{
  "intelligence": {
    "actors": [],
    "attack_details": {
      "coverage": "source-limited",
      "registry_sha256": "7848bdfd30ace1dbdf434776397c3e5c8a9a32ebc2b7d850e29c043b8f0aa025",
      "schema_version": 1,
      "source_paragraphs": 34,
      "sources": [
        {
          "document_sha256": "064988fa14d1ec78641e51d3ca9200e2320afc1b6d6d713500e5b8fc5163384b",
          "name": "Malwarebytes",
          "retrieved_at": "2026-10-19T19:10:52.975531+00:00",
          "role": "primary",
          "source_id": "primary",
          "url": "https://www.malwarebytes.com/blog/threat-intel/2026/09/t-mobile-rewards-points-expiry-texts-are-a-phishing-scam"
        }
      ],
      "steps": [
        {
          "date": "June 4, 2026",
          "relation": "incident-step",
          "source_id": "primary",
          "text": "Vous avez actuellement 18 400 points qui expireront le 4 juin 2026 si vous ne les utilisez pas."
        }
      ]
    },
    "counts": {
      "actors": 0,
      "associated_entity_contexts": 0,
      "deduplicated_iocs": 0,
      "direct_entities": 24,
      "direct_relationships": 12,
      "invalid_iocs": 0,
      "iocs": 0,
      "mentioned": 0,
      "mitre_associated": 0,
      "mitre_direct": 0,
      "targets": 0,
      "techniques": 0,
      "unsupported_indicators": 24,
      "vulnerabilities": 0
    },
    "coverage": {
      "associated_repertoire_is_incident_evidence": false,
      "attribution_policy": "explicit-public-relationships-only",
      "descriptions_publicly_exported": false,
      "excluded_context_objects": 0,
      "excluded_graph_objects": 13,
      "graph_complete": true,
      "graph_objects": 24,
      "graph_relationships": 12,
      "mitre_context_complete": true,
      "source_url": "https://www.malwarebytes.com/blog/threat-intel/2026/09/t-mobile-rewards-points-expiry-texts-are-a-phishing-scam",
      "status_as_of": "2026-10-19T19:10:16+00:00",
      "table_preview_limit": 20
    },
    "direct_entities": [
      {
        "__typename": "Indicator",
        "aliases": [],
        "attributes": {
          "pattern_type": "stix",
          "pattern_version": "2.1",
          "x_opencti_detection": false,
          "x_opencti_main_observable_type": "Hostname",
          "x_opencti_score": 50
        },
        "authorized_members": [],
        "confidence": 50,
        "created_by": null,
        "dates": {
          "created": "2026-09-24T16:57:51.986Z",
          "created_at": "2026-09-26T17:08:36.913Z",
          "modified": "2026-09-26T17:09:13.204Z",
          "updated_at": "2026-09-26T17:09:13.204Z"
        },
        "description_available": false,
        "entity_type": "Indicator",
        "id": "0de3717e-93fa-47e2-a132-b508c6cabdde",
        "is_inferred": false,
        "labels": [
          "phishing campaign",
          "rewards points scam",
          "smishing",
          "sms phishing",
          "social engineering"
        ],
        "lang": "en",
        "name": null,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://www.malwarebytes.com/blog/threat-intel/2026/09/t-mobile-rewards-points-expiry-texts-are-a-phishing-scam",
        "standard_id": "indicator--4f5c2687-6edb-58f5-8694-3cdb23768446",
        "type": "Indicator"
      },
      {
        "__typename": "Indicator",
        "aliases": [],
        "attributes": {
          "pattern_type": "stix",
          "pattern_version": "2.1",
          "x_opencti_detection": false,
          "x_opencti_main_observable_type": "Hostname",
          "x_opencti_score": 50
        },
        "authorized_members": [],
        "confidence": 50,
        "created_by": null,
        "dates": {
          "created": "2026-09-24T16:57:51.975Z",
          "created_at": "2026-09-26T17:08:31.045Z",
          "modified": "2026-09-26T17:09:06.019Z",
          "updated_at": "2026-09-26T17:09:06.019Z"
        },
        "description_available": false,
        "entity_type": "Indicator",
        "id": "17a5cadc-9405-466b-987c-c48cd6fcbf58",
        "is_inferred": false,
        "labels": [
          "phishing campaign",
          "rewards points scam",
          "smishing",
          "sms phishing",
          "social engineering"
        ],
        "lang": "en",
        "name": null,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://www.malwarebytes.com/blog/threat-intel/2026/09/t-mobile-rewards-points-expiry-texts-are-a-phishing-scam",
        "standard_id": "indicator--fc757335-5748-5edd-ab88-9c6c112fc7bb",
        "type": "Indicator"
      },
      {
        "__typename": "Hostname",
        "aliases": [],
        "attributes": {},
        "authorized_members": [],
        "confidence": null,
        "created_by": null,
        "dates": {
          "created_at": "2026-09-26T17:07:50.315Z",
          "updated_at": "2026-09-26T17:07:52.484Z"
        },
        "description_available": false,
        "entity_type": "Hostname",
        "id": "19823d31-f328-4e75-91ea-93d43b45dfb5",
        "is_inferred": false,
        "labels": [
          "phishing campaign",
          "rewards points scam",
          "smishing",
          "sms phishing",
          "social engineering"
        ],
        "lang": null,
        "name": null,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://www.malwarebytes.com/blog/threat-intel/2026/09/t-mobile-rewards-points-expiry-texts-are-a-phishing-scam",
        "standard_id": "hostname--7224bcb7-a22d-54b7-b485-e6389f9ac378",
        "type": "Hostname"
      },
      {
        "__typename": "Indicator",
        "aliases": [],
        "attributes": {
          "pattern_type": "stix",
          "pattern_version": "2.1",
          "x_opencti_detection": false,
          "x_opencti_main_observable_type": "Hostname",
          "x_opencti_score": 50
        },
        "authorized_members": [],
