{
  "type": "bundle",
  "id": "bundle--3830a7cf-e708-53e4-8148-3b72c9813df2",
  "objects": [
    {
      "type": "identity",
      "spec_version": "2.1",
      "id": "identity--6a88545b-bbf6-582c-8381-b1fbec278934",
      "created": "2026-09-18T12:00:00Z",
      "modified": "2026-09-18T12:00:00Z",
      "x_ally_original_id": "org:5489d91d-0e99-5d7f-b14f-3ce9bd58153a",
      "name": "Cloudflare",
      "identity_class": "organization"
    },
    {
      "type": "incident",
      "spec_version": "2.1",
      "id": "incident--2cde418b-256d-527a-819a-0398254006a0",
      "created": "2026-09-18T12:00:00Z",
      "modified": "2026-09-18T12:00:00Z",
      "x_ally_original_id": "brh:04eb0588-33fe-577d-a37b-dbf4c09cefc8",
      "name": "Cloudflare blocked phishing campaign"
    },
    {
      "type": "incident",
      "spec_version": "2.1",
      "id": "incident--d0d46186-aeff-5775-8f44-80301eb02b4d",
      "created": "2026-09-18T12:00:00Z",
      "modified": "2026-09-18T12:00:00Z",
      "x_ally_original_id": "inc:4f652bbf-750d-5ab1-88bc-2bb6b11d96b1",
      "name": "Cloudflare blocked phishing campaign"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a02d63fc-5c1e-5da4-8478-c30284fcc068",
      "created": "2026-09-18T12:00:00Z",
      "modified": "2026-09-18T12:00:00Z",
      "x_ally_original_id": "clm:0e5d1daf-0e9a-5247-a8d4-4bf322260628",
      "relationship_type": "affected-organization",
      "source_ref": "incident--d0d46186-aeff-5775-8f44-80301eb02b4d",
      "target_ref": "identity--6a88545b-bbf6-582c-8381-b1fbec278934",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "Cloudflare",
          "url": "https://blog.cloudflare.com/2022-07-sms-phishing-attacks/",
          "external_id": "cit:65e7e72a-e81f-5853-8da0-48332cc72bb7",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:8ea32e010abadace19661a1817d9e658c0c4b03d98bd5007039d15fa1af1e890"
        }
      ]
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--5fff969e-6ed1-5248-84db-f037841039b7",
      "created": "2026-09-19T12:00:00Z",
      "modified": "2026-09-19T12:00:00Z",
      "x_ally_original_id": "clm:20f9d1d0-284b-58e1-817c-63ce87b83317",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "Cloudflare",
          "url": "https://blog.cloudflare.com/2022-07-sms-phishing-attacks/",
          "external_id": "cit:d2cde504-97ef-514e-b819-046a02b0ee91",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:39e10b8a315cecab55c1e0f0e386a6a76412e27aedcb81f25856bed09ce5a6ab"
        }
      ],
      "x_ally_claim_object": {
        "kind": "value",
        "datatype": "date",
        "value": "2022-08-09"
      }
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--65b711b3-b6c0-57ab-8a2d-62d0b4138acc",
      "created": "2026-09-19T12:00:00Z",
      "modified": "2026-09-19T12:00:00Z",
      "x_ally_original_id": "clm:4cc330e0-d896-5c80-a12b-b0a2e3d121be",
      "confidence": 90,
      "external_references": [
        {
          "source_name": "Cloudflare",
          "url": "https://blog.cloudflare.com/2022-07-sms-phishing-attacks/",
          "external_id": "cit:6b014354-3ce4-5a20-a76c-206f0c4c29db",
          "description": "We worked with DigitalOcean to shut down the attacker’s server.",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:39e10b8a315cecab55c1e0f0e386a6a76412e27aedcb81f25856bed09ce5a6ab"
        }
      ],
      "x_ally_claim_object": {
        "kind": "value",
        "datatype": "string",
        "value": "The retained source describes containment action intended to limit further access or disruption."
