: 88.218.105.254
+  status: reference_only
+  provenance: unattributed_public_indicator
+  source_ids: []
+  source_urls: []
+  observations:
+  - status: reference_only
+    original_status: reference_only
+    role: search_candidate
+    confidence: low
+    description: Public search candidate without published attribution in this inventory. Malicious attribution
+      has not been independently verified; a match does not establish compromise.
+    source_ids: []
+    source_urls: []
+    source_dates: []
+  source: []
+  roles:
+  - search_candidate
+  role: search_candidate
+  description: Public search candidate without published attribution in this inventory. Malicious attribution has
+    not been independently verified; a match does not establish compromise.
+  matching: exact
+  context_only: false
 ---
 title: NetScaler Public Reference LITERAL Indicators
 id: ab2dc47b-3926-5b50-ac61-83185ae90fac
@@ -11385,7 +11560,7 @@ logsource:
   product: netscaler
 detection:
   selection:
-    raw|re: "(?:(?i:(?<![\\w])1bd314b661396c7086f6367fbbb48025e03ca2de69c073d53a8b0a38aa5fbb7d(?![\\w]))|(?i:(?<![\\w])57f9f30c50240fd48d761de7961a430cdebf2c084a36bc76d376a1ce8e6dfa9d(?![\\w]))|(?i:(?<![\\w])5ea5ea61e9062822bee3f66ef5ff47c217178d9e31936ad6daf10c5dfae44d12(?![\\w]))|(?i:(?<![\\w])6f5a2a452a7901323abd21879c6cecccb47c06aeeaccb1b467212f3b11e4b1e7(?![\\w]))|(?i:(?<![\\w])73b74309f4728d169cc9edfb2767c5aadd75d39b62de93c935a86c777d2646bc(?![\\w]))|(?i:(?<![\\w])79c65fa04541032e251fa4796b97800374b63c7982593dd1a2e0db605d429186(?![\\w]))|(?i:(?<![\\w])7add390ceee4a1373211b3e340451b34f08965fc4d805f94c9b8cebdc0775774(?![\\w]))|(?i:(?<![\\w])927c7fbef2e620c1ce482c3ed67ebf53da97693c1d6c7552c77aec84ba982cf8(?![\\w]))|(?i:(?<![\\w])974b69782fdf5d67b97cfd508465939e44ee10798dbcc1e82b92d78776bad938(?![\\w]))|(?i:(?<![\\w])9c7bf01d2c2cb31a3609d27c1bc9abc60d86e37b7f9908547e0c75fb18b99aab(?![\\w]))|(?i:(?<![\\w])ae22ef2517b5c0fb47f78745b9cb5260acee0e751b89bcd354640ff8bc8d29ec(?![\\w]))|(?i:(?<![\\w])e9fe43968c6c0955300e3bc4d7fb0b05a18570b4733aaf4f5c6f7f09be5a242c(?![\\w]))|(?i:(?<![\\w])ed082f744f035035900f67edf438f2f7d0528ac501234f63d476d65273cdb9a1(?![\\w])))"
+    raw|re: (?:(?:(?i:(?<![\w])1bd314b661396c7086f6367fbbb48025e03ca2de69c073d53a8b0a38aa5fbb7d(?![\w]))|(?i:(?<![\w])57f9f30c50240fd48d761de7961a430cdebf2c084a36bc76d376a1ce8e6dfa9d(?![\w]))|(?i:(?<![\w])5ea5ea61e9062822bee3f66ef5ff47c217178d9e31936ad6daf10c5dfae44d12(?![\w]))|(?i:(?<![\w])6f5a2a452a7901323abd21879c6cecccb47c06aeeaccb1b467212f3b11e4b1e7(?![\w]))|(?i:(?<![\w])73b74309f4728d169cc9edfb2767c5aadd75d39b62de93c935a86c777d2646bc(?![\w]))|(?i:(?<![\w])79c65fa04541032e251fa4796b97800374b63c7982593dd1a2e0db605d429186(?![\w]))|(?i:(?<![\w])7add390ceee4a1373211b3e340451b34f08965fc4d805f94c9b8cebdc0775774(?![\w]))|(?i:(?<![\w])927c7fbef2e620c1ce482c3ed67ebf53da97693c1d6c7552c77aec84ba982cf8(?![\w]))|(?i:(?<![\w])974b69782fdf5d67b97cfd508465939e44ee10798dbcc1e82b92d78776bad938(?![\w]))|(?i:(?