index=activity AND rg_functionality="Next Generation Firewall" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "official-server.com" OR destinationhostname CONTAINS "server694590423.tech" OR destinationhostname CONTAINS "island-placid-bromine.glitch.me" OR destinationhostname CONTAINS "circular-noon-farmhouse.glitch.me" OR destinationhostname CONTAINS "talented-friendly-price.glitch.me" OR destinationhostname CONTAINS "dflfmgsdokasdcpl.com" OR destinationhostname CONTAINS "original-backend.com" OR destinationhostname CONTAINS "07159889-coinbase.com" OR destinationhostname CONTAINS "10195-coinbase.com" OR destinationhostname CONTAINS "11246-coinbase.com" OR destinationhostname CONTAINS "11247-coinbase.com" OR destinationhostname CONTAINS "11248-coinbase.com" OR destinationhostname CONTAINS "11258-coinbase.com" OR destinationhostname CONTAINS "11259-coinbase.com" OR destinationhostname CONTAINS "113912-coinbase.com" OR destinationhostname CONTAINS "11472-coinbase.com" OR destinationhostname CONTAINS "11923-coinbase.com" OR destinationhostname CONTAINS "11957-coinbase.com" OR destinationhostname CONTAINS "128147-coinbase.com" OR destinationhostname CONTAINS "12958-coinbase.com" OR destinationhostname CONTAINS "12984-okta.com" OR destinationhostname CONTAINS "12985-coinbase.com" OR destinationhostname CONTAINS "13130-coinbase.com" OR destinationhostname CONTAINS "13247-coinbase.com" OR destinationhostname CONTAINS "13247-icloud.com" OR destinationhostname CONTAINS "13267-coinbase.com" OR destinationhostname CONTAINS "146271510-coinbase.com" OR destinationhostname CONTAINS "146282-coinbase.com" OR destinationhostname CONTAINS "146284-coinbase.com" OR destinationhostname CONTAINS "147260-coinbase.com" OR destinationhostname CONTAINS "14765-coinbase.com" OR destinationhostname CONTAINS "14817582-coinbase.com" OR destinationhostname CONTAINS "14871904-coinbase.com" OR destinationhostname CONTAINS "14891902-coinbase.com" OR destinationhostname CONTAINS "1492864-coinbase.com" OR destinationhostname CONTAINS "158312-coinbase.com" OR destinationhostname CONTAINS "158372-coinbase.com" OR destinationhostname CONTAINS "158702-coinbase.com" OR destinationhostname CONTAINS "16171675-coinbase.com" OR destinationhostname CONTAINS "16171832-coinbase.com" OR destinationhostname CONTAINS "16178234-coinbase.com" OR destinationhostname CONTAINS "16178237-coinbase.com" OR destinationhostname CONTAINS "16178434-coinbase.com" OR destinationhostname CONTAINS "162178-coinbase.com" OR destinationhostname CONTAINS "162478-coinbase.com" OR destinationhostname CONTAINS "162782-coinbase.com" OR destinationhostname CONTAINS "162812-coinbase.com" OR destinationhostname CONTAINS "162814-coinbase.com" OR destinationhostname CONTAINS "16442580-coinbase.com" OR destinationhostname CONTAINS "16450107-coinbase.com")
index=activity AND rg_functionality="Next Generation Firewall" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "official-server.com" OR sourcentdomain CONTAINS "server694590423.tech" OR sourcentdomain CONTAINS "island-placid-bromine.glitch.me" OR sourcentdomain CONTAINS "circular-noon-farmhouse.glitch.me" OR sourcentdomain CONTAINS "talented-friendly-price.glitch.me" OR sourcentdomain CONTAINS "dflfmgsdokasdcpl.com" OR sourcentdomain CONTAINS "original-backend.com" OR sourcentdomain CONTAINS "07159889-coinbase.com" OR sourcentdomain CONTAINS "10195-coinbase.com" OR sourcentdomain CONTAINS "11246-coinbase.com" OR sourcentdomain CONTAINS "11247-coinbase.com" OR sourcentdomain CONTAINS "11248-coinbase.com" OR sourcentdomain CONTAINS "11258-coinbase.com" OR sourcentdomain CONTAINS "11259-coinbase.com" OR sourcentdomain CONTAINS "113912-coinbase.com" OR sourcentdomain CONTAINS "11472-coinbase.com" OR sourcentdomain CONTAINS "11923-coinbase.com" OR sourcentdomain CONTAINS "11957-coinbase.com" OR sourcentdomain CONTAINS "128147-coinbase.com" OR sourcentdomain CONTAINS "12958-coinbase.com" OR sourcentdomain CONTAINS "12984-okta.com" OR sourcentdomain CONTAINS "12985-coinbase.com" OR sourcentdomain CONTAINS "13130-coinbase.com" OR sourcentdomain CONTAINS "13247-coinbase.com" OR sourcentdomain CONTAINS "13247-icloud.com" OR sourcentdomain CONTAINS "13267-coinbase.com" OR sourcentdomain CONTAINS "146271510-coinbase.com" OR sourcentdomain CONTAINS "146282-coinbase.com" OR sourcentdomain CONTAINS "146284-coinbase.com" OR sourcentdomain CONTAINS "147260-coinbase.com" OR sourcentdomain CONTAINS "14765-coinbase.com" OR sourcentdomain CONTAINS "14817582-coinbase.com" OR sourcentdomain CONTAINS "14871904-coinbase.com" OR sourcentdomain CONTAINS "14891902-coinbase.com" OR sourcentdomain CONTAINS "1492864-coinbase.com" OR sourcentdomain CONTAINS "158312-coinbase.com" OR sourcentdomain CONTAINS "158372-coinbase.com" OR sourcentdomain CONTAINS "158702-coinbase.com" OR sourcentdomain CONTAINS "16171675-coinbase.com" OR sourcentdomain CONTAINS "16171832-coinbase.com" OR sourcentdomain CONTAINS "16178234-coinbase.com" OR sourcentdomain CONTAINS "16178237-coinbase.com" OR sourcentdomain CONTAINS "16178434-coinbase.com" OR sourcentdomain CONTAINS "162178-coinbase.com" OR sourcentdomain CONTAINS "162478-coinbase.com" OR sourcentdomain CONTAINS "162782-coinbase.com" OR sourcentdomain CONTAINS "162812-coinbase.com" OR sourcentdomain CONTAINS "162814-coinbase.com" OR sourcentdomain CONTAINS "16442580-coinbase.com" OR sourcentdomain CONTAINS "16450107-coinbase.com")
index=activity AND rg_functionality="Next Generation Firewall" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "official-server.com" OR sourcehostname CONTAINS "server694590423.tech" OR sourcehostname CONTAINS "island-placid-bromine.glitch.me" OR sourcehostname CONTAINS "circular-noon-farmhouse.glitch.me" OR sourcehostname CONTAINS "talented-friendly-price.glitch.me" OR sourcehostname CONTAINS "dflfmgsdokasdcpl.com" OR sourcehostname CONTAINS "original-backend.com" OR sourcehostname CONTAINS "07159889-coinbase.com" OR sourcehostname CONTAINS "10195-coinbase.com" OR sourcehostname CONTAINS "11246-coinbase.com" OR sourcehostname CONTAINS "11247-coinbase.com" OR sourcehostname CONTAINS "11248-coinbase.com" OR sourcehostname CONTAINS "11258-coinbase.com" OR sourcehostname CONTAINS "11259-coinbase.com" OR sourcehostname CONTAINS "113912-coinbase.com" OR sourcehostname CONTAINS "11472-coinbase.com" OR sourcehostname CONTAINS "11923-coinbase.com" OR sourcehostname CONTAINS "11957-coinbase.com" OR sourcehostname CONTAINS "128147-coinbase.com" OR sourcehostname CONTAINS "12958-coinbase.com" OR sourcehostname CONTAINS "12984-okta.com" OR sourcehostname CONTAINS "12985-coinbase.com" OR sourcehostname CONTAINS "13130-coinbase.com" OR sourcehostname CONTAINS "13247-coinbase.com" OR sourcehostname CONTAINS "13247-icloud.com" OR sourcehostname CONTAINS "13267-coinbase.com" OR sourcehostname CONTAINS "146271510-coinbase.com" OR sourcehostname CONTAINS "146282-coinbase.com" OR sourcehostname CONTAINS "146284-coinbase.com" OR sourcehostname CONTAINS "147260-coinbase.com" OR sourcehostname CONTAINS "14765-coinbase.com" OR sourcehostname CONTAINS "14817582-coinbase.com" OR sourcehostname CONTAINS "14871904-coinbase.com" OR sourcehostname CONTAINS "14891902-coinbase.com" OR sourcehostname CONTAINS "1492864-coinbase.com" OR sourcehostname CONTAINS "158312-coinbase.com" OR sourcehostname CONTAINS "158372-coinbase.com" OR sourcehostname CONTAINS "158702-coinbase.com" OR sourcehostname CONTAINS "16171675-coinbase.com" OR sourcehostname CONTAINS "16171832-coinbase.com" OR sourcehostname CONTAINS "16178234-coinbase.com" OR sourcehostname CONTAINS "16178237-coinbase.com" OR sourcehostname CONTAINS "16178434-coinbase.com" OR sourcehostname CONTAINS "162178-coinbase.com" OR sourcehostname CONTAINS "162478-coinbase.com" OR sourcehostname CONTAINS "162782-coinbase.com" OR sourcehostname CONTAINS "162812-coinbase.com" OR sourcehostname CONTAINS "162814-coinbase.com" OR sourcehostname CONTAINS "16442580-coinbase.com" OR sourcehostname CONTAINS "16450107-coinbase.com")
index=activity AND rg_functionality="Next Generation Firewall" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "official-server.com" OR destinationntdomain CONTAINS "server694590423.tech" OR destinationntdomain CONTAINS "island-placid-bromine.glitch.me" OR destinationntdomain CONTAINS "circular-noon-farmhouse.glitch.me" OR destinationntdomain CONTAINS "talented-friendly-price.glitch.me" OR destinationntdomain CONTAINS "dflfmgsdokasdcpl.com" OR destinationntdomain CONTAINS "original-backend.com" OR destinationntdomain CONTAINS "07159889-coinbase.com" OR destinationntdomain CONTAINS "10195-coinbase.com" OR destinationntdomain CONTAINS "11246-coinbase.com" OR destinationntdomain CONTAINS "11247-coinbase.com" OR destinationntdomain CONTAINS "11248-coinbase.com" OR destinationntdomain CONTAINS "11258-coinbase.com" OR destinationntdomain CONTAINS "11259-coinbase.com" OR destinationntdomain CONTAINS "113912-coinbase.com" OR destinationntdomain CONTAINS "11472-coinbase.com" OR destinationntdomain CONTAINS "11923-coinbase.com" OR destinationntdomain CONTAINS "11957-coinbase.com" OR destinationntdomain CONTAINS "128147-coinbase.com" OR destinationntdomain CONTAINS "12958-coinbase.com" OR destinationntdomain CONTAINS "12984-okta.com" OR destinationntdomain CONTAINS "12985-coinbase.com" OR destinationntdomain CONTAINS "13130-coinbase.com" OR destinationntdomain CONTAINS "13247-coinbase.com" OR destinationntdomain CONTAINS "13247-icloud.com" OR destinationntdomain CONTAINS "13267-coinbase.com" OR destinationntdomain CONTAINS "146271510-coinbase.com" OR destinationntdomain CONTAINS "146282-coinbase.com" OR destinationntdomain CONTAINS "146284-coinbase.com" OR destinationntdomain CONTAINS "147260-coinbase.com" OR destinationntdomain CONTAINS "14765-coinbase.com" OR destinationntdomain CONTAINS "14817582-coinbase.com" OR destinationntdomain CONTAINS "14871904-coinbase.com" OR destinationntdomain CONTAINS "14891902-coinbase.com" OR destinationntdomain CONTAINS "1492864-coinbase.com" OR destinationntdomain CONTAINS "158312-coinbase.com" OR destinationntdomain CONTAINS "158372-coinbase.com" OR destinationntdomain CONTAINS "158702-coinbase.com" OR destinationntdomain CONTAINS "16171675-coinbase.com" OR destinationntdomain CONTAINS "16171832-coinbase.com" OR destinationntdomain CONTAINS "16178234-coinbase.com" OR destinationntdomain CONTAINS "16178237-coinbase.com" OR destinationntdomain CONTAINS "16178434-coinbase.com" OR destinationntdomain CONTAINS "162178-coinbase.com" OR destinationntdomain CONTAINS "162478-coinbase.com" OR destinationntdomain CONTAINS "162782-coinbase.com" OR destinationntdomain CONTAINS "162812-coinbase.com" OR destinationntdomain CONTAINS "162814-coinbase.com" OR destinationntdomain CONTAINS "16442580-coinbase.com" OR destinationntdomain CONTAINS "16450107-coinbase.com")
index=activity AND rg_functionality="Next Generation Firewall" AND requesturl NOT NULL AND (requesturl CONTAINS "official-server.com" OR requesturl CONTAINS "server694590423.tech" OR requesturl CONTAINS "island-placid-bromine.glitch.me" OR requesturl CONTAINS "circular-noon-farmhouse.glitch.me" OR requesturl CONTAINS "talented-friendly-price.glitch.me" OR requesturl CONTAINS "dflfmgsdokasdcpl.com" OR requesturl CONTAINS "original-backend.com" OR requesturl CONTAINS "07159889-coinbase.com" OR requesturl CONTAINS "10195-coinbase.com" OR requesturl CONTAINS "11246-coinbase.com" OR requesturl CONTAINS "11247-coinbase.com" OR requesturl CONTAINS "11248-coinbase.com" OR requesturl CONTAINS "11258-coinbase.com" OR requesturl CONTAINS "11259-coinbase.com" OR requesturl CONTAINS "113912-coinbase.com" OR requesturl CONTAINS "11472-coinbase.com" OR requesturl CONTAINS "11923-coinbase.com" OR requesturl CONTAINS "11957-coinbase.com" OR requesturl CONTAINS "128147-coinbase.com" OR requesturl CONTAINS "12958-coinbase.com" OR requesturl CONTAINS "12984-okta.com" OR requesturl CONTAINS "12985-coinbase.com" OR requesturl CONTAINS "13130-coinbase.com" OR requesturl CONTAINS "13247-coinbase.com" OR requesturl CONTAINS "13247-icloud.com" OR requesturl CONTAINS "13267-coinbase.com" OR requesturl CONTAINS "146271510-coinbase.com" OR requesturl CONTAINS "146282-coinbase.com" OR requesturl CONTAINS "146284-coinbase.com" OR requesturl CONTAINS "147260-coinbase.com" OR requesturl CONTAINS "14765-coinbase.com" OR requesturl CONTAINS "14817582-coinbase.com" OR requesturl CONTAINS "14871904-coinbase.com" OR requesturl CONTAINS "14891902-coinbase.com" OR requesturl CONTAINS "1492864-coinbase.com" OR requesturl CONTAINS "158312-coinbase.com" OR requesturl CONTAINS "158372-coinbase.com" OR requesturl CONTAINS "158702-coinbase.com" OR requesturl CONTAINS "16171675-coinbase.com" OR requesturl CONTAINS "16171832-coinbase.com" OR requesturl CONTAINS "16178234-coinbase.com" OR requesturl CONTAINS "16178237-coinbase.com" OR requesturl CONTAINS "16178434-coinbase.com" OR requesturl CONTAINS "162178-coinbase.com" OR requesturl CONTAINS "162478-coinbase.com" OR requesturl CONTAINS "162782-coinbase.com" OR requesturl CONTAINS "162812-coinbase.com" OR requesturl CONTAINS "162814-coinbase.com" OR requesturl CONTAINS "16442580-coinbase.com" OR requesturl CONTAINS "16450107-coinbase.com")
index=activity AND rg_functionality="Next Generation Firewall" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "16450207-coinbase.com" OR destinationhostname CONTAINS "16458207-coinbase.com" OR destinationhostname CONTAINS "16478202-coinbase.com" OR destinationhostname CONTAINS "164872942-coinbase.com" OR destinationhostname CONTAINS "16590-coinbase.com" OR destinationhostname CONTAINS "16594373-coinbase.com" OR destinationhostname CONTAINS "16624831-coinbase.com" OR destinationhostname CONTAINS "16642124-coinbase.com" OR destinationhostname CONTAINS "16642172-coinbase.com" OR destinationhostname CONTAINS "16642580-coinbase.com" OR destinationhostname CONTAINS "16642721-coinbase.com" OR destinationhostname CONTAINS "16642724-coinbase.com" OR destinationhostname CONTAINS "16642871-coinbase.com" OR destinationhostname CONTAINS "16642872-coinbase.com" OR destinationhostname CONTAINS "16712942-coinbase.com" OR destinationhostname CONTAINS "16718672-coinbase.com" OR destinationhostname CONTAINS "16728342-coinbase.com" OR destinationhostname CONTAINS "16728348-coinbase.com" OR destinationhostname CONTAINS "16728442-coinbase.com" OR destinationhostname CONTAINS "16728472-coinbase.com" OR destinationhostname CONTAINS "167285-coinbase.com" OR destinationhostname CONTAINS "16729042-coinbase.com" OR destinationhostname CONTAINS "16748272-coinbase.com" OR destinationhostname CONTAINS "16782942-coinbase.com" OR destinationhostname CONTAINS "16827420-coinbase.com" OR destinationhostname CONTAINS "16827423-coinbase.com" OR destinationhostname CONTAINS "16847145-coinbase.com" OR destinationhostname CONTAINS "16893924-coinbase.com" OR destinationhostname CONTAINS "17182-coinbase.com" OR destinationhostname CONTAINS "17255030-coinbase.com" OR destinationhostname CONTAINS "17259-kraken.com" OR destinationhostname CONTAINS "172486-coinbase.com" OR destinationhostname CONTAINS "17284652-coinbase.com" OR destinationhostname CONTAINS "17286-coinbase.com" OR destinationhostname CONTAINS "17334522-coinbase.com" OR destinationhostname CONTAINS "17334522-kraken.com" OR destinationhostname CONTAINS "17384522-coinbase.com" OR destinationhostname CONTAINS "173912-coinbase.com" OR destinationhostname CONTAINS "17494976-coinbase.com" OR destinationhostname CONTAINS "17512854-coinbase.com" OR destinationhostname CONTAINS "17512857-coinbase.com" OR destinationhostname CONTAINS "1751954-coinbase.com" OR destinationhostname CONTAINS "17525030-coinbase.com" OR destinationhostname CONTAINS "17529580-coinbase.com" OR destinationhostname CONTAINS "17614-coinbase.com" OR destinationhostname CONTAINS "17618412-coinbase.com" OR destinationhostname CONTAINS "17619-coinbase.com" OR destinationhostname CONTAINS "176284-coinbase.com" OR destinationhostname CONTAINS "17823920-coinbase.com" OR destinationhostname CONTAINS "178253-coinbase.com")
index=activity AND rg_functionality="Next Generation Firewall" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "16450207-coinbase.com" OR sourcentdomain CONTAINS "16458207-coinbase.com" OR sourcentdomain CONTAINS "16478202-coinbase.com" OR sourcentdomain CONTAINS "164872942-coinbase.com" OR sourcentdomain CONTAINS "16590-coinbase.com" OR sourcentdomain CONTAINS "16594373-coinbase.com" OR sourcentdomain CONTAINS "16624831-coinbase.com" OR sourcentdomain CONTAINS "16642124-coinbase.com" OR sourcentdomain CONTAINS "16642172-coinbase.com" OR sourcentdomain CONTAINS "16642580-coinbase.com" OR sourcentdomain CONTAINS "16642721-coinbase.com" OR sourcentdomain CONTAINS "16642724-coinbase.com" OR sourcentdomain CONTAINS "16642871-coinbase.com" OR sourcentdomain CONTAINS "16642872-coinbase.com" OR sourcentdomain CONTAINS "16712942-coinbase.com" OR sourcentdomain CONTAINS "16718672-coinbase.com" OR sourcentdomain CONTAINS "16728342-coinbase.com" OR sourcentdomain CONTAINS "16728348-coinbase.com" OR sourcentdomain CONTAINS "16728442-coinbase.com" OR sourcentdomain CONTAINS "16728472-coinbase.com" OR sourcentdomain CONTAINS "167285-coinbase.com" OR sourcentdomain CONTAINS "16729042-coinbase.com" OR sourcentdomain CONTAINS "16748272-coinbase.com" OR sourcentdomain CONTAINS "16782942-coinbase.com" OR sourcentdomain CONTAINS "16827420-coinbase.com" OR sourcentdomain CONTAINS "16827423-coinbase.com" OR sourcentdomain CONTAINS "16847145-coinbase.com" OR sourcentdomain CONTAINS "16893924-coinbase.com" OR sourcentdomain CONTAINS "17182-coinbase.com" OR sourcentdomain CONTAINS "17255030-coinbase.com" OR sourcentdomain CONTAINS "17259-kraken.com" OR sourcentdomain CONTAINS "172486-coinbase.com" OR sourcentdomain CONTAINS "17284652-coinbase.com" OR sourcentdomain CONTAINS "17286-coinbase.com" OR sourcentdomain CONTAINS "17334522-coinbase.com" OR sourcentdomain CONTAINS "17334522-kraken.com" OR sourcentdomain CONTAINS "17384522-coinbase.com" OR sourcentdomain CONTAINS "173912-coinbase.com" OR sourcentdomain CONTAINS "17494976-coinbase.com" OR sourcentdomain CONTAINS "17512854-coinbase.com" OR sourcentdomain CONTAINS "17512857-coinbase.com" OR sourcentdomain CONTAINS "1751954-coinbase.com" OR sourcentdomain CONTAINS "17525030-coinbase.com" OR sourcentdomain CONTAINS "17529580-coinbase.com" OR sourcentdomain CONTAINS "17614-coinbase.com" OR sourcentdomain CONTAINS "17618412-coinbase.com" OR sourcentdomain CONTAINS "17619-coinbase.com" OR sourcentdomain CONTAINS "176284-coinbase.com" OR sourcentdomain CONTAINS "17823920-coinbase.com" OR sourcentdomain CONTAINS "178253-coinbase.com")
index=activity AND rg_functionality="Next Generation Firewall" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "16450207-coinbase.com" OR sourcehostname CONTAINS "16458207-coinbase.com" OR sourcehostname CONTAINS "16478202-coinbase.com" OR sourcehostname CONTAINS "164872942-coinbase.com" OR sourcehostname CONTAINS "16590-coinbase.com" OR sourcehostname CONTAINS "16594373-coinbase.com" OR sourcehostname CONTAINS "16624831-coinbase.com" OR sourcehostname CONTAINS "16642124-coinbase.com" OR sourcehostname CONTAINS "16642172-coinbase.com" OR sourcehostname CONTAINS "16642580-coinbase.com" OR sourcehostname CONTAINS "16642721-coinbase.com" OR sourcehostname CONTAINS "16642724-coinbase.com" OR sourcehostname CONTAINS "16642871-coinbase.com" OR sourcehostname CONTAINS "16642872-coinbase.com" OR sourcehostname CONTAINS "16712942-coinbase.com" OR sourcehostname CONTAINS "16718672-coinbase.com" OR sourcehostname CONTAINS "16728342-coinbase.com" OR sourcehostname CONTAINS "16728348-coinbase.com" OR sourcehostname CONTAINS "16728442-coinbase.com" OR sourcehostname CONTAINS "16728472-coinbase.com" OR sourcehostname CONTAINS "167285-coinbase.com" OR sourcehostname CONTAINS "16729042-coinbase.com" OR sourcehostname CONTAINS "16748272-coinbase.com" OR sourcehostname CONTAINS "16782942-coinbase.com" OR sourcehostname CONTAINS "16827420-coinbase.com" OR sourcehostname CONTAINS "16827423-coinbase.com" OR sourcehostname CONTAINS "16847145-coinbase.com" OR sourcehostname CONTAINS "16893924-coinbase.com" OR sourcehostname CONTAINS "17182-coinbase.com" OR sourcehostname CONTAINS "17255030-coinbase.com" OR sourcehostname CONTAINS "17259-kraken.com" OR sourcehostname CONTAINS "172486-coinbase.com" OR sourcehostname CONTAINS "17284652-coinbase.com" OR sourcehostname CONTAINS "17286-coinbase.com" OR sourcehostname CONTAINS "17334522-coinbase.com" OR sourcehostname CONTAINS "17334522-kraken.com" OR sourcehostname CONTAINS "17384522-coinbase.com" OR sourcehostname CONTAINS "173912-coinbase.com" OR sourcehostname CONTAINS "17494976-coinbase.com" OR sourcehostname CONTAINS "17512854-coinbase.com" OR sourcehostname CONTAINS "17512857-coinbase.com" OR sourcehostname CONTAINS "1751954-coinbase.com" OR sourcehostname CONTAINS "17525030-coinbase.com" OR sourcehostname CONTAINS "17529580-coinbase.com" OR sourcehostname CONTAINS "17614-coinbase.com" OR sourcehostname CONTAINS "17618412-coinbase.com" OR sourcehostname CONTAINS "17619-coinbase.com" OR sourcehostname CONTAINS "176284-coinbase.com" OR sourcehostname CONTAINS "17823920-coinbase.com" OR sourcehostname CONTAINS "178253-coinbase.com")
index=activity AND rg_functionality="Next Generation Firewall" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "16450207-coinbase.com" OR destinationntdomain CONTAINS "16458207-coinbase.com" OR destinationntdomain CONTAINS "16478202-coinbase.com" OR destinationntdomain CONTAINS "164872942-coinbase.com" OR destinationntdomain CONTAINS "16590-coinbase.com" OR destinationntdomain CONTAINS "16594373-coinbase.com" OR destinationntdomain CONTAINS "16624831-coinbase.com" OR destinationntdomain CONTAINS "16642124-coinbase.com" OR destinationntdomain CONTAINS "16642172-coinbase.com" OR destinationntdomain CONTAINS "16642580-coinbase.com" OR destinationntdomain CONTAINS "16642721-coinbase.com" OR destinationntdomain CONTAINS "16642724-coinbase.com" OR destinationntdomain CONTAINS "16642871-coinbase.com" OR destinationntdomain CONTAINS "16642872-coinbase.com" OR destinationntdomain CONTAINS "16712942-coinbase.com" OR destinationntdomain CONTAINS "16718672-coinbase.com" OR destinationntdomain CONTAINS "16728342-coinbase.com" OR destinationntdomain CONTAINS "16728348-coinbase.com" OR destinationntdomain CONTAINS "16728442-coinbase.com" OR destinationntdomain CONTAINS "16728472-coinbase.com" OR destinationntdomain CONTAINS "167285-coinbase.com" OR destinationntdomain CONTAINS "16729042-coinbase.com" OR destinationntdomain CONTAINS "16748272-coinbase.com" OR destinationntdomain CONTAINS "16782942-coinbase.com" OR destinationntdomain CONTAINS "16827420-coinbase.com" OR destinationntdomain CONTAINS "16827423-coinbase.com" OR destinationntdomain CONTAINS "16847145-coinbase.com" OR destinationntdomain CONTAINS "16893924-coinbase.com" OR destinationntdomain CONTAINS "17182-coinbase.com" OR destinationntdomain CONTAINS "17255030-coinbase.com" OR destinationntdomain CONTAINS "17259-kraken.com" OR destinationntdomain CONTAINS "172486-coinbase.com" OR destinationntdomain CONTAINS "17284652-coinbase.com" OR destinationntdomain CONTAINS "17286-coinbase.com" OR destinationntdomain CONTAINS "17334522-coinbase.com" OR destinationntdomain CONTAINS "17334522-kraken.com" OR destinationntdomain CONTAINS "17384522-coinbase.com" OR destinationntdomain CONTAINS "173912-coinbase.com" OR destinationntdomain CONTAINS "17494976-coinbase.com" OR destinationntdomain CONTAINS "17512854-coinbase.com" OR destinationntdomain CONTAINS "17512857-coinbase.com" OR destinationntdomain CONTAINS "1751954-coinbase.com" OR destinationntdomain CONTAINS "17525030-coinbase.com" OR destinationntdomain CONTAINS "17529580-coinbase.com" OR destinationntdomain CONTAINS "17614-coinbase.com" OR destinationntdomain CONTAINS "17618412-coinbase.com" OR destinationntdomain CONTAINS "17619-coinbase.com" OR destinationntdomain CONTAINS "176284-coinbase.com" OR destinationntdomain CONTAINS "17823920-coinbase.com" OR destinationntdomain CONTAINS "178253-coinbase.com")
index=activity AND rg_functionality="Next Generation Firewall" AND requesturl NOT NULL AND (requesturl CONTAINS "16450207-coinbase.com" OR requesturl CONTAINS "16458207-coinbase.com" OR requesturl CONTAINS "16478202-coinbase.com" OR requesturl CONTAINS "164872942-coinbase.com" OR requesturl CONTAINS "16590-coinbase.com" OR requesturl CONTAINS "16594373-coinbase.com" OR requesturl CONTAINS "16624831-coinbase.com" OR requesturl CONTAINS "16642124-coinbase.com" OR requesturl CONTAINS "16642172-coinbase.com" OR requesturl CONTAINS "16642580-coinbase.com" OR requesturl CONTAINS "16642721-coinbase.com" OR requesturl CONTAINS "16642724-coinbase.com" OR requesturl CONTAINS "16642871-coinbase.com" OR requesturl CONTAINS "16642872-coinbase.com" OR requesturl CONTAINS "16712942-coinbase.com" OR requesturl CONTAINS "16718672-coinbase.com" OR requesturl CONTAINS "16728342-coinbase.com" OR requesturl CONTAINS "16728348-coinbase.com" OR requesturl CONTAINS "16728442-coinbase.com" OR requesturl CONTAINS "16728472-coinbase.com" OR requesturl CONTAINS "167285-coinbase.com" OR requesturl CONTAINS "16729042-coinbase.com" OR requesturl CONTAINS "16748272-coinbase.com" OR requesturl CONTAINS "16782942-coinbase.com" OR requesturl CONTAINS "16827420-coinbase.com" OR requesturl CONTAINS "16827423-coinbase.com" OR requesturl CONTAINS "16847145-coinbase.com" OR requesturl CONTAINS "16893924-coinbase.com" OR requesturl CONTAINS "17182-coinbase.com" OR requesturl CONTAINS "17255030-coinbase.com" OR requesturl CONTAINS "17259-kraken.com" OR requesturl CONTAINS "172486-coinbase.com" OR requesturl CONTAINS "17284652-coinbase.com" OR requesturl CONTAINS "17286-coinbase.com" OR requesturl CONTAINS "17334522-coinbase.com" OR requesturl CONTAINS "17334522-kraken.com" OR requesturl CONTAINS "17384522-coinbase.com" OR requesturl CONTAINS "173912-coinbase.com" OR requesturl CONTAINS "17494976-coinbase.com" OR requesturl CONTAINS "17512854-coinbase.com" OR requesturl CONTAINS "17512857-coinbase.com" OR requesturl CONTAINS "1751954-coinbase.com" OR requesturl CONTAINS "17525030-coinbase.com" OR requesturl CONTAINS "17529580-coinbase.com" OR requesturl CONTAINS "17614-coinbase.com" OR requesturl CONTAINS "17618412-coinbase.com" OR requesturl CONTAINS "17619-coinbase.com" OR requesturl CONTAINS "176284-coinbase.com" OR requesturl CONTAINS "17823920-coinbase.com" OR requesturl CONTAINS "178253-coinbase.com")
index=activity AND rg_functionality="Next Generation Firewall" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "178294-coinbase.com" OR destinationhostname CONTAINS "17912-coinbase.com" OR destinationhostname CONTAINS "17914-coinbase.com" OR destinationhostname CONTAINS "17917-coinbase.com" OR destinationhostname CONTAINS "17954-coinbase.com" OR destinationhostname CONTAINS "17958-coinbase.com" OR destinationhostname CONTAINS "182043-coinbase.com" OR destinationhostname CONTAINS "18275-gemini.com" OR destinationhostname CONTAINS "18276-coinbase.com" OR destinationhostname CONTAINS "18290185-coinbase.com" OR destinationhostname CONTAINS "182967-coinbase.com" OR destinationhostname CONTAINS "18560-coinbase.com" OR destinationhostname CONTAINS "18571-coinbase.com" OR destinationhostname CONTAINS "185912-coinbase.com" OR destinationhostname CONTAINS "185914-coinbase.com" OR destinationhostname CONTAINS "18592176-coinbase.com" OR destinationhostname CONTAINS "18594162-coinbase.com" OR destinationhostname CONTAINS "18594962-coinbase.com" OR destinationhostname CONTAINS "18597162-coinbase.com" OR destinationhostname CONTAINS "18719562-coinbase.com" OR destinationhostname CONTAINS "1875290-coinbase.com" OR destinationhostname CONTAINS "1882730-coinbase.com" OR destinationhostname CONTAINS "18902-coinbase.com" OR destinationhostname CONTAINS "18903-coinbase.com" OR destinationhostname CONTAINS "189126-coinbase.com" OR destinationhostname CONTAINS "18952-coinbase.com" OR destinationhostname CONTAINS "192854-coinbase.com" OR destinationhostname CONTAINS "192856-coinbase.com" OR destinationhostname CONTAINS "19287-binance.com" OR destinationhostname CONTAINS "19572-coinbase.com" OR destinationhostname CONTAINS "195812-coinbase.com" OR destinationhostname CONTAINS "195826-coinbase.com" OR destinationhostname CONTAINS "1958262-coinbase.com" OR destinationhostname CONTAINS "195827-binance.com" OR destinationhostname CONTAINS "1958297-coinbase.com" OR destinationhostname CONTAINS "19582970-coinbase.com" OR destinationhostname CONTAINS "19582971-coinbase.com" OR destinationhostname CONTAINS "19583-coinbase.com" OR destinationhostname CONTAINS "19592653-coinbase.com" OR destinationhostname CONTAINS "197304-coinbase.com" OR destinationhostname CONTAINS "19730492-coinbase.com" OR destinationhostname CONTAINS "19764162-coinbase.com" OR destinationhostname CONTAINS "19803-coinbase.com" OR destinationhostname CONTAINS "201784289-coinbase.com" OR destinationhostname CONTAINS "210823644-coinbase.com" OR destinationhostname CONTAINS "21158-coinbase.com" OR destinationhostname CONTAINS "21509-coinbase.com" OR destinationhostname CONTAINS "25985-coinbase.com" OR destinationhostname CONTAINS "27699-coinbase.com" OR destinationhostname CONTAINS "28367-coinbase.com")