        "confidence": 50,
        "created_by": null,
        "dates": {
          "created": "2026-09-24T16:57:51.981Z",
          "created_at": "2026-09-26T17:08:31.402Z",
          "modified": "2026-09-26T17:09:01.429Z",
          "updated_at": "2026-09-26T17:09:01.429Z"
        },
        "description_available": false,
        "entity_type": "Indicator",
        "id": "24ca0ecb-92e3-4ff5-980e-643f913beb67",
        "is_inferred": false,
        "labels": [
          "phishing campaign",
          "rewards points scam",
          "smishing",
          "sms phishing",
          "social engineering"
        ],
        "lang": "en",
        "name": null,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://www.malwarebytes.com/blog/threat-intel/2026/09/t-mobile-rewards-points-expiry-texts-are-a-phishing-scam",
        "standard_id": "indicator--8e9edb44-06ca-5242-8f71-6702aaf1edab",
        "type": "Indicator"
      },
      {
        "__typename": "Hostname",
        "aliases": [],
        "attributes": {},
        "authorized_members": [],
        "confidence": null,
        "created_by": null,
        "dates": {
          "created_at": "2026-09-26T17:07:38.695Z",
          "updated_at": "2026-09-26T17:07:40.489Z"
        },
        "description_available": false,
        "entity_type": "Hostname",
        "id": "2f17f7e0-caab-40da-ae6d-333776f42ff4",
        "is_inferred": false,
        "labels": [
          "phishing campaign",
          "rewards points scam",
          "smishing",
          "sms phishing",
          "social engineering"
        ],
        "lang": null,
        "name": null,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://www.malwarebytes.com/blog/threat-intel/2026/09/t-mobile-rewards-points-expiry-texts-are-a-phishing-scam",
        "standard_id": "hostname--ea367c41-f69e-50cd-bec8-18e0acd32c46",
        "type": "Hostname"
      },
      {
        "__typename": "Indicator",
        "aliases": [],
        "attributes": {
          "pattern_type": "stix",
          "pattern_version": "2.1",
          "x_opencti_detection": false,
          "x_opencti_main_observable_type": "Hostname",
          "x_opencti_score": 50
        },
        "authorized_members": [],
        "confidence": 50,
        "created_by": null,
        "dates": {
          "created": "2026-09-24T16:57:51.978Z",
          "created_at": "2026-09-26T17:08:31.073Z",
          "modified": "2026-09-26T17:08:32.741Z",
          "updated_at": "2026-09-26T17:08:32.741Z"
        },
        "description_available": false,
        "entity_type": "Indicator",
        "id": "488f0212-f839-4671-9da3-e7afd695ca57",
        "is_inferred": false,
        "labels": [
          "phishing campaign",
          "rewards points scam",
          "smishing",
          "sms phishing",
          "social engineering"
        ],
        "lang": "en",
        "name": null,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://www.malwarebytes.com/blog/threat-intel/2026/09/t-mobile-rewards-points-expiry-texts-are-a-phishing-scam",
        "standard_id": "indicator--12864991-d6d4-54d5-963f-2af3d23e349f",
        "type": "Indicator"
      },
      {
        "__typename": "Hostname",
        "aliases": [],
        "attributes": {},
        "authorized_members": [],
        "confidence": null,
        "created_by": null,
        "dates": {
          "created_at": "2026-09-26T17:07:58.921Z",
          "updated_at": "2026-09-26T17:08:01.565Z"
        },
        "description_available": false,
        "entity_type": "Hostname",
        "id": "4bbd8eee-4ffa-423f-842b-c82e6ad3d742",
        "is_inferred": false,
        "labels": [
          "phishing campaign",
          "rewards points scam",
          "smishing",
          "sms phishing",
          "social engineering"
        ],
        "lang": null,
        "name": null,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://www.malwarebytes.com/blog/threat-intel/2026/09/t-mobile-rewards-points-expiry-texts-are-a-phishing-scam",
        "standard_id": "hostname--e14a7df2-d983-5336-a444-e075751de519",
        "type": "Hostname"
      },
      {
        "__typename": "Hostname",
        "aliases": [],
        "attributes": {},
        "authorized_members": [],
        "confidence": null,
        "created_by": null,
        "dates": {
          "created_at": "2026-09-26T17:08:09.682Z",
          "updated_at": "2026-09-26T17:08:16.466Z"
        },
        "description_available": false,
        "entity_type": "Hostname",
        "id": "5eca82ff-36bf-4328-be3e-d0507adb6e38",
        "is_inferred": false,
        "labels": [
          "phishing campaign",
          "rewards points scam",
          "smishing",
          "sms phishing",
          "social engineering"
        ],
        "lang": null,
        "name": null,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://www.malwarebytes.com/blog/threat-intel/2026/09/t-mobile-rewards-points-expiry-texts-are-a-phishing-scam",
        "standard_id": "hostname--9cb87f30-90d9-5ac7-b544-8a68aac9dc41",
        "type": "Hostname"
      },
      {
        "__typename": "Indicator",
        "aliases": [],
        "attributes": {
          "pattern_type": "stix",
          "pattern_version": "2.1",
          "x_opencti_detection": false,
          "x_opencti_main_observable_type": "Hostname",
          "x_opencti_score": 50
        },
        "authorized_members": [],
        "confidence": 50,
        "created_by": null,
        "dates": {
          "created": "2026-09-24T16:57:51.952Z",
          "created_at": "2026-09-26T17:08:14.004Z",
          "modified": "2026-09-26T17:08:34.803Z",
          "updated_at": "2026-09-26T17:08:34.803Z"
        },
        "description_available": false,
        "entity_type": "Indicator",
        "id": "6d369bb7-69d7-4457-b366-2f31d99001f4",
        "is_inferred": false,