<![\w])9c7bf01d2c2cb31a3609d27c1bc9abc60d86e37b7f9908547e0c75fb18b99aab(?![\w]))|(?i:(?<![\w])ae22ef2517b5c0fb47f78745b9cb5260acee0e751b89bcd354640ff8bc8d29ec(?![\w]))|(?i:(?<![\w])e9fe43968c6c0955300e3bc4d7fb0b05a18570b4733aaf4f5c6f7f09be5a242c(?![\w]))|(?i:(?<![\w])ed082f744f035035900f67edf438f2f7d0528ac501234f63d476d65273cdb9a1(?![\w])))|(?i:(?<![\w])(?:53f923284f286715df2c7993e4e65228d3f78d9c6594714be5c4da276b01ad15|62f4c9972f86346585b1f1dc22c065769d5c8391f24aa9811819b30bf628c9f4|8115f306dfa15483cd990a36ee3acd19aff335a26a555c4e5113e99fc5e381a4|81b0bcf945c08ebfa9e10276bd19f554c62e42a458efaf2b91b416b0c9da829d|ac7cc79df320df6d7a954d32fe1638dac5b12e134369becf7342869f98a98c81|b094bd5e34ed2bb96d289b8e26a1e0de1a87796f8047bb45a61dac03b47c617d|e96049b559fc028d2dbbf5761d01124362957264fcd342f7133b055318480945|e9c3760e3afaa713710cf6d7669cbf2024ff81c3707ad8f141951812e22f8eb9|ec894d6ac7d0e11dd4aae9e74e101490c8fcbf52afaf4b2a35f840086eaeee6b)(?![\w])))
   condition: selection or hash
   hash:
     SHA256:
@@ -11402,6 +11577,15 @@ detection:
     - ae22ef2517b5c0fb47f78745b9cb5260acee0e751b89bcd354640ff8bc8d29ec
     - e9fe43968c6c0955300e3bc4d7fb0b05a18570b4733aaf4f5c6f7f09be5a242c
     - ed082f744f035035900f67edf438f2f7d0528ac501234f63d476d65273cdb9a1
+    - 53f923284f286715df2c7993e4e65228d3f78d9c6594714be5c4da276b01ad15
+    - 62f4c9972f86346585b1f1dc22c065769d5c8391f24aa9811819b30bf628c9f4
+    - 8115f306dfa15483cd990a36ee3acd19aff335a26a555c4e5113e99fc5e381a4
+    - 81b0bcf945c08ebfa9e10276bd19f554c62e42a458efaf2b91b416b0c9da829d
+    - ac7cc79df320df6d7a954d32fe1638dac5b12e134369becf7342869f98a98c81
+    - b094bd5e34ed2bb96d289b8e26a1e0de1a87796f8047bb45a61dac03b47c617d
+    - e96049b559fc028d2dbbf5761d01124362957264fcd342f7133b055318480945
+    - e9c3760e3afaa713710cf6d7669cbf2024ff81c3707ad8f141951812e22f8eb9
+    - ec894d6ac7d0e11dd4aae9e74e101490c8fcbf52afaf4b2a35f840086eaeee6b
 falsepositives:
 - Authorized testing, shared infrastructure, legitimate references, and quoted threat intelligence.
 level: low
@@ -12366,6 +12550,231 @@ indicators:
     A match does not establish compromise.
   matching: exact
   context_only: false
+- id: ioc-6ac8fcee-0ae5-52e9-b3e0-e5b3b0f9313f
+  type: sha256
+  value: 53f923284f286715df2c7993e4e65228d3f78d9c6594714be5c4da276b01ad15
+  status: reference_only
+  provenance: unattributed_public_indicator
+  source_ids: []
+  source_urls: []
+  observations:
+  - status: reference_only
+    original_status: reference_only
+    role: search_candidate
+    confidence: low
+    description: Public search candidate without published attribution in this inventory. Malicious attribution
+      has not been independently verified; a match does not establish compromise.
+    source_ids: []
+    source_urls: []
+    source_dates: []
+  source: []
+  roles:
+  - search_candidate
+  role: search_candidate
+  description: Public search candidate without published attribution in this inventory. Malicious attribution has
+    not been independently verified; a match does not establish compromise.