index=activity AND rg_functionality="Next Generation Firewall" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "178294-coinbase.com" OR sourcentdomain CONTAINS "17912-coinbase.com" OR sourcentdomain CONTAINS "17914-coinbase.com" OR sourcentdomain CONTAINS "17917-coinbase.com" OR sourcentdomain CONTAINS "17954-coinbase.com" OR sourcentdomain CONTAINS "17958-coinbase.com" OR sourcentdomain CONTAINS "182043-coinbase.com" OR sourcentdomain CONTAINS "18275-gemini.com" OR sourcentdomain CONTAINS "18276-coinbase.com" OR sourcentdomain CONTAINS "18290185-coinbase.com" OR sourcentdomain CONTAINS "182967-coinbase.com" OR sourcentdomain CONTAINS "18560-coinbase.com" OR sourcentdomain CONTAINS "18571-coinbase.com" OR sourcentdomain CONTAINS "185912-coinbase.com" OR sourcentdomain CONTAINS "185914-coinbase.com" OR sourcentdomain CONTAINS "18592176-coinbase.com" OR sourcentdomain CONTAINS "18594162-coinbase.com" OR sourcentdomain CONTAINS "18594962-coinbase.com" OR sourcentdomain CONTAINS "18597162-coinbase.com" OR sourcentdomain CONTAINS "18719562-coinbase.com" OR sourcentdomain CONTAINS "1875290-coinbase.com" OR sourcentdomain CONTAINS "1882730-coinbase.com" OR sourcentdomain CONTAINS "18902-coinbase.com" OR sourcentdomain CONTAINS "18903-coinbase.com" OR sourcentdomain CONTAINS "189126-coinbase.com" OR sourcentdomain CONTAINS "18952-coinbase.com" OR sourcentdomain CONTAINS "192854-coinbase.com" OR sourcentdomain CONTAINS "192856-coinbase.com" OR sourcentdomain CONTAINS "19287-binance.com" OR sourcentdomain CONTAINS "19572-coinbase.com" OR sourcentdomain CONTAINS "195812-coinbase.com" OR sourcentdomain CONTAINS "195826-coinbase.com" OR sourcentdomain CONTAINS "1958262-coinbase.com" OR sourcentdomain CONTAINS "195827-binance.com" OR sourcentdomain CONTAINS "1958297-coinbase.com" OR sourcentdomain CONTAINS "19582970-coinbase.com" OR sourcentdomain CONTAINS "19582971-coinbase.com" OR sourcentdomain CONTAINS "19583-coinbase.com" OR sourcentdomain CONTAINS "19592653-coinbase.com" OR sourcentdomain CONTAINS "197304-coinbase.com" OR sourcentdomain CONTAINS "19730492-coinbase.com" OR sourcentdomain CONTAINS "19764162-coinbase.com" OR sourcentdomain CONTAINS "19803-coinbase.com" OR sourcentdomain CONTAINS "201784289-coinbase.com" OR sourcentdomain CONTAINS "210823644-coinbase.com" OR sourcentdomain CONTAINS "21158-coinbase.com" OR sourcentdomain CONTAINS "21509-coinbase.com" OR sourcentdomain CONTAINS "25985-coinbase.com" OR sourcentdomain CONTAINS "27699-coinbase.com" OR sourcentdomain CONTAINS "28367-coinbase.com")
index=activity AND rg_functionality="Next Generation Firewall" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "178294-coinbase.com" OR sourcehostname CONTAINS "17912-coinbase.com" OR sourcehostname CONTAINS "17914-coinbase.com" OR sourcehostname CONTAINS "17917-coinbase.com" OR sourcehostname CONTAINS "17954-coinbase.com" OR sourcehostname CONTAINS "17958-coinbase.com" OR sourcehostname CONTAINS "182043-coinbase.com" OR sourcehostname CONTAINS "18275-gemini.com" OR sourcehostname CONTAINS "18276-coinbase.com" OR sourcehostname CONTAINS "18290185-coinbase.com" OR sourcehostname CONTAINS "182967-coinbase.com" OR sourcehostname CONTAINS "18560-coinbase.com" OR sourcehostname CONTAINS "18571-coinbase.com" OR sourcehostname CONTAINS "185912-coinbase.com" OR sourcehostname CONTAINS "185914-coinbase.com" OR sourcehostname CONTAINS "18592176-coinbase.com" OR sourcehostname CONTAINS "18594162-coinbase.com" OR sourcehostname CONTAINS "18594962-coinbase.com" OR sourcehostname CONTAINS "18597162-coinbase.com" OR sourcehostname CONTAINS "18719562-coinbase.com" OR sourcehostname CONTAINS "1875290-coinbase.com" OR sourcehostname CONTAINS "1882730-coinbase.com" OR sourcehostname CONTAINS "18902-coinbase.com" OR sourcehostname CONTAINS "18903-coinbase.com" OR sourcehostname CONTAINS "189126-coinbase.com" OR sourcehostname CONTAINS "18952-coinbase.com" OR sourcehostname CONTAINS "192854-coinbase.com" OR sourcehostname CONTAINS "192856-coinbase.com" OR sourcehostname CONTAINS "19287-binance.com" OR sourcehostname CONTAINS "19572-coinbase.com" OR sourcehostname CONTAINS "195812-coinbase.com" OR sourcehostname CONTAINS "195826-coinbase.com" OR sourcehostname CONTAINS "1958262-coinbase.com" OR sourcehostname CONTAINS "195827-binance.com" OR sourcehostname CONTAINS "1958297-coinbase.com" OR sourcehostname CONTAINS "19582970-coinbase.com" OR sourcehostname CONTAINS "19582971-coinbase.com" OR sourcehostname CONTAINS "19583-coinbase.com" OR sourcehostname CONTAINS "19592653-coinbase.com" OR sourcehostname CONTAINS "197304-coinbase.com" OR sourcehostname CONTAINS "19730492-coinbase.com" OR sourcehostname CONTAINS "19764162-coinbase.com" OR sourcehostname CONTAINS "19803-coinbase.com" OR sourcehostname CONTAINS "201784289-coinbase.com" OR sourcehostname CONTAINS "210823644-coinbase.com" OR sourcehostname CONTAINS "21158-coinbase.com" OR sourcehostname CONTAINS "21509-coinbase.com" OR sourcehostname CONTAINS "25985-coinbase.com" OR sourcehostname CONTAINS "27699-coinbase.com" OR sourcehostname CONTAINS "28367-coinbase.com")
index=activity AND rg_functionality="Next Generation Firewall" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "178294-coinbase.com" OR destinationntdomain CONTAINS "17912-coinbase.com" OR destinationntdomain CONTAINS "17914-coinbase.com" OR destinationntdomain CONTAINS "17917-coinbase.com" OR destinationntdomain CONTAINS "17954-coinbase.com" OR destinationntdomain CONTAINS "17958-coinbase.com" OR destinationntdomain CONTAINS "182043-coinbase.com" OR destinationntdomain CONTAINS "18275-gemini.com" OR destinationntdomain CONTAINS "18276-coinbase.com" OR destinationntdomain CONTAINS "18290185-coinbase.com" OR destinationntdomain CONTAINS "182967-coinbase.com" OR destinationntdomain CONTAINS "18560-coinbase.com" OR destinationntdomain CONTAINS "18571-coinbase.com" OR destinationntdomain CONTAINS "185912-coinbase.com" OR destinationntdomain CONTAINS "185914-coinbase.com" OR destinationntdomain CONTAINS "18592176-coinbase.com" OR destinationntdomain CONTAINS "18594162-coinbase.com" OR destinationntdomain CONTAINS "18594962-coinbase.com" OR destinationntdomain CONTAINS "18597162-coinbase.com" OR destinationntdomain CONTAINS "18719562-coinbase.com" OR destinationntdomain CONTAINS "1875290-coinbase.com" OR destinationntdomain CONTAINS "1882730-coinbase.com" OR destinationntdomain CONTAINS "18902-coinbase.com" OR destinationntdomain CONTAINS "18903-coinbase.com" OR destinationntdomain CONTAINS "189126-coinbase.com" OR destinationntdomain CONTAINS "18952-coinbase.com" OR destinationntdomain CONTAINS "192854-coinbase.com" OR destinationntdomain CONTAINS "192856-coinbase.com" OR destinationntdomain CONTAINS "19287-binance.com" OR destinationntdomain CONTAINS "19572-coinbase.com" OR destinationntdomain CONTAINS "195812-coinbase.com" OR destinationntdomain CONTAINS "195826-coinbase.com" OR destinationntdomain CONTAINS "1958262-coinbase.com" OR destinationntdomain CONTAINS "195827-binance.com" OR destinationntdomain CONTAINS "1958297-coinbase.com" OR destinationntdomain CONTAINS "19582970-coinbase.com" OR destinationntdomain CONTAINS "19582971-coinbase.com" OR destinationntdomain CONTAINS "19583-coinbase.com" OR destinationntdomain CONTAINS "19592653-coinbase.com" OR destinationntdomain CONTAINS "197304-coinbase.com" OR destinationntdomain CONTAINS "19730492-coinbase.com" OR destinationntdomain CONTAINS "19764162-coinbase.com" OR destinationntdomain CONTAINS "19803-coinbase.com" OR destinationntdomain CONTAINS "201784289-coinbase.com" OR destinationntdomain CONTAINS "210823644-coinbase.com" OR destinationntdomain CONTAINS "21158-coinbase.com" OR destinationntdomain CONTAINS "21509-coinbase.com" OR destinationntdomain CONTAINS "25985-coinbase.com" OR destinationntdomain CONTAINS "27699-coinbase.com" OR destinationntdomain CONTAINS "28367-coinbase.com")
index=activity AND rg_functionality="Next Generation Firewall" AND requesturl NOT NULL AND (requesturl CONTAINS "178294-coinbase.com" OR requesturl CONTAINS "17912-coinbase.com" OR requesturl CONTAINS "17914-coinbase.com" OR requesturl CONTAINS "17917-coinbase.com" OR requesturl CONTAINS "17954-coinbase.com" OR requesturl CONTAINS "17958-coinbase.com" OR requesturl CONTAINS "182043-coinbase.com" OR requesturl CONTAINS "18275-gemini.com" OR requesturl CONTAINS "18276-coinbase.com" OR requesturl CONTAINS "18290185-coinbase.com" OR requesturl CONTAINS "182967-coinbase.com" OR requesturl CONTAINS "18560-coinbase.com" OR requesturl CONTAINS "18571-coinbase.com" OR requesturl CONTAINS "185912-coinbase.com" OR requesturl CONTAINS "185914-coinbase.com" OR requesturl CONTAINS "18592176-coinbase.com" OR requesturl CONTAINS "18594162-coinbase.com" OR requesturl CONTAINS "18594962-coinbase.com" OR requesturl CONTAINS "18597162-coinbase.com" OR requesturl CONTAINS "18719562-coinbase.com" OR requesturl CONTAINS "1875290-coinbase.com" OR requesturl CONTAINS "1882730-coinbase.com" OR requesturl CONTAINS "18902-coinbase.com" OR requesturl CONTAINS "18903-coinbase.com" OR requesturl CONTAINS "189126-coinbase.com" OR requesturl CONTAINS "18952-coinbase.com" OR requesturl CONTAINS "192854-coinbase.com" OR requesturl CONTAINS "192856-coinbase.com" OR requesturl CONTAINS "19287-binance.com" OR requesturl CONTAINS "19572-coinbase.com" OR requesturl CONTAINS "195812-coinbase.com" OR requesturl CONTAINS "195826-coinbase.com" OR requesturl CONTAINS "1958262-coinbase.com" OR requesturl CONTAINS "195827-binance.com" OR requesturl CONTAINS "1958297-coinbase.com" OR requesturl CONTAINS "19582970-coinbase.com" OR requesturl CONTAINS "19582971-coinbase.com" OR requesturl CONTAINS "19583-coinbase.com" OR requesturl CONTAINS "19592653-coinbase.com" OR requesturl CONTAINS "197304-coinbase.com" OR requesturl CONTAINS "19730492-coinbase.com" OR requesturl CONTAINS "19764162-coinbase.com" OR requesturl CONTAINS "19803-coinbase.com" OR requesturl CONTAINS "201784289-coinbase.com" OR requesturl CONTAINS "210823644-coinbase.com" OR requesturl CONTAINS "21158-coinbase.com" OR requesturl CONTAINS "21509-coinbase.com" OR requesturl CONTAINS "25985-coinbase.com" OR requesturl CONTAINS "27699-coinbase.com" OR requesturl CONTAINS "28367-coinbase.com")
index=activity AND rg_functionality="Next Generation Firewall" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "28676-coinbase.com" OR destinationhostname CONTAINS "29185-coinbase.com" OR destinationhostname CONTAINS "29195-coinbase.com" OR destinationhostname CONTAINS "2a-coinbase.com" OR destinationhostname CONTAINS "2b-coinbase.com" OR destinationhostname CONTAINS "2c-coinbase.com" OR destinationhostname CONTAINS "2f-coinbase.com" OR destinationhostname CONTAINS "2fas-coinbase.com" OR destinationhostname CONTAINS "2o-coinbase.com" OR destinationhostname CONTAINS "2r-coinbase.com" OR destinationhostname CONTAINS "2s-coinbase.com" OR destinationhostname CONTAINS "2sv-coinbase.com" OR destinationhostname CONTAINS "352134951-coinbase.com" OR destinationhostname CONTAINS "38468-coinbase.com" OR destinationhostname CONTAINS "39590-coinbase.com" OR destinationhostname CONTAINS "41260-coinbase.com" OR destinationhostname CONTAINS "427883-coinbase.com" OR destinationhostname CONTAINS "43017-coinbase.com" OR destinationhostname CONTAINS "47562-coinbase.com" OR destinationhostname CONTAINS "50195-coinbase.com" OR destinationhostname CONTAINS "5247-coinbase.com" OR destinationhostname CONTAINS "54765-coinbase.com" OR destinationhostname CONTAINS "57197-coinbase.com" OR destinationhostname CONTAINS "58176-coinbase.com" OR destinationhostname CONTAINS "58297-coinbase.com" OR destinationhostname CONTAINS "61250-coinbase.com" OR destinationhostname CONTAINS "61835-coinbase.com" OR destinationhostname CONTAINS "61851-coinbase.com" OR destinationhostname CONTAINS "61937-coinbase.com" OR destinationhostname CONTAINS "71925-coinbase.com" OR destinationhostname CONTAINS "72957-coinbase.com" OR destinationhostname CONTAINS "72985-coinbase.com" OR destinationhostname CONTAINS "74651-coinbase.com" OR destinationhostname CONTAINS "754668948-coinbase.com" OR destinationhostname CONTAINS "76159869-coinbase.com" OR destinationhostname CONTAINS "76153-coinbase.com" OR destinationhostname CONTAINS "81758-coinbase.com" OR destinationhostname CONTAINS "81920-coinbase.com" OR destinationhostname CONTAINS "81926-coinbase.com" OR destinationhostname CONTAINS "81958-coinbase.com" OR destinationhostname CONTAINS "826298-coinbase.com" OR destinationhostname CONTAINS "83216-coinbase.com" OR destinationhostname CONTAINS "837613-coinbase.com" OR destinationhostname CONTAINS "83956-coinbase.com" OR destinationhostname CONTAINS "87157-coinbase.com" OR destinationhostname CONTAINS "87312-coinbase.com" OR destinationhostname CONTAINS "89304-coinbase.com" OR destinationhostname CONTAINS "89375-coinbase.com" OR destinationhostname CONTAINS "91723-gemini.com" OR destinationhostname CONTAINS "91752-coinbase.com")
index=activity AND rg_functionality="Next Generation Firewall" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "28676-coinbase.com" OR sourcentdomain CONTAINS "29185-coinbase.com" OR sourcentdomain CONTAINS "29195-coinbase.com" OR sourcentdomain CONTAINS "2a-coinbase.com" OR sourcentdomain CONTAINS "2b-coinbase.com" OR sourcentdomain CONTAINS "2c-coinbase.com" OR sourcentdomain CONTAINS "2f-coinbase.com" OR sourcentdomain CONTAINS "2fas-coinbase.com" OR sourcentdomain CONTAINS "2o-coinbase.com" OR sourcentdomain CONTAINS "2r-coinbase.com" OR sourcentdomain CONTAINS "2s-coinbase.com" OR sourcentdomain CONTAINS "2sv-coinbase.com" OR sourcentdomain CONTAINS "352134951-coinbase.com" OR sourcentdomain CONTAINS "38468-coinbase.com" OR sourcentdomain CONTAINS "39590-coinbase.com" OR sourcentdomain CONTAINS "41260-coinbase.com" OR sourcentdomain CONTAINS "427883-coinbase.com" OR sourcentdomain CONTAINS "43017-coinbase.com" OR sourcentdomain CONTAINS "47562-coinbase.com" OR sourcentdomain CONTAINS "50195-coinbase.com" OR sourcentdomain CONTAINS "5247-coinbase.com" OR sourcentdomain CONTAINS "54765-coinbase.com" OR sourcentdomain CONTAINS "57197-coinbase.com" OR sourcentdomain CONTAINS "58176-coinbase.com" OR sourcentdomain CONTAINS "58297-coinbase.com" OR sourcentdomain CONTAINS "61250-coinbase.com" OR sourcentdomain CONTAINS "61835-coinbase.com" OR sourcentdomain CONTAINS "61851-coinbase.com" OR sourcentdomain CONTAINS "61937-coinbase.com" OR sourcentdomain CONTAINS "71925-coinbase.com" OR sourcentdomain CONTAINS "72957-coinbase.com" OR sourcentdomain CONTAINS "72985-coinbase.com" OR sourcentdomain CONTAINS "74651-coinbase.com" OR sourcentdomain CONTAINS "754668948-coinbase.com" OR sourcentdomain CONTAINS "76159869-coinbase.com" OR sourcentdomain CONTAINS "76153-coinbase.com" OR sourcentdomain CONTAINS "81758-coinbase.com" OR sourcentdomain CONTAINS "81920-coinbase.com" OR sourcentdomain CONTAINS "81926-coinbase.com" OR sourcentdomain CONTAINS "81958-coinbase.com" OR sourcentdomain CONTAINS "826298-coinbase.com" OR sourcentdomain CONTAINS "83216-coinbase.com" OR sourcentdomain CONTAINS "837613-coinbase.com" OR sourcentdomain CONTAINS "83956-coinbase.com" OR sourcentdomain CONTAINS "87157-coinbase.com" OR sourcentdomain CONTAINS "87312-coinbase.com" OR sourcentdomain CONTAINS "89304-coinbase.com" OR sourcentdomain CONTAINS "89375-coinbase.com" OR sourcentdomain CONTAINS "91723-gemini.com" OR sourcentdomain CONTAINS "91752-coinbase.com")
index=activity AND rg_functionality="Next Generation Firewall" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "28676-coinbase.com" OR sourcehostname CONTAINS "29185-coinbase.com" OR sourcehostname CONTAINS "29195-coinbase.com" OR sourcehostname CONTAINS "2a-coinbase.com" OR sourcehostname CONTAINS "2b-coinbase.com" OR sourcehostname CONTAINS "2c-coinbase.com" OR sourcehostname CONTAINS "2f-coinbase.com" OR sourcehostname CONTAINS "2fas-coinbase.com" OR sourcehostname CONTAINS "2o-coinbase.com" OR sourcehostname CONTAINS "2r-coinbase.com" OR sourcehostname CONTAINS "2s-coinbase.com" OR sourcehostname CONTAINS "2sv-coinbase.com" OR sourcehostname CONTAINS "352134951-coinbase.com" OR sourcehostname CONTAINS "38468-coinbase.com" OR sourcehostname CONTAINS "39590-coinbase.com" OR sourcehostname CONTAINS "41260-coinbase.com" OR sourcehostname CONTAINS "427883-coinbase.com" OR sourcehostname CONTAINS "43017-coinbase.com" OR sourcehostname CONTAINS "47562-coinbase.com" OR sourcehostname CONTAINS "50195-coinbase.com" OR sourcehostname CONTAINS "5247-coinbase.com" OR sourcehostname CONTAINS "54765-coinbase.com" OR sourcehostname CONTAINS "57197-coinbase.com" OR sourcehostname CONTAINS "58176-coinbase.com" OR sourcehostname CONTAINS "58297-coinbase.com" OR sourcehostname CONTAINS "61250-coinbase.com" OR sourcehostname CONTAINS "61835-coinbase.com" OR sourcehostname CONTAINS "61851-coinbase.com" OR sourcehostname CONTAINS "61937-coinbase.com" OR sourcehostname CONTAINS "71925-coinbase.com" OR sourcehostname CONTAINS "72957-coinbase.com" OR sourcehostname CONTAINS "72985-coinbase.com" OR sourcehostname CONTAINS "74651-coinbase.com" OR sourcehostname CONTAINS "754668948-coinbase.com" OR sourcehostname CONTAINS "76159869-coinbase.com" OR sourcehostname CONTAINS "76153-coinbase.com" OR sourcehostname CONTAINS "81758-coinbase.com" OR sourcehostname CONTAINS "81920-coinbase.com" OR sourcehostname CONTAINS "81926-coinbase.com" OR sourcehostname CONTAINS "81958-coinbase.com" OR sourcehostname CONTAINS "826298-coinbase.com" OR sourcehostname CONTAINS "83216-coinbase.com" OR sourcehostname CONTAINS "837613-coinbase.com" OR sourcehostname CONTAINS "83956-coinbase.com" OR sourcehostname CONTAINS "87157-coinbase.com" OR sourcehostname CONTAINS "87312-coinbase.com" OR sourcehostname CONTAINS "89304-coinbase.com" OR sourcehostname CONTAINS "89375-coinbase.com" OR sourcehostname CONTAINS "91723-gemini.com" OR sourcehostname CONTAINS "91752-coinbase.com")
index=activity AND rg_functionality="Next Generation Firewall" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "28676-coinbase.com" OR destinationntdomain CONTAINS "29185-coinbase.com" OR destinationntdomain CONTAINS "29195-coinbase.com" OR destinationntdomain CONTAINS "2a-coinbase.com" OR destinationntdomain CONTAINS "2b-coinbase.com" OR destinationntdomain CONTAINS "2c-coinbase.com" OR destinationntdomain CONTAINS "2f-coinbase.com" OR destinationntdomain CONTAINS "2fas-coinbase.com" OR destinationntdomain CONTAINS "2o-coinbase.com" OR destinationntdomain CONTAINS "2r-coinbase.com" OR destinationntdomain CONTAINS "2s-coinbase.com" OR destinationntdomain CONTAINS "2sv-coinbase.com" OR destinationntdomain CONTAINS "352134951-coinbase.com" OR destinationntdomain CONTAINS "38468-coinbase.com" OR destinationntdomain CONTAINS "39590-coinbase.com" OR destinationntdomain CONTAINS "41260-coinbase.com" OR destinationntdomain CONTAINS "427883-coinbase.com" OR destinationntdomain CONTAINS "43017-coinbase.com" OR destinationntdomain CONTAINS "47562-coinbase.com" OR destinationntdomain CONTAINS "50195-coinbase.com" OR destinationntdomain CONTAINS "5247-coinbase.com" OR destinationntdomain CONTAINS "54765-coinbase.com" OR destinationntdomain CONTAINS "57197-coinbase.com" OR destinationntdomain CONTAINS "58176-coinbase.com" OR destinationntdomain CONTAINS "58297-coinbase.com" OR destinationntdomain CONTAINS "61250-coinbase.com" OR destinationntdomain CONTAINS "61835-coinbase.com" OR destinationntdomain CONTAINS "61851-coinbase.com" OR destinationntdomain CONTAINS "61937-coinbase.com" OR destinationntdomain CONTAINS "71925-coinbase.com" OR destinationntdomain CONTAINS "72957-coinbase.com" OR destinationntdomain CONTAINS "72985-coinbase.com" OR destinationntdomain CONTAINS "74651-coinbase.com" OR destinationntdomain CONTAINS "754668948-coinbase.com" OR destinationntdomain CONTAINS "76159869-coinbase.com" OR destinationntdomain CONTAINS "76153-coinbase.com" OR destinationntdomain CONTAINS "81758-coinbase.com" OR destinationntdomain CONTAINS "81920-coinbase.com" OR destinationntdomain CONTAINS "81926-coinbase.com" OR destinationntdomain CONTAINS "81958-coinbase.com" OR destinationntdomain CONTAINS "826298-coinbase.com" OR destinationntdomain CONTAINS "83216-coinbase.com" OR destinationntdomain CONTAINS "837613-coinbase.com" OR destinationntdomain CONTAINS "83956-coinbase.com" OR destinationntdomain CONTAINS "87157-coinbase.com" OR destinationntdomain CONTAINS "87312-coinbase.com" OR destinationntdomain CONTAINS "89304-coinbase.com" OR destinationntdomain CONTAINS "89375-coinbase.com" OR destinationntdomain CONTAINS "91723-gemini.com" OR destinationntdomain CONTAINS "91752-coinbase.com")
index=activity AND rg_functionality="Next Generation Firewall" AND requesturl NOT NULL AND (requesturl CONTAINS "28676-coinbase.com" OR requesturl CONTAINS "29185-coinbase.com" OR requesturl CONTAINS "29195-coinbase.com" OR requesturl CONTAINS "2a-coinbase.com" OR requesturl CONTAINS "2b-coinbase.com" OR requesturl CONTAINS "2c-coinbase.com" OR requesturl CONTAINS "2f-coinbase.com" OR requesturl CONTAINS "2fas-coinbase.com" OR requesturl CONTAINS "2o-coinbase.com" OR requesturl CONTAINS "2r-coinbase.com" OR requesturl CONTAINS "2s-coinbase.com" OR requesturl CONTAINS "2sv-coinbase.com" OR requesturl CONTAINS "352134951-coinbase.com" OR requesturl CONTAINS "38468-coinbase.com" OR requesturl CONTAINS "39590-coinbase.com" OR requesturl CONTAINS "41260-coinbase.com" OR requesturl CONTAINS "427883-coinbase.com" OR requesturl CONTAINS "43017-coinbase.com" OR requesturl CONTAINS "47562-coinbase.com" OR requesturl CONTAINS "50195-coinbase.com" OR requesturl CONTAINS "5247-coinbase.com" OR requesturl CONTAINS "54765-coinbase.com" OR requesturl CONTAINS "57197-coinbase.com" OR requesturl CONTAINS "58176-coinbase.com" OR requesturl CONTAINS "58297-coinbase.com" OR requesturl CONTAINS "61250-coinbase.com" OR requesturl CONTAINS "61835-coinbase.com" OR requesturl CONTAINS "61851-coinbase.com" OR requesturl CONTAINS "61937-coinbase.com" OR requesturl CONTAINS "71925-coinbase.com" OR requesturl CONTAINS "72957-coinbase.com" OR requesturl CONTAINS "72985-coinbase.com" OR requesturl CONTAINS "74651-coinbase.com" OR requesturl CONTAINS "754668948-coinbase.com" OR requesturl CONTAINS "76159869-coinbase.com" OR requesturl CONTAINS "76153-coinbase.com" OR requesturl CONTAINS "81758-coinbase.com" OR requesturl CONTAINS "81920-coinbase.com" OR requesturl CONTAINS "81926-coinbase.com" OR requesturl CONTAINS "81958-coinbase.com" OR requesturl CONTAINS "826298-coinbase.com" OR requesturl CONTAINS "83216-coinbase.com" OR requesturl CONTAINS "837613-coinbase.com" OR requesturl CONTAINS "83956-coinbase.com" OR requesturl CONTAINS "87157-coinbase.com" OR requesturl CONTAINS "87312-coinbase.com" OR requesturl CONTAINS "89304-coinbase.com" OR requesturl CONTAINS "89375-coinbase.com" OR requesturl CONTAINS "91723-gemini.com" OR requesturl CONTAINS "91752-coinbase.com")
index=activity AND rg_functionality="Next Generation Firewall" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "91756-coinbase.com" OR destinationhostname CONTAINS "91782-coinbase.com" OR destinationhostname CONTAINS "91835-coinbase.com" OR destinationhostname CONTAINS "91845-coinbase.com" OR destinationhostname CONTAINS "91923-coinbase.com" OR destinationhostname CONTAINS "92758-coinbase.com" OR destinationhostname CONTAINS "948122061-coinbase.com" OR destinationhostname CONTAINS "978941-coinbase.com" OR destinationhostname CONTAINS "accountrecovery-coinbase.com" OR destinationhostname CONTAINS "action-shakepay.com" OR destinationhostname CONTAINS "adjust-coinbase.com" OR destinationhostname CONTAINS "admin-kraken.com" OR destinationhostname CONTAINS "applechargebacks.com" OR destinationhostname CONTAINS "authenticate-gemini.com" OR destinationhostname CONTAINS "authorize-gmail.com" OR destinationhostname CONTAINS "binance-okta.com" OR destinationhostname CONTAINS "captcha-coinbase.com" OR destinationhostname CONTAINS "cd-coinbase.com" OR destinationhostname CONTAINS "coinbase-heip.com" OR destinationhostname CONTAINS "coinbase-live.support" OR destinationhostname CONTAINS "coinbase-reject.com" OR destinationhostname CONTAINS "coinbase-ticket.com" OR destinationhostname CONTAINS "coinbaseheip.com" OR destinationhostname CONTAINS "com-2fa.help" OR destinationhostname CONTAINS "com-2fa.support" OR destinationhostname CONTAINS "com-3845.support" OR destinationhostname CONTAINS "com-connect.help" OR destinationhostname CONTAINS "com-fraud.support" OR destinationhostname CONTAINS "com-help.support" OR destinationhostname CONTAINS "com-reset.help" OR destinationhostname CONTAINS "com-reset.net" OR destinationhostname CONTAINS "com-ticket.live" OR destinationhostname CONTAINS "com-ticket.support" OR destinationhostname CONTAINS "contact-nexo.com" OR destinationhostname CONTAINS "convert-coinbase.com" OR destinationhostname CONTAINS "customerservice-coinbase.com" OR destinationhostname CONTAINS "default-coinbase.com" OR destinationhostname CONTAINS "defend-coinbase.com" OR destinationhostname CONTAINS "deny-coinbase.com" OR destinationhostname CONTAINS "disconnect-coinbase.com" OR destinationhostname CONTAINS "escalate-coinbase.com" OR destinationhostname CONTAINS "establish-coinbase.com" OR destinationhostname CONTAINS "fcc-okta.com" OR destinationhostname CONTAINS "fraudulent-coinbase.com" OR destinationhostname CONTAINS "guard-apple.com" OR destinationhostname CONTAINS "guard-icloud.com" OR destinationhostname CONTAINS "guardian-coinbase.com" OR destinationhostname CONTAINS "guide-gemini.com" OR destinationhostname CONTAINS "help-bitfinex.com" OR destinationhostname CONTAINS "help-shakepay.com")
index=activity AND rg_functionality="Next Generation Firewall" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "91756-coinbase.com" OR sourcentdomain CONTAINS "91782-coinbase.com" OR sourcentdomain CONTAINS "91835-coinbase.com" OR sourcentdomain CONTAINS "91845-coinbase.com" OR sourcentdomain CONTAINS "91923-coinbase.com" OR sourcentdomain CONTAINS "92758-coinbase.com" OR sourcentdomain CONTAINS "948122061-coinbase.com" OR sourcentdomain CONTAINS "978941-coinbase.com" OR sourcentdomain CONTAINS "accountrecovery-coinbase.com" OR sourcentdomain CONTAINS "action-shakepay.com" OR sourcentdomain CONTAINS "adjust-coinbase.com" OR sourcentdomain CONTAINS "admin-kraken.com" OR sourcentdomain CONTAINS "applechargebacks.com" OR sourcentdomain CONTAINS "authenticate-gemini.com" OR sourcentdomain CONTAINS "authorize-gmail.com" OR sourcentdomain CONTAINS "binance-okta.com" OR sourcentdomain CONTAINS "captcha-coinbase.com" OR sourcentdomain CONTAINS "cd-coinbase.com" OR sourcentdomain CONTAINS "coinbase-heip.com" OR sourcentdomain CONTAINS "coinbase-live.support" OR sourcentdomain CONTAINS "coinbase-reject.com" OR sourcentdomain CONTAINS "coinbase-ticket.com" OR sourcentdomain CONTAINS "coinbaseheip.com" OR sourcentdomain CONTAINS "com-2fa.help" OR sourcentdomain CONTAINS "com-2fa.support" OR sourcentdomain CONTAINS "com-3845.support" OR sourcentdomain CONTAINS "com-connect.help" OR sourcentdomain CONTAINS "com-fraud.support" OR sourcentdomain CONTAINS "com-help.support" OR sourcentdomain CONTAINS "com-reset.help" OR sourcentdomain CONTAINS "com-reset.net" OR sourcentdomain CONTAINS "com-ticket.live" OR sourcentdomain CONTAINS "com-ticket.support" OR sourcentdomain CONTAINS "contact-nexo.com" OR sourcentdomain CONTAINS "convert-coinbase.com" OR sourcentdomain CONTAINS "customerservice-coinbase.com" OR sourcentdomain CONTAINS "default-coinbase.com" OR sourcentdomain CONTAINS "defend-coinbase.com" OR sourcentdomain CONTAINS "deny-coinbase.com" OR sourcentdomain CONTAINS "disconnect-coinbase.com" OR sourcentdomain CONTAINS "escalate-coinbase.com" OR sourcentdomain CONTAINS "establish-coinbase.com" OR sourcentdomain CONTAINS "fcc-okta.com" OR sourcentdomain CONTAINS "fraudulent-coinbase.com" OR sourcentdomain CONTAINS "guard-apple.com" OR sourcentdomain CONTAINS "guard-icloud.com" OR sourcentdomain CONTAINS "guardian-coinbase.com" OR sourcentdomain CONTAINS "guide-gemini.com" OR sourcentdomain CONTAINS "help-bitfinex.com" OR sourcentdomain CONTAINS "help-shakepay.com")