        "labels": [
          "phishing campaign",
          "rewards points scam",
          "smishing",
          "sms phishing",
          "social engineering"
        ],
        "lang": "en",
        "name": null,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://www.malwarebytes.com/blog/threat-intel/2026/09/t-mobile-rewards-points-expiry-texts-are-a-phishing-scam",
        "standard_id": "indicator--a5b5eb04-d34b-584c-84bb-1935ab1550b7",
        "type": "Indicator"
      },
      {
        "__typename": "Hostname",
        "aliases": [],
        "attributes": {},
        "authorized_members": [],
        "confidence": null,
        "created_by": null,
        "dates": {
          "created_at": "2026-09-26T17:08:01.728Z",
          "updated_at": "2026-09-26T17:08:05.004Z"
        },
        "description_available": false,
        "entity_type": "Hostname",
        "id": "79bb8518-df8f-4b7a-a617-d280f5aef243",
        "is_inferred": false,
        "labels": [
          "phishing campaign",
          "rewards points scam",
          "smishing",
          "sms phishing",
          "social engineering"
        ],
        "lang": null,
        "name": null,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://www.malwarebytes.com/blog/threat-intel/2026/09/t-mobile-rewards-points-expiry-texts-are-a-phishing-scam",
        "standard_id": "hostname--87d96fa5-a3b0-560c-9c96-87197da24432",
        "type": "Hostname"
      },
      {
        "__typename": "Hostname",
        "aliases": [],
        "attributes": {},
        "authorized_members": [],
        "confidence": null,
        "created_by": null,
        "dates": {
          "created_at": "2026-09-26T17:07:21.787Z",
          "updated_at": "2026-09-26T17:07:31.755Z"
        },
        "description_available": false,
        "entity_type": "Hostname",
        "id": "82e50c4c-dd23-46a6-b9b9-f9c910a9d874",
        "is_inferred": false,
        "labels": [
          "phishing campaign",
          "rewards points scam",
          "smishing",
          "sms phishing",
          "social engineering"
        ],
        "lang": null,
        "name": null,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://www.malwarebytes.com/blog/threat-intel/2026/09/t-mobile-rewards-points-expiry-texts-are-a-phishing-scam",
        "standard_id": "hostname--6b0ffdc7-83af-5b82-8024-61caf0847159",
        "type": "Hostname"
      },
      {
        "__typename": "Indicator",
        "aliases": [],
        "attributes": {
          "pattern_type": "stix",
          "pattern_version": "2.1",
          "x_opencti_detection": false,
          "x_opencti_main_observable_type": "Hostname",
          "x_opencti_score": 50
        },
        "authorized_members": [],
        "confidence": 50,
        "created_by": null,
        "dates": {
          "created": "2026-09-24T16:57:51.968Z",
          "created_at": "2026-09-26T17:08:26.298Z",
          "modified": "2026-09-26T17:08:50.442Z",
          "updated_at": "2026-09-26T17:08:50.442Z"
        },
        "description_available": false,
        "entity_type": "Indicator",
        "id": "8982b5dc-43c8-4b0e-a90f-2e40c3c9bb31",
        "is_inferred": false,
        "labels": [
          "phishing campaign",
          "rewards points scam",
          "smishing",
          "sms phishing",
          "social engineering"
        ],
        "lang": "en",
        "name": null,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://www.malwarebytes.com/blog/threat-intel/2026/09/t-mobile-rewards-points-expiry-texts-are-a-phishing-scam",
        "standard_id": "indicator--cc42cfd0-fc48-5c20-b03d-c374e43f8cda",
        "type": "Indicator"
      },
      {
        "__typename": "Indicator",
        "aliases": [],
        "attributes": {
          "pattern_type": "stix",
          "pattern_version": "2.1",
          "x_opencti_detection": false,
          "x_opencti_main_observable_type": "Hostname",
          "x_opencti_score": 50
        },
        "authorized_members": [],
        "confidence": 50,
        "created_by": null,
        "dates": {
          "created": "2026-09-24T16:57:51.972Z",
          "created_at": "2026-09-26T17:08:26.932Z",
          "modified": "2026-09-26T17:08:58.637Z",
          "updated_at": "2026-09-26T17:08:58.637Z"
        },
        "description_available": false,
        "entity_type": "Indicator",
        "id": "92f472e0-9fce-4099-9cde-c2fd73b51487",
        "is_inferred": false,
        "labels": [
          "phishing campaign",
          "rewards points scam",
          "smishing",
          "sms phishing",
          "social engineering"
        ],
        "lang": "en",
        "name": null,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://www.malwarebytes.com/blog/threat-intel/2026/09/t-mobile-rewards-points-expiry-texts-are-a-phishing-scam",
        "standard_id": "indicator--635db995-9f15-5433-9d3c-29ab5a9807c0",
        "type": "Indicator"
      },
      {
        "__typename": "Indicator",
        "aliases": [],
        "attributes": {
          "pattern_type": "stix",
          "pattern_version": "2.1",
          "x_opencti_detection": false,
          "x_opencti_main_observable_type": "Hostname",
          "x_opencti_score": 50
        },
        "authorized_members": [],
        "confidence": 50,
        "created_by": null,
        "dates": {
          "created": "2026-09-24T16:57:51.961Z",
          "created_at": "2026-09-26T17:08:24.044Z",
          "modified": "2026-09-26T17:08:46.632Z",
          "updated_at": "2026-09-26T17:08:46.632Z"
        },
        "description_available": false,
        "entity_type": "Indicator",
        "id": "99121aea-8ff6-406d-ba98-d5b74f496f80",
        "is_inferred": false,
        "labels": [
          "phishing campaign",
          "rewards points scam",
          "smishing",