+  matching: exact
+  context_only: false
+- id: ioc-a9d5f5c9-336e-5f2d-bfb5-db7b373a8a35
+  type: sha256
+  value: 62f4c9972f86346585b1f1dc22c065769d5c8391f24aa9811819b30bf628c9f4
+  status: reference_only
+  provenance: unattributed_public_indicator
+  source_ids: []
+  source_urls: []
+  observations:
+  - status: reference_only
+    original_status: reference_only
+    role: search_candidate
+    confidence: low
+    description: Public search candidate without published attribution in this inventory. Malicious attribution
+      has not been independently verified; a match does not establish compromise.
+    source_ids: []
+    source_urls: []
+    source_dates: []
+  source: []
+  roles:
+  - search_candidate
+  role: search_candidate
+  description: Public search candidate without published attribution in this inventory. Malicious attribution has
+    not been independently verified; a match does not establish compromise.
+  matching: exact
+  context_only: false
+- id: ioc-135b9d7d-6619-5cee-ba16-548196e71999
+  type: sha256
+  value: 8115f306dfa15483cd990a36ee3acd19aff335a26a555c4e5113e99fc5e381a4
+  status: reference_only
+  provenance: unattributed_public_indicator
+  source_ids: []
+  source_urls: []
+  observations:
+  - status: reference_only
+    original_status: reference_only
+    role: search_candidate
+    confidence: low
+    description: Public search candidate without published attribution in this inventory. Malicious attribution
+      has not been independently verified; a match does not establish compromise.
+    source_ids: []
+    source_urls: []
+    source_dates: []
+  source: []
+  roles:
+  - search_candidate
+  role: search_candidate
+  description: Public search candidate without published attribution in this inventory. Malicious attribution has
+    not been independently verified; a match does not establish compromise.
+  matching: exact
+  context_only: false
+- id: ioc-52059bbe-4c5d-5494-8b87-c91252d67c65
+  type: sha256
+  value: 81b0bcf945c08ebfa9e10276bd19f554c62e42a458efaf2b91b416b0c9da829d
+  status: reference_only
+  provenance: unattributed_public_indicator
+  source_ids: []
+  source_urls: []
+  observations:
+  - status: reference_only
+    original_status: reference_only
+    role: search_candidate
+    confidence: low
+    description: Public search candidate without published attribution in this inventory. Malicious attribution
+      has not been independently verified; a match does not establish compromise.
+    source_ids: []
+    source_urls: []
+    source_dates: []
+  source: []
+  roles:
+  - search_candidate
+  role: search_candidate
+  description: Public search candidate without published attribution in this inventory. Malicious attribution has
+    not been independently verified; a match does not establish compromise.
+  matching: exact
+  context_only: false
+- id: ioc-a9cb81f2-189f-56c5-9e51-e5dba0618386
+  type: sha256
+  value: ac7cc79df320df6d7a954d32fe1638dac5b12e134369becf7342869f98a98c81
+  status: reference_only
+  provenance: unattributed_public_indicator
+  source_ids: []
+  source_urls: []
+  observations:
+  - status: reference_only
+    original_status: reference_only
+    role: search_candidate
+    confidence: low
+    description: Public search candidate without published attribution in this inventory. Malicious attribution
+      has not been independently verified; a match does not establish compromise.
+    source_ids: []
+    source_urls: []
+    source_dates: []
+  source: []
+  roles:
+  - search_candidate
+  role: search_candidate
+  description: Public search candidate without published attribution in this inventory. Malicious attribution has
+    not been independently verified; a match does not establish compromise.
+  matching: exact
+  context_only: false
+- id: ioc-9976f53c-b6bf-5aa7-bd36-40565777f617
+  type: sha256
+  value: b094bd5e34ed2bb96d289b8e26a1e0de1a87796f8047bb45a61dac03b47c617d
+  status: reference_only
+  provenance: unattributed_public_indicator
+  source_ids: []
+  source_urls: []
+  observations:
+  - status: reference_only
+    original_status: reference_only
+    role: search_candidate
+    confidence: low
+    description: Public search candidate without published attribution in this inventory. Malicious attribution
+      has not been independently verified; a match does not establish compromise.
+    source_ids: []
+    source_urls: []
+    source_dates: []
+  source: []
+  roles:
+  - search_candidate
+  role: search_candidate
+  description: Public search candidate without published attribution in this inventory. Malicious attribution has
+    not been independently verified; a match does not establish compromise.