index=activity AND rg_functionality="Next Generation Firewall" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "91756-coinbase.com" OR sourcehostname CONTAINS "91782-coinbase.com" OR sourcehostname CONTAINS "91835-coinbase.com" OR sourcehostname CONTAINS "91845-coinbase.com" OR sourcehostname CONTAINS "91923-coinbase.com" OR sourcehostname CONTAINS "92758-coinbase.com" OR sourcehostname CONTAINS "948122061-coinbase.com" OR sourcehostname CONTAINS "978941-coinbase.com" OR sourcehostname CONTAINS "accountrecovery-coinbase.com" OR sourcehostname CONTAINS "action-shakepay.com" OR sourcehostname CONTAINS "adjust-coinbase.com" OR sourcehostname CONTAINS "admin-kraken.com" OR sourcehostname CONTAINS "applechargebacks.com" OR sourcehostname CONTAINS "authenticate-gemini.com" OR sourcehostname CONTAINS "authorize-gmail.com" OR sourcehostname CONTAINS "binance-okta.com" OR sourcehostname CONTAINS "captcha-coinbase.com" OR sourcehostname CONTAINS "cd-coinbase.com" OR sourcehostname CONTAINS "coinbase-heip.com" OR sourcehostname CONTAINS "coinbase-live.support" OR sourcehostname CONTAINS "coinbase-reject.com" OR sourcehostname CONTAINS "coinbase-ticket.com" OR sourcehostname CONTAINS "coinbaseheip.com" OR sourcehostname CONTAINS "com-2fa.help" OR sourcehostname CONTAINS "com-2fa.support" OR sourcehostname CONTAINS "com-3845.support" OR sourcehostname CONTAINS "com-connect.help" OR sourcehostname CONTAINS "com-fraud.support" OR sourcehostname CONTAINS "com-help.support" OR sourcehostname CONTAINS "com-reset.help" OR sourcehostname CONTAINS "com-reset.net" OR sourcehostname CONTAINS "com-ticket.live" OR sourcehostname CONTAINS "com-ticket.support" OR sourcehostname CONTAINS "contact-nexo.com" OR sourcehostname CONTAINS "convert-coinbase.com" OR sourcehostname CONTAINS "customerservice-coinbase.com" OR sourcehostname CONTAINS "default-coinbase.com" OR sourcehostname CONTAINS "defend-coinbase.com" OR sourcehostname CONTAINS "deny-coinbase.com" OR sourcehostname CONTAINS "disconnect-coinbase.com" OR sourcehostname CONTAINS "escalate-coinbase.com" OR sourcehostname CONTAINS "establish-coinbase.com" OR sourcehostname CONTAINS "fcc-okta.com" OR sourcehostname CONTAINS "fraudulent-coinbase.com" OR sourcehostname CONTAINS "guard-apple.com" OR sourcehostname CONTAINS "guard-icloud.com" OR sourcehostname CONTAINS "guardian-coinbase.com" OR sourcehostname CONTAINS "guide-gemini.com" OR sourcehostname CONTAINS "help-bitfinex.com" OR sourcehostname CONTAINS "help-shakepay.com")
index=activity AND rg_functionality="Next Generation Firewall" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "91756-coinbase.com" OR destinationntdomain CONTAINS "91782-coinbase.com" OR destinationntdomain CONTAINS "91835-coinbase.com" OR destinationntdomain CONTAINS "91845-coinbase.com" OR destinationntdomain CONTAINS "91923-coinbase.com" OR destinationntdomain CONTAINS "92758-coinbase.com" OR destinationntdomain CONTAINS "948122061-coinbase.com" OR destinationntdomain CONTAINS "978941-coinbase.com" OR destinationntdomain CONTAINS "accountrecovery-coinbase.com" OR destinationntdomain CONTAINS "action-shakepay.com" OR destinationntdomain CONTAINS "adjust-coinbase.com" OR destinationntdomain CONTAINS "admin-kraken.com" OR destinationntdomain CONTAINS "applechargebacks.com" OR destinationntdomain CONTAINS "authenticate-gemini.com" OR destinationntdomain CONTAINS "authorize-gmail.com" OR destinationntdomain CONTAINS "binance-okta.com" OR destinationntdomain CONTAINS "captcha-coinbase.com" OR destinationntdomain CONTAINS "cd-coinbase.com" OR destinationntdomain CONTAINS "coinbase-heip.com" OR destinationntdomain CONTAINS "coinbase-live.support" OR destinationntdomain CONTAINS "coinbase-reject.com" OR destinationntdomain CONTAINS "coinbase-ticket.com" OR destinationntdomain CONTAINS "coinbaseheip.com" OR destinationntdomain CONTAINS "com-2fa.help" OR destinationntdomain CONTAINS "com-2fa.support" OR destinationntdomain CONTAINS "com-3845.support" OR destinationntdomain CONTAINS "com-connect.help" OR destinationntdomain CONTAINS "com-fraud.support" OR destinationntdomain CONTAINS "com-help.support" OR destinationntdomain CONTAINS "com-reset.help" OR destinationntdomain CONTAINS "com-reset.net" OR destinationntdomain CONTAINS "com-ticket.live" OR destinationntdomain CONTAINS "com-ticket.support" OR destinationntdomain CONTAINS "contact-nexo.com" OR destinationntdomain CONTAINS "convert-coinbase.com" OR destinationntdomain CONTAINS "customerservice-coinbase.com" OR destinationntdomain CONTAINS "default-coinbase.com" OR destinationntdomain CONTAINS "defend-coinbase.com" OR destinationntdomain CONTAINS "deny-coinbase.com" OR destinationntdomain CONTAINS "disconnect-coinbase.com" OR destinationntdomain CONTAINS "escalate-coinbase.com" OR destinationntdomain CONTAINS "establish-coinbase.com" OR destinationntdomain CONTAINS "fcc-okta.com" OR destinationntdomain CONTAINS "fraudulent-coinbase.com" OR destinationntdomain CONTAINS "guard-apple.com" OR destinationntdomain CONTAINS "guard-icloud.com" OR destinationntdomain CONTAINS "guardian-coinbase.com" OR destinationntdomain CONTAINS "guide-gemini.com" OR destinationntdomain CONTAINS "help-bitfinex.com" OR destinationntdomain CONTAINS "help-shakepay.com")
index=activity AND rg_functionality="Next Generation Firewall" AND requesturl NOT NULL AND (requesturl CONTAINS "91756-coinbase.com" OR requesturl CONTAINS "91782-coinbase.com" OR requesturl CONTAINS "91835-coinbase.com" OR requesturl CONTAINS "91845-coinbase.com" OR requesturl CONTAINS "91923-coinbase.com" OR requesturl CONTAINS "92758-coinbase.com" OR requesturl CONTAINS "948122061-coinbase.com" OR requesturl CONTAINS "978941-coinbase.com" OR requesturl CONTAINS "accountrecovery-coinbase.com" OR requesturl CONTAINS "action-shakepay.com" OR requesturl CONTAINS "adjust-coinbase.com" OR requesturl CONTAINS "admin-kraken.com" OR requesturl CONTAINS "applechargebacks.com" OR requesturl CONTAINS "authenticate-gemini.com" OR requesturl CONTAINS "authorize-gmail.com" OR requesturl CONTAINS "binance-okta.com" OR requesturl CONTAINS "captcha-coinbase.com" OR requesturl CONTAINS "cd-coinbase.com" OR requesturl CONTAINS "coinbase-heip.com" OR requesturl CONTAINS "coinbase-live.support" OR requesturl CONTAINS "coinbase-reject.com" OR requesturl CONTAINS "coinbase-ticket.com" OR requesturl CONTAINS "coinbaseheip.com" OR requesturl CONTAINS "com-2fa.help" OR requesturl CONTAINS "com-2fa.support" OR requesturl CONTAINS "com-3845.support" OR requesturl CONTAINS "com-connect.help" OR requesturl CONTAINS "com-fraud.support" OR requesturl CONTAINS "com-help.support" OR requesturl CONTAINS "com-reset.help" OR requesturl CONTAINS "com-reset.net" OR requesturl CONTAINS "com-ticket.live" OR requesturl CONTAINS "com-ticket.support" OR requesturl CONTAINS "contact-nexo.com" OR requesturl CONTAINS "convert-coinbase.com" OR requesturl CONTAINS "customerservice-coinbase.com" OR requesturl CONTAINS "default-coinbase.com" OR requesturl CONTAINS "defend-coinbase.com" OR requesturl CONTAINS "deny-coinbase.com" OR requesturl CONTAINS "disconnect-coinbase.com" OR requesturl CONTAINS "escalate-coinbase.com" OR requesturl CONTAINS "establish-coinbase.com" OR requesturl CONTAINS "fcc-okta.com" OR requesturl CONTAINS "fraudulent-coinbase.com" OR requesturl CONTAINS "guard-apple.com" OR requesturl CONTAINS "guard-icloud.com" OR requesturl CONTAINS "guardian-coinbase.com" OR requesturl CONTAINS "guide-gemini.com" OR requesturl CONTAINS "help-bitfinex.com" OR requesturl CONTAINS "help-shakepay.com")
index=activity AND rg_functionality="Next Generation Firewall" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "helpdesk-apple.com" OR destinationhostname CONTAINS "helpdesk-gemini.com" OR destinationhostname CONTAINS "helpdesk-icloud.com" OR destinationhostname CONTAINS "identification-coinbase.com" OR destinationhostname CONTAINS "lockdown-coinbase.com" OR destinationhostname CONTAINS "login-nexo.com" OR destinationhostname CONTAINS "keys-coinbase.com" OR destinationhostname CONTAINS "messages-coinbase.com" OR destinationhostname CONTAINS "newpassword-coinbase.com" OR destinationhostname CONTAINS "prompt-coinbase.com" OR destinationhostname CONTAINS "protect-apple.com" OR destinationhostname CONTAINS "protect-coinbase.com" OR destinationhostname CONTAINS "protect-gmail.com" OR destinationhostname CONTAINS "protect-kraken.com" OR destinationhostname CONTAINS "recoverme-coinbase.com" OR destinationhostname CONTAINS "recoveryportal-coinbase.com" OR destinationhostname CONTAINS "refunds-coinbase.com" OR destinationhostname CONTAINS "reset-okta.com" OR destinationhostname CONTAINS "restore-coinbase.com" OR destinationhostname CONTAINS "return-coinbase.com" OR destinationhostname CONTAINS "reverts-coinbase.com" OR destinationhostname CONTAINS "secure-binance.us" OR destinationhostname CONTAINS "secure-icloud.com" OR destinationhostname CONTAINS "secure-nexo.com" OR destinationhostname CONTAINS "secure-shakepay.com" OR destinationhostname CONTAINS "security-umusic.com" OR destinationhostname CONTAINS "server694590423.tech" OR destinationhostname CONTAINS "session-coinbase.com" OR destinationhostname CONTAINS "startrecovery-coinbase.com" OR destinationhostname CONTAINS "signin-kraken.com" OR destinationhostname CONTAINS "suite-trezor.io" OR destinationhostname CONTAINS "supportportal-coinbase.com" OR destinationhostname CONTAINS "tech-icloud.com" OR destinationhostname CONTAINS "threat-coinbase.com" OR destinationhostname CONTAINS "ticket-apple.com" OR destinationhostname CONTAINS "ticket-coinbase.com" OR destinationhostname CONTAINS "tickets-apple.com" OR destinationhostname CONTAINS "tokens-coinbase.com" OR destinationhostname CONTAINS "unblock-coinbase.com" OR destinationhostname CONTAINS "unlink-coinbase.com" OR destinationhostname CONTAINS "your-coinbase.com" OR destinationhostname CONTAINS "welcome-coinbase.com" OR destinationhostname CONTAINS "www-coinbasewallet.com" OR destinationhostname CONTAINS "www-help-coinbase.com" OR destinationhostname CONTAINS "www-help-gemini.com")
index=activity AND rg_functionality="Next Generation Firewall" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "helpdesk-apple.com" OR sourcentdomain CONTAINS "helpdesk-gemini.com" OR sourcentdomain CONTAINS "helpdesk-icloud.com" OR sourcentdomain CONTAINS "identification-coinbase.com" OR sourcentdomain CONTAINS "lockdown-coinbase.com" OR sourcentdomain CONTAINS "login-nexo.com" OR sourcentdomain CONTAINS "keys-coinbase.com" OR sourcentdomain CONTAINS "messages-coinbase.com" OR sourcentdomain CONTAINS "newpassword-coinbase.com" OR sourcentdomain CONTAINS "prompt-coinbase.com" OR sourcentdomain CONTAINS "protect-apple.com" OR sourcentdomain CONTAINS "protect-coinbase.com" OR sourcentdomain CONTAINS "protect-gmail.com" OR sourcentdomain CONTAINS "protect-kraken.com" OR sourcentdomain CONTAINS "recoverme-coinbase.com" OR sourcentdomain CONTAINS "recoveryportal-coinbase.com" OR sourcentdomain CONTAINS "refunds-coinbase.com" OR sourcentdomain CONTAINS "reset-okta.com" OR sourcentdomain CONTAINS "restore-coinbase.com" OR sourcentdomain CONTAINS "return-coinbase.com" OR sourcentdomain CONTAINS "reverts-coinbase.com" OR sourcentdomain CONTAINS "secure-binance.us" OR sourcentdomain CONTAINS "secure-icloud.com" OR sourcentdomain CONTAINS "secure-nexo.com" OR sourcentdomain CONTAINS "secure-shakepay.com" OR sourcentdomain CONTAINS "security-umusic.com" OR sourcentdomain CONTAINS "server694590423.tech" OR sourcentdomain CONTAINS "session-coinbase.com" OR sourcentdomain CONTAINS "startrecovery-coinbase.com" OR sourcentdomain CONTAINS "signin-kraken.com" OR sourcentdomain CONTAINS "suite-trezor.io" OR sourcentdomain CONTAINS "supportportal-coinbase.com" OR sourcentdomain CONTAINS "tech-icloud.com" OR sourcentdomain CONTAINS "threat-coinbase.com" OR sourcentdomain CONTAINS "ticket-apple.com" OR sourcentdomain CONTAINS "ticket-coinbase.com" OR sourcentdomain CONTAINS "tickets-apple.com" OR sourcentdomain CONTAINS "tokens-coinbase.com" OR sourcentdomain CONTAINS "unblock-coinbase.com" OR sourcentdomain CONTAINS "unlink-coinbase.com" OR sourcentdomain CONTAINS "your-coinbase.com" OR sourcentdomain CONTAINS "welcome-coinbase.com" OR sourcentdomain CONTAINS "www-coinbasewallet.com" OR sourcentdomain CONTAINS "www-help-coinbase.com" OR sourcentdomain CONTAINS "www-help-gemini.com")
index=activity AND rg_functionality="Next Generation Firewall" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "helpdesk-apple.com" OR sourcehostname CONTAINS "helpdesk-gemini.com" OR sourcehostname CONTAINS "helpdesk-icloud.com" OR sourcehostname CONTAINS "identification-coinbase.com" OR sourcehostname CONTAINS "lockdown-coinbase.com" OR sourcehostname CONTAINS "login-nexo.com" OR sourcehostname CONTAINS "keys-coinbase.com" OR sourcehostname CONTAINS "messages-coinbase.com" OR sourcehostname CONTAINS "newpassword-coinbase.com" OR sourcehostname CONTAINS "prompt-coinbase.com" OR sourcehostname CONTAINS "protect-apple.com" OR sourcehostname CONTAINS "protect-coinbase.com" OR sourcehostname CONTAINS "protect-gmail.com" OR sourcehostname CONTAINS "protect-kraken.com" OR sourcehostname CONTAINS "recoverme-coinbase.com" OR sourcehostname CONTAINS "recoveryportal-coinbase.com" OR sourcehostname CONTAINS "refunds-coinbase.com" OR sourcehostname CONTAINS "reset-okta.com" OR sourcehostname CONTAINS "restore-coinbase.com" OR sourcehostname CONTAINS "return-coinbase.com" OR sourcehostname CONTAINS "reverts-coinbase.com" OR sourcehostname CONTAINS "secure-binance.us" OR sourcehostname CONTAINS "secure-icloud.com" OR sourcehostname CONTAINS "secure-nexo.com" OR sourcehostname CONTAINS "secure-shakepay.com" OR sourcehostname CONTAINS "security-umusic.com" OR sourcehostname CONTAINS "server694590423.tech" OR sourcehostname CONTAINS "session-coinbase.com" OR sourcehostname CONTAINS "startrecovery-coinbase.com" OR sourcehostname CONTAINS "signin-kraken.com" OR sourcehostname CONTAINS "suite-trezor.io" OR sourcehostname CONTAINS "supportportal-coinbase.com" OR sourcehostname CONTAINS "tech-icloud.com" OR sourcehostname CONTAINS "threat-coinbase.com" OR sourcehostname CONTAINS "ticket-apple.com" OR sourcehostname CONTAINS "ticket-coinbase.com" OR sourcehostname CONTAINS "tickets-apple.com" OR sourcehostname CONTAINS "tokens-coinbase.com" OR sourcehostname CONTAINS "unblock-coinbase.com" OR sourcehostname CONTAINS "unlink-coinbase.com" OR sourcehostname CONTAINS "your-coinbase.com" OR sourcehostname CONTAINS "welcome-coinbase.com" OR sourcehostname CONTAINS "www-coinbasewallet.com" OR sourcehostname CONTAINS "www-help-coinbase.com" OR sourcehostname CONTAINS "www-help-gemini.com")
index=activity AND rg_functionality="Next Generation Firewall" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "helpdesk-apple.com" OR destinationntdomain CONTAINS "helpdesk-gemini.com" OR destinationntdomain CONTAINS "helpdesk-icloud.com" OR destinationntdomain CONTAINS "identification-coinbase.com" OR destinationntdomain CONTAINS "lockdown-coinbase.com" OR destinationntdomain CONTAINS "login-nexo.com" OR destinationntdomain CONTAINS "keys-coinbase.com" OR destinationntdomain CONTAINS "messages-coinbase.com" OR destinationntdomain CONTAINS "newpassword-coinbase.com" OR destinationntdomain CONTAINS "prompt-coinbase.com" OR destinationntdomain CONTAINS "protect-apple.com" OR destinationntdomain CONTAINS "protect-coinbase.com" OR destinationntdomain CONTAINS "protect-gmail.com" OR destinationntdomain CONTAINS "protect-kraken.com" OR destinationntdomain CONTAINS "recoverme-coinbase.com" OR destinationntdomain CONTAINS "recoveryportal-coinbase.com" OR destinationntdomain CONTAINS "refunds-coinbase.com" OR destinationntdomain CONTAINS "reset-okta.com" OR destinationntdomain CONTAINS "restore-coinbase.com" OR destinationntdomain CONTAINS "return-coinbase.com" OR destinationntdomain CONTAINS "reverts-coinbase.com" OR destinationntdomain CONTAINS "secure-binance.us" OR destinationntdomain CONTAINS "secure-icloud.com" OR destinationntdomain CONTAINS "secure-nexo.com" OR destinationntdomain CONTAINS "secure-shakepay.com" OR destinationntdomain CONTAINS "security-umusic.com" OR destinationntdomain CONTAINS "server694590423.tech" OR destinationntdomain CONTAINS "session-coinbase.com" OR destinationntdomain CONTAINS "startrecovery-coinbase.com" OR destinationntdomain CONTAINS "signin-kraken.com" OR destinationntdomain CONTAINS "suite-trezor.io" OR destinationntdomain CONTAINS "supportportal-coinbase.com" OR destinationntdomain CONTAINS "tech-icloud.com" OR destinationntdomain CONTAINS "threat-coinbase.com" OR destinationntdomain CONTAINS "ticket-apple.com" OR destinationntdomain CONTAINS "ticket-coinbase.com" OR destinationntdomain CONTAINS "tickets-apple.com" OR destinationntdomain CONTAINS "tokens-coinbase.com" OR destinationntdomain CONTAINS "unblock-coinbase.com" OR destinationntdomain CONTAINS "unlink-coinbase.com" OR destinationntdomain CONTAINS "your-coinbase.com" OR destinationntdomain CONTAINS "welcome-coinbase.com" OR destinationntdomain CONTAINS "www-coinbasewallet.com" OR destinationntdomain CONTAINS "www-help-coinbase.com" OR destinationntdomain CONTAINS "www-help-gemini.com")
index=activity AND rg_functionality="Next Generation Firewall" AND requesturl NOT NULL AND (requesturl CONTAINS "helpdesk-apple.com" OR requesturl CONTAINS "helpdesk-gemini.com" OR requesturl CONTAINS "helpdesk-icloud.com" OR requesturl CONTAINS "identification-coinbase.com" OR requesturl CONTAINS "lockdown-coinbase.com" OR requesturl CONTAINS "login-nexo.com" OR requesturl CONTAINS "keys-coinbase.com" OR requesturl CONTAINS "messages-coinbase.com" OR requesturl CONTAINS "newpassword-coinbase.com" OR requesturl CONTAINS "prompt-coinbase.com" OR requesturl CONTAINS "protect-apple.com" OR requesturl CONTAINS "protect-coinbase.com" OR requesturl CONTAINS "protect-gmail.com" OR requesturl CONTAINS "protect-kraken.com" OR requesturl CONTAINS "recoverme-coinbase.com" OR requesturl CONTAINS "recoveryportal-coinbase.com" OR requesturl CONTAINS "refunds-coinbase.com" OR requesturl CONTAINS "reset-okta.com" OR requesturl CONTAINS "restore-coinbase.com" OR requesturl CONTAINS "return-coinbase.com" OR requesturl CONTAINS "reverts-coinbase.com" OR requesturl CONTAINS "secure-binance.us" OR requesturl CONTAINS "secure-icloud.com" OR requesturl CONTAINS "secure-nexo.com" OR requesturl CONTAINS "secure-shakepay.com" OR requesturl CONTAINS "security-umusic.com" OR requesturl CONTAINS "server694590423.tech" OR requesturl CONTAINS "session-coinbase.com" OR requesturl CONTAINS "startrecovery-coinbase.com" OR requesturl CONTAINS "signin-kraken.com" OR requesturl CONTAINS "suite-trezor.io" OR requesturl CONTAINS "supportportal-coinbase.com" OR requesturl CONTAINS "tech-icloud.com" OR requesturl CONTAINS "threat-coinbase.com" OR requesturl CONTAINS "ticket-apple.com" OR requesturl CONTAINS "ticket-coinbase.com" OR requesturl CONTAINS "tickets-apple.com" OR requesturl CONTAINS "tokens-coinbase.com" OR requesturl CONTAINS "unblock-coinbase.com" OR requesturl CONTAINS "unlink-coinbase.com" OR requesturl CONTAINS "your-coinbase.com" OR requesturl CONTAINS "welcome-coinbase.com" OR requesturl CONTAINS "www-coinbasewallet.com" OR requesturl CONTAINS "www-help-coinbase.com" OR requesturl CONTAINS "www-help-gemini.com")
index=activity AND rg_functionality="Firewall" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "official-server.com" OR destinationhostname CONTAINS "server694590423.tech" OR destinationhostname CONTAINS "island-placid-bromine.glitch.me" OR destinationhostname CONTAINS "circular-noon-farmhouse.glitch.me" OR destinationhostname CONTAINS "talented-friendly-price.glitch.me" OR destinationhostname CONTAINS "dflfmgsdokasdcpl.com" OR destinationhostname CONTAINS "original-backend.com" OR destinationhostname CONTAINS "07159889-coinbase.com" OR destinationhostname CONTAINS "10195-coinbase.com" OR destinationhostname CONTAINS "11246-coinbase.com" OR destinationhostname CONTAINS "11247-coinbase.com" OR destinationhostname CONTAINS "11248-coinbase.com" OR destinationhostname CONTAINS "11258-coinbase.com" OR destinationhostname CONTAINS "11259-coinbase.com" OR destinationhostname CONTAINS "113912-coinbase.com" OR destinationhostname CONTAINS "11472-coinbase.com" OR destinationhostname CONTAINS "11923-coinbase.com" OR destinationhostname CONTAINS "11957-coinbase.com" OR destinationhostname CONTAINS "128147-coinbase.com" OR destinationhostname CONTAINS "12958-coinbase.com" OR destinationhostname CONTAINS "12984-okta.com" OR destinationhostname CONTAINS "12985-coinbase.com" OR destinationhostname CONTAINS "13130-coinbase.com" OR destinationhostname CONTAINS "13247-coinbase.com" OR destinationhostname CONTAINS "13247-icloud.com" OR destinationhostname CONTAINS "13267-coinbase.com" OR destinationhostname CONTAINS "146271510-coinbase.com" OR destinationhostname CONTAINS "146282-coinbase.com" OR destinationhostname CONTAINS "146284-coinbase.com" OR destinationhostname CONTAINS "147260-coinbase.com" OR destinationhostname CONTAINS "14765-coinbase.com" OR destinationhostname CONTAINS "14817582-coinbase.com" OR destinationhostname CONTAINS "14871904-coinbase.com" OR destinationhostname CONTAINS "14891902-coinbase.com" OR destinationhostname CONTAINS "1492864-coinbase.com" OR destinationhostname CONTAINS "158312-coinbase.com" OR destinationhostname CONTAINS "158372-coinbase.com" OR destinationhostname CONTAINS "158702-coinbase.com" OR destinationhostname CONTAINS "16171675-coinbase.com" OR destinationhostname CONTAINS "16171832-coinbase.com" OR destinationhostname CONTAINS "16178234-coinbase.com" OR destinationhostname CONTAINS "16178237-coinbase.com" OR destinationhostname CONTAINS "16178434-coinbase.com" OR destinationhostname CONTAINS "162178-coinbase.com" OR destinationhostname CONTAINS "162478-coinbase.com" OR destinationhostname CONTAINS "162782-coinbase.com" OR destinationhostname CONTAINS "162812-coinbase.com" OR destinationhostname CONTAINS "162814-coinbase.com" OR destinationhostname CONTAINS "16442580-coinbase.com" OR destinationhostname CONTAINS "16450107-coinbase.com")
index=activity AND rg_functionality="Firewall" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "official-server.com" OR sourcentdomain CONTAINS "server694590423.tech" OR sourcentdomain CONTAINS "island-placid-bromine.glitch.me" OR sourcentdomain CONTAINS "circular-noon-farmhouse.glitch.me" OR sourcentdomain CONTAINS "talented-friendly-price.glitch.me" OR sourcentdomain CONTAINS "dflfmgsdokasdcpl.com" OR sourcentdomain CONTAINS "original-backend.com" OR sourcentdomain CONTAINS "07159889-coinbase.com" OR sourcentdomain CONTAINS "10195-coinbase.com" OR sourcentdomain CONTAINS "11246-coinbase.com" OR sourcentdomain CONTAINS "11247-coinbase.com" OR sourcentdomain CONTAINS "11248-coinbase.com" OR sourcentdomain CONTAINS "11258-coinbase.com" OR sourcentdomain CONTAINS "11259-coinbase.com" OR sourcentdomain CONTAINS "113912-coinbase.com" OR sourcentdomain CONTAINS "11472-coinbase.com" OR sourcentdomain CONTAINS "11923-coinbase.com" OR sourcentdomain CONTAINS "11957-coinbase.com" OR sourcentdomain CONTAINS "128147-coinbase.com" OR sourcentdomain CONTAINS "12958-coinbase.com" OR sourcentdomain CONTAINS "12984-okta.com" OR sourcentdomain CONTAINS "12985-coinbase.com" OR sourcentdomain CONTAINS "13130-coinbase.com" OR sourcentdomain CONTAINS "13247-coinbase.com" OR sourcentdomain CONTAINS "13247-icloud.com" OR sourcentdomain CONTAINS "13267-coinbase.com" OR sourcentdomain CONTAINS "146271510-coinbase.com" OR sourcentdomain CONTAINS "146282-coinbase.com" OR sourcentdomain CONTAINS "146284-coinbase.com" OR sourcentdomain CONTAINS "147260-coinbase.com" OR sourcentdomain CONTAINS "14765-coinbase.com" OR sourcentdomain CONTAINS "14817582-coinbase.com" OR sourcentdomain CONTAINS "14871904-coinbase.com" OR sourcentdomain CONTAINS "14891902-coinbase.com" OR sourcentdomain CONTAINS "1492864-coinbase.com" OR sourcentdomain CONTAINS "158312-coinbase.com" OR sourcentdomain CONTAINS "158372-coinbase.com" OR sourcentdomain CONTAINS "158702-coinbase.com" OR sourcentdomain CONTAINS "16171675-coinbase.com" OR sourcentdomain CONTAINS "16171832-coinbase.com" OR sourcentdomain CONTAINS "16178234-coinbase.com" OR sourcentdomain CONTAINS "16178237-coinbase.com" OR sourcentdomain CONTAINS "16178434-coinbase.com" OR sourcentdomain CONTAINS "162178-coinbase.com" OR sourcentdomain CONTAINS "162478-coinbase.com" OR sourcentdomain CONTAINS "162782-coinbase.com" OR sourcentdomain CONTAINS "162812-coinbase.com" OR sourcentdomain CONTAINS "162814-coinbase.com" OR sourcentdomain CONTAINS "16442580-coinbase.com" OR sourcentdomain CONTAINS "16450107-coinbase.com")
index=activity AND rg_functionality="Firewall" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "official-server.com" OR sourcehostname CONTAINS "server694590423.tech" OR sourcehostname CONTAINS "island-placid-bromine.glitch.me" OR sourcehostname CONTAINS "circular-noon-farmhouse.glitch.me" OR sourcehostname CONTAINS "talented-friendly-price.glitch.me" OR sourcehostname CONTAINS "dflfmgsdokasdcpl.com" OR sourcehostname CONTAINS "original-backend.com" OR sourcehostname CONTAINS "07159889-coinbase.com" OR sourcehostname CONTAINS "10195-coinbase.com" OR sourcehostname CONTAINS "11246-coinbase.com" OR sourcehostname CONTAINS "11247-coinbase.com" OR sourcehostname CONTAINS "11248-coinbase.com" OR sourcehostname CONTAINS "11258-coinbase.com" OR sourcehostname CONTAINS "11259-coinbase.com" OR sourcehostname CONTAINS "113912-coinbase.com" OR sourcehostname CONTAINS "11472-coinbase.com" OR sourcehostname CONTAINS "11923-coinbase.com" OR sourcehostname CONTAINS "11957-coinbase.com" OR sourcehostname CONTAINS "128147-coinbase.com" OR sourcehostname CONTAINS "12958-coinbase.com" OR sourcehostname CONTAINS "12984-okta.com" OR sourcehostname CONTAINS "12985-coinbase.com" OR sourcehostname CONTAINS "13130-coinbase.com" OR sourcehostname CONTAINS "13247-coinbase.com" OR sourcehostname CONTAINS "13247-icloud.com" OR sourcehostname CONTAINS "13267-coinbase.com" OR sourcehostname CONTAINS "146271510-coinbase.com" OR sourcehostname CONTAINS "146282-coinbase.com" OR sourcehostname CONTAINS "146284-coinbase.com" OR sourcehostname CONTAINS "147260-coinbase.com" OR sourcehostname CONTAINS "14765-coinbase.com" OR sourcehostname CONTAINS "14817582-coinbase.com" OR sourcehostname CONTAINS "14871904-coinbase.com" OR sourcehostname CONTAINS "14891902-coinbase.com" OR sourcehostname CONTAINS "1492864-coinbase.com" OR sourcehostname CONTAINS "158312-coinbase.com" OR sourcehostname CONTAINS "158372-coinbase.com" OR sourcehostname CONTAINS "158702-coinbase.com" OR sourcehostname CONTAINS "16171675-coinbase.com" OR sourcehostname CONTAINS "16171832-coinbase.com" OR sourcehostname CONTAINS "16178234-coinbase.com" OR sourcehostname CONTAINS "16178237-coinbase.com" OR sourcehostname CONTAINS "16178434-coinbase.com" OR sourcehostname CONTAINS "162178-coinbase.com" OR sourcehostname CONTAINS "162478-coinbase.com" OR sourcehostname CONTAINS "162782-coinbase.com" OR sourcehostname CONTAINS "162812-coinbase.com" OR sourcehostname CONTAINS "162814-coinbase.com" OR sourcehostname CONTAINS "16442580-coinbase.com" OR sourcehostname CONTAINS "16450107-coinbase.com")