          "sms phishing",
          "social engineering"
        ],
        "lang": "en",
        "name": null,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://www.malwarebytes.com/blog/threat-intel/2026/09/t-mobile-rewards-points-expiry-texts-are-a-phishing-scam",
        "standard_id": "indicator--5df6af34-0fd1-5fa3-a3ad-bf8b8949af1f",
        "type": "Indicator"
      },
      {
        "__typename": "Hostname",
        "aliases": [],
        "attributes": {},
        "authorized_members": [],
        "confidence": null,
        "created_by": null,
        "dates": {
          "created_at": "2026-09-26T17:07:40.648Z",
          "updated_at": "2026-09-26T17:07:44.507Z"
        },
        "description_available": false,
        "entity_type": "Hostname",
        "id": "a6536263-c426-43dd-9189-061704501e87",
        "is_inferred": false,
        "labels": [
          "phishing campaign",
          "rewards points scam",
          "smishing",
          "sms phishing",
          "social engineering"
        ],
        "lang": null,
        "name": null,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://www.malwarebytes.com/blog/threat-intel/2026/09/t-mobile-rewards-points-expiry-texts-are-a-phishing-scam",
        "standard_id": "hostname--42b69f9f-5181-5e66-9423-7eb9cc69d088",
        "type": "Hostname"
      },
      {
        "__typename": "Hostname",
        "aliases": [],
        "attributes": {},
        "authorized_members": [],
        "confidence": null,
        "created_by": null,
        "dates": {
          "created_at": "2026-09-26T17:07:46.757Z",
          "updated_at": "2026-09-26T17:07:50.582Z"
        },
        "description_available": false,
        "entity_type": "Hostname",
        "id": "a7078b43-bead-4dac-9afc-0b3a2df67fb0",
        "is_inferred": false,
        "labels": [
          "phishing campaign",
          "rewards points scam",
          "smishing",
          "sms phishing",
          "social engineering"
        ],
        "lang": null,
        "name": null,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://www.malwarebytes.com/blog/threat-intel/2026/09/t-mobile-rewards-points-expiry-texts-are-a-phishing-scam",
        "standard_id": "hostname--cca8cb83-de0a-55b2-9aac-61217bbaf654",
        "type": "Hostname"
      },
      {
        "__typename": "Indicator",
        "aliases": [],
        "attributes": {
          "pattern_type": "stix",
          "pattern_version": "2.1",
          "x_opencti_detection": false,
          "x_opencti_main_observable_type": "Hostname",
          "x_opencti_score": 50
        },
        "authorized_members": [],
        "confidence": 50,
        "created_by": null,
        "dates": {
          "created": "2026-09-24T16:57:51.956Z",
          "created_at": "2026-09-26T17:08:18.807Z",
          "modified": "2026-09-26T17:08:42.337Z",
          "updated_at": "2026-09-26T17:08:42.337Z"
        },
        "description_available": false,
        "entity_type": "Indicator",
        "id": "ac07bce2-2f81-4ffd-b495-c2f5bd34bf21",
        "is_inferred": false,
        "labels": [
          "phishing campaign",
          "rewards points scam",
          "smishing",
          "sms phishing",
          "social engineering"
        ],
        "lang": "en",
        "name": null,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://www.malwarebytes.com/blog/threat-intel/2026/09/t-mobile-rewards-points-expiry-texts-are-a-phishing-scam",
        "standard_id": "indicator--3cee2c5f-6488-58e5-88a6-3062549088ca",
        "type": "Indicator"
      },
      {
        "__typename": "Indicator",
        "aliases": [],
        "attributes": {
          "pattern_type": "stix",
          "pattern_version": "2.1",
          "x_opencti_detection": false,
          "x_opencti_main_observable_type": "Hostname",
          "x_opencti_score": 50
        },
        "authorized_members": [],
        "confidence": 50,
        "created_by": null,
        "dates": {
          "created": "2026-09-24T16:57:51.964Z",
          "created_at": "2026-09-26T17:08:25.880Z",
          "modified": "2026-09-26T17:08:53.391Z",
          "updated_at": "2026-09-26T17:08:53.391Z"
        },
        "description_available": false,
        "entity_type": "Indicator",
        "id": "adfb8eff-fe8c-4cc5-af91-2a3abaf493e1",
        "is_inferred": false,
        "labels": [
          "phishing campaign",
          "rewards points scam",
          "smishing",
          "sms phishing",
          "social engineering"
        ],
        "lang": "en",
        "name": null,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://www.malwarebytes.com/blog/threat-intel/2026/09/t-mobile-rewards-points-expiry-texts-are-a-phishing-scam",
        "standard_id": "indicator--b889699b-9ef4-585b-bd0a-5eb39fad440b",
        "type": "Indicator"
      },
      {
        "__typename": "Hostname",
        "aliases": [],
        "attributes": {},
        "authorized_members": [],
        "confidence": null,
        "created_by": null,
        "dates": {
          "created_at": "2026-09-26T17:07:52.642Z",
          "updated_at": "2026-09-26T17:07:57.424Z"
        },
        "description_available": false,
        "entity_type": "Hostname",
        "id": "b9428f50-6b19-4c41-b10a-c1861431eee0",
        "is_inferred": false,
        "labels": [
          "phishing campaign",
          "rewards points scam",
          "smishing",
          "sms phishing",
          "social engineering"
        ],
        "lang": null,
        "name": null,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://www.malwarebytes.com/blog/threat-intel/2026/09/t-mobile-rewards-points-expiry-texts-are-a-phishing-scam",
        "standard_id": "hostname--15cf16c0-5710-5fa8-b374-e98fa325379a",
        "type": "Hostname"
      },
      {
        "__typename": "Indicator",