+  matching: exact
+  context_only: false
+- id: ioc-849554d4-80a5-51bf-933f-d597aa130138
+  type: sha256
+  value: e96049b559fc028d2dbbf5761d01124362957264fcd342f7133b055318480945
+  status: reference_only
+  provenance: unattributed_public_indicator
+  source_ids: []
+  source_urls: []
+  observations:
+  - status: reference_only
+    original_status: reference_only
+    role: search_candidate
+    confidence: low
+    description: Public search candidate without published attribution in this inventory. Malicious attribution
+      has not been independently verified; a match does not establish compromise.
+    source_ids: []
+    source_urls: []
+    source_dates: []
+  source: []
+  roles:
+  - search_candidate
+  role: search_candidate
+  description: Public search candidate without published attribution in this inventory. Malicious attribution has
+    not been independently verified; a match does not establish compromise.
+  matching: exact
+  context_only: false
+- id: ioc-78aac967-820a-59f8-9dd7-99a5511de4e3
+  type: sha256
+  value: e9c3760e3afaa713710cf6d7669cbf2024ff81c3707ad8f141951812e22f8eb9
+  status: reference_only
+  provenance: unattributed_public_indicator
+  source_ids: []
+  source_urls: []
+  observations:
+  - status: reference_only
+    original_status: reference_only
+    role: search_candidate
+    confidence: low
+    description: Public search candidate without published attribution in this inventory. Malicious attribution
+      has not been independently verified; a match does not establish compromise.
+    source_ids: []
+    source_urls: []
+    source_dates: []
+  source: []
+  roles:
+  - search_candidate
+  role: search_candidate
+  description: Public search candidate without published attribution in this inventory. Malicious attribution has
+    not been independently verified; a match does not establish compromise.
+  matching: exact
+  context_only: false
+- id: ioc-8b74a63c-e8d2-5f86-8fc0-b2d8b2a2a81d
+  type: sha256
+  value: ec894d6ac7d0e11dd4aae9e74e101490c8fcbf52afaf4b2a35f840086eaeee6b
+  status: reference_only
+  provenance: unattributed_public_indicator
+  source_ids: []
+  source_urls: []
+  observations:
+  - status: reference_only
+    original_status: reference_only
+    role: search_candidate
+    confidence: low
+    description: Public search candidate without published attribution in this inventory. Malicious attribution
+      has not been independently verified; a match does not establish compromise.
+    source_ids: []
+    source_urls: []
+    source_dates: []
+  source: []
+  roles:
+  - search_candidate
+  role: search_candidate
+  description: Public search candidate without published attribution in this inventory. Malicious attribution has
+    not been independently verified; a match does not establish compromise.
+  matching: exact
+  context_only: false
 ---
 title: NetScaler Public Reference URL Indicators
 id: d19912af-166e-5f23-a191-f072117d1057
diff --git a/src/netscaler_triage/data/threat_intel.json b/src/netscaler_triage/data/threat_intel.json
index 53c39f8..4b32562 100644
--- a/src/netscaler_triage/data/threat_intel.json
+++ b/src/netscaler_triage/data/threat_intel.json
@@ -1,6 +1,6 @@
 {
   "schema_version": 2,
-  "updated": "2026-10-01",
+  "updated": "2026-10-05",
   "sources": [
     {
       "id": "cisa-direct",
@@ -10798,6 +10798,209 @@
       "matching": "exact",
       "context_only": false
     },
+    {
+      "id": "ioc-9ec7945d-865e-596c-a7f4-0a6da1c81f0a",
+      "type": "ipv4",
+      "value": "107.172.221.57",
+      "status": "reference_only",
+      "provenance": "unattributed_public_indicator",
+      "source_ids": [],
+      "source_urls": [],
+      "observations": [
+        {
+          "status": "reference_only",
+          "original_status": "reference_only",
+          "role": "search_candidate",
+          "confidence": "low",
+          "description": "Public search candidate without published attribution in this inventory. Malicious attribution has not been independently verified; a match does not establish compromise.",
+          "source_ids": [],
+          "source_urls": [],
+          "source_dates": []
+        }
+      ],
+      "source": [],
+      "roles": [
+        "search_candidate"
+      ],
+      "role": "search_candidate",
+      "description": "Public search candidate without published attribution in this inventory. Malicious attribution has not been independently verified; a match does not establish compromise.",
+      "matching": "exact",
+      "context_only": false
+    },
+    {
+      "id": "ioc-50fff1fb-6c39-5b8a-a596-308e3eaf6a1e",
+      "type": "ipv4",
+      "value": "144.126.221.237",
+      "status": "reference_only",
+      "provenance": "unattributed_public_indicator",