index=activity AND rg_functionality="Firewall" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "official-server.com" OR destinationntdomain CONTAINS "server694590423.tech" OR destinationntdomain CONTAINS "island-placid-bromine.glitch.me" OR destinationntdomain CONTAINS "circular-noon-farmhouse.glitch.me" OR destinationntdomain CONTAINS "talented-friendly-price.glitch.me" OR destinationntdomain CONTAINS "dflfmgsdokasdcpl.com" OR destinationntdomain CONTAINS "original-backend.com" OR destinationntdomain CONTAINS "07159889-coinbase.com" OR destinationntdomain CONTAINS "10195-coinbase.com" OR destinationntdomain CONTAINS "11246-coinbase.com" OR destinationntdomain CONTAINS "11247-coinbase.com" OR destinationntdomain CONTAINS "11248-coinbase.com" OR destinationntdomain CONTAINS "11258-coinbase.com" OR destinationntdomain CONTAINS "11259-coinbase.com" OR destinationntdomain CONTAINS "113912-coinbase.com" OR destinationntdomain CONTAINS "11472-coinbase.com" OR destinationntdomain CONTAINS "11923-coinbase.com" OR destinationntdomain CONTAINS "11957-coinbase.com" OR destinationntdomain CONTAINS "128147-coinbase.com" OR destinationntdomain CONTAINS "12958-coinbase.com" OR destinationntdomain CONTAINS "12984-okta.com" OR destinationntdomain CONTAINS "12985-coinbase.com" OR destinationntdomain CONTAINS "13130-coinbase.com" OR destinationntdomain CONTAINS "13247-coinbase.com" OR destinationntdomain CONTAINS "13247-icloud.com" OR destinationntdomain CONTAINS "13267-coinbase.com" OR destinationntdomain CONTAINS "146271510-coinbase.com" OR destinationntdomain CONTAINS "146282-coinbase.com" OR destinationntdomain CONTAINS "146284-coinbase.com" OR destinationntdomain CONTAINS "147260-coinbase.com" OR destinationntdomain CONTAINS "14765-coinbase.com" OR destinationntdomain CONTAINS "14817582-coinbase.com" OR destinationntdomain CONTAINS "14871904-coinbase.com" OR destinationntdomain CONTAINS "14891902-coinbase.com" OR destinationntdomain CONTAINS "1492864-coinbase.com" OR destinationntdomain CONTAINS "158312-coinbase.com" OR destinationntdomain CONTAINS "158372-coinbase.com" OR destinationntdomain CONTAINS "158702-coinbase.com" OR destinationntdomain CONTAINS "16171675-coinbase.com" OR destinationntdomain CONTAINS "16171832-coinbase.com" OR destinationntdomain CONTAINS "16178234-coinbase.com" OR destinationntdomain CONTAINS "16178237-coinbase.com" OR destinationntdomain CONTAINS "16178434-coinbase.com" OR destinationntdomain CONTAINS "162178-coinbase.com" OR destinationntdomain CONTAINS "162478-coinbase.com" OR destinationntdomain CONTAINS "162782-coinbase.com" OR destinationntdomain CONTAINS "162812-coinbase.com" OR destinationntdomain CONTAINS "162814-coinbase.com" OR destinationntdomain CONTAINS "16442580-coinbase.com" OR destinationntdomain CONTAINS "16450107-coinbase.com")
index=activity AND rg_functionality="Firewall" AND requesturl NOT NULL AND (requesturl CONTAINS "official-server.com" OR requesturl CONTAINS "server694590423.tech" OR requesturl CONTAINS "island-placid-bromine.glitch.me" OR requesturl CONTAINS "circular-noon-farmhouse.glitch.me" OR requesturl CONTAINS "talented-friendly-price.glitch.me" OR requesturl CONTAINS "dflfmgsdokasdcpl.com" OR requesturl CONTAINS "original-backend.com" OR requesturl CONTAINS "07159889-coinbase.com" OR requesturl CONTAINS "10195-coinbase.com" OR requesturl CONTAINS "11246-coinbase.com" OR requesturl CONTAINS "11247-coinbase.com" OR requesturl CONTAINS "11248-coinbase.com" OR requesturl CONTAINS "11258-coinbase.com" OR requesturl CONTAINS "11259-coinbase.com" OR requesturl CONTAINS "113912-coinbase.com" OR requesturl CONTAINS "11472-coinbase.com" OR requesturl CONTAINS "11923-coinbase.com" OR requesturl CONTAINS "11957-coinbase.com" OR requesturl CONTAINS "128147-coinbase.com" OR requesturl CONTAINS "12958-coinbase.com" OR requesturl CONTAINS "12984-okta.com" OR requesturl CONTAINS "12985-coinbase.com" OR requesturl CONTAINS "13130-coinbase.com" OR requesturl CONTAINS "13247-coinbase.com" OR requesturl CONTAINS "13247-icloud.com" OR requesturl CONTAINS "13267-coinbase.com" OR requesturl CONTAINS "146271510-coinbase.com" OR requesturl CONTAINS "146282-coinbase.com" OR requesturl CONTAINS "146284-coinbase.com" OR requesturl CONTAINS "147260-coinbase.com" OR requesturl CONTAINS "14765-coinbase.com" OR requesturl CONTAINS "14817582-coinbase.com" OR requesturl CONTAINS "14871904-coinbase.com" OR requesturl CONTAINS "14891902-coinbase.com" OR requesturl CONTAINS "1492864-coinbase.com" OR requesturl CONTAINS "158312-coinbase.com" OR requesturl CONTAINS "158372-coinbase.com" OR requesturl CONTAINS "158702-coinbase.com" OR requesturl CONTAINS "16171675-coinbase.com" OR requesturl CONTAINS "16171832-coinbase.com" OR requesturl CONTAINS "16178234-coinbase.com" OR requesturl CONTAINS "16178237-coinbase.com" OR requesturl CONTAINS "16178434-coinbase.com" OR requesturl CONTAINS "162178-coinbase.com" OR requesturl CONTAINS "162478-coinbase.com" OR requesturl CONTAINS "162782-coinbase.com" OR requesturl CONTAINS "162812-coinbase.com" OR requesturl CONTAINS "162814-coinbase.com" OR requesturl CONTAINS "16442580-coinbase.com" OR requesturl CONTAINS "16450107-coinbase.com")
index=activity AND rg_functionality="Firewall" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "16450207-coinbase.com" OR destinationhostname CONTAINS "16458207-coinbase.com" OR destinationhostname CONTAINS "16478202-coinbase.com" OR destinationhostname CONTAINS "164872942-coinbase.com" OR destinationhostname CONTAINS "16590-coinbase.com" OR destinationhostname CONTAINS "16594373-coinbase.com" OR destinationhostname CONTAINS "16624831-coinbase.com" OR destinationhostname CONTAINS "16642124-coinbase.com" OR destinationhostname CONTAINS "16642172-coinbase.com" OR destinationhostname CONTAINS "16642580-coinbase.com" OR destinationhostname CONTAINS "16642721-coinbase.com" OR destinationhostname CONTAINS "16642724-coinbase.com" OR destinationhostname CONTAINS "16642871-coinbase.com" OR destinationhostname CONTAINS "16642872-coinbase.com" OR destinationhostname CONTAINS "16712942-coinbase.com" OR destinationhostname CONTAINS "16718672-coinbase.com" OR destinationhostname CONTAINS "16728342-coinbase.com" OR destinationhostname CONTAINS "16728348-coinbase.com" OR destinationhostname CONTAINS "16728442-coinbase.com" OR destinationhostname CONTAINS "16728472-coinbase.com" OR destinationhostname CONTAINS "167285-coinbase.com" OR destinationhostname CONTAINS "16729042-coinbase.com" OR destinationhostname CONTAINS "16748272-coinbase.com" OR destinationhostname CONTAINS "16782942-coinbase.com" OR destinationhostname CONTAINS "16827420-coinbase.com" OR destinationhostname CONTAINS "16827423-coinbase.com" OR destinationhostname CONTAINS "16847145-coinbase.com" OR destinationhostname CONTAINS "16893924-coinbase.com" OR destinationhostname CONTAINS "17182-coinbase.com" OR destinationhostname CONTAINS "17255030-coinbase.com" OR destinationhostname CONTAINS "17259-kraken.com" OR destinationhostname CONTAINS "172486-coinbase.com" OR destinationhostname CONTAINS "17284652-coinbase.com" OR destinationhostname CONTAINS "17286-coinbase.com" OR destinationhostname CONTAINS "17334522-coinbase.com" OR destinationhostname CONTAINS "17334522-kraken.com" OR destinationhostname CONTAINS "17384522-coinbase.com" OR destinationhostname CONTAINS "173912-coinbase.com" OR destinationhostname CONTAINS "17494976-coinbase.com" OR destinationhostname CONTAINS "17512854-coinbase.com" OR destinationhostname CONTAINS "17512857-coinbase.com" OR destinationhostname CONTAINS "1751954-coinbase.com" OR destinationhostname CONTAINS "17525030-coinbase.com" OR destinationhostname CONTAINS "17529580-coinbase.com" OR destinationhostname CONTAINS "17614-coinbase.com" OR destinationhostname CONTAINS "17618412-coinbase.com" OR destinationhostname CONTAINS "17619-coinbase.com" OR destinationhostname CONTAINS "176284-coinbase.com" OR destinationhostname CONTAINS "17823920-coinbase.com" OR destinationhostname CONTAINS "178253-coinbase.com")
index=activity AND rg_functionality="Firewall" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "16450207-coinbase.com" OR sourcentdomain CONTAINS "16458207-coinbase.com" OR sourcentdomain CONTAINS "16478202-coinbase.com" OR sourcentdomain CONTAINS "164872942-coinbase.com" OR sourcentdomain CONTAINS "16590-coinbase.com" OR sourcentdomain CONTAINS "16594373-coinbase.com" OR sourcentdomain CONTAINS "16624831-coinbase.com" OR sourcentdomain CONTAINS "16642124-coinbase.com" OR sourcentdomain CONTAINS "16642172-coinbase.com" OR sourcentdomain CONTAINS "16642580-coinbase.com" OR sourcentdomain CONTAINS "16642721-coinbase.com" OR sourcentdomain CONTAINS "16642724-coinbase.com" OR sourcentdomain CONTAINS "16642871-coinbase.com" OR sourcentdomain CONTAINS "16642872-coinbase.com" OR sourcentdomain CONTAINS "16712942-coinbase.com" OR sourcentdomain CONTAINS "16718672-coinbase.com" OR sourcentdomain CONTAINS "16728342-coinbase.com" OR sourcentdomain CONTAINS "16728348-coinbase.com" OR sourcentdomain CONTAINS "16728442-coinbase.com" OR sourcentdomain CONTAINS "16728472-coinbase.com" OR sourcentdomain CONTAINS "167285-coinbase.com" OR sourcentdomain CONTAINS "16729042-coinbase.com" OR sourcentdomain CONTAINS "16748272-coinbase.com" OR sourcentdomain CONTAINS "16782942-coinbase.com" OR sourcentdomain CONTAINS "16827420-coinbase.com" OR sourcentdomain CONTAINS "16827423-coinbase.com" OR sourcentdomain CONTAINS "16847145-coinbase.com" OR sourcentdomain CONTAINS "16893924-coinbase.com" OR sourcentdomain CONTAINS "17182-coinbase.com" OR sourcentdomain CONTAINS "17255030-coinbase.com" OR sourcentdomain CONTAINS "17259-kraken.com" OR sourcentdomain CONTAINS "172486-coinbase.com" OR sourcentdomain CONTAINS "17284652-coinbase.com" OR sourcentdomain CONTAINS "17286-coinbase.com" OR sourcentdomain CONTAINS "17334522-coinbase.com" OR sourcentdomain CONTAINS "17334522-kraken.com" OR sourcentdomain CONTAINS "17384522-coinbase.com" OR sourcentdomain CONTAINS "173912-coinbase.com" OR sourcentdomain CONTAINS "17494976-coinbase.com" OR sourcentdomain CONTAINS "17512854-coinbase.com" OR sourcentdomain CONTAINS "17512857-coinbase.com" OR sourcentdomain CONTAINS "1751954-coinbase.com" OR sourcentdomain CONTAINS "17525030-coinbase.com" OR sourcentdomain CONTAINS "17529580-coinbase.com" OR sourcentdomain CONTAINS "17614-coinbase.com" OR sourcentdomain CONTAINS "17618412-coinbase.com" OR sourcentdomain CONTAINS "17619-coinbase.com" OR sourcentdomain CONTAINS "176284-coinbase.com" OR sourcentdomain CONTAINS "17823920-coinbase.com" OR sourcentdomain CONTAINS "178253-coinbase.com")
index=activity AND rg_functionality="Firewall" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "16450207-coinbase.com" OR sourcehostname CONTAINS "16458207-coinbase.com" OR sourcehostname CONTAINS "16478202-coinbase.com" OR sourcehostname CONTAINS "164872942-coinbase.com" OR sourcehostname CONTAINS "16590-coinbase.com" OR sourcehostname CONTAINS "16594373-coinbase.com" OR sourcehostname CONTAINS "16624831-coinbase.com" OR sourcehostname CONTAINS "16642124-coinbase.com" OR sourcehostname CONTAINS "16642172-coinbase.com" OR sourcehostname CONTAINS "16642580-coinbase.com" OR sourcehostname CONTAINS "16642721-coinbase.com" OR sourcehostname CONTAINS "16642724-coinbase.com" OR sourcehostname CONTAINS "16642871-coinbase.com" OR sourcehostname CONTAINS "16642872-coinbase.com" OR sourcehostname CONTAINS "16712942-coinbase.com" OR sourcehostname CONTAINS "16718672-coinbase.com" OR sourcehostname CONTAINS "16728342-coinbase.com" OR sourcehostname CONTAINS "16728348-coinbase.com" OR sourcehostname CONTAINS "16728442-coinbase.com" OR sourcehostname CONTAINS "16728472-coinbase.com" OR sourcehostname CONTAINS "167285-coinbase.com" OR sourcehostname CONTAINS "16729042-coinbase.com" OR sourcehostname CONTAINS "16748272-coinbase.com" OR sourcehostname CONTAINS "16782942-coinbase.com" OR sourcehostname CONTAINS "16827420-coinbase.com" OR sourcehostname CONTAINS "16827423-coinbase.com" OR sourcehostname CONTAINS "16847145-coinbase.com" OR sourcehostname CONTAINS "16893924-coinbase.com" OR sourcehostname CONTAINS "17182-coinbase.com" OR sourcehostname CONTAINS "17255030-coinbase.com" OR sourcehostname CONTAINS "17259-kraken.com" OR sourcehostname CONTAINS "172486-coinbase.com" OR sourcehostname CONTAINS "17284652-coinbase.com" OR sourcehostname CONTAINS "17286-coinbase.com" OR sourcehostname CONTAINS "17334522-coinbase.com" OR sourcehostname CONTAINS "17334522-kraken.com" OR sourcehostname CONTAINS "17384522-coinbase.com" OR sourcehostname CONTAINS "173912-coinbase.com" OR sourcehostname CONTAINS "17494976-coinbase.com" OR sourcehostname CONTAINS "17512854-coinbase.com" OR sourcehostname CONTAINS "17512857-coinbase.com" OR sourcehostname CONTAINS "1751954-coinbase.com" OR sourcehostname CONTAINS "17525030-coinbase.com" OR sourcehostname CONTAINS "17529580-coinbase.com" OR sourcehostname CONTAINS "17614-coinbase.com" OR sourcehostname CONTAINS "17618412-coinbase.com" OR sourcehostname CONTAINS "17619-coinbase.com" OR sourcehostname CONTAINS "176284-coinbase.com" OR sourcehostname CONTAINS "17823920-coinbase.com" OR sourcehostname CONTAINS "178253-coinbase.com")
index=activity AND rg_functionality="Firewall" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "16450207-coinbase.com" OR destinationntdomain CONTAINS "16458207-coinbase.com" OR destinationntdomain CONTAINS "16478202-coinbase.com" OR destinationntdomain CONTAINS "164872942-coinbase.com" OR destinationntdomain CONTAINS "16590-coinbase.com" OR destinationntdomain CONTAINS "16594373-coinbase.com" OR destinationntdomain CONTAINS "16624831-coinbase.com" OR destinationntdomain CONTAINS "16642124-coinbase.com" OR destinationntdomain CONTAINS "16642172-coinbase.com" OR destinationntdomain CONTAINS "16642580-coinbase.com" OR destinationntdomain CONTAINS "16642721-coinbase.com" OR destinationntdomain CONTAINS "16642724-coinbase.com" OR destinationntdomain CONTAINS "16642871-coinbase.com" OR destinationntdomain CONTAINS "16642872-coinbase.com" OR destinationntdomain CONTAINS "16712942-coinbase.com" OR destinationntdomain CONTAINS "16718672-coinbase.com" OR destinationntdomain CONTAINS "16728342-coinbase.com" OR destinationntdomain CONTAINS "16728348-coinbase.com" OR destinationntdomain CONTAINS "16728442-coinbase.com" OR destinationntdomain CONTAINS "16728472-coinbase.com" OR destinationntdomain CONTAINS "167285-coinbase.com" OR destinationntdomain CONTAINS "16729042-coinbase.com" OR destinationntdomain CONTAINS "16748272-coinbase.com" OR destinationntdomain CONTAINS "16782942-coinbase.com" OR destinationntdomain CONTAINS "16827420-coinbase.com" OR destinationntdomain CONTAINS "16827423-coinbase.com" OR destinationntdomain CONTAINS "16847145-coinbase.com" OR destinationntdomain CONTAINS "16893924-coinbase.com" OR destinationntdomain CONTAINS "17182-coinbase.com" OR destinationntdomain CONTAINS "17255030-coinbase.com" OR destinationntdomain CONTAINS "17259-kraken.com" OR destinationntdomain CONTAINS "172486-coinbase.com" OR destinationntdomain CONTAINS "17284652-coinbase.com" OR destinationntdomain CONTAINS "17286-coinbase.com" OR destinationntdomain CONTAINS "17334522-coinbase.com" OR destinationntdomain CONTAINS "17334522-kraken.com" OR destinationntdomain CONTAINS "17384522-coinbase.com" OR destinationntdomain CONTAINS "173912-coinbase.com" OR destinationntdomain CONTAINS "17494976-coinbase.com" OR destinationntdomain CONTAINS "17512854-coinbase.com" OR destinationntdomain CONTAINS "17512857-coinbase.com" OR destinationntdomain CONTAINS "1751954-coinbase.com" OR destinationntdomain CONTAINS "17525030-coinbase.com" OR destinationntdomain CONTAINS "17529580-coinbase.com" OR destinationntdomain CONTAINS "17614-coinbase.com" OR destinationntdomain CONTAINS "17618412-coinbase.com" OR destinationntdomain CONTAINS "17619-coinbase.com" OR destinationntdomain CONTAINS "176284-coinbase.com" OR destinationntdomain CONTAINS "17823920-coinbase.com" OR destinationntdomain CONTAINS "178253-coinbase.com")
index=activity AND rg_functionality="Firewall" AND requesturl NOT NULL AND (requesturl CONTAINS "16450207-coinbase.com" OR requesturl CONTAINS "16458207-coinbase.com" OR requesturl CONTAINS "16478202-coinbase.com" OR requesturl CONTAINS "164872942-coinbase.com" OR requesturl CONTAINS "16590-coinbase.com" OR requesturl CONTAINS "16594373-coinbase.com" OR requesturl CONTAINS "16624831-coinbase.com" OR requesturl CONTAINS "16642124-coinbase.com" OR requesturl CONTAINS "16642172-coinbase.com" OR requesturl CONTAINS "16642580-coinbase.com" OR requesturl CONTAINS "16642721-coinbase.com" OR requesturl CONTAINS "16642724-coinbase.com" OR requesturl CONTAINS "16642871-coinbase.com" OR requesturl CONTAINS "16642872-coinbase.com" OR requesturl CONTAINS "16712942-coinbase.com" OR requesturl CONTAINS "16718672-coinbase.com" OR requesturl CONTAINS "16728342-coinbase.com" OR requesturl CONTAINS "16728348-coinbase.com" OR requesturl CONTAINS "16728442-coinbase.com" OR requesturl CONTAINS "16728472-coinbase.com" OR requesturl CONTAINS "167285-coinbase.com" OR requesturl CONTAINS "16729042-coinbase.com" OR requesturl CONTAINS "16748272-coinbase.com" OR requesturl CONTAINS "16782942-coinbase.com" OR requesturl CONTAINS "16827420-coinbase.com" OR requesturl CONTAINS "16827423-coinbase.com" OR requesturl CONTAINS "16847145-coinbase.com" OR requesturl CONTAINS "16893924-coinbase.com" OR requesturl CONTAINS "17182-coinbase.com" OR requesturl CONTAINS "17255030-coinbase.com" OR requesturl CONTAINS "17259-kraken.com" OR requesturl CONTAINS "172486-coinbase.com" OR requesturl CONTAINS "17284652-coinbase.com" OR requesturl CONTAINS "17286-coinbase.com" OR requesturl CONTAINS "17334522-coinbase.com" OR requesturl CONTAINS "17334522-kraken.com" OR requesturl CONTAINS "17384522-coinbase.com" OR requesturl CONTAINS "173912-coinbase.com" OR requesturl CONTAINS "17494976-coinbase.com" OR requesturl CONTAINS "17512854-coinbase.com" OR requesturl CONTAINS "17512857-coinbase.com" OR requesturl CONTAINS "1751954-coinbase.com" OR requesturl CONTAINS "17525030-coinbase.com" OR requesturl CONTAINS "17529580-coinbase.com" OR requesturl CONTAINS "17614-coinbase.com" OR requesturl CONTAINS "17618412-coinbase.com" OR requesturl CONTAINS "17619-coinbase.com" OR requesturl CONTAINS "176284-coinbase.com" OR requesturl CONTAINS "17823920-coinbase.com" OR requesturl CONTAINS "178253-coinbase.com")
index=activity AND rg_functionality="Firewall" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "178294-coinbase.com" OR destinationhostname CONTAINS "17912-coinbase.com" OR destinationhostname CONTAINS "17914-coinbase.com" OR destinationhostname CONTAINS "17917-coinbase.com" OR destinationhostname CONTAINS "17954-coinbase.com" OR destinationhostname CONTAINS "17958-coinbase.com" OR destinationhostname CONTAINS "182043-coinbase.com" OR destinationhostname CONTAINS "18275-gemini.com" OR destinationhostname CONTAINS "18276-coinbase.com" OR destinationhostname CONTAINS "18290185-coinbase.com" OR destinationhostname CONTAINS "182967-coinbase.com" OR destinationhostname CONTAINS "18560-coinbase.com" OR destinationhostname CONTAINS "18571-coinbase.com" OR destinationhostname CONTAINS "185912-coinbase.com" OR destinationhostname CONTAINS "185914-coinbase.com" OR destinationhostname CONTAINS "18592176-coinbase.com" OR destinationhostname CONTAINS "18594162-coinbase.com" OR destinationhostname CONTAINS "18594962-coinbase.com" OR destinationhostname CONTAINS "18597162-coinbase.com" OR destinationhostname CONTAINS "18719562-coinbase.com" OR destinationhostname CONTAINS "1875290-coinbase.com" OR destinationhostname CONTAINS "1882730-coinbase.com" OR destinationhostname CONTAINS "18902-coinbase.com" OR destinationhostname CONTAINS "18903-coinbase.com" OR destinationhostname CONTAINS "189126-coinbase.com" OR destinationhostname CONTAINS "18952-coinbase.com" OR destinationhostname CONTAINS "192854-coinbase.com" OR destinationhostname CONTAINS "192856-coinbase.com" OR destinationhostname CONTAINS "19287-binance.com" OR destinationhostname CONTAINS "19572-coinbase.com" OR destinationhostname CONTAINS "195812-coinbase.com" OR destinationhostname CONTAINS "195826-coinbase.com" OR destinationhostname CONTAINS "1958262-coinbase.com" OR destinationhostname CONTAINS "195827-binance.com" OR destinationhostname CONTAINS "1958297-coinbase.com" OR destinationhostname CONTAINS "19582970-coinbase.com" OR destinationhostname CONTAINS "19582971-coinbase.com" OR destinationhostname CONTAINS "19583-coinbase.com" OR destinationhostname CONTAINS "19592653-coinbase.com" OR destinationhostname CONTAINS "197304-coinbase.com" OR destinationhostname CONTAINS "19730492-coinbase.com" OR destinationhostname CONTAINS "19764162-coinbase.com" OR destinationhostname CONTAINS "19803-coinbase.com" OR destinationhostname CONTAINS "201784289-coinbase.com" OR destinationhostname CONTAINS "210823644-coinbase.com" OR destinationhostname CONTAINS "21158-coinbase.com" OR destinationhostname CONTAINS "21509-coinbase.com" OR destinationhostname CONTAINS "25985-coinbase.com" OR destinationhostname CONTAINS "27699-coinbase.com" OR destinationhostname CONTAINS "28367-coinbase.com")
index=activity AND rg_functionality="Firewall" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "178294-coinbase.com" OR sourcentdomain CONTAINS "17912-coinbase.com" OR sourcentdomain CONTAINS "17914-coinbase.com" OR sourcentdomain CONTAINS "17917-coinbase.com" OR sourcentdomain CONTAINS "17954-coinbase.com" OR sourcentdomain CONTAINS "17958-coinbase.com" OR sourcentdomain CONTAINS "182043-coinbase.com" OR sourcentdomain CONTAINS "18275-gemini.com" OR sourcentdomain CONTAINS "18276-coinbase.com" OR sourcentdomain CONTAINS "18290185-coinbase.com" OR sourcentdomain CONTAINS "182967-coinbase.com" OR sourcentdomain CONTAINS "18560-coinbase.com" OR sourcentdomain CONTAINS "18571-coinbase.com" OR sourcentdomain CONTAINS "185912-coinbase.com" OR sourcentdomain CONTAINS "185914-coinbase.com" OR sourcentdomain CONTAINS "18592176-coinbase.com" OR sourcentdomain CONTAINS "18594162-coinbase.com" OR sourcentdomain CONTAINS "18594962-coinbase.com" OR sourcentdomain CONTAINS "18597162-coinbase.com" OR sourcentdomain CONTAINS "18719562-coinbase.com" OR sourcentdomain CONTAINS "1875290-coinbase.com" OR sourcentdomain CONTAINS "1882730-coinbase.com" OR sourcentdomain CONTAINS "18902-coinbase.com" OR sourcentdomain CONTAINS "18903-coinbase.com" OR sourcentdomain CONTAINS "189126-coinbase.com" OR sourcentdomain CONTAINS "18952-coinbase.com" OR sourcentdomain CONTAINS "192854-coinbase.com" OR sourcentdomain CONTAINS "192856-coinbase.com" OR sourcentdomain CONTAINS "19287-binance.com" OR sourcentdomain CONTAINS "19572-coinbase.com" OR sourcentdomain CONTAINS "195812-coinbase.com" OR sourcentdomain CONTAINS "195826-coinbase.com" OR sourcentdomain CONTAINS "1958262-coinbase.com" OR sourcentdomain CONTAINS "195827-binance.com" OR sourcentdomain CONTAINS "1958297-coinbase.com" OR sourcentdomain CONTAINS "19582970-coinbase.com" OR sourcentdomain CONTAINS "19582971-coinbase.com" OR sourcentdomain CONTAINS "19583-coinbase.com" OR sourcentdomain CONTAINS "19592653-coinbase.com" OR sourcentdomain CONTAINS "197304-coinbase.com" OR sourcentdomain CONTAINS "19730492-coinbase.com" OR sourcentdomain CONTAINS "19764162-coinbase.com" OR sourcentdomain CONTAINS "19803-coinbase.com" OR sourcentdomain CONTAINS "201784289-coinbase.com" OR sourcentdomain CONTAINS "210823644-coinbase.com" OR sourcentdomain CONTAINS "21158-coinbase.com" OR sourcentdomain CONTAINS "21509-coinbase.com" OR sourcentdomain CONTAINS "25985-coinbase.com" OR sourcentdomain CONTAINS "27699-coinbase.com" OR sourcentdomain CONTAINS "28367-coinbase.com")
index=activity AND rg_functionality="Firewall" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "178294-coinbase.com" OR sourcehostname CONTAINS "17912-coinbase.com" OR sourcehostname CONTAINS "17914-coinbase.com" OR sourcehostname CONTAINS "17917-coinbase.com" OR sourcehostname CONTAINS "17954-coinbase.com" OR sourcehostname CONTAINS "17958-coinbase.com" OR sourcehostname CONTAINS "182043-coinbase.com" OR sourcehostname CONTAINS "18275-gemini.com" OR sourcehostname CONTAINS "18276-coinbase.com" OR sourcehostname CONTAINS "18290185-coinbase.com" OR sourcehostname CONTAINS "182967-coinbase.com" OR sourcehostname CONTAINS "18560-coinbase.com" OR sourcehostname CONTAINS "18571-coinbase.com" OR sourcehostname CONTAINS "185912-coinbase.com" OR sourcehostname CONTAINS "185914-coinbase.com" OR sourcehostname CONTAINS "18592176-coinbase.com" OR sourcehostname CONTAINS "18594162-coinbase.com" OR sourcehostname CONTAINS "18594962-coinbase.com" OR sourcehostname CONTAINS "18597162-coinbase.com" OR sourcehostname CONTAINS "18719562-coinbase.com" OR sourcehostname CONTAINS "1875290-coinbase.com" OR sourcehostname CONTAINS "1882730-coinbase.com" OR sourcehostname CONTAINS "18902-coinbase.com" OR sourcehostname CONTAINS "18903-coinbase.com" OR sourcehostname CONTAINS "189126-coinbase.com" OR sourcehostname CONTAINS "18952-coinbase.com" OR sourcehostname CONTAINS "192854-coinbase.com" OR sourcehostname CONTAINS "192856-coinbase.com" OR sourcehostname CONTAINS "19287-binance.com" OR sourcehostname CONTAINS "19572-coinbase.com" OR sourcehostname CONTAINS "195812-coinbase.com" OR sourcehostname CONTAINS "195826-coinbase.com" OR sourcehostname CONTAINS "1958262-coinbase.com" OR sourcehostname CONTAINS "195827-binance.com" OR sourcehostname CONTAINS "1958297-coinbase.com" OR sourcehostname CONTAINS "19582970-coinbase.com" OR sourcehostname CONTAINS "19582971-coinbase.com" OR sourcehostname CONTAINS "19583-coinbase.com" OR sourcehostname CONTAINS "19592653-coinbase.com" OR sourcehostname CONTAINS "197304-coinbase.com" OR sourcehostname CONTAINS "19730492-coinbase.com" OR sourcehostname CONTAINS "19764162-coinbase.com" OR sourcehostname CONTAINS "19803-coinbase.com" OR sourcehostname CONTAINS "201784289-coinbase.com" OR sourcehostname CONTAINS "210823644-coinbase.com" OR sourcehostname CONTAINS "21158-coinbase.com" OR sourcehostname CONTAINS "21509-coinbase.com" OR sourcehostname CONTAINS "25985-coinbase.com" OR sourcehostname CONTAINS "27699-coinbase.com" OR sourcehostname CONTAINS "28367-coinbase.com")
index=activity AND rg_functionality="Firewall" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "178294-coinbase.com" OR destinationntdomain CONTAINS "17912-coinbase.com" OR destinationntdomain CONTAINS "17914-coinbase.com" OR destinationntdomain CONTAINS "17917-coinbase.com" OR destinationntdomain CONTAINS "17954-coinbase.com" OR destinationntdomain CONTAINS "17958-coinbase.com" OR destinationntdomain CONTAINS "182043-coinbase.com" OR destinationntdomain CONTAINS "18275-gemini.com" OR destinationntdomain CONTAINS "18276-coinbase.com" OR destinationntdomain CONTAINS "18290185-coinbase.com" OR destinationntdomain CONTAINS "182967-coinbase.com" OR destinationntdomain CONTAINS "18560-coinbase.com" OR destinationntdomain CONTAINS "18571-coinbase.com" OR destinationntdomain CONTAINS "185912-coinbase.com" OR destinationntdomain CONTAINS "185914-coinbase.com" OR destinationntdomain CONTAINS "18592176-coinbase.com" OR destinationntdomain CONTAINS "18594162-coinbase.com" OR destinationntdomain CONTAINS "18594962-coinbase.com" OR destinationntdomain CONTAINS "18597162-coinbase.com" OR destinationntdomain CONTAINS "18719562-coinbase.com" OR destinationntdomain CONTAINS "1875290-coinbase.com" OR destinationntdomain CONTAINS "1882730-coinbase.com" OR destinationntdomain CONTAINS "18902-coinbase.com" OR destinationntdomain CONTAINS "18903-coinbase.com" OR destinationntdomain CONTAINS "189126-coinbase.com" OR destinationntdomain CONTAINS "18952-coinbase.com" OR destinationntdomain CONTAINS "192854-coinbase.com" OR destinationntdomain CONTAINS "192856-coinbase.com" OR destinationntdomain CONTAINS "19287-binance.com" OR destinationntdomain CONTAINS "19572-coinbase.com" OR destinationntdomain CONTAINS "195812-coinbase.com" OR destinationntdomain CONTAINS "195826-coinbase.com" OR destinationntdomain CONTAINS "1958262-coinbase.com" OR destinationntdomain CONTAINS "195827-binance.com" OR destinationntdomain CONTAINS "1958297-coinbase.com" OR destinationntdomain CONTAINS "19582970-coinbase.com" OR destinationntdomain CONTAINS "19582971-coinbase.com" OR destinationntdomain CONTAINS "19583-coinbase.com" OR destinationntdomain CONTAINS "19592653-coinbase.com" OR destinationntdomain CONTAINS "197304-coinbase.com" OR destinationntdomain CONTAINS "19730492-coinbase.com" OR destinationntdomain CONTAINS "19764162-coinbase.com" OR destinationntdomain CONTAINS "19803-coinbase.com" OR destinationntdomain CONTAINS "201784289-coinbase.com" OR destinationntdomain CONTAINS "210823644-coinbase.com" OR destinationntdomain CONTAINS "21158-coinbase.com" OR destinationntdomain CONTAINS "21509-coinbase.com" OR destinationntdomain CONTAINS "25985-coinbase.com" OR destinationntdomain CONTAINS "27699-coinbase.com" OR destinationntdomain CONTAINS "28367-coinbase.com")