      }
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--9149e210-e143-50e4-8e10-17fd6c7adae3",
      "created": "2026-09-19T12:00:00Z",
      "modified": "2026-09-19T12:00:00Z",
      "x_ally_original_id": "clm:e0af4a56-9611-5789-b6c4-bfe236d09972",
      "confidence": 88,
      "external_references": [
        {
          "source_name": "Cloudflare",
          "url": "https://blog.cloudflare.com/2022-07-sms-phishing-attacks/",
          "external_id": "cit:4f35d27f-4e2a-5b43-8e73-003e4f369881",
          "description": "That domain had been registered via Porkbun, a domain registrar, at 2022-07-20 22:13:04 UTC — less than 40 minutes before the phishing campaign began.",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:39e10b8a315cecab55c1e0f0e386a6a76412e27aedcb81f25856bed09ce5a6ab"
        }
      ],
      "x_ally_claim_object": {
        "kind": "value",
        "datatype": "string",
        "value": "Same 0ktapus campaign."
      }
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--94ba7fb0-651e-5a65-8b28-1b7f502a09d4",
      "created": "2026-09-18T12:00:00Z",
      "modified": "2026-09-18T12:00:00Z",
      "x_ally_original_id": "clm:144311b3-00fd-56e5-9440-90ce98b46172",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "Cloudflare",
          "url": "https://blog.cloudflare.com/2022-07-sms-phishing-attacks/",
          "external_id": "cit:a5712639-368f-52e4-94b5-c205c548cd6e",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:8ea32e010abadace19661a1817d9e658c0c4b03d98bd5007039d15fa1af1e890"
        }
      ],
      "x_ally_claim_object": {
        "kind": "value",
        "datatype": "string",
        "value": "The reviewed source documents the cloudflare blocked phishing campaign involving Cloudflare."
      }
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--c20b66e2-4250-5f6c-8438-c02ccfdf69ed",
      "created": "2026-09-19T12:00:00Z",
      "modified": "2026-09-19T12:00:00Z",
      "x_ally_original_id": "clm:6c65056f-98a3-5ff9-9bfd-ce8375d0cfb6",
      "confidence": 89,
      "external_references": [
        {
          "source_name": "Cloudflare",
          "url": "https://blog.cloudflare.com/2022-07-sms-phishing-attacks/",
          "external_id": "cit:301c0dfe-1c80-5000-b4ab-d040c6b5b42e",
          "description": "Gateway’s automatic detection of malicious domains also identified the domain and blocked it, but the fact that it was registered and messages were sent within such a short interval of time meant that the system hadn’t automatically taken action before some employees had clicked on the links.",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:39e10b8a315cecab55c1e0f0e386a6a76412e27aedcb81f25856bed09ce5a6ab"
        }
      ],
      "x_ally_claim_object": {
        "kind": "value",
        "datatype": "string",
        "value": "$0 (attack blocked)."
      }
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--ff942d93-1649-506b-8a9f-8f49b1978662",
      "created": "2026-09-19T12:00:00Z",
      "modified": "2026-09-19T12:00:00Z",
      "x_ally_original_id": "clm:9dd43295-43ef-5c9d-af59-216013d43c93",
      "confidence": 84,
      "external_references": [
        {
          "source_name": "Cloudflare",
          "url": "https://blog.cloudflare.com/2022-07-sms-phishing-attacks/",
          "external_id": "cit:7571e64f-7d20-599f-9c13-80172d0271ec",
          "description": "Instead, every employee at the company is issued a FIDO2-compliant security key from a vendor like YubiKey.",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:39e10b8a315cecab55c1e0f0e386a6a76412e27aedcb81f25856bed09ce5a6ab"
        }
      ],
      "x_ally_claim_object": {
        "kind": "value",
        "datatype": "string",
        "value": "Attack failed due to hardware FIDO2 security keys."
      }
    },
    {
      "type": "x-ally-event",
      "spec_version": "2.1",
      "id": "x-ally-event--123fe8ab-50d5-55e4-8b52-f4850a636cec",
      "created": "2026-09-19T12:00:00Z",
      "modified": "2026-09-19T12:00:00Z",
      "x_ally_original_id": "evt:fe3c90ca-b858-525d-94d0-0ff0001f35a1",
      "name": "Documented public update"
    }
  ]
}