+      "source_ids": [],
+      "source_urls": [],
+      "observations": [
+        {
+          "status": "reference_only",
+          "original_status": "reference_only",
+          "role": "search_candidate",
+          "confidence": "low",
+          "description": "Public search candidate without published attribution in this inventory. Malicious attribution has not been independently verified; a match does not establish compromise.",
+          "source_ids": [],
+          "source_urls": [],
+          "source_dates": []
+        }
+      ],
+      "source": [],
+      "roles": [
+        "search_candidate"
+      ],
+      "role": "search_candidate",
+      "description": "Public search candidate without published attribution in this inventory. Malicious attribution has not been independently verified; a match does not establish compromise.",
+      "matching": "exact",
+      "context_only": false
+    },
+    {
+      "id": "ioc-3c6a1c17-8362-5c47-82d2-2d43e6daccef",
+      "type": "ipv4",
+      "value": "149.248.21.5",
+      "status": "reference_only",
+      "provenance": "unattributed_public_indicator",
+      "source_ids": [],
+      "source_urls": [],
+      "observations": [
+        {
+          "status": "reference_only",
+          "original_status": "reference_only",
+          "role": "search_candidate",
+          "confidence": "low",
+          "description": "Public search candidate without published attribution in this inventory. Malicious attribution has not been independently verified; a match does not establish compromise.",
+          "source_ids": [],
+          "source_urls": [],
+          "source_dates": []
+        }
+      ],
+      "source": [],
+      "roles": [
+        "search_candidate"
+      ],
+      "role": "search_candidate",
+      "description": "Public search candidate without published attribution in this inventory. Malicious attribution has not been independently verified; a match does not establish compromise.",
+      "matching": "exact",
+      "context_only": false
+    },
+    {
+      "id": "ioc-0dc83b54-5562-5446-9fec-5d2114810676",
+      "type": "ipv4",
+      "value": "149.28.121.199",
+      "status": "reference_only",
+      "provenance": "unattributed_public_indicator",
+      "source_ids": [],
+      "source_urls": [],
+      "observations": [
+        {
+          "status": "reference_only",
+          "original_status": "reference_only",
+          "role": "search_candidate",
+          "confidence": "low",
+          "description": "Public search candidate without published attribution in this inventory. Malicious attribution has not been independently verified; a match does not establish compromise.",
+          "source_ids": [],
+          "source_urls": [],
+          "source_dates": []
+        }
+      ],
+      "source": [],
+      "roles": [
+        "search_candidate"
+      ],
+      "role": "search_candidate",
+      "description": "Public search candidate without published attribution in this inventory. Malicious attribution has not been independently verified; a match does not establish compromise.",
+      "matching": "exact",
+      "context_only": false
+    },
+    {
+      "id": "ioc-6704dc2d-7a73-51bc-8d3b-feaba5d8ac8f",
+      "type": "ipv4",
+      "value": "172.98.178.104",
+      "status": "reference_only",
+      "provenance": "unattributed_public_indicator",
+      "source_ids": [],
+      "source_urls": [],
+      "observations": [
+        {
+          "status": "reference_only",
+          "original_status": "reference_only",
+          "role": "search_candidate",
+          "confidence": "low",
+          "description": "Public search candidate without published attribution in this inventory. Malicious attribution has not been independently verified; a match does not establish compromise.",
+          "source_ids": [],
+          "source_urls": [],
+          "source_dates": []
+        }
+      ],
+      "source": [],
+      "roles": [
+        "search_candidate"
+      ],
+      "role": "search_candidate",
+      "description": "Public search candidate without published attribution in this inventory. Malicious attribution has not been independently verified; a match does not establish compromise.",
+      "matching": "exact",
+      "context_only": false
+    },
+    {
+      "id": "ioc-60aac534-cde8-50b3-bb2d-798f451acb8d",
+      "type": "ipv4",
+      "value": "66.55.159.67",
+      "status": "reference_only",
+      "provenance": "unattributed_public_indicator",
+      "source_ids": [],
+      "source_urls": [],
+      "observations": [
+        {
+          "status": "reference_only",
+          "original_status": "reference_only",
+          "role": "search_candidate",