index=activity AND rg_functionality="Firewall" AND requesturl NOT NULL AND (requesturl CONTAINS "178294-coinbase.com" OR requesturl CONTAINS "17912-coinbase.com" OR requesturl CONTAINS "17914-coinbase.com" OR requesturl CONTAINS "17917-coinbase.com" OR requesturl CONTAINS "17954-coinbase.com" OR requesturl CONTAINS "17958-coinbase.com" OR requesturl CONTAINS "182043-coinbase.com" OR requesturl CONTAINS "18275-gemini.com" OR requesturl CONTAINS "18276-coinbase.com" OR requesturl CONTAINS "18290185-coinbase.com" OR requesturl CONTAINS "182967-coinbase.com" OR requesturl CONTAINS "18560-coinbase.com" OR requesturl CONTAINS "18571-coinbase.com" OR requesturl CONTAINS "185912-coinbase.com" OR requesturl CONTAINS "185914-coinbase.com" OR requesturl CONTAINS "18592176-coinbase.com" OR requesturl CONTAINS "18594162-coinbase.com" OR requesturl CONTAINS "18594962-coinbase.com" OR requesturl CONTAINS "18597162-coinbase.com" OR requesturl CONTAINS "18719562-coinbase.com" OR requesturl CONTAINS "1875290-coinbase.com" OR requesturl CONTAINS "1882730-coinbase.com" OR requesturl CONTAINS "18902-coinbase.com" OR requesturl CONTAINS "18903-coinbase.com" OR requesturl CONTAINS "189126-coinbase.com" OR requesturl CONTAINS "18952-coinbase.com" OR requesturl CONTAINS "192854-coinbase.com" OR requesturl CONTAINS "192856-coinbase.com" OR requesturl CONTAINS "19287-binance.com" OR requesturl CONTAINS "19572-coinbase.com" OR requesturl CONTAINS "195812-coinbase.com" OR requesturl CONTAINS "195826-coinbase.com" OR requesturl CONTAINS "1958262-coinbase.com" OR requesturl CONTAINS "195827-binance.com" OR requesturl CONTAINS "1958297-coinbase.com" OR requesturl CONTAINS "19582970-coinbase.com" OR requesturl CONTAINS "19582971-coinbase.com" OR requesturl CONTAINS "19583-coinbase.com" OR requesturl CONTAINS "19592653-coinbase.com" OR requesturl CONTAINS "197304-coinbase.com" OR requesturl CONTAINS "19730492-coinbase.com" OR requesturl CONTAINS "19764162-coinbase.com" OR requesturl CONTAINS "19803-coinbase.com" OR requesturl CONTAINS "201784289-coinbase.com" OR requesturl CONTAINS "210823644-coinbase.com" OR requesturl CONTAINS "21158-coinbase.com" OR requesturl CONTAINS "21509-coinbase.com" OR requesturl CONTAINS "25985-coinbase.com" OR requesturl CONTAINS "27699-coinbase.com" OR requesturl CONTAINS "28367-coinbase.com")
index=activity AND rg_functionality="Firewall" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "28676-coinbase.com" OR destinationhostname CONTAINS "29185-coinbase.com" OR destinationhostname CONTAINS "29195-coinbase.com" OR destinationhostname CONTAINS "2a-coinbase.com" OR destinationhostname CONTAINS "2b-coinbase.com" OR destinationhostname CONTAINS "2c-coinbase.com" OR destinationhostname CONTAINS "2f-coinbase.com" OR destinationhostname CONTAINS "2fas-coinbase.com" OR destinationhostname CONTAINS "2o-coinbase.com" OR destinationhostname CONTAINS "2r-coinbase.com" OR destinationhostname CONTAINS "2s-coinbase.com" OR destinationhostname CONTAINS "2sv-coinbase.com" OR destinationhostname CONTAINS "352134951-coinbase.com" OR destinationhostname CONTAINS "38468-coinbase.com" OR destinationhostname CONTAINS "39590-coinbase.com" OR destinationhostname CONTAINS "41260-coinbase.com" OR destinationhostname CONTAINS "427883-coinbase.com" OR destinationhostname CONTAINS "43017-coinbase.com" OR destinationhostname CONTAINS "47562-coinbase.com" OR destinationhostname CONTAINS "50195-coinbase.com" OR destinationhostname CONTAINS "5247-coinbase.com" OR destinationhostname CONTAINS "54765-coinbase.com" OR destinationhostname CONTAINS "57197-coinbase.com" OR destinationhostname CONTAINS "58176-coinbase.com" OR destinationhostname CONTAINS "58297-coinbase.com" OR destinationhostname CONTAINS "61250-coinbase.com" OR destinationhostname CONTAINS "61835-coinbase.com" OR destinationhostname CONTAINS "61851-coinbase.com" OR destinationhostname CONTAINS "61937-coinbase.com" OR destinationhostname CONTAINS "71925-coinbase.com" OR destinationhostname CONTAINS "72957-coinbase.com" OR destinationhostname CONTAINS "72985-coinbase.com" OR destinationhostname CONTAINS "74651-coinbase.com" OR destinationhostname CONTAINS "754668948-coinbase.com" OR destinationhostname CONTAINS "76159869-coinbase.com" OR destinationhostname CONTAINS "76153-coinbase.com" OR destinationhostname CONTAINS "81758-coinbase.com" OR destinationhostname CONTAINS "81920-coinbase.com" OR destinationhostname CONTAINS "81926-coinbase.com" OR destinationhostname CONTAINS "81958-coinbase.com" OR destinationhostname CONTAINS "826298-coinbase.com" OR destinationhostname CONTAINS "83216-coinbase.com" OR destinationhostname CONTAINS "837613-coinbase.com" OR destinationhostname CONTAINS "83956-coinbase.com" OR destinationhostname CONTAINS "87157-coinbase.com" OR destinationhostname CONTAINS "87312-coinbase.com" OR destinationhostname CONTAINS "89304-coinbase.com" OR destinationhostname CONTAINS "89375-coinbase.com" OR destinationhostname CONTAINS "91723-gemini.com" OR destinationhostname CONTAINS "91752-coinbase.com")
index=activity AND rg_functionality="Firewall" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "28676-coinbase.com" OR sourcentdomain CONTAINS "29185-coinbase.com" OR sourcentdomain CONTAINS "29195-coinbase.com" OR sourcentdomain CONTAINS "2a-coinbase.com" OR sourcentdomain CONTAINS "2b-coinbase.com" OR sourcentdomain CONTAINS "2c-coinbase.com" OR sourcentdomain CONTAINS "2f-coinbase.com" OR sourcentdomain CONTAINS "2fas-coinbase.com" OR sourcentdomain CONTAINS "2o-coinbase.com" OR sourcentdomain CONTAINS "2r-coinbase.com" OR sourcentdomain CONTAINS "2s-coinbase.com" OR sourcentdomain CONTAINS "2sv-coinbase.com" OR sourcentdomain CONTAINS "352134951-coinbase.com" OR sourcentdomain CONTAINS "38468-coinbase.com" OR sourcentdomain CONTAINS "39590-coinbase.com" OR sourcentdomain CONTAINS "41260-coinbase.com" OR sourcentdomain CONTAINS "427883-coinbase.com" OR sourcentdomain CONTAINS "43017-coinbase.com" OR sourcentdomain CONTAINS "47562-coinbase.com" OR sourcentdomain CONTAINS "50195-coinbase.com" OR sourcentdomain CONTAINS "5247-coinbase.com" OR sourcentdomain CONTAINS "54765-coinbase.com" OR sourcentdomain CONTAINS "57197-coinbase.com" OR sourcentdomain CONTAINS "58176-coinbase.com" OR sourcentdomain CONTAINS "58297-coinbase.com" OR sourcentdomain CONTAINS "61250-coinbase.com" OR sourcentdomain CONTAINS "61835-coinbase.com" OR sourcentdomain CONTAINS "61851-coinbase.com" OR sourcentdomain CONTAINS "61937-coinbase.com" OR sourcentdomain CONTAINS "71925-coinbase.com" OR sourcentdomain CONTAINS "72957-coinbase.com" OR sourcentdomain CONTAINS "72985-coinbase.com" OR sourcentdomain CONTAINS "74651-coinbase.com" OR sourcentdomain CONTAINS "754668948-coinbase.com" OR sourcentdomain CONTAINS "76159869-coinbase.com" OR sourcentdomain CONTAINS "76153-coinbase.com" OR sourcentdomain CONTAINS "81758-coinbase.com" OR sourcentdomain CONTAINS "81920-coinbase.com" OR sourcentdomain CONTAINS "81926-coinbase.com" OR sourcentdomain CONTAINS "81958-coinbase.com" OR sourcentdomain CONTAINS "826298-coinbase.com" OR sourcentdomain CONTAINS "83216-coinbase.com" OR sourcentdomain CONTAINS "837613-coinbase.com" OR sourcentdomain CONTAINS "83956-coinbase.com" OR sourcentdomain CONTAINS "87157-coinbase.com" OR sourcentdomain CONTAINS "87312-coinbase.com" OR sourcentdomain CONTAINS "89304-coinbase.com" OR sourcentdomain CONTAINS "89375-coinbase.com" OR sourcentdomain CONTAINS "91723-gemini.com" OR sourcentdomain CONTAINS "91752-coinbase.com")
index=activity AND rg_functionality="Firewall" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "28676-coinbase.com" OR sourcehostname CONTAINS "29185-coinbase.com" OR sourcehostname CONTAINS "29195-coinbase.com" OR sourcehostname CONTAINS "2a-coinbase.com" OR sourcehostname CONTAINS "2b-coinbase.com" OR sourcehostname CONTAINS "2c-coinbase.com" OR sourcehostname CONTAINS "2f-coinbase.com" OR sourcehostname CONTAINS "2fas-coinbase.com" OR sourcehostname CONTAINS "2o-coinbase.com" OR sourcehostname CONTAINS "2r-coinbase.com" OR sourcehostname CONTAINS "2s-coinbase.com" OR sourcehostname CONTAINS "2sv-coinbase.com" OR sourcehostname CONTAINS "352134951-coinbase.com" OR sourcehostname CONTAINS "38468-coinbase.com" OR sourcehostname CONTAINS "39590-coinbase.com" OR sourcehostname CONTAINS "41260-coinbase.com" OR sourcehostname CONTAINS "427883-coinbase.com" OR sourcehostname CONTAINS "43017-coinbase.com" OR sourcehostname CONTAINS "47562-coinbase.com" OR sourcehostname CONTAINS "50195-coinbase.com" OR sourcehostname CONTAINS "5247-coinbase.com" OR sourcehostname CONTAINS "54765-coinbase.com" OR sourcehostname CONTAINS "57197-coinbase.com" OR sourcehostname CONTAINS "58176-coinbase.com" OR sourcehostname CONTAINS "58297-coinbase.com" OR sourcehostname CONTAINS "61250-coinbase.com" OR sourcehostname CONTAINS "61835-coinbase.com" OR sourcehostname CONTAINS "61851-coinbase.com" OR sourcehostname CONTAINS "61937-coinbase.com" OR sourcehostname CONTAINS "71925-coinbase.com" OR sourcehostname CONTAINS "72957-coinbase.com" OR sourcehostname CONTAINS "72985-coinbase.com" OR sourcehostname CONTAINS "74651-coinbase.com" OR sourcehostname CONTAINS "754668948-coinbase.com" OR sourcehostname CONTAINS "76159869-coinbase.com" OR sourcehostname CONTAINS "76153-coinbase.com" OR sourcehostname CONTAINS "81758-coinbase.com" OR sourcehostname CONTAINS "81920-coinbase.com" OR sourcehostname CONTAINS "81926-coinbase.com" OR sourcehostname CONTAINS "81958-coinbase.com" OR sourcehostname CONTAINS "826298-coinbase.com" OR sourcehostname CONTAINS "83216-coinbase.com" OR sourcehostname CONTAINS "837613-coinbase.com" OR sourcehostname CONTAINS "83956-coinbase.com" OR sourcehostname CONTAINS "87157-coinbase.com" OR sourcehostname CONTAINS "87312-coinbase.com" OR sourcehostname CONTAINS "89304-coinbase.com" OR sourcehostname CONTAINS "89375-coinbase.com" OR sourcehostname CONTAINS "91723-gemini.com" OR sourcehostname CONTAINS "91752-coinbase.com")
index=activity AND rg_functionality="Firewall" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "28676-coinbase.com" OR destinationntdomain CONTAINS "29185-coinbase.com" OR destinationntdomain CONTAINS "29195-coinbase.com" OR destinationntdomain CONTAINS "2a-coinbase.com" OR destinationntdomain CONTAINS "2b-coinbase.com" OR destinationntdomain CONTAINS "2c-coinbase.com" OR destinationntdomain CONTAINS "2f-coinbase.com" OR destinationntdomain CONTAINS "2fas-coinbase.com" OR destinationntdomain CONTAINS "2o-coinbase.com" OR destinationntdomain CONTAINS "2r-coinbase.com" OR destinationntdomain CONTAINS "2s-coinbase.com" OR destinationntdomain CONTAINS "2sv-coinbase.com" OR destinationntdomain CONTAINS "352134951-coinbase.com" OR destinationntdomain CONTAINS "38468-coinbase.com" OR destinationntdomain CONTAINS "39590-coinbase.com" OR destinationntdomain CONTAINS "41260-coinbase.com" OR destinationntdomain CONTAINS "427883-coinbase.com" OR destinationntdomain CONTAINS "43017-coinbase.com" OR destinationntdomain CONTAINS "47562-coinbase.com" OR destinationntdomain CONTAINS "50195-coinbase.com" OR destinationntdomain CONTAINS "5247-coinbase.com" OR destinationntdomain CONTAINS "54765-coinbase.com" OR destinationntdomain CONTAINS "57197-coinbase.com" OR destinationntdomain CONTAINS "58176-coinbase.com" OR destinationntdomain CONTAINS "58297-coinbase.com" OR destinationntdomain CONTAINS "61250-coinbase.com" OR destinationntdomain CONTAINS "61835-coinbase.com" OR destinationntdomain CONTAINS "61851-coinbase.com" OR destinationntdomain CONTAINS "61937-coinbase.com" OR destinationntdomain CONTAINS "71925-coinbase.com" OR destinationntdomain CONTAINS "72957-coinbase.com" OR destinationntdomain CONTAINS "72985-coinbase.com" OR destinationntdomain CONTAINS "74651-coinbase.com" OR destinationntdomain CONTAINS "754668948-coinbase.com" OR destinationntdomain CONTAINS "76159869-coinbase.com" OR destinationntdomain CONTAINS "76153-coinbase.com" OR destinationntdomain CONTAINS "81758-coinbase.com" OR destinationntdomain CONTAINS "81920-coinbase.com" OR destinationntdomain CONTAINS "81926-coinbase.com" OR destinationntdomain CONTAINS "81958-coinbase.com" OR destinationntdomain CONTAINS "826298-coinbase.com" OR destinationntdomain CONTAINS "83216-coinbase.com" OR destinationntdomain CONTAINS "837613-coinbase.com" OR destinationntdomain CONTAINS "83956-coinbase.com" OR destinationntdomain CONTAINS "87157-coinbase.com" OR destinationntdomain CONTAINS "87312-coinbase.com" OR destinationntdomain CONTAINS "89304-coinbase.com" OR destinationntdomain CONTAINS "89375-coinbase.com" OR destinationntdomain CONTAINS "91723-gemini.com" OR destinationntdomain CONTAINS "91752-coinbase.com")
index=activity AND rg_functionality="Firewall" AND requesturl NOT NULL AND (requesturl CONTAINS "28676-coinbase.com" OR requesturl CONTAINS "29185-coinbase.com" OR requesturl CONTAINS "29195-coinbase.com" OR requesturl CONTAINS "2a-coinbase.com" OR requesturl CONTAINS "2b-coinbase.com" OR requesturl CONTAINS "2c-coinbase.com" OR requesturl CONTAINS "2f-coinbase.com" OR requesturl CONTAINS "2fas-coinbase.com" OR requesturl CONTAINS "2o-coinbase.com" OR requesturl CONTAINS "2r-coinbase.com" OR requesturl CONTAINS "2s-coinbase.com" OR requesturl CONTAINS "2sv-coinbase.com" OR requesturl CONTAINS "352134951-coinbase.com" OR requesturl CONTAINS "38468-coinbase.com" OR requesturl CONTAINS "39590-coinbase.com" OR requesturl CONTAINS "41260-coinbase.com" OR requesturl CONTAINS "427883-coinbase.com" OR requesturl CONTAINS "43017-coinbase.com" OR requesturl CONTAINS "47562-coinbase.com" OR requesturl CONTAINS "50195-coinbase.com" OR requesturl CONTAINS "5247-coinbase.com" OR requesturl CONTAINS "54765-coinbase.com" OR requesturl CONTAINS "57197-coinbase.com" OR requesturl CONTAINS "58176-coinbase.com" OR requesturl CONTAINS "58297-coinbase.com" OR requesturl CONTAINS "61250-coinbase.com" OR requesturl CONTAINS "61835-coinbase.com" OR requesturl CONTAINS "61851-coinbase.com" OR requesturl CONTAINS "61937-coinbase.com" OR requesturl CONTAINS "71925-coinbase.com" OR requesturl CONTAINS "72957-coinbase.com" OR requesturl CONTAINS "72985-coinbase.com" OR requesturl CONTAINS "74651-coinbase.com" OR requesturl CONTAINS "754668948-coinbase.com" OR requesturl CONTAINS "76159869-coinbase.com" OR requesturl CONTAINS "76153-coinbase.com" OR requesturl CONTAINS "81758-coinbase.com" OR requesturl CONTAINS "81920-coinbase.com" OR requesturl CONTAINS "81926-coinbase.com" OR requesturl CONTAINS "81958-coinbase.com" OR requesturl CONTAINS "826298-coinbase.com" OR requesturl CONTAINS "83216-coinbase.com" OR requesturl CONTAINS "837613-coinbase.com" OR requesturl CONTAINS "83956-coinbase.com" OR requesturl CONTAINS "87157-coinbase.com" OR requesturl CONTAINS "87312-coinbase.com" OR requesturl CONTAINS "89304-coinbase.com" OR requesturl CONTAINS "89375-coinbase.com" OR requesturl CONTAINS "91723-gemini.com" OR requesturl CONTAINS "91752-coinbase.com")
index=activity AND rg_functionality="Firewall" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "91756-coinbase.com" OR destinationhostname CONTAINS "91782-coinbase.com" OR destinationhostname CONTAINS "91835-coinbase.com" OR destinationhostname CONTAINS "91845-coinbase.com" OR destinationhostname CONTAINS "91923-coinbase.com" OR destinationhostname CONTAINS "92758-coinbase.com" OR destinationhostname CONTAINS "948122061-coinbase.com" OR destinationhostname CONTAINS "978941-coinbase.com" OR destinationhostname CONTAINS "accountrecovery-coinbase.com" OR destinationhostname CONTAINS "action-shakepay.com" OR destinationhostname CONTAINS "adjust-coinbase.com" OR destinationhostname CONTAINS "admin-kraken.com" OR destinationhostname CONTAINS "applechargebacks.com" OR destinationhostname CONTAINS "authenticate-gemini.com" OR destinationhostname CONTAINS "authorize-gmail.com" OR destinationhostname CONTAINS "binance-okta.com" OR destinationhostname CONTAINS "captcha-coinbase.com" OR destinationhostname CONTAINS "cd-coinbase.com" OR destinationhostname CONTAINS "coinbase-heip.com" OR destinationhostname CONTAINS "coinbase-live.support" OR destinationhostname CONTAINS "coinbase-reject.com" OR destinationhostname CONTAINS "coinbase-ticket.com" OR destinationhostname CONTAINS "coinbaseheip.com" OR destinationhostname CONTAINS "com-2fa.help" OR destinationhostname CONTAINS "com-2fa.support" OR destinationhostname CONTAINS "com-3845.support" OR destinationhostname CONTAINS "com-connect.help" OR destinationhostname CONTAINS "com-fraud.support" OR destinationhostname CONTAINS "com-help.support" OR destinationhostname CONTAINS "com-reset.help" OR destinationhostname CONTAINS "com-reset.net" OR destinationhostname CONTAINS "com-ticket.live" OR destinationhostname CONTAINS "com-ticket.support" OR destinationhostname CONTAINS "contact-nexo.com" OR destinationhostname CONTAINS "convert-coinbase.com" OR destinationhostname CONTAINS "customerservice-coinbase.com" OR destinationhostname CONTAINS "default-coinbase.com" OR destinationhostname CONTAINS "defend-coinbase.com" OR destinationhostname CONTAINS "deny-coinbase.com" OR destinationhostname CONTAINS "disconnect-coinbase.com" OR destinationhostname CONTAINS "escalate-coinbase.com" OR destinationhostname CONTAINS "establish-coinbase.com" OR destinationhostname CONTAINS "fcc-okta.com" OR destinationhostname CONTAINS "fraudulent-coinbase.com" OR destinationhostname CONTAINS "guard-apple.com" OR destinationhostname CONTAINS "guard-icloud.com" OR destinationhostname CONTAINS "guardian-coinbase.com" OR destinationhostname CONTAINS "guide-gemini.com" OR destinationhostname CONTAINS "help-bitfinex.com" OR destinationhostname CONTAINS "help-shakepay.com")
index=activity AND rg_functionality="Firewall" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "91756-coinbase.com" OR sourcentdomain CONTAINS "91782-coinbase.com" OR sourcentdomain CONTAINS "91835-coinbase.com" OR sourcentdomain CONTAINS "91845-coinbase.com" OR sourcentdomain CONTAINS "91923-coinbase.com" OR sourcentdomain CONTAINS "92758-coinbase.com" OR sourcentdomain CONTAINS "948122061-coinbase.com" OR sourcentdomain CONTAINS "978941-coinbase.com" OR sourcentdomain CONTAINS "accountrecovery-coinbase.com" OR sourcentdomain CONTAINS "action-shakepay.com" OR sourcentdomain CONTAINS "adjust-coinbase.com" OR sourcentdomain CONTAINS "admin-kraken.com" OR sourcentdomain CONTAINS "applechargebacks.com" OR sourcentdomain CONTAINS "authenticate-gemini.com" OR sourcentdomain CONTAINS "authorize-gmail.com" OR sourcentdomain CONTAINS "binance-okta.com" OR sourcentdomain CONTAINS "captcha-coinbase.com" OR sourcentdomain CONTAINS "cd-coinbase.com" OR sourcentdomain CONTAINS "coinbase-heip.com" OR sourcentdomain CONTAINS "coinbase-live.support" OR sourcentdomain CONTAINS "coinbase-reject.com" OR sourcentdomain CONTAINS "coinbase-ticket.com" OR sourcentdomain CONTAINS "coinbaseheip.com" OR sourcentdomain CONTAINS "com-2fa.help" OR sourcentdomain CONTAINS "com-2fa.support" OR sourcentdomain CONTAINS "com-3845.support" OR sourcentdomain CONTAINS "com-connect.help" OR sourcentdomain CONTAINS "com-fraud.support" OR sourcentdomain CONTAINS "com-help.support" OR sourcentdomain CONTAINS "com-reset.help" OR sourcentdomain CONTAINS "com-reset.net" OR sourcentdomain CONTAINS "com-ticket.live" OR sourcentdomain CONTAINS "com-ticket.support" OR sourcentdomain CONTAINS "contact-nexo.com" OR sourcentdomain CONTAINS "convert-coinbase.com" OR sourcentdomain CONTAINS "customerservice-coinbase.com" OR sourcentdomain CONTAINS "default-coinbase.com" OR sourcentdomain CONTAINS "defend-coinbase.com" OR sourcentdomain CONTAINS "deny-coinbase.com" OR sourcentdomain CONTAINS "disconnect-coinbase.com" OR sourcentdomain CONTAINS "escalate-coinbase.com" OR sourcentdomain CONTAINS "establish-coinbase.com" OR sourcentdomain CONTAINS "fcc-okta.com" OR sourcentdomain CONTAINS "fraudulent-coinbase.com" OR sourcentdomain CONTAINS "guard-apple.com" OR sourcentdomain CONTAINS "guard-icloud.com" OR sourcentdomain CONTAINS "guardian-coinbase.com" OR sourcentdomain CONTAINS "guide-gemini.com" OR sourcentdomain CONTAINS "help-bitfinex.com" OR sourcentdomain CONTAINS "help-shakepay.com")
index=activity AND rg_functionality="Firewall" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "91756-coinbase.com" OR sourcehostname CONTAINS "91782-coinbase.com" OR sourcehostname CONTAINS "91835-coinbase.com" OR sourcehostname CONTAINS "91845-coinbase.com" OR sourcehostname CONTAINS "91923-coinbase.com" OR sourcehostname CONTAINS "92758-coinbase.com" OR sourcehostname CONTAINS "948122061-coinbase.com" OR sourcehostname CONTAINS "978941-coinbase.com" OR sourcehostname CONTAINS "accountrecovery-coinbase.com" OR sourcehostname CONTAINS "action-shakepay.com" OR sourcehostname CONTAINS "adjust-coinbase.com" OR sourcehostname CONTAINS "admin-kraken.com" OR sourcehostname CONTAINS "applechargebacks.com" OR sourcehostname CONTAINS "authenticate-gemini.com" OR sourcehostname CONTAINS "authorize-gmail.com" OR sourcehostname CONTAINS "binance-okta.com" OR sourcehostname CONTAINS "captcha-coinbase.com" OR sourcehostname CONTAINS "cd-coinbase.com" OR sourcehostname CONTAINS "coinbase-heip.com" OR sourcehostname CONTAINS "coinbase-live.support" OR sourcehostname CONTAINS "coinbase-reject.com" OR sourcehostname CONTAINS "coinbase-ticket.com" OR sourcehostname CONTAINS "coinbaseheip.com" OR sourcehostname CONTAINS "com-2fa.help" OR sourcehostname CONTAINS "com-2fa.support" OR sourcehostname CONTAINS "com-3845.support" OR sourcehostname CONTAINS "com-connect.help" OR sourcehostname CONTAINS "com-fraud.support" OR sourcehostname CONTAINS "com-help.support" OR sourcehostname CONTAINS "com-reset.help" OR sourcehostname CONTAINS "com-reset.net" OR sourcehostname CONTAINS "com-ticket.live" OR sourcehostname CONTAINS "com-ticket.support" OR sourcehostname CONTAINS "contact-nexo.com" OR sourcehostname CONTAINS "convert-coinbase.com" OR sourcehostname CONTAINS "customerservice-coinbase.com" OR sourcehostname CONTAINS "default-coinbase.com" OR sourcehostname CONTAINS "defend-coinbase.com" OR sourcehostname CONTAINS "deny-coinbase.com" OR sourcehostname CONTAINS "disconnect-coinbase.com" OR sourcehostname CONTAINS "escalate-coinbase.com" OR sourcehostname CONTAINS "establish-coinbase.com" OR sourcehostname CONTAINS "fcc-okta.com" OR sourcehostname CONTAINS "fraudulent-coinbase.com" OR sourcehostname CONTAINS "guard-apple.com" OR sourcehostname CONTAINS "guard-icloud.com" OR sourcehostname CONTAINS "guardian-coinbase.com" OR sourcehostname CONTAINS "guide-gemini.com" OR sourcehostname CONTAINS "help-bitfinex.com" OR sourcehostname CONTAINS "help-shakepay.com")
index=activity AND rg_functionality="Firewall" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "91756-coinbase.com" OR destinationntdomain CONTAINS "91782-coinbase.com" OR destinationntdomain CONTAINS "91835-coinbase.com" OR destinationntdomain CONTAINS "91845-coinbase.com" OR destinationntdomain CONTAINS "91923-coinbase.com" OR destinationntdomain CONTAINS "92758-coinbase.com" OR destinationntdomain CONTAINS "948122061-coinbase.com" OR destinationntdomain CONTAINS "978941-coinbase.com" OR destinationntdomain CONTAINS "accountrecovery-coinbase.com" OR destinationntdomain CONTAINS "action-shakepay.com" OR destinationntdomain CONTAINS "adjust-coinbase.com" OR destinationntdomain CONTAINS "admin-kraken.com" OR destinationntdomain CONTAINS "applechargebacks.com" OR destinationntdomain CONTAINS "authenticate-gemini.com" OR destinationntdomain CONTAINS "authorize-gmail.com" OR destinationntdomain CONTAINS "binance-okta.com" OR destinationntdomain CONTAINS "captcha-coinbase.com" OR destinationntdomain CONTAINS "cd-coinbase.com" OR destinationntdomain CONTAINS "coinbase-heip.com" OR destinationntdomain CONTAINS "coinbase-live.support" OR destinationntdomain CONTAINS "coinbase-reject.com" OR destinationntdomain CONTAINS "coinbase-ticket.com" OR destinationntdomain CONTAINS "coinbaseheip.com" OR destinationntdomain CONTAINS "com-2fa.help" OR destinationntdomain CONTAINS "com-2fa.support" OR destinationntdomain CONTAINS "com-3845.support" OR destinationntdomain CONTAINS "com-connect.help" OR destinationntdomain CONTAINS "com-fraud.support" OR destinationntdomain CONTAINS "com-help.support" OR destinationntdomain CONTAINS "com-reset.help" OR destinationntdomain CONTAINS "com-reset.net" OR destinationntdomain CONTAINS "com-ticket.live" OR destinationntdomain CONTAINS "com-ticket.support" OR destinationntdomain CONTAINS "contact-nexo.com" OR destinationntdomain CONTAINS "convert-coinbase.com" OR destinationntdomain CONTAINS "customerservice-coinbase.com" OR destinationntdomain CONTAINS "default-coinbase.com" OR destinationntdomain CONTAINS "defend-coinbase.com" OR destinationntdomain CONTAINS "deny-coinbase.com" OR destinationntdomain CONTAINS "disconnect-coinbase.com" OR destinationntdomain CONTAINS "escalate-coinbase.com" OR destinationntdomain CONTAINS "establish-coinbase.com" OR destinationntdomain CONTAINS "fcc-okta.com" OR destinationntdomain CONTAINS "fraudulent-coinbase.com" OR destinationntdomain CONTAINS "guard-apple.com" OR destinationntdomain CONTAINS "guard-icloud.com" OR destinationntdomain CONTAINS "guardian-coinbase.com" OR destinationntdomain CONTAINS "guide-gemini.com" OR destinationntdomain CONTAINS "help-bitfinex.com" OR destinationntdomain CONTAINS "help-shakepay.com")
index=activity AND rg_functionality="Firewall" AND requesturl NOT NULL AND (requesturl CONTAINS "91756-coinbase.com" OR requesturl CONTAINS "91782-coinbase.com" OR requesturl CONTAINS "91835-coinbase.com" OR requesturl CONTAINS "91845-coinbase.com" OR requesturl CONTAINS "91923-coinbase.com" OR requesturl CONTAINS "92758-coinbase.com" OR requesturl CONTAINS "948122061-coinbase.com" OR requesturl CONTAINS "978941-coinbase.com" OR requesturl CONTAINS "accountrecovery-coinbase.com" OR requesturl CONTAINS "action-shakepay.com" OR requesturl CONTAINS "adjust-coinbase.com" OR requesturl CONTAINS "admin-kraken.com" OR requesturl CONTAINS "applechargebacks.com" OR requesturl CONTAINS "authenticate-gemini.com" OR requesturl CONTAINS "authorize-gmail.com" OR requesturl CONTAINS "binance-okta.com" OR requesturl CONTAINS "captcha-coinbase.com" OR requesturl CONTAINS "cd-coinbase.com" OR requesturl CONTAINS "coinbase-heip.com" OR requesturl CONTAINS "coinbase-live.support" OR requesturl CONTAINS "coinbase-reject.com" OR requesturl CONTAINS "coinbase-ticket.com" OR requesturl CONTAINS "coinbaseheip.com" OR requesturl CONTAINS "com-2fa.help" OR requesturl CONTAINS "com-2fa.support" OR requesturl CONTAINS "com-3845.support" OR requesturl CONTAINS "com-connect.help" OR requesturl CONTAINS "com-fraud.support" OR requesturl CONTAINS "com-help.support" OR requesturl CONTAINS "com-reset.help" OR requesturl CONTAINS "com-reset.net" OR requesturl CONTAINS "com-ticket.live" OR requesturl CONTAINS "com-ticket.support" OR requesturl CONTAINS "contact-nexo.com" OR requesturl CONTAINS "convert-coinbase.com" OR requesturl CONTAINS "customerservice-coinbase.com" OR requesturl CONTAINS "default-coinbase.com" OR requesturl CONTAINS "defend-coinbase.com" OR requesturl CONTAINS "deny-coinbase.com" OR requesturl CONTAINS "disconnect-coinbase.com" OR requesturl CONTAINS "escalate-coinbase.com" OR requesturl CONTAINS "establish-coinbase.com" OR requesturl CONTAINS "fcc-okta.com" OR requesturl CONTAINS "fraudulent-coinbase.com" OR requesturl CONTAINS "guard-apple.com" OR requesturl CONTAINS "guard-icloud.com" OR requesturl CONTAINS "guardian-coinbase.com" OR requesturl CONTAINS "guide-gemini.com" OR requesturl CONTAINS "help-bitfinex.com" OR requesturl CONTAINS "help-shakepay.com")