        "aliases": [],
        "attributes": {
          "pattern_type": "stix",
          "pattern_version": "2.1",
          "x_opencti_detection": false,
          "x_opencti_main_observable_type": "Hostname",
          "x_opencti_score": 50
        },
        "authorized_members": [],
        "confidence": 50,
        "created_by": null,
        "dates": {
          "created": "2026-09-24T16:57:51.958Z",
          "created_at": "2026-09-26T17:08:23.497Z",
          "modified": "2026-09-26T17:08:43.633Z",
          "updated_at": "2026-09-26T17:08:43.633Z"
        },
        "description_available": false,
        "entity_type": "Indicator",
        "id": "bf690e5f-4cad-4d19-863b-1f9c57427848",
        "is_inferred": false,
        "labels": [
          "phishing campaign",
          "rewards points scam",
          "smishing",
          "sms phishing",
          "social engineering"
        ],
        "lang": "en",
        "name": null,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://www.malwarebytes.com/blog/threat-intel/2026/09/t-mobile-rewards-points-expiry-texts-are-a-phishing-scam",
        "standard_id": "indicator--ed2099d0-bc4f-58ab-872e-41605d8b75e4",
        "type": "Indicator"
      },
      {
        "__typename": "Hostname",
        "aliases": [],
        "attributes": {},
        "authorized_members": [],
        "confidence": null,
        "created_by": null,
        "dates": {
          "created_at": "2026-09-26T17:08:03.974Z",
          "updated_at": "2026-09-26T17:08:09.285Z"
        },
        "description_available": false,
        "entity_type": "Hostname",
        "id": "c59d99e2-918b-45c1-b7d9-42c2a61ce2af",
        "is_inferred": false,
        "labels": [
          "phishing campaign",
          "rewards points scam",
          "smishing",
          "sms phishing",
          "social engineering"
        ],
        "lang": null,
        "name": null,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://www.malwarebytes.com/blog/threat-intel/2026/09/t-mobile-rewards-points-expiry-texts-are-a-phishing-scam",
        "standard_id": "hostname--a3a7d73c-b218-5cc2-a02a-c0bc398257d8",
        "type": "Hostname"
      },
      {
        "__typename": "Hostname",
        "aliases": [],
        "attributes": {},
        "authorized_members": [],
        "confidence": null,
        "created_by": null,
        "dates": {
          "created_at": "2026-09-26T17:07:21.872Z",
          "updated_at": "2026-09-26T17:07:31.756Z"
        },
        "description_available": false,
        "entity_type": "Hostname",
        "id": "f5133bf4-f4c7-4b15-9965-1e5b7e841d6f",
        "is_inferred": false,
        "labels": [
          "phishing campaign",
          "rewards points scam",
          "smishing",
          "sms phishing",
          "social engineering"
        ],
        "lang": null,
        "name": null,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://www.malwarebytes.com/blog/threat-intel/2026/09/t-mobile-rewards-points-expiry-texts-are-a-phishing-scam",
        "standard_id": "hostname--275b1938-059a-57d8-b79c-c140ef4bd4ab",
        "type": "Hostname"
      },
      {
        "__typename": "Hostname",
        "aliases": [],
        "attributes": {},
        "authorized_members": [],
        "confidence": null,
        "created_by": null,
        "dates": {
          "created_at": "2026-09-26T17:07:35.671Z",
          "updated_at": "2026-09-26T17:07:37.851Z"
        },
        "description_available": false,
        "entity_type": "Hostname",
        "id": "fd19200d-ff81-43ff-b836-00a638f115ee",
        "is_inferred": false,
        "labels": [
          "phishing campaign",
          "rewards points scam",
          "smishing",
          "sms phishing",
          "social engineering"
        ],
        "lang": null,
        "name": null,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://www.malwarebytes.com/blog/threat-intel/2026/09/t-mobile-rewards-points-expiry-texts-are-a-phishing-scam",
        "standard_id": "hostname--327c198b-1e6e-5e1c-83aa-1b9e2df3aff7",
        "type": "Hostname"
      },
      {
        "__typename": "Indicator",
        "aliases": [],
        "attributes": {
          "pattern_type": "stix",
          "pattern_version": "2.1",
          "x_opencti_detection": false,
          "x_opencti_main_observable_type": "Hostname",
          "x_opencti_score": 50
        },
        "authorized_members": [],
        "confidence": 50,
        "created_by": null,
        "dates": {
          "created": "2026-09-24T16:57:51.983Z",
          "created_at": "2026-09-26T17:08:36.906Z",
          "modified": "2026-09-26T17:09:10.820Z",
          "updated_at": "2026-09-26T17:09:10.820Z"
        },
        "description_available": false,
        "entity_type": "Indicator",
        "id": "ff3c6844-f5f2-4cd6-ba48-b333146ef244",
        "is_inferred": false,
        "labels": [
          "phishing campaign",
          "rewards points scam",
          "smishing",
          "sms phishing",
          "social engineering"
        ],
        "lang": "en",
        "name": null,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://www.malwarebytes.com/blog/threat-intel/2026/09/t-mobile-rewards-points-expiry-texts-are-a-phishing-scam",
        "standard_id": "indicator--edf0c8a1-e785-551c-8214-a162fdf40cd6",
        "type": "Indicator"
      }
    ],
    "direct_relationships": [
      {
        "__typename": "StixCoreRelationship",
        "authorized_members": [],
        "confidence": 50,
        "created_by": null,
        "dates": {
          "created": "2026-09-24T16:57:51.985Z",
          "created_at": "2026-09-26T17:08:46.800Z",
          "modified": "2026-09-26T17:08:47.186Z",
          "start_time": "1970-01-01T00:00:00.000Z",
          "stop_time": "5138-11-16T09:46:40.000Z",