+          "confidence": "low",
+          "description": "Public search candidate without published attribution in this inventory. Malicious attribution has not been independently verified; a match does not establish compromise.",
+          "source_ids": [],
+          "source_urls": [],
+          "source_dates": []
+        }
+      ],
+      "source": [],
+      "roles": [
+        "search_candidate"
+      ],
+      "role": "search_candidate",
+      "description": "Public search candidate without published attribution in this inventory. Malicious attribution has not been independently verified; a match does not establish compromise.",
+      "matching": "exact",
+      "context_only": false
+    },
+    {
+      "id": "ioc-51b89e76-fb7a-5eae-9f05-06413d0e3db2",
+      "type": "ipv4",
+      "value": "88.218.105.254",
+      "status": "reference_only",
+      "provenance": "unattributed_public_indicator",
+      "source_ids": [],
+      "source_urls": [],
+      "observations": [
+        {
+          "status": "reference_only",
+          "original_status": "reference_only",
+          "role": "search_candidate",
+          "confidence": "low",
+          "description": "Public search candidate without published attribution in this inventory. Malicious attribution has not been independently verified; a match does not establish compromise.",
+          "source_ids": [],
+          "source_urls": [],
+          "source_dates": []
+        }
+      ],
+      "source": [],
+      "roles": [
+        "search_candidate"
+      ],
+      "role": "search_candidate",
+      "description": "Public search candidate without published attribution in this inventory. Malicious attribution has not been independently verified; a match does not establish compromise.",
+      "matching": "exact",
+      "context_only": false
+    },
     {
       "id": "ioc-41d198a3-3a03-5082-b7fb-8181df570fee",
       "type": "literal",
@@ -16556,6 +16759,267 @@
       "matching": "exact",
       "context_only": false
     },
+    {
+      "id": "ioc-6ac8fcee-0ae5-52e9-b3e0-e5b3b0f9313f",
+      "type": "sha256",
+      "value": "53f923284f286715df2c7993e4e65228d3f78d9c6594714be5c4da276b01ad15",
+      "status": "reference_only",
+      "provenance": "unattributed_public_indicator",
+      "source_ids": [],
+      "source_urls": [],
+      "observations": [
+        {
+          "status": "reference_only",
+          "original_status": "reference_only",
+          "role": "search_candidate",
+          "confidence": "low",
+          "description": "Public search candidate without published attribution in this inventory. Malicious attribution has not been independently verified; a match does not establish compromise.",
+          "source_ids": [],
+          "source_urls": [],
+          "source_dates": []
+        }
+      ],
+      "source": [],
+      "roles": [
+        "search_candidate"
+      ],
+      "role": "search_candidate",
+      "description": "Public search candidate without published attribution in this inventory. Malicious attribution has not been independently verified; a match does not establish compromise.",
+      "matching": "exact",
+      "context_only": false
+    },
+    {
+      "id": "ioc-a9d5f5c9-336e-5f2d-bfb5-db7b373a8a35",
+      "type": "sha256",
+      "value": "62f4c9972f86346585b1f1dc22c065769d5c8391f24aa9811819b30bf628c9f4",
+      "status": "reference_only",
+      "provenance": "unattributed_public_indicator",
+      "source_ids": [],
+      "source_urls": [],
+      "observations": [
+        {
+          "status": "reference_only",
+          "original_status": "reference_only",
+          "role": "search_candidate",
+          "confidence": "low",
+          "description": "Public search candidate without published attribution in this inventory. Malicious attribution has not been independently verified; a match does not establish compromise.",
+          "source_ids": [],
+          "source_urls": [],
+          "source_dates": []
+        }
+      ],
+      "source": [],
+      "roles": [
+        "search_candidate"
+      ],
+      "role": "search_candidate",
+      "description": "Public search candidate without published attribution in this inventory. Malicious attribution has not been independently verified; a match does not establish compromise.",
+      "matching": "exact",
+      "context_only": false
+    },
+    {
+      "id": "ioc-135b9d7d-6619-5cee-ba16-548196e71999",
+      "type": "sha256",
+      "value": "8115f306dfa15483cd990a36ee3acd19aff335a26a555c4e5113e99fc5e381a4",
+      "status": "reference_only",
+      "provenance": "unattributed_public_indicator",
+      "source_ids": [],
+      "source_urls": [],
+      "observations": [
+        {