index=activity AND rg_functionality="Firewall" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "helpdesk-apple.com" OR destinationhostname CONTAINS "helpdesk-gemini.com" OR destinationhostname CONTAINS "helpdesk-icloud.com" OR destinationhostname CONTAINS "identification-coinbase.com" OR destinationhostname CONTAINS "lockdown-coinbase.com" OR destinationhostname CONTAINS "login-nexo.com" OR destinationhostname CONTAINS "keys-coinbase.com" OR destinationhostname CONTAINS "messages-coinbase.com" OR destinationhostname CONTAINS "newpassword-coinbase.com" OR destinationhostname CONTAINS "prompt-coinbase.com" OR destinationhostname CONTAINS "protect-apple.com" OR destinationhostname CONTAINS "protect-coinbase.com" OR destinationhostname CONTAINS "protect-gmail.com" OR destinationhostname CONTAINS "protect-kraken.com" OR destinationhostname CONTAINS "recoverme-coinbase.com" OR destinationhostname CONTAINS "recoveryportal-coinbase.com" OR destinationhostname CONTAINS "refunds-coinbase.com" OR destinationhostname CONTAINS "reset-okta.com" OR destinationhostname CONTAINS "restore-coinbase.com" OR destinationhostname CONTAINS "return-coinbase.com" OR destinationhostname CONTAINS "reverts-coinbase.com" OR destinationhostname CONTAINS "secure-binance.us" OR destinationhostname CONTAINS "secure-icloud.com" OR destinationhostname CONTAINS "secure-nexo.com" OR destinationhostname CONTAINS "secure-shakepay.com" OR destinationhostname CONTAINS "security-umusic.com" OR destinationhostname CONTAINS "server694590423.tech" OR destinationhostname CONTAINS "session-coinbase.com" OR destinationhostname CONTAINS "startrecovery-coinbase.com" OR destinationhostname CONTAINS "signin-kraken.com" OR destinationhostname CONTAINS "suite-trezor.io" OR destinationhostname CONTAINS "supportportal-coinbase.com" OR destinationhostname CONTAINS "tech-icloud.com" OR destinationhostname CONTAINS "threat-coinbase.com" OR destinationhostname CONTAINS "ticket-apple.com" OR destinationhostname CONTAINS "ticket-coinbase.com" OR destinationhostname CONTAINS "tickets-apple.com" OR destinationhostname CONTAINS "tokens-coinbase.com" OR destinationhostname CONTAINS "unblock-coinbase.com" OR destinationhostname CONTAINS "unlink-coinbase.com" OR destinationhostname CONTAINS "your-coinbase.com" OR destinationhostname CONTAINS "welcome-coinbase.com" OR destinationhostname CONTAINS "www-coinbasewallet.com" OR destinationhostname CONTAINS "www-help-coinbase.com" OR destinationhostname CONTAINS "www-help-gemini.com")
index=activity AND rg_functionality="Firewall" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "helpdesk-apple.com" OR sourcentdomain CONTAINS "helpdesk-gemini.com" OR sourcentdomain CONTAINS "helpdesk-icloud.com" OR sourcentdomain CONTAINS "identification-coinbase.com" OR sourcentdomain CONTAINS "lockdown-coinbase.com" OR sourcentdomain CONTAINS "login-nexo.com" OR sourcentdomain CONTAINS "keys-coinbase.com" OR sourcentdomain CONTAINS "messages-coinbase.com" OR sourcentdomain CONTAINS "newpassword-coinbase.com" OR sourcentdomain CONTAINS "prompt-coinbase.com" OR sourcentdomain CONTAINS "protect-apple.com" OR sourcentdomain CONTAINS "protect-coinbase.com" OR sourcentdomain CONTAINS "protect-gmail.com" OR sourcentdomain CONTAINS "protect-kraken.com" OR sourcentdomain CONTAINS "recoverme-coinbase.com" OR sourcentdomain CONTAINS "recoveryportal-coinbase.com" OR sourcentdomain CONTAINS "refunds-coinbase.com" OR sourcentdomain CONTAINS "reset-okta.com" OR sourcentdomain CONTAINS "restore-coinbase.com" OR sourcentdomain CONTAINS "return-coinbase.com" OR sourcentdomain CONTAINS "reverts-coinbase.com" OR sourcentdomain CONTAINS "secure-binance.us" OR sourcentdomain CONTAINS "secure-icloud.com" OR sourcentdomain CONTAINS "secure-nexo.com" OR sourcentdomain CONTAINS "secure-shakepay.com" OR sourcentdomain CONTAINS "security-umusic.com" OR sourcentdomain CONTAINS "server694590423.tech" OR sourcentdomain CONTAINS "session-coinbase.com" OR sourcentdomain CONTAINS "startrecovery-coinbase.com" OR sourcentdomain CONTAINS "signin-kraken.com" OR sourcentdomain CONTAINS "suite-trezor.io" OR sourcentdomain CONTAINS "supportportal-coinbase.com" OR sourcentdomain CONTAINS "tech-icloud.com" OR sourcentdomain CONTAINS "threat-coinbase.com" OR sourcentdomain CONTAINS "ticket-apple.com" OR sourcentdomain CONTAINS "ticket-coinbase.com" OR sourcentdomain CONTAINS "tickets-apple.com" OR sourcentdomain CONTAINS "tokens-coinbase.com" OR sourcentdomain CONTAINS "unblock-coinbase.com" OR sourcentdomain CONTAINS "unlink-coinbase.com" OR sourcentdomain CONTAINS "your-coinbase.com" OR sourcentdomain CONTAINS "welcome-coinbase.com" OR sourcentdomain CONTAINS "www-coinbasewallet.com" OR sourcentdomain CONTAINS "www-help-coinbase.com" OR sourcentdomain CONTAINS "www-help-gemini.com")
index=activity AND rg_functionality="Firewall" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "helpdesk-apple.com" OR sourcehostname CONTAINS "helpdesk-gemini.com" OR sourcehostname CONTAINS "helpdesk-icloud.com" OR sourcehostname CONTAINS "identification-coinbase.com" OR sourcehostname CONTAINS "lockdown-coinbase.com" OR sourcehostname CONTAINS "login-nexo.com" OR sourcehostname CONTAINS "keys-coinbase.com" OR sourcehostname CONTAINS "messages-coinbase.com" OR sourcehostname CONTAINS "newpassword-coinbase.com" OR sourcehostname CONTAINS "prompt-coinbase.com" OR sourcehostname CONTAINS "protect-apple.com" OR sourcehostname CONTAINS "protect-coinbase.com" OR sourcehostname CONTAINS "protect-gmail.com" OR sourcehostname CONTAINS "protect-kraken.com" OR sourcehostname CONTAINS "recoverme-coinbase.com" OR sourcehostname CONTAINS "recoveryportal-coinbase.com" OR sourcehostname CONTAINS "refunds-coinbase.com" OR sourcehostname CONTAINS "reset-okta.com" OR sourcehostname CONTAINS "restore-coinbase.com" OR sourcehostname CONTAINS "return-coinbase.com" OR sourcehostname CONTAINS "reverts-coinbase.com" OR sourcehostname CONTAINS "secure-binance.us" OR sourcehostname CONTAINS "secure-icloud.com" OR sourcehostname CONTAINS "secure-nexo.com" OR sourcehostname CONTAINS "secure-shakepay.com" OR sourcehostname CONTAINS "security-umusic.com" OR sourcehostname CONTAINS "server694590423.tech" OR sourcehostname CONTAINS "session-coinbase.com" OR sourcehostname CONTAINS "startrecovery-coinbase.com" OR sourcehostname CONTAINS "signin-kraken.com" OR sourcehostname CONTAINS "suite-trezor.io" OR sourcehostname CONTAINS "supportportal-coinbase.com" OR sourcehostname CONTAINS "tech-icloud.com" OR sourcehostname CONTAINS "threat-coinbase.com" OR sourcehostname CONTAINS "ticket-apple.com" OR sourcehostname CONTAINS "ticket-coinbase.com" OR sourcehostname CONTAINS "tickets-apple.com" OR sourcehostname CONTAINS "tokens-coinbase.com" OR sourcehostname CONTAINS "unblock-coinbase.com" OR sourcehostname CONTAINS "unlink-coinbase.com" OR sourcehostname CONTAINS "your-coinbase.com" OR sourcehostname CONTAINS "welcome-coinbase.com" OR sourcehostname CONTAINS "www-coinbasewallet.com" OR sourcehostname CONTAINS "www-help-coinbase.com" OR sourcehostname CONTAINS "www-help-gemini.com")
index=activity AND rg_functionality="Firewall" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "helpdesk-apple.com" OR destinationntdomain CONTAINS "helpdesk-gemini.com" OR destinationntdomain CONTAINS "helpdesk-icloud.com" OR destinationntdomain CONTAINS "identification-coinbase.com" OR destinationntdomain CONTAINS "lockdown-coinbase.com" OR destinationntdomain CONTAINS "login-nexo.com" OR destinationntdomain CONTAINS "keys-coinbase.com" OR destinationntdomain CONTAINS "messages-coinbase.com" OR destinationntdomain CONTAINS "newpassword-coinbase.com" OR destinationntdomain CONTAINS "prompt-coinbase.com" OR destinationntdomain CONTAINS "protect-apple.com" OR destinationntdomain CONTAINS "protect-coinbase.com" OR destinationntdomain CONTAINS "protect-gmail.com" OR destinationntdomain CONTAINS "protect-kraken.com" OR destinationntdomain CONTAINS "recoverme-coinbase.com" OR destinationntdomain CONTAINS "recoveryportal-coinbase.com" OR destinationntdomain CONTAINS "refunds-coinbase.com" OR destinationntdomain CONTAINS "reset-okta.com" OR destinationntdomain CONTAINS "restore-coinbase.com" OR destinationntdomain CONTAINS "return-coinbase.com" OR destinationntdomain CONTAINS "reverts-coinbase.com" OR destinationntdomain CONTAINS "secure-binance.us" OR destinationntdomain CONTAINS "secure-icloud.com" OR destinationntdomain CONTAINS "secure-nexo.com" OR destinationntdomain CONTAINS "secure-shakepay.com" OR destinationntdomain CONTAINS "security-umusic.com" OR destinationntdomain CONTAINS "server694590423.tech" OR destinationntdomain CONTAINS "session-coinbase.com" OR destinationntdomain CONTAINS "startrecovery-coinbase.com" OR destinationntdomain CONTAINS "signin-kraken.com" OR destinationntdomain CONTAINS "suite-trezor.io" OR destinationntdomain CONTAINS "supportportal-coinbase.com" OR destinationntdomain CONTAINS "tech-icloud.com" OR destinationntdomain CONTAINS "threat-coinbase.com" OR destinationntdomain CONTAINS "ticket-apple.com" OR destinationntdomain CONTAINS "ticket-coinbase.com" OR destinationntdomain CONTAINS "tickets-apple.com" OR destinationntdomain CONTAINS "tokens-coinbase.com" OR destinationntdomain CONTAINS "unblock-coinbase.com" OR destinationntdomain CONTAINS "unlink-coinbase.com" OR destinationntdomain CONTAINS "your-coinbase.com" OR destinationntdomain CONTAINS "welcome-coinbase.com" OR destinationntdomain CONTAINS "www-coinbasewallet.com" OR destinationntdomain CONTAINS "www-help-coinbase.com" OR destinationntdomain CONTAINS "www-help-gemini.com")
index=activity AND rg_functionality="Firewall" AND requesturl NOT NULL AND (requesturl CONTAINS "helpdesk-apple.com" OR requesturl CONTAINS "helpdesk-gemini.com" OR requesturl CONTAINS "helpdesk-icloud.com" OR requesturl CONTAINS "identification-coinbase.com" OR requesturl CONTAINS "lockdown-coinbase.com" OR requesturl CONTAINS "login-nexo.com" OR requesturl CONTAINS "keys-coinbase.com" OR requesturl CONTAINS "messages-coinbase.com" OR requesturl CONTAINS "newpassword-coinbase.com" OR requesturl CONTAINS "prompt-coinbase.com" OR requesturl CONTAINS "protect-apple.com" OR requesturl CONTAINS "protect-coinbase.com" OR requesturl CONTAINS "protect-gmail.com" OR requesturl CONTAINS "protect-kraken.com" OR requesturl CONTAINS "recoverme-coinbase.com" OR requesturl CONTAINS "recoveryportal-coinbase.com" OR requesturl CONTAINS "refunds-coinbase.com" OR requesturl CONTAINS "reset-okta.com" OR requesturl CONTAINS "restore-coinbase.com" OR requesturl CONTAINS "return-coinbase.com" OR requesturl CONTAINS "reverts-coinbase.com" OR requesturl CONTAINS "secure-binance.us" OR requesturl CONTAINS "secure-icloud.com" OR requesturl CONTAINS "secure-nexo.com" OR requesturl CONTAINS "secure-shakepay.com" OR requesturl CONTAINS "security-umusic.com" OR requesturl CONTAINS "server694590423.tech" OR requesturl CONTAINS "session-coinbase.com" OR requesturl CONTAINS "startrecovery-coinbase.com" OR requesturl CONTAINS "signin-kraken.com" OR requesturl CONTAINS "suite-trezor.io" OR requesturl CONTAINS "supportportal-coinbase.com" OR requesturl CONTAINS "tech-icloud.com" OR requesturl CONTAINS "threat-coinbase.com" OR requesturl CONTAINS "ticket-apple.com" OR requesturl CONTAINS "ticket-coinbase.com" OR requesturl CONTAINS "tickets-apple.com" OR requesturl CONTAINS "tokens-coinbase.com" OR requesturl CONTAINS "unblock-coinbase.com" OR requesturl CONTAINS "unlink-coinbase.com" OR requesturl CONTAINS "your-coinbase.com" OR requesturl CONTAINS "welcome-coinbase.com" OR requesturl CONTAINS "www-coinbasewallet.com" OR requesturl CONTAINS "www-help-coinbase.com" OR requesturl CONTAINS "www-help-gemini.com")
index=activity AND rg_functionality="Web Proxy" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "official-server.com" OR destinationhostname CONTAINS "server694590423.tech" OR destinationhostname CONTAINS "island-placid-bromine.glitch.me" OR destinationhostname CONTAINS "circular-noon-farmhouse.glitch.me" OR destinationhostname CONTAINS "talented-friendly-price.glitch.me" OR destinationhostname CONTAINS "dflfmgsdokasdcpl.com" OR destinationhostname CONTAINS "original-backend.com" OR destinationhostname CONTAINS "07159889-coinbase.com" OR destinationhostname CONTAINS "10195-coinbase.com" OR destinationhostname CONTAINS "11246-coinbase.com" OR destinationhostname CONTAINS "11247-coinbase.com" OR destinationhostname CONTAINS "11248-coinbase.com" OR destinationhostname CONTAINS "11258-coinbase.com" OR destinationhostname CONTAINS "11259-coinbase.com" OR destinationhostname CONTAINS "113912-coinbase.com" OR destinationhostname CONTAINS "11472-coinbase.com" OR destinationhostname CONTAINS "11923-coinbase.com" OR destinationhostname CONTAINS "11957-coinbase.com" OR destinationhostname CONTAINS "128147-coinbase.com" OR destinationhostname CONTAINS "12958-coinbase.com" OR destinationhostname CONTAINS "12984-okta.com" OR destinationhostname CONTAINS "12985-coinbase.com" OR destinationhostname CONTAINS "13130-coinbase.com" OR destinationhostname CONTAINS "13247-coinbase.com" OR destinationhostname CONTAINS "13247-icloud.com" OR destinationhostname CONTAINS "13267-coinbase.com" OR destinationhostname CONTAINS "146271510-coinbase.com" OR destinationhostname CONTAINS "146282-coinbase.com" OR destinationhostname CONTAINS "146284-coinbase.com" OR destinationhostname CONTAINS "147260-coinbase.com" OR destinationhostname CONTAINS "14765-coinbase.com" OR destinationhostname CONTAINS "14817582-coinbase.com" OR destinationhostname CONTAINS "14871904-coinbase.com" OR destinationhostname CONTAINS "14891902-coinbase.com" OR destinationhostname CONTAINS "1492864-coinbase.com" OR destinationhostname CONTAINS "158312-coinbase.com" OR destinationhostname CONTAINS "158372-coinbase.com" OR destinationhostname CONTAINS "158702-coinbase.com" OR destinationhostname CONTAINS "16171675-coinbase.com" OR destinationhostname CONTAINS "16171832-coinbase.com" OR destinationhostname CONTAINS "16178234-coinbase.com" OR destinationhostname CONTAINS "16178237-coinbase.com" OR destinationhostname CONTAINS "16178434-coinbase.com" OR destinationhostname CONTAINS "162178-coinbase.com" OR destinationhostname CONTAINS "162478-coinbase.com" OR destinationhostname CONTAINS "162782-coinbase.com" OR destinationhostname CONTAINS "162812-coinbase.com" OR destinationhostname CONTAINS "162814-coinbase.com" OR destinationhostname CONTAINS "16442580-coinbase.com" OR destinationhostname CONTAINS "16450107-coinbase.com")
index=activity AND rg_functionality="Web Proxy" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "official-server.com" OR sourcentdomain CONTAINS "server694590423.tech" OR sourcentdomain CONTAINS "island-placid-bromine.glitch.me" OR sourcentdomain CONTAINS "circular-noon-farmhouse.glitch.me" OR sourcentdomain CONTAINS "talented-friendly-price.glitch.me" OR sourcentdomain CONTAINS "dflfmgsdokasdcpl.com" OR sourcentdomain CONTAINS "original-backend.com" OR sourcentdomain CONTAINS "07159889-coinbase.com" OR sourcentdomain CONTAINS "10195-coinbase.com" OR sourcentdomain CONTAINS "11246-coinbase.com" OR sourcentdomain CONTAINS "11247-coinbase.com" OR sourcentdomain CONTAINS "11248-coinbase.com" OR sourcentdomain CONTAINS "11258-coinbase.com" OR sourcentdomain CONTAINS "11259-coinbase.com" OR sourcentdomain CONTAINS "113912-coinbase.com" OR sourcentdomain CONTAINS "11472-coinbase.com" OR sourcentdomain CONTAINS "11923-coinbase.com" OR sourcentdomain CONTAINS "11957-coinbase.com" OR sourcentdomain CONTAINS "128147-coinbase.com" OR sourcentdomain CONTAINS "12958-coinbase.com" OR sourcentdomain CONTAINS "12984-okta.com" OR sourcentdomain CONTAINS "12985-coinbase.com" OR sourcentdomain CONTAINS "13130-coinbase.com" OR sourcentdomain CONTAINS "13247-coinbase.com" OR sourcentdomain CONTAINS "13247-icloud.com" OR sourcentdomain CONTAINS "13267-coinbase.com" OR sourcentdomain CONTAINS "146271510-coinbase.com" OR sourcentdomain CONTAINS "146282-coinbase.com" OR sourcentdomain CONTAINS "146284-coinbase.com" OR sourcentdomain CONTAINS "147260-coinbase.com" OR sourcentdomain CONTAINS "14765-coinbase.com" OR sourcentdomain CONTAINS "14817582-coinbase.com" OR sourcentdomain CONTAINS "14871904-coinbase.com" OR sourcentdomain CONTAINS "14891902-coinbase.com" OR sourcentdomain CONTAINS "1492864-coinbase.com" OR sourcentdomain CONTAINS "158312-coinbase.com" OR sourcentdomain CONTAINS "158372-coinbase.com" OR sourcentdomain CONTAINS "158702-coinbase.com" OR sourcentdomain CONTAINS "16171675-coinbase.com" OR sourcentdomain CONTAINS "16171832-coinbase.com" OR sourcentdomain CONTAINS "16178234-coinbase.com" OR sourcentdomain CONTAINS "16178237-coinbase.com" OR sourcentdomain CONTAINS "16178434-coinbase.com" OR sourcentdomain CONTAINS "162178-coinbase.com" OR sourcentdomain CONTAINS "162478-coinbase.com" OR sourcentdomain CONTAINS "162782-coinbase.com" OR sourcentdomain CONTAINS "162812-coinbase.com" OR sourcentdomain CONTAINS "162814-coinbase.com" OR sourcentdomain CONTAINS "16442580-coinbase.com" OR sourcentdomain CONTAINS "16450107-coinbase.com")
index=activity AND rg_functionality="Web Proxy" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "official-server.com" OR sourcehostname CONTAINS "server694590423.tech" OR sourcehostname CONTAINS "island-placid-bromine.glitch.me" OR sourcehostname CONTAINS "circular-noon-farmhouse.glitch.me" OR sourcehostname CONTAINS "talented-friendly-price.glitch.me" OR sourcehostname CONTAINS "dflfmgsdokasdcpl.com" OR sourcehostname CONTAINS "original-backend.com" OR sourcehostname CONTAINS "07159889-coinbase.com" OR sourcehostname CONTAINS "10195-coinbase.com" OR sourcehostname CONTAINS "11246-coinbase.com" OR sourcehostname CONTAINS "11247-coinbase.com" OR sourcehostname CONTAINS "11248-coinbase.com" OR sourcehostname CONTAINS "11258-coinbase.com" OR sourcehostname CONTAINS "11259-coinbase.com" OR sourcehostname CONTAINS "113912-coinbase.com" OR sourcehostname CONTAINS "11472-coinbase.com" OR sourcehostname CONTAINS "11923-coinbase.com" OR sourcehostname CONTAINS "11957-coinbase.com" OR sourcehostname CONTAINS "128147-coinbase.com" OR sourcehostname CONTAINS "12958-coinbase.com" OR sourcehostname CONTAINS "12984-okta.com" OR sourcehostname CONTAINS "12985-coinbase.com" OR sourcehostname CONTAINS "13130-coinbase.com" OR sourcehostname CONTAINS "13247-coinbase.com" OR sourcehostname CONTAINS "13247-icloud.com" OR sourcehostname CONTAINS "13267-coinbase.com" OR sourcehostname CONTAINS "146271510-coinbase.com" OR sourcehostname CONTAINS "146282-coinbase.com" OR sourcehostname CONTAINS "146284-coinbase.com" OR sourcehostname CONTAINS "147260-coinbase.com" OR sourcehostname CONTAINS "14765-coinbase.com" OR sourcehostname CONTAINS "14817582-coinbase.com" OR sourcehostname CONTAINS "14871904-coinbase.com" OR sourcehostname CONTAINS "14891902-coinbase.com" OR sourcehostname CONTAINS "1492864-coinbase.com" OR sourcehostname CONTAINS "158312-coinbase.com" OR sourcehostname CONTAINS "158372-coinbase.com" OR sourcehostname CONTAINS "158702-coinbase.com" OR sourcehostname CONTAINS "16171675-coinbase.com" OR sourcehostname CONTAINS "16171832-coinbase.com" OR sourcehostname CONTAINS "16178234-coinbase.com" OR sourcehostname CONTAINS "16178237-coinbase.com" OR sourcehostname CONTAINS "16178434-coinbase.com" OR sourcehostname CONTAINS "162178-coinbase.com" OR sourcehostname CONTAINS "162478-coinbase.com" OR sourcehostname CONTAINS "162782-coinbase.com" OR sourcehostname CONTAINS "162812-coinbase.com" OR sourcehostname CONTAINS "162814-coinbase.com" OR sourcehostname CONTAINS "16442580-coinbase.com" OR sourcehostname CONTAINS "16450107-coinbase.com")
index=activity AND rg_functionality="Web Proxy" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "official-server.com" OR destinationntdomain CONTAINS "server694590423.tech" OR destinationntdomain CONTAINS "island-placid-bromine.glitch.me" OR destinationntdomain CONTAINS "circular-noon-farmhouse.glitch.me" OR destinationntdomain CONTAINS "talented-friendly-price.glitch.me" OR destinationntdomain CONTAINS "dflfmgsdokasdcpl.com" OR destinationntdomain CONTAINS "original-backend.com" OR destinationntdomain CONTAINS "07159889-coinbase.com" OR destinationntdomain CONTAINS "10195-coinbase.com" OR destinationntdomain CONTAINS "11246-coinbase.com" OR destinationntdomain CONTAINS "11247-coinbase.com" OR destinationntdomain CONTAINS "11248-coinbase.com" OR destinationntdomain CONTAINS "11258-coinbase.com" OR destinationntdomain CONTAINS "11259-coinbase.com" OR destinationntdomain CONTAINS "113912-coinbase.com" OR destinationntdomain CONTAINS "11472-coinbase.com" OR destinationntdomain CONTAINS "11923-coinbase.com" OR destinationntdomain CONTAINS "11957-coinbase.com" OR destinationntdomain CONTAINS "128147-coinbase.com" OR destinationntdomain CONTAINS "12958-coinbase.com" OR destinationntdomain CONTAINS "12984-okta.com" OR destinationntdomain CONTAINS "12985-coinbase.com" OR destinationntdomain CONTAINS "13130-coinbase.com" OR destinationntdomain CONTAINS "13247-coinbase.com" OR destinationntdomain CONTAINS "13247-icloud.com" OR destinationntdomain CONTAINS "13267-coinbase.com" OR destinationntdomain CONTAINS "146271510-coinbase.com" OR destinationntdomain CONTAINS "146282-coinbase.com" OR destinationntdomain CONTAINS "146284-coinbase.com" OR destinationntdomain CONTAINS "147260-coinbase.com" OR destinationntdomain CONTAINS "14765-coinbase.com" OR destinationntdomain CONTAINS "14817582-coinbase.com" OR destinationntdomain CONTAINS "14871904-coinbase.com" OR destinationntdomain CONTAINS "14891902-coinbase.com" OR destinationntdomain CONTAINS "1492864-coinbase.com" OR destinationntdomain CONTAINS "158312-coinbase.com" OR destinationntdomain CONTAINS "158372-coinbase.com" OR destinationntdomain CONTAINS "158702-coinbase.com" OR destinationntdomain CONTAINS "16171675-coinbase.com" OR destinationntdomain CONTAINS "16171832-coinbase.com" OR destinationntdomain CONTAINS "16178234-coinbase.com" OR destinationntdomain CONTAINS "16178237-coinbase.com" OR destinationntdomain CONTAINS "16178434-coinbase.com" OR destinationntdomain CONTAINS "162178-coinbase.com" OR destinationntdomain CONTAINS "162478-coinbase.com" OR destinationntdomain CONTAINS "162782-coinbase.com" OR destinationntdomain CONTAINS "162812-coinbase.com" OR destinationntdomain CONTAINS "162814-coinbase.com" OR destinationntdomain CONTAINS "16442580-coinbase.com" OR destinationntdomain CONTAINS "16450107-coinbase.com")
index=activity AND rg_functionality="Web Proxy" AND requesturl NOT NULL AND (requesturl CONTAINS "official-server.com" OR requesturl CONTAINS "server694590423.tech" OR requesturl CONTAINS "island-placid-bromine.glitch.me" OR requesturl CONTAINS "circular-noon-farmhouse.glitch.me" OR requesturl CONTAINS "talented-friendly-price.glitch.me" OR requesturl CONTAINS "dflfmgsdokasdcpl.com" OR requesturl CONTAINS "original-backend.com" OR requesturl CONTAINS "07159889-coinbase.com" OR requesturl CONTAINS "10195-coinbase.com" OR requesturl CONTAINS "11246-coinbase.com" OR requesturl CONTAINS "11247-coinbase.com" OR requesturl CONTAINS "11248-coinbase.com" OR requesturl CONTAINS "11258-coinbase.com" OR requesturl CONTAINS "11259-coinbase.com" OR requesturl CONTAINS "113912-coinbase.com" OR requesturl CONTAINS "11472-coinbase.com" OR requesturl CONTAINS "11923-coinbase.com" OR requesturl CONTAINS "11957-coinbase.com" OR requesturl CONTAINS "128147-coinbase.com" OR requesturl CONTAINS "12958-coinbase.com" OR requesturl CONTAINS "12984-okta.com" OR requesturl CONTAINS "12985-coinbase.com" OR requesturl CONTAINS "13130-coinbase.com" OR requesturl CONTAINS "13247-coinbase.com" OR requesturl CONTAINS "13247-icloud.com" OR requesturl CONTAINS "13267-coinbase.com" OR requesturl CONTAINS "146271510-coinbase.com" OR requesturl CONTAINS "146282-coinbase.com" OR requesturl CONTAINS "146284-coinbase.com" OR requesturl CONTAINS "147260-coinbase.com" OR requesturl CONTAINS "14765-coinbase.com" OR requesturl CONTAINS "14817582-coinbase.com" OR requesturl CONTAINS "14871904-coinbase.com" OR requesturl CONTAINS "14891902-coinbase.com" OR requesturl CONTAINS "1492864-coinbase.com" OR requesturl CONTAINS "158312-coinbase.com" OR requesturl CONTAINS "158372-coinbase.com" OR requesturl CONTAINS "158702-coinbase.com" OR requesturl CONTAINS "16171675-coinbase.com" OR requesturl CONTAINS "16171832-coinbase.com" OR requesturl CONTAINS "16178234-coinbase.com" OR requesturl CONTAINS "16178237-coinbase.com" OR requesturl CONTAINS "16178434-coinbase.com" OR requesturl CONTAINS "162178-coinbase.com" OR requesturl CONTAINS "162478-coinbase.com" OR requesturl CONTAINS "162782-coinbase.com" OR requesturl CONTAINS "162812-coinbase.com" OR requesturl CONTAINS "162814-coinbase.com" OR requesturl CONTAINS "16442580-coinbase.com" OR requesturl CONTAINS "16450107-coinbase.com")
index=activity AND rg_functionality="Web Proxy" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "16450207-coinbase.com" OR destinationhostname CONTAINS "16458207-coinbase.com" OR destinationhostname CONTAINS "16478202-coinbase.com" OR destinationhostname CONTAINS "164872942-coinbase.com" OR destinationhostname CONTAINS "16590-coinbase.com" OR destinationhostname CONTAINS "16594373-coinbase.com" OR destinationhostname CONTAINS "16624831-coinbase.com" OR destinationhostname CONTAINS "16642124-coinbase.com" OR destinationhostname CONTAINS "16642172-coinbase.com" OR destinationhostname CONTAINS "16642580-coinbase.com" OR destinationhostname CONTAINS "16642721-coinbase.com" OR destinationhostname CONTAINS "16642724-coinbase.com" OR destinationhostname CONTAINS "16642871-coinbase.com" OR destinationhostname CONTAINS "16642872-coinbase.com" OR destinationhostname CONTAINS "16712942-coinbase.com" OR destinationhostname CONTAINS "16718672-coinbase.com" OR destinationhostname CONTAINS "16728342-coinbase.com" OR destinationhostname CONTAINS "16728348-coinbase.com" OR destinationhostname CONTAINS "16728442-coinbase.com" OR destinationhostname CONTAINS "16728472-coinbase.com" OR destinationhostname CONTAINS "167285-coinbase.com" OR destinationhostname CONTAINS "16729042-coinbase.com" OR destinationhostname CONTAINS "16748272-coinbase.com" OR destinationhostname CONTAINS "16782942-coinbase.com" OR destinationhostname CONTAINS "16827420-coinbase.com" OR destinationhostname CONTAINS "16827423-coinbase.com" OR destinationhostname CONTAINS "16847145-coinbase.com" OR destinationhostname CONTAINS "16893924-coinbase.com" OR destinationhostname CONTAINS "17182-coinbase.com" OR destinationhostname CONTAINS "17255030-coinbase.com" OR destinationhostname CONTAINS "17259-kraken.com" OR destinationhostname CONTAINS "172486-coinbase.com" OR destinationhostname CONTAINS "17284652-coinbase.com" OR destinationhostname CONTAINS "17286-coinbase.com" OR destinationhostname CONTAINS "17334522-coinbase.com" OR destinationhostname CONTAINS "17334522-kraken.com" OR destinationhostname CONTAINS "17384522-coinbase.com" OR destinationhostname CONTAINS "173912-coinbase.com" OR destinationhostname CONTAINS "17494976-coinbase.com" OR destinationhostname CONTAINS "17512854-coinbase.com" OR destinationhostname CONTAINS "17512857-coinbase.com" OR destinationhostname CONTAINS "1751954-coinbase.com" OR destinationhostname CONTAINS "17525030-coinbase.com" OR destinationhostname CONTAINS "17529580-coinbase.com" OR destinationhostname CONTAINS "17614-coinbase.com" OR destinationhostname CONTAINS "17618412-coinbase.com" OR destinationhostname CONTAINS "17619-coinbase.com" OR destinationhostname CONTAINS "176284-coinbase.com" OR destinationhostname CONTAINS "17823920-coinbase.com" OR destinationhostname CONTAINS "178253-coinbase.com")