          "updated_at": "2026-09-26T17:08:47.186Z"
        },
        "description_available": false,
        "entity_type": "based-on",
        "fromId": "ff3c6844-f5f2-4cd6-ba48-b333146ef244",
        "from_id": "ff3c6844-f5f2-4cd6-ba48-b333146ef244",
        "from_name": null,
        "from_type": "Indicator",
        "id": "1442b5ee-6797-40a0-98eb-f47e8120ef56",
        "is_inferred": false,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "relationship_type": "based-on",
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://www.malwarebytes.com/blog/threat-intel/2026/09/t-mobile-rewards-points-expiry-texts-are-a-phishing-scam",
        "standard_id": "relationship--92803955-1c01-53d2-971e-28dda47e3b41",
        "toId": "c59d99e2-918b-45c1-b7d9-42c2a61ce2af",
        "to_id": "c59d99e2-918b-45c1-b7d9-42c2a61ce2af",
        "to_name": null,
        "to_type": "Hostname"
      },
      {
        "__typename": "StixCoreRelationship",
        "authorized_members": [],
        "confidence": 50,
        "created_by": null,
        "dates": {
          "created": "2026-09-24T16:57:51.987Z",
          "created_at": "2026-09-26T17:08:47.033Z",
          "modified": "2026-09-26T17:08:48.046Z",
          "start_time": "1970-01-01T00:00:00.000Z",
          "stop_time": "5138-11-16T09:46:40.000Z",
          "updated_at": "2026-09-26T17:08:48.046Z"
        },
        "description_available": false,
        "entity_type": "based-on",
        "fromId": "0de3717e-93fa-47e2-a132-b508c6cabdde",
        "from_id": "0de3717e-93fa-47e2-a132-b508c6cabdde",
        "from_name": null,
        "from_type": "Indicator",
        "id": "178f4b32-f1c0-46f6-a595-80f2be374b4f",
        "is_inferred": false,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "relationship_type": "based-on",
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://www.malwarebytes.com/blog/threat-intel/2026/09/t-mobile-rewards-points-expiry-texts-are-a-phishing-scam",
        "standard_id": "relationship--943c431d-231f-5642-a1c3-0caddc7e1923",
        "toId": "5eca82ff-36bf-4328-be3e-d0507adb6e38",
        "to_id": "5eca82ff-36bf-4328-be3e-d0507adb6e38",
        "to_name": null,
        "to_type": "Hostname"
      },
      {
        "__typename": "StixCoreRelationship",
        "authorized_members": [],
        "confidence": 50,
        "created_by": null,
        "dates": {
          "created": "2026-09-24T16:57:51.980Z",
          "created_at": "2026-09-26T17:08:44.919Z",
          "modified": "2026-09-26T17:08:45.611Z",
          "start_time": "1970-01-01T00:00:00.000Z",
          "stop_time": "5138-11-16T09:46:40.000Z",
          "updated_at": "2026-09-26T17:08:45.611Z"
        },
        "description_available": false,
        "entity_type": "based-on",
        "fromId": "488f0212-f839-4671-9da3-e7afd695ca57",
        "from_id": "488f0212-f839-4671-9da3-e7afd695ca57",
        "from_name": null,
        "from_type": "Indicator",
        "id": "227fd182-cee3-4728-a22e-50057bf87cf2",
        "is_inferred": false,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "relationship_type": "based-on",
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://www.malwarebytes.com/blog/threat-intel/2026/09/t-mobile-rewards-points-expiry-texts-are-a-phishing-scam",
        "standard_id": "relationship--1f088dab-994d-53f8-82e4-c298aa9f53d9",
        "toId": "4bbd8eee-4ffa-423f-842b-c82e6ad3d742",
        "to_id": "4bbd8eee-4ffa-423f-842b-c82e6ad3d742",
        "to_name": null,
        "to_type": "Hostname"
      },
      {
        "__typename": "StixCoreRelationship",
        "authorized_members": [],
        "confidence": 50,
        "created_by": null,
        "dates": {
          "created": "2026-09-24T16:57:51.957Z",
          "created_at": "2026-09-26T17:08:39.997Z",
          "modified": "2026-09-26T17:08:41.398Z",
          "start_time": "1970-01-01T00:00:00.000Z",
          "stop_time": "5138-11-16T09:46:40.000Z",
          "updated_at": "2026-09-26T17:08:41.398Z"
        },
        "description_available": false,
        "entity_type": "based-on",
        "fromId": "ac07bce2-2f81-4ffd-b495-c2f5bd34bf21",
        "from_id": "ac07bce2-2f81-4ffd-b495-c2f5bd34bf21",
        "from_name": null,
        "from_type": "Indicator",
        "id": "3e42c736-7f14-4f87-9ec3-eaef8932b061",
        "is_inferred": false,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "relationship_type": "based-on",
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://www.malwarebytes.com/blog/threat-intel/2026/09/t-mobile-rewards-points-expiry-texts-are-a-phishing-scam",
        "standard_id": "relationship--29815188-7b2c-5b8c-9690-d6b62c356c3c",
        "toId": "f5133bf4-f4c7-4b15-9965-1e5b7e841d6f",
        "to_id": "f5133bf4-f4c7-4b15-9965-1e5b7e841d6f",
        "to_name": null,
        "to_type": "Hostname"
      },
      {
        "__typename": "StixCoreRelationship",
        "authorized_members": [],
        "confidence": 50,
        "created_by": null,
        "dates": {
          "created": "2026-09-24T16:57:51.970Z",
          "created_at": "2026-09-26T17:08:43.475Z",
          "modified": "2026-09-26T17:08:43.922Z",
          "start_time": "1970-01-01T00:00:00.000Z",
          "stop_time": "5138-11-16T09:46:40.000Z",
          "updated_at": "2026-09-26T17:08:43.922Z"
        },
        "description_available": false,
        "entity_type": "based-on",
        "fromId": "8982b5dc-43c8-4b0e-a90f-2e40c3c9bb31",
        "from_id": "8982b5dc-43c8-4b0e-a90f-2e40c3c9bb31",
        "from_name": null,
        "from_type": "Indicator",
        "id": "44b9e707-6edf-45d8-9c1c-3686ee6ef126",
        "is_inferred": false,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "relationship_type": "based-on",
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://www.malwarebytes.com/blog/threat-intel/2026/09/t-mobile-rewards-points-expiry-texts-are-a-phishing-scam",