+          "status": "reference_only",
+          "original_status": "reference_only",
+          "role": "search_candidate",
+          "confidence": "low",
+          "description": "Public search candidate without published attribution in this inventory. Malicious attribution has not been independently verified; a match does not establish compromise.",
+          "source_ids": [],
+          "source_urls": [],
+          "source_dates": []
+        }
+      ],
+      "source": [],
+      "roles": [
+        "search_candidate"
+      ],
+      "role": "search_candidate",
+      "description": "Public search candidate without published attribution in this inventory. Malicious attribution has not been independently verified; a match does not establish compromise.",
+      "matching": "exact",
+      "context_only": false
+    },
+    {
+      "id": "ioc-52059bbe-4c5d-5494-8b87-c91252d67c65",
+      "type": "sha256",
+      "value": "81b0bcf945c08ebfa9e10276bd19f554c62e42a458efaf2b91b416b0c9da829d",
+      "status": "reference_only",
+      "provenance": "unattributed_public_indicator",
+      "source_ids": [],
+      "source_urls": [],
+      "observations": [
+        {
+          "status": "reference_only",
+          "original_status": "reference_only",
+          "role": "search_candidate",
+          "confidence": "low",
+          "description": "Public search candidate without published attribution in this inventory. Malicious attribution has not been independently verified; a match does not establish compromise.",
+          "source_ids": [],
+          "source_urls": [],
+          "source_dates": []
+        }
+      ],
+      "source": [],
+      "roles": [
+        "search_candidate"
+      ],
+      "role": "search_candidate",
+      "description": "Public search candidate without published attribution in this inventory. Malicious attribution has not been independently verified; a match does not establish compromise.",
+      "matching": "exact",
+      "context_only": false
+    },
+    {
+      "id": "ioc-a9cb81f2-189f-56c5-9e51-e5dba0618386",
+      "type": "sha256",
+      "value": "ac7cc79df320df6d7a954d32fe1638dac5b12e134369becf7342869f98a98c81",
+      "status": "reference_only",
+      "provenance": "unattributed_public_indicator",
+      "source_ids": [],
+      "source_urls": [],
+      "observations": [
+        {
+          "status": "reference_only",
+          "original_status": "reference_only",
+          "role": "search_candidate",
+          "confidence": "low",
+          "description": "Public search candidate without published attribution in this inventory. Malicious attribution has not been independently verified; a match does not establish compromise.",
+          "source_ids": [],
+          "source_urls": [],
+          "source_dates": []
+        }
+      ],
+      "source": [],
+      "roles": [
+        "search_candidate"
+      ],
+      "role": "search_candidate",
+      "description": "Public search candidate without published attribution in this inventory. Malicious attribution has not been independently verified; a match does not establish compromise.",
+      "matching": "exact",
+      "context_only": false
+    },
+    {
+      "id": "ioc-9976f53c-b6bf-5aa7-bd36-40565777f617",
+      "type": "sha256",
+      "value": "b094bd5e34ed2bb96d289b8e26a1e0de1a87796f8047bb45a61dac03b47c617d",
+      "status": "reference_only",
+      "provenance": "unattributed_public_indicator",
+      "source_ids": [],
+      "source_urls": [],
+      "observations": [
+        {
+          "status": "reference_only",
+          "original_status": "reference_only",
+          "role": "search_candidate",
+          "confidence": "low",
+          "description": "Public search candidate without published attribution in this inventory. Malicious attribution has not been independently verified; a match does not establish compromise.",
+          "source_ids": [],
+          "source_urls": [],
+          "source_dates": []
+        }
+      ],
+      "source": [],
+      "roles": [
+        "search_candidate"
+      ],
+      "role": "search_candidate",
+      "description": "Public search candidate without published attribution in this inventory. Malicious attribution has not been independently verified; a match does not establish compromise.",
+      "matching": "exact",
+      "context_only": false
+    },
+    {
+      "id": "ioc-849554d4-80a5-51bf-933f-d597aa130138",
+      "type": "sha256",
+      "value": "e96049b559fc028d2dbbf5761d01124362957264fcd342f7133b055318480945",
+      "status": "reference_only",
+      "provenance": "unattributed_public_indicator",
+      "source_ids": [],
+      "source_urls": [],
+      "observations": [
+        {
+          "status": "reference_only",