index=activity AND rg_functionality="Web Proxy" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "16450207-coinbase.com" OR sourcentdomain CONTAINS "16458207-coinbase.com" OR sourcentdomain CONTAINS "16478202-coinbase.com" OR sourcentdomain CONTAINS "164872942-coinbase.com" OR sourcentdomain CONTAINS "16590-coinbase.com" OR sourcentdomain CONTAINS "16594373-coinbase.com" OR sourcentdomain CONTAINS "16624831-coinbase.com" OR sourcentdomain CONTAINS "16642124-coinbase.com" OR sourcentdomain CONTAINS "16642172-coinbase.com" OR sourcentdomain CONTAINS "16642580-coinbase.com" OR sourcentdomain CONTAINS "16642721-coinbase.com" OR sourcentdomain CONTAINS "16642724-coinbase.com" OR sourcentdomain CONTAINS "16642871-coinbase.com" OR sourcentdomain CONTAINS "16642872-coinbase.com" OR sourcentdomain CONTAINS "16712942-coinbase.com" OR sourcentdomain CONTAINS "16718672-coinbase.com" OR sourcentdomain CONTAINS "16728342-coinbase.com" OR sourcentdomain CONTAINS "16728348-coinbase.com" OR sourcentdomain CONTAINS "16728442-coinbase.com" OR sourcentdomain CONTAINS "16728472-coinbase.com" OR sourcentdomain CONTAINS "167285-coinbase.com" OR sourcentdomain CONTAINS "16729042-coinbase.com" OR sourcentdomain CONTAINS "16748272-coinbase.com" OR sourcentdomain CONTAINS "16782942-coinbase.com" OR sourcentdomain CONTAINS "16827420-coinbase.com" OR sourcentdomain CONTAINS "16827423-coinbase.com" OR sourcentdomain CONTAINS "16847145-coinbase.com" OR sourcentdomain CONTAINS "16893924-coinbase.com" OR sourcentdomain CONTAINS "17182-coinbase.com" OR sourcentdomain CONTAINS "17255030-coinbase.com" OR sourcentdomain CONTAINS "17259-kraken.com" OR sourcentdomain CONTAINS "172486-coinbase.com" OR sourcentdomain CONTAINS "17284652-coinbase.com" OR sourcentdomain CONTAINS "17286-coinbase.com" OR sourcentdomain CONTAINS "17334522-coinbase.com" OR sourcentdomain CONTAINS "17334522-kraken.com" OR sourcentdomain CONTAINS "17384522-coinbase.com" OR sourcentdomain CONTAINS "173912-coinbase.com" OR sourcentdomain CONTAINS "17494976-coinbase.com" OR sourcentdomain CONTAINS "17512854-coinbase.com" OR sourcentdomain CONTAINS "17512857-coinbase.com" OR sourcentdomain CONTAINS "1751954-coinbase.com" OR sourcentdomain CONTAINS "17525030-coinbase.com" OR sourcentdomain CONTAINS "17529580-coinbase.com" OR sourcentdomain CONTAINS "17614-coinbase.com" OR sourcentdomain CONTAINS "17618412-coinbase.com" OR sourcentdomain CONTAINS "17619-coinbase.com" OR sourcentdomain CONTAINS "176284-coinbase.com" OR sourcentdomain CONTAINS "17823920-coinbase.com" OR sourcentdomain CONTAINS "178253-coinbase.com")
index=activity AND rg_functionality="Web Proxy" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "16450207-coinbase.com" OR sourcehostname CONTAINS "16458207-coinbase.com" OR sourcehostname CONTAINS "16478202-coinbase.com" OR sourcehostname CONTAINS "164872942-coinbase.com" OR sourcehostname CONTAINS "16590-coinbase.com" OR sourcehostname CONTAINS "16594373-coinbase.com" OR sourcehostname CONTAINS "16624831-coinbase.com" OR sourcehostname CONTAINS "16642124-coinbase.com" OR sourcehostname CONTAINS "16642172-coinbase.com" OR sourcehostname CONTAINS "16642580-coinbase.com" OR sourcehostname CONTAINS "16642721-coinbase.com" OR sourcehostname CONTAINS "16642724-coinbase.com" OR sourcehostname CONTAINS "16642871-coinbase.com" OR sourcehostname CONTAINS "16642872-coinbase.com" OR sourcehostname CONTAINS "16712942-coinbase.com" OR sourcehostname CONTAINS "16718672-coinbase.com" OR sourcehostname CONTAINS "16728342-coinbase.com" OR sourcehostname CONTAINS "16728348-coinbase.com" OR sourcehostname CONTAINS "16728442-coinbase.com" OR sourcehostname CONTAINS "16728472-coinbase.com" OR sourcehostname CONTAINS "167285-coinbase.com" OR sourcehostname CONTAINS "16729042-coinbase.com" OR sourcehostname CONTAINS "16748272-coinbase.com" OR sourcehostname CONTAINS "16782942-coinbase.com" OR sourcehostname CONTAINS "16827420-coinbase.com" OR sourcehostname CONTAINS "16827423-coinbase.com" OR sourcehostname CONTAINS "16847145-coinbase.com" OR sourcehostname CONTAINS "16893924-coinbase.com" OR sourcehostname CONTAINS "17182-coinbase.com" OR sourcehostname CONTAINS "17255030-coinbase.com" OR sourcehostname CONTAINS "17259-kraken.com" OR sourcehostname CONTAINS "172486-coinbase.com" OR sourcehostname CONTAINS "17284652-coinbase.com" OR sourcehostname CONTAINS "17286-coinbase.com" OR sourcehostname CONTAINS "17334522-coinbase.com" OR sourcehostname CONTAINS "17334522-kraken.com" OR sourcehostname CONTAINS "17384522-coinbase.com" OR sourcehostname CONTAINS "173912-coinbase.com" OR sourcehostname CONTAINS "17494976-coinbase.com" OR sourcehostname CONTAINS "17512854-coinbase.com" OR sourcehostname CONTAINS "17512857-coinbase.com" OR sourcehostname CONTAINS "1751954-coinbase.com" OR sourcehostname CONTAINS "17525030-coinbase.com" OR sourcehostname CONTAINS "17529580-coinbase.com" OR sourcehostname CONTAINS "17614-coinbase.com" OR sourcehostname CONTAINS "17618412-coinbase.com" OR sourcehostname CONTAINS "17619-coinbase.com" OR sourcehostname CONTAINS "176284-coinbase.com" OR sourcehostname CONTAINS "17823920-coinbase.com" OR sourcehostname CONTAINS "178253-coinbase.com")
index=activity AND rg_functionality="Web Proxy" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "16450207-coinbase.com" OR destinationntdomain CONTAINS "16458207-coinbase.com" OR destinationntdomain CONTAINS "16478202-coinbase.com" OR destinationntdomain CONTAINS "164872942-coinbase.com" OR destinationntdomain CONTAINS "16590-coinbase.com" OR destinationntdomain CONTAINS "16594373-coinbase.com" OR destinationntdomain CONTAINS "16624831-coinbase.com" OR destinationntdomain CONTAINS "16642124-coinbase.com" OR destinationntdomain CONTAINS "16642172-coinbase.com" OR destinationntdomain CONTAINS "16642580-coinbase.com" OR destinationntdomain CONTAINS "16642721-coinbase.com" OR destinationntdomain CONTAINS "16642724-coinbase.com" OR destinationntdomain CONTAINS "16642871-coinbase.com" OR destinationntdomain CONTAINS "16642872-coinbase.com" OR destinationntdomain CONTAINS "16712942-coinbase.com" OR destinationntdomain CONTAINS "16718672-coinbase.com" OR destinationntdomain CONTAINS "16728342-coinbase.com" OR destinationntdomain CONTAINS "16728348-coinbase.com" OR destinationntdomain CONTAINS "16728442-coinbase.com" OR destinationntdomain CONTAINS "16728472-coinbase.com" OR destinationntdomain CONTAINS "167285-coinbase.com" OR destinationntdomain CONTAINS "16729042-coinbase.com" OR destinationntdomain CONTAINS "16748272-coinbase.com" OR destinationntdomain CONTAINS "16782942-coinbase.com" OR destinationntdomain CONTAINS "16827420-coinbase.com" OR destinationntdomain CONTAINS "16827423-coinbase.com" OR destinationntdomain CONTAINS "16847145-coinbase.com" OR destinationntdomain CONTAINS "16893924-coinbase.com" OR destinationntdomain CONTAINS "17182-coinbase.com" OR destinationntdomain CONTAINS "17255030-coinbase.com" OR destinationntdomain CONTAINS "17259-kraken.com" OR destinationntdomain CONTAINS "172486-coinbase.com" OR destinationntdomain CONTAINS "17284652-coinbase.com" OR destinationntdomain CONTAINS "17286-coinbase.com" OR destinationntdomain CONTAINS "17334522-coinbase.com" OR destinationntdomain CONTAINS "17334522-kraken.com" OR destinationntdomain CONTAINS "17384522-coinbase.com" OR destinationntdomain CONTAINS "173912-coinbase.com" OR destinationntdomain CONTAINS "17494976-coinbase.com" OR destinationntdomain CONTAINS "17512854-coinbase.com" OR destinationntdomain CONTAINS "17512857-coinbase.com" OR destinationntdomain CONTAINS "1751954-coinbase.com" OR destinationntdomain CONTAINS "17525030-coinbase.com" OR destinationntdomain CONTAINS "17529580-coinbase.com" OR destinationntdomain CONTAINS "17614-coinbase.com" OR destinationntdomain CONTAINS "17618412-coinbase.com" OR destinationntdomain CONTAINS "17619-coinbase.com" OR destinationntdomain CONTAINS "176284-coinbase.com" OR destinationntdomain CONTAINS "17823920-coinbase.com" OR destinationntdomain CONTAINS "178253-coinbase.com")
index=activity AND rg_functionality="Web Proxy" AND requesturl NOT NULL AND (requesturl CONTAINS "16450207-coinbase.com" OR requesturl CONTAINS "16458207-coinbase.com" OR requesturl CONTAINS "16478202-coinbase.com" OR requesturl CONTAINS "164872942-coinbase.com" OR requesturl CONTAINS "16590-coinbase.com" OR requesturl CONTAINS "16594373-coinbase.com" OR requesturl CONTAINS "16624831-coinbase.com" OR requesturl CONTAINS "16642124-coinbase.com" OR requesturl CONTAINS "16642172-coinbase.com" OR requesturl CONTAINS "16642580-coinbase.com" OR requesturl CONTAINS "16642721-coinbase.com" OR requesturl CONTAINS "16642724-coinbase.com" OR requesturl CONTAINS "16642871-coinbase.com" OR requesturl CONTAINS "16642872-coinbase.com" OR requesturl CONTAINS "16712942-coinbase.com" OR requesturl CONTAINS "16718672-coinbase.com" OR requesturl CONTAINS "16728342-coinbase.com" OR requesturl CONTAINS "16728348-coinbase.com" OR requesturl CONTAINS "16728442-coinbase.com" OR requesturl CONTAINS "16728472-coinbase.com" OR requesturl CONTAINS "167285-coinbase.com" OR requesturl CONTAINS "16729042-coinbase.com" OR requesturl CONTAINS "16748272-coinbase.com" OR requesturl CONTAINS "16782942-coinbase.com" OR requesturl CONTAINS "16827420-coinbase.com" OR requesturl CONTAINS "16827423-coinbase.com" OR requesturl CONTAINS "16847145-coinbase.com" OR requesturl CONTAINS "16893924-coinbase.com" OR requesturl CONTAINS "17182-coinbase.com" OR requesturl CONTAINS "17255030-coinbase.com" OR requesturl CONTAINS "17259-kraken.com" OR requesturl CONTAINS "172486-coinbase.com" OR requesturl CONTAINS "17284652-coinbase.com" OR requesturl CONTAINS "17286-coinbase.com" OR requesturl CONTAINS "17334522-coinbase.com" OR requesturl CONTAINS "17334522-kraken.com" OR requesturl CONTAINS "17384522-coinbase.com" OR requesturl CONTAINS "173912-coinbase.com" OR requesturl CONTAINS "17494976-coinbase.com" OR requesturl CONTAINS "17512854-coinbase.com" OR requesturl CONTAINS "17512857-coinbase.com" OR requesturl CONTAINS "1751954-coinbase.com" OR requesturl CONTAINS "17525030-coinbase.com" OR requesturl CONTAINS "17529580-coinbase.com" OR requesturl CONTAINS "17614-coinbase.com" OR requesturl CONTAINS "17618412-coinbase.com" OR requesturl CONTAINS "17619-coinbase.com" OR requesturl CONTAINS "176284-coinbase.com" OR requesturl CONTAINS "17823920-coinbase.com" OR requesturl CONTAINS "178253-coinbase.com")
index=activity AND rg_functionality="Web Proxy" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "178294-coinbase.com" OR destinationhostname CONTAINS "17912-coinbase.com" OR destinationhostname CONTAINS "17914-coinbase.com" OR destinationhostname CONTAINS "17917-coinbase.com" OR destinationhostname CONTAINS "17954-coinbase.com" OR destinationhostname CONTAINS "17958-coinbase.com" OR destinationhostname CONTAINS "182043-coinbase.com" OR destinationhostname CONTAINS "18275-gemini.com" OR destinationhostname CONTAINS "18276-coinbase.com" OR destinationhostname CONTAINS "18290185-coinbase.com" OR destinationhostname CONTAINS "182967-coinbase.com" OR destinationhostname CONTAINS "18560-coinbase.com" OR destinationhostname CONTAINS "18571-coinbase.com" OR destinationhostname CONTAINS "185912-coinbase.com" OR destinationhostname CONTAINS "185914-coinbase.com" OR destinationhostname CONTAINS "18592176-coinbase.com" OR destinationhostname CONTAINS "18594162-coinbase.com" OR destinationhostname CONTAINS "18594962-coinbase.com" OR destinationhostname CONTAINS "18597162-coinbase.com" OR destinationhostname CONTAINS "18719562-coinbase.com" OR destinationhostname CONTAINS "1875290-coinbase.com" OR destinationhostname CONTAINS "1882730-coinbase.com" OR destinationhostname CONTAINS "18902-coinbase.com" OR destinationhostname CONTAINS "18903-coinbase.com" OR destinationhostname CONTAINS "189126-coinbase.com" OR destinationhostname CONTAINS "18952-coinbase.com" OR destinationhostname CONTAINS "192854-coinbase.com" OR destinationhostname CONTAINS "192856-coinbase.com" OR destinationhostname CONTAINS "19287-binance.com" OR destinationhostname CONTAINS "19572-coinbase.com" OR destinationhostname CONTAINS "195812-coinbase.com" OR destinationhostname CONTAINS "195826-coinbase.com" OR destinationhostname CONTAINS "1958262-coinbase.com" OR destinationhostname CONTAINS "195827-binance.com" OR destinationhostname CONTAINS "1958297-coinbase.com" OR destinationhostname CONTAINS "19582970-coinbase.com" OR destinationhostname CONTAINS "19582971-coinbase.com" OR destinationhostname CONTAINS "19583-coinbase.com" OR destinationhostname CONTAINS "19592653-coinbase.com" OR destinationhostname CONTAINS "197304-coinbase.com" OR destinationhostname CONTAINS "19730492-coinbase.com" OR destinationhostname CONTAINS "19764162-coinbase.com" OR destinationhostname CONTAINS "19803-coinbase.com" OR destinationhostname CONTAINS "201784289-coinbase.com" OR destinationhostname CONTAINS "210823644-coinbase.com" OR destinationhostname CONTAINS "21158-coinbase.com" OR destinationhostname CONTAINS "21509-coinbase.com" OR destinationhostname CONTAINS "25985-coinbase.com" OR destinationhostname CONTAINS "27699-coinbase.com" OR destinationhostname CONTAINS "28367-coinbase.com")
index=activity AND rg_functionality="Web Proxy" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "178294-coinbase.com" OR sourcentdomain CONTAINS "17912-coinbase.com" OR sourcentdomain CONTAINS "17914-coinbase.com" OR sourcentdomain CONTAINS "17917-coinbase.com" OR sourcentdomain CONTAINS "17954-coinbase.com" OR sourcentdomain CONTAINS "17958-coinbase.com" OR sourcentdomain CONTAINS "182043-coinbase.com" OR sourcentdomain CONTAINS "18275-gemini.com" OR sourcentdomain CONTAINS "18276-coinbase.com" OR sourcentdomain CONTAINS "18290185-coinbase.com" OR sourcentdomain CONTAINS "182967-coinbase.com" OR sourcentdomain CONTAINS "18560-coinbase.com" OR sourcentdomain CONTAINS "18571-coinbase.com" OR sourcentdomain CONTAINS "185912-coinbase.com" OR sourcentdomain CONTAINS "185914-coinbase.com" OR sourcentdomain CONTAINS "18592176-coinbase.com" OR sourcentdomain CONTAINS "18594162-coinbase.com" OR sourcentdomain CONTAINS "18594962-coinbase.com" OR sourcentdomain CONTAINS "18597162-coinbase.com" OR sourcentdomain CONTAINS "18719562-coinbase.com" OR sourcentdomain CONTAINS "1875290-coinbase.com" OR sourcentdomain CONTAINS "1882730-coinbase.com" OR sourcentdomain CONTAINS "18902-coinbase.com" OR sourcentdomain CONTAINS "18903-coinbase.com" OR sourcentdomain CONTAINS "189126-coinbase.com" OR sourcentdomain CONTAINS "18952-coinbase.com" OR sourcentdomain CONTAINS "192854-coinbase.com" OR sourcentdomain CONTAINS "192856-coinbase.com" OR sourcentdomain CONTAINS "19287-binance.com" OR sourcentdomain CONTAINS "19572-coinbase.com" OR sourcentdomain CONTAINS "195812-coinbase.com" OR sourcentdomain CONTAINS "195826-coinbase.com" OR sourcentdomain CONTAINS "1958262-coinbase.com" OR sourcentdomain CONTAINS "195827-binance.com" OR sourcentdomain CONTAINS "1958297-coinbase.com" OR sourcentdomain CONTAINS "19582970-coinbase.com" OR sourcentdomain CONTAINS "19582971-coinbase.com" OR sourcentdomain CONTAINS "19583-coinbase.com" OR sourcentdomain CONTAINS "19592653-coinbase.com" OR sourcentdomain CONTAINS "197304-coinbase.com" OR sourcentdomain CONTAINS "19730492-coinbase.com" OR sourcentdomain CONTAINS "19764162-coinbase.com" OR sourcentdomain CONTAINS "19803-coinbase.com" OR sourcentdomain CONTAINS "201784289-coinbase.com" OR sourcentdomain CONTAINS "210823644-coinbase.com" OR sourcentdomain CONTAINS "21158-coinbase.com" OR sourcentdomain CONTAINS "21509-coinbase.com" OR sourcentdomain CONTAINS "25985-coinbase.com" OR sourcentdomain CONTAINS "27699-coinbase.com" OR sourcentdomain CONTAINS "28367-coinbase.com")
index=activity AND rg_functionality="Web Proxy" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "178294-coinbase.com" OR sourcehostname CONTAINS "17912-coinbase.com" OR sourcehostname CONTAINS "17914-coinbase.com" OR sourcehostname CONTAINS "17917-coinbase.com" OR sourcehostname CONTAINS "17954-coinbase.com" OR sourcehostname CONTAINS "17958-coinbase.com" OR sourcehostname CONTAINS "182043-coinbase.com" OR sourcehostname CONTAINS "18275-gemini.com" OR sourcehostname CONTAINS "18276-coinbase.com" OR sourcehostname CONTAINS "18290185-coinbase.com" OR sourcehostname CONTAINS "182967-coinbase.com" OR sourcehostname CONTAINS "18560-coinbase.com" OR sourcehostname CONTAINS "18571-coinbase.com" OR sourcehostname CONTAINS "185912-coinbase.com" OR sourcehostname CONTAINS "185914-coinbase.com" OR sourcehostname CONTAINS "18592176-coinbase.com" OR sourcehostname CONTAINS "18594162-coinbase.com" OR sourcehostname CONTAINS "18594962-coinbase.com" OR sourcehostname CONTAINS "18597162-coinbase.com" OR sourcehostname CONTAINS "18719562-coinbase.com" OR sourcehostname CONTAINS "1875290-coinbase.com" OR sourcehostname CONTAINS "1882730-coinbase.com" OR sourcehostname CONTAINS "18902-coinbase.com" OR sourcehostname CONTAINS "18903-coinbase.com" OR sourcehostname CONTAINS "189126-coinbase.com" OR sourcehostname CONTAINS "18952-coinbase.com" OR sourcehostname CONTAINS "192854-coinbase.com" OR sourcehostname CONTAINS "192856-coinbase.com" OR sourcehostname CONTAINS "19287-binance.com" OR sourcehostname CONTAINS "19572-coinbase.com" OR sourcehostname CONTAINS "195812-coinbase.com" OR sourcehostname CONTAINS "195826-coinbase.com" OR sourcehostname CONTAINS "1958262-coinbase.com" OR sourcehostname CONTAINS "195827-binance.com" OR sourcehostname CONTAINS "1958297-coinbase.com" OR sourcehostname CONTAINS "19582970-coinbase.com" OR sourcehostname CONTAINS "19582971-coinbase.com" OR sourcehostname CONTAINS "19583-coinbase.com" OR sourcehostname CONTAINS "19592653-coinbase.com" OR sourcehostname CONTAINS "197304-coinbase.com" OR sourcehostname CONTAINS "19730492-coinbase.com" OR sourcehostname CONTAINS "19764162-coinbase.com" OR sourcehostname CONTAINS "19803-coinbase.com" OR sourcehostname CONTAINS "201784289-coinbase.com" OR sourcehostname CONTAINS "210823644-coinbase.com" OR sourcehostname CONTAINS "21158-coinbase.com" OR sourcehostname CONTAINS "21509-coinbase.com" OR sourcehostname CONTAINS "25985-coinbase.com" OR sourcehostname CONTAINS "27699-coinbase.com" OR sourcehostname CONTAINS "28367-coinbase.com")
index=activity AND rg_functionality="Web Proxy" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "178294-coinbase.com" OR destinationntdomain CONTAINS "17912-coinbase.com" OR destinationntdomain CONTAINS "17914-coinbase.com" OR destinationntdomain CONTAINS "17917-coinbase.com" OR destinationntdomain CONTAINS "17954-coinbase.com" OR destinationntdomain CONTAINS "17958-coinbase.com" OR destinationntdomain CONTAINS "182043-coinbase.com" OR destinationntdomain CONTAINS "18275-gemini.com" OR destinationntdomain CONTAINS "18276-coinbase.com" OR destinationntdomain CONTAINS "18290185-coinbase.com" OR destinationntdomain CONTAINS "182967-coinbase.com" OR destinationntdomain CONTAINS "18560-coinbase.com" OR destinationntdomain CONTAINS "18571-coinbase.com" OR destinationntdomain CONTAINS "185912-coinbase.com" OR destinationntdomain CONTAINS "185914-coinbase.com" OR destinationntdomain CONTAINS "18592176-coinbase.com" OR destinationntdomain CONTAINS "18594162-coinbase.com" OR destinationntdomain CONTAINS "18594962-coinbase.com" OR destinationntdomain CONTAINS "18597162-coinbase.com" OR destinationntdomain CONTAINS "18719562-coinbase.com" OR destinationntdomain CONTAINS "1875290-coinbase.com" OR destinationntdomain CONTAINS "1882730-coinbase.com" OR destinationntdomain CONTAINS "18902-coinbase.com" OR destinationntdomain CONTAINS "18903-coinbase.com" OR destinationntdomain CONTAINS "189126-coinbase.com" OR destinationntdomain CONTAINS "18952-coinbase.com" OR destinationntdomain CONTAINS "192854-coinbase.com" OR destinationntdomain CONTAINS "192856-coinbase.com" OR destinationntdomain CONTAINS "19287-binance.com" OR destinationntdomain CONTAINS "19572-coinbase.com" OR destinationntdomain CONTAINS "195812-coinbase.com" OR destinationntdomain CONTAINS "195826-coinbase.com" OR destinationntdomain CONTAINS "1958262-coinbase.com" OR destinationntdomain CONTAINS "195827-binance.com" OR destinationntdomain CONTAINS "1958297-coinbase.com" OR destinationntdomain CONTAINS "19582970-coinbase.com" OR destinationntdomain CONTAINS "19582971-coinbase.com" OR destinationntdomain CONTAINS "19583-coinbase.com" OR destinationntdomain CONTAINS "19592653-coinbase.com" OR destinationntdomain CONTAINS "197304-coinbase.com" OR destinationntdomain CONTAINS "19730492-coinbase.com" OR destinationntdomain CONTAINS "19764162-coinbase.com" OR destinationntdomain CONTAINS "19803-coinbase.com" OR destinationntdomain CONTAINS "201784289-coinbase.com" OR destinationntdomain CONTAINS "210823644-coinbase.com" OR destinationntdomain CONTAINS "21158-coinbase.com" OR destinationntdomain CONTAINS "21509-coinbase.com" OR destinationntdomain CONTAINS "25985-coinbase.com" OR destinationntdomain CONTAINS "27699-coinbase.com" OR destinationntdomain CONTAINS "28367-coinbase.com")
index=activity AND rg_functionality="Web Proxy" AND requesturl NOT NULL AND (requesturl CONTAINS "178294-coinbase.com" OR requesturl CONTAINS "17912-coinbase.com" OR requesturl CONTAINS "17914-coinbase.com" OR requesturl CONTAINS "17917-coinbase.com" OR requesturl CONTAINS "17954-coinbase.com" OR requesturl CONTAINS "17958-coinbase.com" OR requesturl CONTAINS "182043-coinbase.com" OR requesturl CONTAINS "18275-gemini.com" OR requesturl CONTAINS "18276-coinbase.com" OR requesturl CONTAINS "18290185-coinbase.com" OR requesturl CONTAINS "182967-coinbase.com" OR requesturl CONTAINS "18560-coinbase.com" OR requesturl CONTAINS "18571-coinbase.com" OR requesturl CONTAINS "185912-coinbase.com" OR requesturl CONTAINS "185914-coinbase.com" OR requesturl CONTAINS "18592176-coinbase.com" OR requesturl CONTAINS "18594162-coinbase.com" OR requesturl CONTAINS "18594962-coinbase.com" OR requesturl CONTAINS "18597162-coinbase.com" OR requesturl CONTAINS "18719562-coinbase.com" OR requesturl CONTAINS "1875290-coinbase.com" OR requesturl CONTAINS "1882730-coinbase.com" OR requesturl CONTAINS "18902-coinbase.com" OR requesturl CONTAINS "18903-coinbase.com" OR requesturl CONTAINS "189126-coinbase.com" OR requesturl CONTAINS "18952-coinbase.com" OR requesturl CONTAINS "192854-coinbase.com" OR requesturl CONTAINS "192856-coinbase.com" OR requesturl CONTAINS "19287-binance.com" OR requesturl CONTAINS "19572-coinbase.com" OR requesturl CONTAINS "195812-coinbase.com" OR requesturl CONTAINS "195826-coinbase.com" OR requesturl CONTAINS "1958262-coinbase.com" OR requesturl CONTAINS "195827-binance.com" OR requesturl CONTAINS "1958297-coinbase.com" OR requesturl CONTAINS "19582970-coinbase.com" OR requesturl CONTAINS "19582971-coinbase.com" OR requesturl CONTAINS "19583-coinbase.com" OR requesturl CONTAINS "19592653-coinbase.com" OR requesturl CONTAINS "197304-coinbase.com" OR requesturl CONTAINS "19730492-coinbase.com" OR requesturl CONTAINS "19764162-coinbase.com" OR requesturl CONTAINS "19803-coinbase.com" OR requesturl CONTAINS "201784289-coinbase.com" OR requesturl CONTAINS "210823644-coinbase.com" OR requesturl CONTAINS "21158-coinbase.com" OR requesturl CONTAINS "21509-coinbase.com" OR requesturl CONTAINS "25985-coinbase.com" OR requesturl CONTAINS "27699-coinbase.com" OR requesturl CONTAINS "28367-coinbase.com")
index=activity AND rg_functionality="Web Proxy" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "28676-coinbase.com" OR destinationhostname CONTAINS "29185-coinbase.com" OR destinationhostname CONTAINS "29195-coinbase.com" OR destinationhostname CONTAINS "2a-coinbase.com" OR destinationhostname CONTAINS "2b-coinbase.com" OR destinationhostname CONTAINS "2c-coinbase.com" OR destinationhostname CONTAINS "2f-coinbase.com" OR destinationhostname CONTAINS "2fas-coinbase.com" OR destinationhostname CONTAINS "2o-coinbase.com" OR destinationhostname CONTAINS "2r-coinbase.com" OR destinationhostname CONTAINS "2s-coinbase.com" OR destinationhostname CONTAINS "2sv-coinbase.com" OR destinationhostname CONTAINS "352134951-coinbase.com" OR destinationhostname CONTAINS "38468-coinbase.com" OR destinationhostname CONTAINS "39590-coinbase.com" OR destinationhostname CONTAINS "41260-coinbase.com" OR destinationhostname CONTAINS "427883-coinbase.com" OR destinationhostname CONTAINS "43017-coinbase.com" OR destinationhostname CONTAINS "47562-coinbase.com" OR destinationhostname CONTAINS "50195-coinbase.com" OR destinationhostname CONTAINS "5247-coinbase.com" OR destinationhostname CONTAINS "54765-coinbase.com" OR destinationhostname CONTAINS "57197-coinbase.com" OR destinationhostname CONTAINS "58176-coinbase.com" OR destinationhostname CONTAINS "58297-coinbase.com" OR destinationhostname CONTAINS "61250-coinbase.com" OR destinationhostname CONTAINS "61835-coinbase.com" OR destinationhostname CONTAINS "61851-coinbase.com" OR destinationhostname CONTAINS "61937-coinbase.com" OR destinationhostname CONTAINS "71925-coinbase.com" OR destinationhostname CONTAINS "72957-coinbase.com" OR destinationhostname CONTAINS "72985-coinbase.com" OR destinationhostname CONTAINS "74651-coinbase.com" OR destinationhostname CONTAINS "754668948-coinbase.com" OR destinationhostname CONTAINS "76159869-coinbase.com" OR destinationhostname CONTAINS "76153-coinbase.com" OR destinationhostname CONTAINS "81758-coinbase.com" OR destinationhostname CONTAINS "81920-coinbase.com" OR destinationhostname CONTAINS "81926-coinbase.com" OR destinationhostname CONTAINS "81958-coinbase.com" OR destinationhostname CONTAINS "826298-coinbase.com" OR destinationhostname CONTAINS "83216-coinbase.com" OR destinationhostname CONTAINS "837613-coinbase.com" OR destinationhostname CONTAINS "83956-coinbase.com" OR destinationhostname CONTAINS "87157-coinbase.com" OR destinationhostname CONTAINS "87312-coinbase.com" OR destinationhostname CONTAINS "89304-coinbase.com" OR destinationhostname CONTAINS "89375-coinbase.com" OR destinationhostname CONTAINS "91723-gemini.com" OR destinationhostname CONTAINS "91752-coinbase.com")
index=activity AND rg_functionality="Web Proxy" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "28676-coinbase.com" OR sourcentdomain CONTAINS "29185-coinbase.com" OR sourcentdomain CONTAINS "29195-coinbase.com" OR sourcentdomain CONTAINS "2a-coinbase.com" OR sourcentdomain CONTAINS "2b-coinbase.com" OR sourcentdomain CONTAINS "2c-coinbase.com" OR sourcentdomain CONTAINS "2f-coinbase.com" OR sourcentdomain CONTAINS "2fas-coinbase.com" OR sourcentdomain CONTAINS "2o-coinbase.com" OR sourcentdomain CONTAINS "2r-coinbase.com" OR sourcentdomain CONTAINS "2s-coinbase.com" OR sourcentdomain CONTAINS "2sv-coinbase.com" OR sourcentdomain CONTAINS "352134951-coinbase.com" OR sourcentdomain CONTAINS "38468-coinbase.com" OR sourcentdomain CONTAINS "39590-coinbase.com" OR sourcentdomain CONTAINS "41260-coinbase.com" OR sourcentdomain CONTAINS "427883-coinbase.com" OR sourcentdomain CONTAINS "43017-coinbase.com" OR sourcentdomain CONTAINS "47562-coinbase.com" OR sourcentdomain CONTAINS "50195-coinbase.com" OR sourcentdomain CONTAINS "5247-coinbase.com" OR sourcentdomain CONTAINS "54765-coinbase.com" OR sourcentdomain CONTAINS "57197-coinbase.com" OR sourcentdomain CONTAINS "58176-coinbase.com" OR sourcentdomain CONTAINS "58297-coinbase.com" OR sourcentdomain CONTAINS "61250-coinbase.com" OR sourcentdomain CONTAINS "61835-coinbase.com" OR sourcentdomain CONTAINS "61851-coinbase.com" OR sourcentdomain CONTAINS "61937-coinbase.com" OR sourcentdomain CONTAINS "71925-coinbase.com" OR sourcentdomain CONTAINS "72957-coinbase.com" OR sourcentdomain CONTAINS "72985-coinbase.com" OR sourcentdomain CONTAINS "74651-coinbase.com" OR sourcentdomain CONTAINS "754668948-coinbase.com" OR sourcentdomain CONTAINS "76159869-coinbase.com" OR sourcentdomain CONTAINS "76153-coinbase.com" OR sourcentdomain CONTAINS "81758-coinbase.com" OR sourcentdomain CONTAINS "81920-coinbase.com" OR sourcentdomain CONTAINS "81926-coinbase.com" OR sourcentdomain CONTAINS "81958-coinbase.com" OR sourcentdomain CONTAINS "826298-coinbase.com" OR sourcentdomain CONTAINS "83216-coinbase.com" OR sourcentdomain CONTAINS "837613-coinbase.com" OR sourcentdomain CONTAINS "83956-coinbase.com" OR sourcentdomain CONTAINS "87157-coinbase.com" OR sourcentdomain CONTAINS "87312-coinbase.com" OR sourcentdomain CONTAINS "89304-coinbase.com" OR sourcentdomain CONTAINS "89375-coinbase.com" OR sourcentdomain CONTAINS "91723-gemini.com" OR sourcentdomain CONTAINS "91752-coinbase.com")