        "standard_id": "relationship--02fe2c3b-f254-53b3-841c-24419a116305",
        "toId": "a7078b43-bead-4dac-9afc-0b3a2df67fb0",
        "to_id": "a7078b43-bead-4dac-9afc-0b3a2df67fb0",
        "to_name": null,
        "to_type": "Hostname"
      },
      {
        "__typename": "StixCoreRelationship",
        "authorized_members": [],
        "confidence": 50,
        "created_by": null,
        "dates": {
          "created": "2026-09-24T16:57:51.966Z",
          "created_at": "2026-09-26T17:08:42.312Z",
          "modified": "2026-09-26T17:08:42.797Z",
          "start_time": "1970-01-01T00:00:00.000Z",
          "stop_time": "5138-11-16T09:46:40.000Z",
          "updated_at": "2026-09-26T17:08:42.797Z"
        },
        "description_available": false,
        "entity_type": "based-on",
        "fromId": "adfb8eff-fe8c-4cc5-af91-2a3abaf493e1",
        "from_id": "adfb8eff-fe8c-4cc5-af91-2a3abaf493e1",
        "from_name": null,
        "from_type": "Indicator",
        "id": "4a2964a3-c995-4fdb-aa17-a4308a6e2334",
        "is_inferred": false,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "relationship_type": "based-on",
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://www.malwarebytes.com/blog/threat-intel/2026/09/t-mobile-rewards-points-expiry-texts-are-a-phishing-scam",
        "standard_id": "relationship--51164021-c7af-5353-8ecd-fb1f26a12bce",
        "toId": "a6536263-c426-43dd-9189-061704501e87",
        "to_id": "a6536263-c426-43dd-9189-061704501e87",
        "to_name": null,
        "to_type": "Hostname"
      },
      {
        "__typename": "StixCoreRelationship",
        "authorized_members": [],
        "confidence": 50,
        "created_by": null,
        "dates": {
          "created": "2026-09-24T16:57:51.974Z",
          "created_at": "2026-09-26T17:08:44.424Z",
          "modified": "2026-09-26T17:08:45.391Z",
          "start_time": "1970-01-01T00:00:00.000Z",
          "stop_time": "5138-11-16T09:46:40.000Z",
          "updated_at": "2026-09-26T17:08:45.391Z"
        },
        "description_available": false,
        "entity_type": "based-on",
        "fromId": "92f472e0-9fce-4099-9cde-c2fd73b51487",
        "from_id": "92f472e0-9fce-4099-9cde-c2fd73b51487",
        "from_name": null,
        "from_type": "Indicator",
        "id": "a42b04dd-3841-43f1-bbf6-009694abb871",
        "is_inferred": false,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "relationship_type": "based-on",
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://www.malwarebytes.com/blog/threat-intel/2026/09/t-mobile-rewards-points-expiry-texts-are-a-phishing-scam",
        "standard_id": "relationship--6ba67a0b-585d-5cfb-b263-31655cb5e686",
        "toId": "19823d31-f328-4e75-91ea-93d43b45dfb5",
        "to_id": "19823d31-f328-4e75-91ea-93d43b45dfb5",
        "to_name": null,
        "to_type": "Hostname"
      },
      {
        "__typename": "StixCoreRelationship",
        "authorized_members": [],
        "confidence": 50,
        "created_by": null,
        "dates": {
          "created": "2026-09-24T16:57:51.977Z",
          "created_at": "2026-09-26T17:08:43.603Z",
          "modified": "2026-09-26T17:08:44.588Z",
          "start_time": "1970-01-01T00:00:00.000Z",
          "stop_time": "5138-11-16T09:46:40.000Z",
          "updated_at": "2026-09-26T17:08:44.588Z"
        },
        "description_available": false,
        "entity_type": "based-on",
        "fromId": "17a5cadc-9405-466b-987c-c48cd6fcbf58",
        "from_id": "17a5cadc-9405-466b-987c-c48cd6fcbf58",
        "from_name": null,
        "from_type": "Indicator",
        "id": "abaf1933-3685-466e-9573-5d8c84c79102",
        "is_inferred": false,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "relationship_type": "based-on",
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://www.malwarebytes.com/blog/threat-intel/2026/09/t-mobile-rewards-points-expiry-texts-are-a-phishing-scam",
        "standard_id": "relationship--a2487ec0-35f4-598a-bb59-cdb8961e65e2",
        "toId": "b9428f50-6b19-4c41-b10a-c1861431eee0",
        "to_id": "b9428f50-6b19-4c41-b10a-c1861431eee0",
        "to_name": null,
        "to_type": "Hostname"
      },
      {
        "__typename": "StixCoreRelationship",
        "authorized_members": [],
        "confidence": 50,
        "created_by": null,
        "dates": {
          "created": "2026-09-24T16:57:51.960Z",
          "created_at": "2026-09-26T17:08:41.901Z",
          "modified": "2026-09-26T17:08:42.600Z",
          "start_time": "1970-01-01T00:00:00.000Z",
          "stop_time": "5138-11-16T09:46:40.000Z",
          "updated_at": "2026-09-26T17:08:42.600Z"
        },
        "description_available": false,
        "entity_type": "based-on",
        "fromId": "bf690e5f-4cad-4d19-863b-1f9c57427848",
        "from_id": "bf690e5f-4cad-4d19-863b-1f9c57427848",
        "from_name": null,
        "from_type": "Indicator",
        "id": "b9261734-8074-402e-9ccb-bf1b7b3b74ca",
        "is_inferred": false,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "relationship_type": "based-on",
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://www.malwarebytes.com/blog/threat-intel/2026/09/t-mobile-rewards-points-expiry-texts-are-a-phishing-scam",
        "standard_id": "relationship--9a7fef95-d706-5bbf-ad70-ec4c00e914b6",
        "toId": "fd19200d-ff81-43ff-b836-00a638f115ee",
        "to_id": "fd19200d-ff81-43ff-b836-00a638f115ee",
        "to_name": null,
        "to_type": "Hostname"
      },
      {
        "__typename": "StixCoreRelationship",
        "authorized_members": [],
        "confidence": 50,
        "created_by": null,
        "dates": {
          "created": "2026-09-24T16:57:51.962Z",
          "created_at": "2026-09-26T17:08:41.901Z",