+          "original_status": "reference_only",
+          "role": "search_candidate",
+          "confidence": "low",
+          "description": "Public search candidate without published attribution in this inventory. Malicious attribution has not been independently verified; a match does not establish compromise.",
+          "source_ids": [],
+          "source_urls": [],
+          "source_dates": []
+        }
+      ],
+      "source": [],
+      "roles": [
+        "search_candidate"
+      ],
+      "role": "search_candidate",
+      "description": "Public search candidate without published attribution in this inventory. Malicious attribution has not been independently verified; a match does not establish compromise.",
+      "matching": "exact",
+      "context_only": false
+    },
+    {
+      "id": "ioc-78aac967-820a-59f8-9dd7-99a5511de4e3",
+      "type": "sha256",
+      "value": "e9c3760e3afaa713710cf6d7669cbf2024ff81c3707ad8f141951812e22f8eb9",
+      "status": "reference_only",
+      "provenance": "unattributed_public_indicator",
+      "source_ids": [],
+      "source_urls": [],
+      "observations": [
+        {
+          "status": "reference_only",
+          "original_status": "reference_only",
+          "role": "search_candidate",
+          "confidence": "low",
+          "description": "Public search candidate without published attribution in this inventory. Malicious attribution has not been independently verified; a match does not establish compromise.",
+          "source_ids": [],
+          "source_urls": [],
+          "source_dates": []
+        }
+      ],
+      "source": [],
+      "roles": [
+        "search_candidate"
+      ],
+      "role": "search_candidate",
+      "description": "Public search candidate without published attribution in this inventory. Malicious attribution has not been independently verified; a match does not establish compromise.",
+      "matching": "exact",
+      "context_only": false
+    },
+    {
+      "id": "ioc-8b74a63c-e8d2-5f86-8fc0-b2d8b2a2a81d",
+      "type": "sha256",
+      "value": "ec894d6ac7d0e11dd4aae9e74e101490c8fcbf52afaf4b2a35f840086eaeee6b",
+      "status": "reference_only",
+      "provenance": "unattributed_public_indicator",
+      "source_ids": [],
+      "source_urls": [],
+      "observations": [
+        {
+          "status": "reference_only",
+          "original_status": "reference_only",
+          "role": "search_candidate",
+          "confidence": "low",
+          "description": "Public search candidate without published attribution in this inventory. Malicious attribution has not been independently verified; a match does not establish compromise.",
+          "source_ids": [],
+          "source_urls": [],
+          "source_dates": []
+        }
+      ],
+      "source": [],
+      "roles": [
+        "search_candidate"
+      ],
+      "role": "search_candidate",
+      "description": "Public search candidate without published attribution in this inventory. Malicious attribution has not been independently verified; a match does not establish compromise.",
+      "matching": "exact",
+      "context_only": false
+    },
     {
       "id": "ioc-ed202314-1f91-5a66-8c36-502623bdbfd3",
       "type": "url",
diff --git a/tests/test_intel_inventory.py b/tests/test_intel_inventory.py
index 40c60dc..b5c6a43 100644
--- a/tests/test_intel_inventory.py
+++ b/tests/test_intel_inventory.py
@@ -32,6 +32,16 @@ class IntelInventoryTests(unittest.TestCase):
             with self.subTest(indicator=row["id"]):
                 self.assertTrue(row["roles"])
                 self.assertTrue(row["observations"])
+                if row.get("provenance") == "unattributed_public_indicator":
+                    self.assertEqual(row["status"], "reference_only")
+                    self.assertEqual(row["source_ids"], [])
+                    self.assertEqual(row["source_urls"], [])
+                    self.assertEqual(row["roles"], ["search_candidate"])
+                    for observation in row["observations"]:
+                        self.assertEqual(observation["source_dates"], [])
+                        self.assertEqual(observation["source_ids"], [])
+                        self.assertEqual(observation["confidence"], "low")
+                    continue
                 self.assertTrue(row["source_ids"])
                 for source_id in row["source_ids"]:
                     self.assertIn(source_id, sources)
diff --git a/uv.lock b/uv.lock
index 928a911..6c4939f 100644
--- a/uv.lock
+++ b/uv.lock
@@ -546,7 +546,7 @@ wheels = [
 
 [[package]]
 name = "netscaler-triage"
-version = "1.0.2"
+version = "1.0.3"
 source = { editable = "." }
 dependencies = [
     { name = "py7zr" },