          "modified": "2026-09-26T17:08:42.602Z",
          "start_time": "1970-01-01T00:00:00.000Z",
          "stop_time": "5138-11-16T09:46:40.000Z",
          "updated_at": "2026-09-26T17:08:42.602Z"
        },
        "description_available": false,
        "entity_type": "based-on",
        "fromId": "99121aea-8ff6-406d-ba98-d5b74f496f80",
        "from_id": "99121aea-8ff6-406d-ba98-d5b74f496f80",
        "from_name": null,
        "from_type": "Indicator",
        "id": "eb28b9c0-5695-45e2-b4bb-fe1e1513295f",
        "is_inferred": false,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "relationship_type": "based-on",
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://www.malwarebytes.com/blog/threat-intel/2026/09/t-mobile-rewards-points-expiry-texts-are-a-phishing-scam",
        "standard_id": "relationship--a63c2111-5572-5b7d-8c08-5378e486b8d1",
        "toId": "2f17f7e0-caab-40da-ae6d-333776f42ff4",
        "to_id": "2f17f7e0-caab-40da-ae6d-333776f42ff4",
        "to_name": null,
        "to_type": "Hostname"
      },
      {
        "__typename": "StixCoreRelationship",
        "authorized_members": [],
        "confidence": 50,
        "created_by": null,
        "dates": {
          "created": "2026-09-24T16:57:51.982Z",
          "created_at": "2026-09-26T17:08:45.324Z",
          "modified": "2026-09-26T17:08:46.729Z",
          "start_time": "1970-01-01T00:00:00.000Z",
          "stop_time": "5138-11-16T09:46:40.000Z",
          "updated_at": "2026-09-26T17:08:46.729Z"
        },
        "description_available": false,
        "entity_type": "based-on",
        "fromId": "24ca0ecb-92e3-4ff5-980e-643f913beb67",
        "from_id": "24ca0ecb-92e3-4ff5-980e-643f913beb67",
        "from_name": null,
        "from_type": "Indicator",
        "id": "f806e3f8-a0f6-4305-847a-cfb104bd4f41",
        "is_inferred": false,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "relationship_type": "based-on",
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://www.malwarebytes.com/blog/threat-intel/2026/09/t-mobile-rewards-points-expiry-texts-are-a-phishing-scam",
        "standard_id": "relationship--092f4d3a-c812-5ca2-943c-b5997c13d131",
        "toId": "79bb8518-df8f-4b7a-a617-d280f5aef243",
        "to_id": "79bb8518-df8f-4b7a-a617-d280f5aef243",
        "to_name": null,
        "to_type": "Hostname"
      },
      {
        "__typename": "StixCoreRelationship",
        "authorized_members": [],
        "confidence": 50,
        "created_by": null,
        "dates": {
          "created": "2026-09-24T16:57:51.955Z",
          "created_at": "2026-09-26T17:08:36.878Z",
          "modified": "2026-09-26T17:08:37.390Z",
          "start_time": "1970-01-01T00:00:00.000Z",
          "stop_time": "5138-11-16T09:46:40.000Z",
          "updated_at": "2026-09-26T17:08:37.390Z"
        },
        "description_available": false,
        "entity_type": "based-on",
        "fromId": "6d369bb7-69d7-4457-b366-2f31d99001f4",
        "from_id": "6d369bb7-69d7-4457-b366-2f31d99001f4",
        "from_name": null,
        "from_type": "Indicator",
        "id": "fa2b0269-3888-44b3-8692-2518a0369335",
        "is_inferred": false,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "relationship_type": "based-on",
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://www.malwarebytes.com/blog/threat-intel/2026/09/t-mobile-rewards-points-expiry-texts-are-a-phishing-scam",
        "standard_id": "relationship--14f06a3d-843b-549b-a849-40c0158bf283",
        "toId": "82e50c4c-dd23-46a6-b9b9-f9c910a9d874",
        "to_id": "82e50c4c-dd23-46a6-b9b9-f9c910a9d874",
        "to_name": null,
        "to_type": "Hostname"
      }
    ],
    "iocs": [],
    "mentioned": [],
    "mitre": {
      "associated_repertoire": [],
      "direct_techniques": []
    },
    "report_metadata": {
      "authorized_members": [],
      "confidence": 50,
      "created_by": null,
      "dates": {
        "created": "2026-09-17T16:23:58.251Z",
        "created_at": "2026-09-26T17:08:57.622Z",
        "modified": "2026-09-26T17:08:58.808Z",
        "published": "2026-09-17T16:23:58.251Z",
        "updated_at": "2026-09-26T17:08:58.808Z"
      },
      "description_available": true,
      "id": "672a8653-9544-41c5-bd15-0f5d146f5216",
      "is_inferred": false,
      "labels": [
        "phishing campaign",
        "rewards points scam",
        "smishing",
        "sms phishing",
        "social engineering"
      ],
      "lang": "en",
      "name": "T-Mobile rewards points expiry texts are a phishing scam",
      "objectMarking": [
        {
          "definition": "TLP:CLEAR",
          "definition_type": "TLP"
        }
      ],
      "objectOrganization": [],
      "published": "2026-09-17T16:23:58.251Z",
      "references": [
        {
          "external_id": null,
          "id": "5d5194b8-9b34-4523-8c74-b25543b87bf5",
          "source_name": "alien-vault",
          "url": "https://www.malwarebytes.com/blog/threat-intel/2026/09/t-mobile-rewards-points-expiry-texts-are-a-phishing-scam"
        },
        {
          "external_id": "6aac141e2773119436b98523",
          "id": "05b7bfb3-bd3e-416d-aeab-203ea71622cd",
          "source_name": "alien-vault",
          "url": "https://otx.alienvault.com/pulse/6aac141e2773119436b98523"
        }
      ],
      "report_types": [
        "threat-report"
      ],
      "restrict_access": false,
      "source_url": "https://www.malwarebytes.com/blog/threat-intel/2026/09/t-mobile-rewards-points-expiry-texts-are-a-phishing-scam"
    },
    "targets": [],
    "techniques": [],
    "vulnerabilities": []
  },
  "report_id": "672a8653-9544-41c5-bd15-0f5d146f5216",
  "schema_version": 1,
  "selected_date": "2026-09-17",
  "source_url": "https://www.malwarebytes.com/blog/threat-intel/2026/09/t-mobile-rewards-points-expiry-texts-are-a-phishing-scam"
}