index=activity AND rg_functionality="Web Proxy" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "28676-coinbase.com" OR sourcehostname CONTAINS "29185-coinbase.com" OR sourcehostname CONTAINS "29195-coinbase.com" OR sourcehostname CONTAINS "2a-coinbase.com" OR sourcehostname CONTAINS "2b-coinbase.com" OR sourcehostname CONTAINS "2c-coinbase.com" OR sourcehostname CONTAINS "2f-coinbase.com" OR sourcehostname CONTAINS "2fas-coinbase.com" OR sourcehostname CONTAINS "2o-coinbase.com" OR sourcehostname CONTAINS "2r-coinbase.com" OR sourcehostname CONTAINS "2s-coinbase.com" OR sourcehostname CONTAINS "2sv-coinbase.com" OR sourcehostname CONTAINS "352134951-coinbase.com" OR sourcehostname CONTAINS "38468-coinbase.com" OR sourcehostname CONTAINS "39590-coinbase.com" OR sourcehostname CONTAINS "41260-coinbase.com" OR sourcehostname CONTAINS "427883-coinbase.com" OR sourcehostname CONTAINS "43017-coinbase.com" OR sourcehostname CONTAINS "47562-coinbase.com" OR sourcehostname CONTAINS "50195-coinbase.com" OR sourcehostname CONTAINS "5247-coinbase.com" OR sourcehostname CONTAINS "54765-coinbase.com" OR sourcehostname CONTAINS "57197-coinbase.com" OR sourcehostname CONTAINS "58176-coinbase.com" OR sourcehostname CONTAINS "58297-coinbase.com" OR sourcehostname CONTAINS "61250-coinbase.com" OR sourcehostname CONTAINS "61835-coinbase.com" OR sourcehostname CONTAINS "61851-coinbase.com" OR sourcehostname CONTAINS "61937-coinbase.com" OR sourcehostname CONTAINS "71925-coinbase.com" OR sourcehostname CONTAINS "72957-coinbase.com" OR sourcehostname CONTAINS "72985-coinbase.com" OR sourcehostname CONTAINS "74651-coinbase.com" OR sourcehostname CONTAINS "754668948-coinbase.com" OR sourcehostname CONTAINS "76159869-coinbase.com" OR sourcehostname CONTAINS "76153-coinbase.com" OR sourcehostname CONTAINS "81758-coinbase.com" OR sourcehostname CONTAINS "81920-coinbase.com" OR sourcehostname CONTAINS "81926-coinbase.com" OR sourcehostname CONTAINS "81958-coinbase.com" OR sourcehostname CONTAINS "826298-coinbase.com" OR sourcehostname CONTAINS "83216-coinbase.com" OR sourcehostname CONTAINS "837613-coinbase.com" OR sourcehostname CONTAINS "83956-coinbase.com" OR sourcehostname CONTAINS "87157-coinbase.com" OR sourcehostname CONTAINS "87312-coinbase.com" OR sourcehostname CONTAINS "89304-coinbase.com" OR sourcehostname CONTAINS "89375-coinbase.com" OR sourcehostname CONTAINS "91723-gemini.com" OR sourcehostname CONTAINS "91752-coinbase.com")
index=activity AND rg_functionality="Web Proxy" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "28676-coinbase.com" OR destinationntdomain CONTAINS "29185-coinbase.com" OR destinationntdomain CONTAINS "29195-coinbase.com" OR destinationntdomain CONTAINS "2a-coinbase.com" OR destinationntdomain CONTAINS "2b-coinbase.com" OR destinationntdomain CONTAINS "2c-coinbase.com" OR destinationntdomain CONTAINS "2f-coinbase.com" OR destinationntdomain CONTAINS "2fas-coinbase.com" OR destinationntdomain CONTAINS "2o-coinbase.com" OR destinationntdomain CONTAINS "2r-coinbase.com" OR destinationntdomain CONTAINS "2s-coinbase.com" OR destinationntdomain CONTAINS "2sv-coinbase.com" OR destinationntdomain CONTAINS "352134951-coinbase.com" OR destinationntdomain CONTAINS "38468-coinbase.com" OR destinationntdomain CONTAINS "39590-coinbase.com" OR destinationntdomain CONTAINS "41260-coinbase.com" OR destinationntdomain CONTAINS "427883-coinbase.com" OR destinationntdomain CONTAINS "43017-coinbase.com" OR destinationntdomain CONTAINS "47562-coinbase.com" OR destinationntdomain CONTAINS "50195-coinbase.com" OR destinationntdomain CONTAINS "5247-coinbase.com" OR destinationntdomain CONTAINS "54765-coinbase.com" OR destinationntdomain CONTAINS "57197-coinbase.com" OR destinationntdomain CONTAINS "58176-coinbase.com" OR destinationntdomain CONTAINS "58297-coinbase.com" OR destinationntdomain CONTAINS "61250-coinbase.com" OR destinationntdomain CONTAINS "61835-coinbase.com" OR destinationntdomain CONTAINS "61851-coinbase.com" OR destinationntdomain CONTAINS "61937-coinbase.com" OR destinationntdomain CONTAINS "71925-coinbase.com" OR destinationntdomain CONTAINS "72957-coinbase.com" OR destinationntdomain CONTAINS "72985-coinbase.com" OR destinationntdomain CONTAINS "74651-coinbase.com" OR destinationntdomain CONTAINS "754668948-coinbase.com" OR destinationntdomain CONTAINS "76159869-coinbase.com" OR destinationntdomain CONTAINS "76153-coinbase.com" OR destinationntdomain CONTAINS "81758-coinbase.com" OR destinationntdomain CONTAINS "81920-coinbase.com" OR destinationntdomain CONTAINS "81926-coinbase.com" OR destinationntdomain CONTAINS "81958-coinbase.com" OR destinationntdomain CONTAINS "826298-coinbase.com" OR destinationntdomain CONTAINS "83216-coinbase.com" OR destinationntdomain CONTAINS "837613-coinbase.com" OR destinationntdomain CONTAINS "83956-coinbase.com" OR destinationntdomain CONTAINS "87157-coinbase.com" OR destinationntdomain CONTAINS "87312-coinbase.com" OR destinationntdomain CONTAINS "89304-coinbase.com" OR destinationntdomain CONTAINS "89375-coinbase.com" OR destinationntdomain CONTAINS "91723-gemini.com" OR destinationntdomain CONTAINS "91752-coinbase.com")
index=activity AND rg_functionality="Web Proxy" AND requesturl NOT NULL AND (requesturl CONTAINS "28676-coinbase.com" OR requesturl CONTAINS "29185-coinbase.com" OR requesturl CONTAINS "29195-coinbase.com" OR requesturl CONTAINS "2a-coinbase.com" OR requesturl CONTAINS "2b-coinbase.com" OR requesturl CONTAINS "2c-coinbase.com" OR requesturl CONTAINS "2f-coinbase.com" OR requesturl CONTAINS "2fas-coinbase.com" OR requesturl CONTAINS "2o-coinbase.com" OR requesturl CONTAINS "2r-coinbase.com" OR requesturl CONTAINS "2s-coinbase.com" OR requesturl CONTAINS "2sv-coinbase.com" OR requesturl CONTAINS "352134951-coinbase.com" OR requesturl CONTAINS "38468-coinbase.com" OR requesturl CONTAINS "39590-coinbase.com" OR requesturl CONTAINS "41260-coinbase.com" OR requesturl CONTAINS "427883-coinbase.com" OR requesturl CONTAINS "43017-coinbase.com" OR requesturl CONTAINS "47562-coinbase.com" OR requesturl CONTAINS "50195-coinbase.com" OR requesturl CONTAINS "5247-coinbase.com" OR requesturl CONTAINS "54765-coinbase.com" OR requesturl CONTAINS "57197-coinbase.com" OR requesturl CONTAINS "58176-coinbase.com" OR requesturl CONTAINS "58297-coinbase.com" OR requesturl CONTAINS "61250-coinbase.com" OR requesturl CONTAINS "61835-coinbase.com" OR requesturl CONTAINS "61851-coinbase.com" OR requesturl CONTAINS "61937-coinbase.com" OR requesturl CONTAINS "71925-coinbase.com" OR requesturl CONTAINS "72957-coinbase.com" OR requesturl CONTAINS "72985-coinbase.com" OR requesturl CONTAINS "74651-coinbase.com" OR requesturl CONTAINS "754668948-coinbase.com" OR requesturl CONTAINS "76159869-coinbase.com" OR requesturl CONTAINS "76153-coinbase.com" OR requesturl CONTAINS "81758-coinbase.com" OR requesturl CONTAINS "81920-coinbase.com" OR requesturl CONTAINS "81926-coinbase.com" OR requesturl CONTAINS "81958-coinbase.com" OR requesturl CONTAINS "826298-coinbase.com" OR requesturl CONTAINS "83216-coinbase.com" OR requesturl CONTAINS "837613-coinbase.com" OR requesturl CONTAINS "83956-coinbase.com" OR requesturl CONTAINS "87157-coinbase.com" OR requesturl CONTAINS "87312-coinbase.com" OR requesturl CONTAINS "89304-coinbase.com" OR requesturl CONTAINS "89375-coinbase.com" OR requesturl CONTAINS "91723-gemini.com" OR requesturl CONTAINS "91752-coinbase.com")
index=activity AND rg_functionality="Web Proxy" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "91756-coinbase.com" OR destinationhostname CONTAINS "91782-coinbase.com" OR destinationhostname CONTAINS "91835-coinbase.com" OR destinationhostname CONTAINS "91845-coinbase.com" OR destinationhostname CONTAINS "91923-coinbase.com" OR destinationhostname CONTAINS "92758-coinbase.com" OR destinationhostname CONTAINS "948122061-coinbase.com" OR destinationhostname CONTAINS "978941-coinbase.com" OR destinationhostname CONTAINS "accountrecovery-coinbase.com" OR destinationhostname CONTAINS "action-shakepay.com" OR destinationhostname CONTAINS "adjust-coinbase.com" OR destinationhostname CONTAINS "admin-kraken.com" OR destinationhostname CONTAINS "applechargebacks.com" OR destinationhostname CONTAINS "authenticate-gemini.com" OR destinationhostname CONTAINS "authorize-gmail.com" OR destinationhostname CONTAINS "binance-okta.com" OR destinationhostname CONTAINS "captcha-coinbase.com" OR destinationhostname CONTAINS "cd-coinbase.com" OR destinationhostname CONTAINS "coinbase-heip.com" OR destinationhostname CONTAINS "coinbase-live.support" OR destinationhostname CONTAINS "coinbase-reject.com" OR destinationhostname CONTAINS "coinbase-ticket.com" OR destinationhostname CONTAINS "coinbaseheip.com" OR destinationhostname CONTAINS "com-2fa.help" OR destinationhostname CONTAINS "com-2fa.support" OR destinationhostname CONTAINS "com-3845.support" OR destinationhostname CONTAINS "com-connect.help" OR destinationhostname CONTAINS "com-fraud.support" OR destinationhostname CONTAINS "com-help.support" OR destinationhostname CONTAINS "com-reset.help" OR destinationhostname CONTAINS "com-reset.net" OR destinationhostname CONTAINS "com-ticket.live" OR destinationhostname CONTAINS "com-ticket.support" OR destinationhostname CONTAINS "contact-nexo.com" OR destinationhostname CONTAINS "convert-coinbase.com" OR destinationhostname CONTAINS "customerservice-coinbase.com" OR destinationhostname CONTAINS "default-coinbase.com" OR destinationhostname CONTAINS "defend-coinbase.com" OR destinationhostname CONTAINS "deny-coinbase.com" OR destinationhostname CONTAINS "disconnect-coinbase.com" OR destinationhostname CONTAINS "escalate-coinbase.com" OR destinationhostname CONTAINS "establish-coinbase.com" OR destinationhostname CONTAINS "fcc-okta.com" OR destinationhostname CONTAINS "fraudulent-coinbase.com" OR destinationhostname CONTAINS "guard-apple.com" OR destinationhostname CONTAINS "guard-icloud.com" OR destinationhostname CONTAINS "guardian-coinbase.com" OR destinationhostname CONTAINS "guide-gemini.com" OR destinationhostname CONTAINS "help-bitfinex.com" OR destinationhostname CONTAINS "help-shakepay.com")
index=activity AND rg_functionality="Web Proxy" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "91756-coinbase.com" OR sourcentdomain CONTAINS "91782-coinbase.com" OR sourcentdomain CONTAINS "91835-coinbase.com" OR sourcentdomain CONTAINS "91845-coinbase.com" OR sourcentdomain CONTAINS "91923-coinbase.com" OR sourcentdomain CONTAINS "92758-coinbase.com" OR sourcentdomain CONTAINS "948122061-coinbase.com" OR sourcentdomain CONTAINS "978941-coinbase.com" OR sourcentdomain CONTAINS "accountrecovery-coinbase.com" OR sourcentdomain CONTAINS "action-shakepay.com" OR sourcentdomain CONTAINS "adjust-coinbase.com" OR sourcentdomain CONTAINS "admin-kraken.com" OR sourcentdomain CONTAINS "applechargebacks.com" OR sourcentdomain CONTAINS "authenticate-gemini.com" OR sourcentdomain CONTAINS "authorize-gmail.com" OR sourcentdomain CONTAINS "binance-okta.com" OR sourcentdomain CONTAINS "captcha-coinbase.com" OR sourcentdomain CONTAINS "cd-coinbase.com" OR sourcentdomain CONTAINS "coinbase-heip.com" OR sourcentdomain CONTAINS "coinbase-live.support" OR sourcentdomain CONTAINS "coinbase-reject.com" OR sourcentdomain CONTAINS "coinbase-ticket.com" OR sourcentdomain CONTAINS "coinbaseheip.com" OR sourcentdomain CONTAINS "com-2fa.help" OR sourcentdomain CONTAINS "com-2fa.support" OR sourcentdomain CONTAINS "com-3845.support" OR sourcentdomain CONTAINS "com-connect.help" OR sourcentdomain CONTAINS "com-fraud.support" OR sourcentdomain CONTAINS "com-help.support" OR sourcentdomain CONTAINS "com-reset.help" OR sourcentdomain CONTAINS "com-reset.net" OR sourcentdomain CONTAINS "com-ticket.live" OR sourcentdomain CONTAINS "com-ticket.support" OR sourcentdomain CONTAINS "contact-nexo.com" OR sourcentdomain CONTAINS "convert-coinbase.com" OR sourcentdomain CONTAINS "customerservice-coinbase.com" OR sourcentdomain CONTAINS "default-coinbase.com" OR sourcentdomain CONTAINS "defend-coinbase.com" OR sourcentdomain CONTAINS "deny-coinbase.com" OR sourcentdomain CONTAINS "disconnect-coinbase.com" OR sourcentdomain CONTAINS "escalate-coinbase.com" OR sourcentdomain CONTAINS "establish-coinbase.com" OR sourcentdomain CONTAINS "fcc-okta.com" OR sourcentdomain CONTAINS "fraudulent-coinbase.com" OR sourcentdomain CONTAINS "guard-apple.com" OR sourcentdomain CONTAINS "guard-icloud.com" OR sourcentdomain CONTAINS "guardian-coinbase.com" OR sourcentdomain CONTAINS "guide-gemini.com" OR sourcentdomain CONTAINS "help-bitfinex.com" OR sourcentdomain CONTAINS "help-shakepay.com")
index=activity AND rg_functionality="Web Proxy" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "91756-coinbase.com" OR sourcehostname CONTAINS "91782-coinbase.com" OR sourcehostname CONTAINS "91835-coinbase.com" OR sourcehostname CONTAINS "91845-coinbase.com" OR sourcehostname CONTAINS "91923-coinbase.com" OR sourcehostname CONTAINS "92758-coinbase.com" OR sourcehostname CONTAINS "948122061-coinbase.com" OR sourcehostname CONTAINS "978941-coinbase.com" OR sourcehostname CONTAINS "accountrecovery-coinbase.com" OR sourcehostname CONTAINS "action-shakepay.com" OR sourcehostname CONTAINS "adjust-coinbase.com" OR sourcehostname CONTAINS "admin-kraken.com" OR sourcehostname CONTAINS "applechargebacks.com" OR sourcehostname CONTAINS "authenticate-gemini.com" OR sourcehostname CONTAINS "authorize-gmail.com" OR sourcehostname CONTAINS "binance-okta.com" OR sourcehostname CONTAINS "captcha-coinbase.com" OR sourcehostname CONTAINS "cd-coinbase.com" OR sourcehostname CONTAINS "coinbase-heip.com" OR sourcehostname CONTAINS "coinbase-live.support" OR sourcehostname CONTAINS "coinbase-reject.com" OR sourcehostname CONTAINS "coinbase-ticket.com" OR sourcehostname CONTAINS "coinbaseheip.com" OR sourcehostname CONTAINS "com-2fa.help" OR sourcehostname CONTAINS "com-2fa.support" OR sourcehostname CONTAINS "com-3845.support" OR sourcehostname CONTAINS "com-connect.help" OR sourcehostname CONTAINS "com-fraud.support" OR sourcehostname CONTAINS "com-help.support" OR sourcehostname CONTAINS "com-reset.help" OR sourcehostname CONTAINS "com-reset.net" OR sourcehostname CONTAINS "com-ticket.live" OR sourcehostname CONTAINS "com-ticket.support" OR sourcehostname CONTAINS "contact-nexo.com" OR sourcehostname CONTAINS "convert-coinbase.com" OR sourcehostname CONTAINS "customerservice-coinbase.com" OR sourcehostname CONTAINS "default-coinbase.com" OR sourcehostname CONTAINS "defend-coinbase.com" OR sourcehostname CONTAINS "deny-coinbase.com" OR sourcehostname CONTAINS "disconnect-coinbase.com" OR sourcehostname CONTAINS "escalate-coinbase.com" OR sourcehostname CONTAINS "establish-coinbase.com" OR sourcehostname CONTAINS "fcc-okta.com" OR sourcehostname CONTAINS "fraudulent-coinbase.com" OR sourcehostname CONTAINS "guard-apple.com" OR sourcehostname CONTAINS "guard-icloud.com" OR sourcehostname CONTAINS "guardian-coinbase.com" OR sourcehostname CONTAINS "guide-gemini.com" OR sourcehostname CONTAINS "help-bitfinex.com" OR sourcehostname CONTAINS "help-shakepay.com")
index=activity AND rg_functionality="Web Proxy" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "91756-coinbase.com" OR destinationntdomain CONTAINS "91782-coinbase.com" OR destinationntdomain CONTAINS "91835-coinbase.com" OR destinationntdomain CONTAINS "91845-coinbase.com" OR destinationntdomain CONTAINS "91923-coinbase.com" OR destinationntdomain CONTAINS "92758-coinbase.com" OR destinationntdomain CONTAINS "948122061-coinbase.com" OR destinationntdomain CONTAINS "978941-coinbase.com" OR destinationntdomain CONTAINS "accountrecovery-coinbase.com" OR destinationntdomain CONTAINS "action-shakepay.com" OR destinationntdomain CONTAINS "adjust-coinbase.com" OR destinationntdomain CONTAINS "admin-kraken.com" OR destinationntdomain CONTAINS "applechargebacks.com" OR destinationntdomain CONTAINS "authenticate-gemini.com" OR destinationntdomain CONTAINS "authorize-gmail.com" OR destinationntdomain CONTAINS "binance-okta.com" OR destinationntdomain CONTAINS "captcha-coinbase.com" OR destinationntdomain CONTAINS "cd-coinbase.com" OR destinationntdomain CONTAINS "coinbase-heip.com" OR destinationntdomain CONTAINS "coinbase-live.support" OR destinationntdomain CONTAINS "coinbase-reject.com" OR destinationntdomain CONTAINS "coinbase-ticket.com" OR destinationntdomain CONTAINS "coinbaseheip.com" OR destinationntdomain CONTAINS "com-2fa.help" OR destinationntdomain CONTAINS "com-2fa.support" OR destinationntdomain CONTAINS "com-3845.support" OR destinationntdomain CONTAINS "com-connect.help" OR destinationntdomain CONTAINS "com-fraud.support" OR destinationntdomain CONTAINS "com-help.support" OR destinationntdomain CONTAINS "com-reset.help" OR destinationntdomain CONTAINS "com-reset.net" OR destinationntdomain CONTAINS "com-ticket.live" OR destinationntdomain CONTAINS "com-ticket.support" OR destinationntdomain CONTAINS "contact-nexo.com" OR destinationntdomain CONTAINS "convert-coinbase.com" OR destinationntdomain CONTAINS "customerservice-coinbase.com" OR destinationntdomain CONTAINS "default-coinbase.com" OR destinationntdomain CONTAINS "defend-coinbase.com" OR destinationntdomain CONTAINS "deny-coinbase.com" OR destinationntdomain CONTAINS "disconnect-coinbase.com" OR destinationntdomain CONTAINS "escalate-coinbase.com" OR destinationntdomain CONTAINS "establish-coinbase.com" OR destinationntdomain CONTAINS "fcc-okta.com" OR destinationntdomain CONTAINS "fraudulent-coinbase.com" OR destinationntdomain CONTAINS "guard-apple.com" OR destinationntdomain CONTAINS "guard-icloud.com" OR destinationntdomain CONTAINS "guardian-coinbase.com" OR destinationntdomain CONTAINS "guide-gemini.com" OR destinationntdomain CONTAINS "help-bitfinex.com" OR destinationntdomain CONTAINS "help-shakepay.com")
index=activity AND rg_functionality="Web Proxy" AND requesturl NOT NULL AND (requesturl CONTAINS "91756-coinbase.com" OR requesturl CONTAINS "91782-coinbase.com" OR requesturl CONTAINS "91835-coinbase.com" OR requesturl CONTAINS "91845-coinbase.com" OR requesturl CONTAINS "91923-coinbase.com" OR requesturl CONTAINS "92758-coinbase.com" OR requesturl CONTAINS "948122061-coinbase.com" OR requesturl CONTAINS "978941-coinbase.com" OR requesturl CONTAINS "accountrecovery-coinbase.com" OR requesturl CONTAINS "action-shakepay.com" OR requesturl CONTAINS "adjust-coinbase.com" OR requesturl CONTAINS "admin-kraken.com" OR requesturl CONTAINS "applechargebacks.com" OR requesturl CONTAINS "authenticate-gemini.com" OR requesturl CONTAINS "authorize-gmail.com" OR requesturl CONTAINS "binance-okta.com" OR requesturl CONTAINS "captcha-coinbase.com" OR requesturl CONTAINS "cd-coinbase.com" OR requesturl CONTAINS "coinbase-heip.com" OR requesturl CONTAINS "coinbase-live.support" OR requesturl CONTAINS "coinbase-reject.com" OR requesturl CONTAINS "coinbase-ticket.com" OR requesturl CONTAINS "coinbaseheip.com" OR requesturl CONTAINS "com-2fa.help" OR requesturl CONTAINS "com-2fa.support" OR requesturl CONTAINS "com-3845.support" OR requesturl CONTAINS "com-connect.help" OR requesturl CONTAINS "com-fraud.support" OR requesturl CONTAINS "com-help.support" OR requesturl CONTAINS "com-reset.help" OR requesturl CONTAINS "com-reset.net" OR requesturl CONTAINS "com-ticket.live" OR requesturl CONTAINS "com-ticket.support" OR requesturl CONTAINS "contact-nexo.com" OR requesturl CONTAINS "convert-coinbase.com" OR requesturl CONTAINS "customerservice-coinbase.com" OR requesturl CONTAINS "default-coinbase.com" OR requesturl CONTAINS "defend-coinbase.com" OR requesturl CONTAINS "deny-coinbase.com" OR requesturl CONTAINS "disconnect-coinbase.com" OR requesturl CONTAINS "escalate-coinbase.com" OR requesturl CONTAINS "establish-coinbase.com" OR requesturl CONTAINS "fcc-okta.com" OR requesturl CONTAINS "fraudulent-coinbase.com" OR requesturl CONTAINS "guard-apple.com" OR requesturl CONTAINS "guard-icloud.com" OR requesturl CONTAINS "guardian-coinbase.com" OR requesturl CONTAINS "guide-gemini.com" OR requesturl CONTAINS "help-bitfinex.com" OR requesturl CONTAINS "help-shakepay.com")
index=activity AND rg_functionality="Web Proxy" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "helpdesk-apple.com" OR destinationhostname CONTAINS "helpdesk-gemini.com" OR destinationhostname CONTAINS "helpdesk-icloud.com" OR destinationhostname CONTAINS "identification-coinbase.com" OR destinationhostname CONTAINS "lockdown-coinbase.com" OR destinationhostname CONTAINS "login-nexo.com" OR destinationhostname CONTAINS "keys-coinbase.com" OR destinationhostname CONTAINS "messages-coinbase.com" OR destinationhostname CONTAINS "newpassword-coinbase.com" OR destinationhostname CONTAINS "prompt-coinbase.com" OR destinationhostname CONTAINS "protect-apple.com" OR destinationhostname CONTAINS "protect-coinbase.com" OR destinationhostname CONTAINS "protect-gmail.com" OR destinationhostname CONTAINS "protect-kraken.com" OR destinationhostname CONTAINS "recoverme-coinbase.com" OR destinationhostname CONTAINS "recoveryportal-coinbase.com" OR destinationhostname CONTAINS "refunds-coinbase.com" OR destinationhostname CONTAINS "reset-okta.com" OR destinationhostname CONTAINS "restore-coinbase.com" OR destinationhostname CONTAINS "return-coinbase.com" OR destinationhostname CONTAINS "reverts-coinbase.com" OR destinationhostname CONTAINS "secure-binance.us" OR destinationhostname CONTAINS "secure-icloud.com" OR destinationhostname CONTAINS "secure-nexo.com" OR destinationhostname CONTAINS "secure-shakepay.com" OR destinationhostname CONTAINS "security-umusic.com" OR destinationhostname CONTAINS "server694590423.tech" OR destinationhostname CONTAINS "session-coinbase.com" OR destinationhostname CONTAINS "startrecovery-coinbase.com" OR destinationhostname CONTAINS "signin-kraken.com" OR destinationhostname CONTAINS "suite-trezor.io" OR destinationhostname CONTAINS "supportportal-coinbase.com" OR destinationhostname CONTAINS "tech-icloud.com" OR destinationhostname CONTAINS "threat-coinbase.com" OR destinationhostname CONTAINS "ticket-apple.com" OR destinationhostname CONTAINS "ticket-coinbase.com" OR destinationhostname CONTAINS "tickets-apple.com" OR destinationhostname CONTAINS "tokens-coinbase.com" OR destinationhostname CONTAINS "unblock-coinbase.com" OR destinationhostname CONTAINS "unlink-coinbase.com" OR destinationhostname CONTAINS "your-coinbase.com" OR destinationhostname CONTAINS "welcome-coinbase.com" OR destinationhostname CONTAINS "www-coinbasewallet.com" OR destinationhostname CONTAINS "www-help-coinbase.com" OR destinationhostname CONTAINS "www-help-gemini.com")
index=activity AND rg_functionality="Web Proxy" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "helpdesk-apple.com" OR sourcentdomain CONTAINS "helpdesk-gemini.com" OR sourcentdomain CONTAINS "helpdesk-icloud.com" OR sourcentdomain CONTAINS "identification-coinbase.com" OR sourcentdomain CONTAINS "lockdown-coinbase.com" OR sourcentdomain CONTAINS "login-nexo.com" OR sourcentdomain CONTAINS "keys-coinbase.com" OR sourcentdomain CONTAINS "messages-coinbase.com" OR sourcentdomain CONTAINS "newpassword-coinbase.com" OR sourcentdomain CONTAINS "prompt-coinbase.com" OR sourcentdomain CONTAINS "protect-apple.com" OR sourcentdomain CONTAINS "protect-coinbase.com" OR sourcentdomain CONTAINS "protect-gmail.com" OR sourcentdomain CONTAINS "protect-kraken.com" OR sourcentdomain CONTAINS "recoverme-coinbase.com" OR sourcentdomain CONTAINS "recoveryportal-coinbase.com" OR sourcentdomain CONTAINS "refunds-coinbase.com" OR sourcentdomain CONTAINS "reset-okta.com" OR sourcentdomain CONTAINS "restore-coinbase.com" OR sourcentdomain CONTAINS "return-coinbase.com" OR sourcentdomain CONTAINS "reverts-coinbase.com" OR sourcentdomain CONTAINS "secure-binance.us" OR sourcentdomain CONTAINS "secure-icloud.com" OR sourcentdomain CONTAINS "secure-nexo.com" OR sourcentdomain CONTAINS "secure-shakepay.com" OR sourcentdomain CONTAINS "security-umusic.com" OR sourcentdomain CONTAINS "server694590423.tech" OR sourcentdomain CONTAINS "session-coinbase.com" OR sourcentdomain CONTAINS "startrecovery-coinbase.com" OR sourcentdomain CONTAINS "signin-kraken.com" OR sourcentdomain CONTAINS "suite-trezor.io" OR sourcentdomain CONTAINS "supportportal-coinbase.com" OR sourcentdomain CONTAINS "tech-icloud.com" OR sourcentdomain CONTAINS "threat-coinbase.com" OR sourcentdomain CONTAINS "ticket-apple.com" OR sourcentdomain CONTAINS "ticket-coinbase.com" OR sourcentdomain CONTAINS "tickets-apple.com" OR sourcentdomain CONTAINS "tokens-coinbase.com" OR sourcentdomain CONTAINS "unblock-coinbase.com" OR sourcentdomain CONTAINS "unlink-coinbase.com" OR sourcentdomain CONTAINS "your-coinbase.com" OR sourcentdomain CONTAINS "welcome-coinbase.com" OR sourcentdomain CONTAINS "www-coinbasewallet.com" OR sourcentdomain CONTAINS "www-help-coinbase.com" OR sourcentdomain CONTAINS "www-help-gemini.com")
index=activity AND rg_functionality="Web Proxy" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "helpdesk-apple.com" OR sourcehostname CONTAINS "helpdesk-gemini.com" OR sourcehostname CONTAINS "helpdesk-icloud.com" OR sourcehostname CONTAINS "identification-coinbase.com" OR sourcehostname CONTAINS "lockdown-coinbase.com" OR sourcehostname CONTAINS "login-nexo.com" OR sourcehostname CONTAINS "keys-coinbase.com" OR sourcehostname CONTAINS "messages-coinbase.com" OR sourcehostname CONTAINS "newpassword-coinbase.com" OR sourcehostname CONTAINS "prompt-coinbase.com" OR sourcehostname CONTAINS "protect-apple.com" OR sourcehostname CONTAINS "protect-coinbase.com" OR sourcehostname CONTAINS "protect-gmail.com" OR sourcehostname CONTAINS "protect-kraken.com" OR sourcehostname CONTAINS "recoverme-coinbase.com" OR sourcehostname CONTAINS "recoveryportal-coinbase.com" OR sourcehostname CONTAINS "refunds-coinbase.com" OR sourcehostname CONTAINS "reset-okta.com" OR sourcehostname CONTAINS "restore-coinbase.com" OR sourcehostname CONTAINS "return-coinbase.com" OR sourcehostname CONTAINS "reverts-coinbase.com" OR sourcehostname CONTAINS "secure-binance.us" OR sourcehostname CONTAINS "secure-icloud.com" OR sourcehostname CONTAINS "secure-nexo.com" OR sourcehostname CONTAINS "secure-shakepay.com" OR sourcehostname CONTAINS "security-umusic.com" OR sourcehostname CONTAINS "server694590423.tech" OR sourcehostname CONTAINS "session-coinbase.com" OR sourcehostname CONTAINS "startrecovery-coinbase.com" OR sourcehostname CONTAINS "signin-kraken.com" OR sourcehostname CONTAINS "suite-trezor.io" OR sourcehostname CONTAINS "supportportal-coinbase.com" OR sourcehostname CONTAINS "tech-icloud.com" OR sourcehostname CONTAINS "threat-coinbase.com" OR sourcehostname CONTAINS "ticket-apple.com" OR sourcehostname CONTAINS "ticket-coinbase.com" OR sourcehostname CONTAINS "tickets-apple.com" OR sourcehostname CONTAINS "tokens-coinbase.com" OR sourcehostname CONTAINS "unblock-coinbase.com" OR sourcehostname CONTAINS "unlink-coinbase.com" OR sourcehostname CONTAINS "your-coinbase.com" OR sourcehostname CONTAINS "welcome-coinbase.com" OR sourcehostname CONTAINS "www-coinbasewallet.com" OR sourcehostname CONTAINS "www-help-coinbase.com" OR sourcehostname CONTAINS "www-help-gemini.com")
index=activity AND rg_functionality="Web Proxy" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "helpdesk-apple.com" OR destinationntdomain CONTAINS "helpdesk-gemini.com" OR destinationntdomain CONTAINS "helpdesk-icloud.com" OR destinationntdomain CONTAINS "identification-coinbase.com" OR destinationntdomain CONTAINS "lockdown-coinbase.com" OR destinationntdomain CONTAINS "login-nexo.com" OR destinationntdomain CONTAINS "keys-coinbase.com" OR destinationntdomain CONTAINS "messages-coinbase.com" OR destinationntdomain CONTAINS "newpassword-coinbase.com" OR destinationntdomain CONTAINS "prompt-coinbase.com" OR destinationntdomain CONTAINS "protect-apple.com" OR destinationntdomain CONTAINS "protect-coinbase.com" OR destinationntdomain CONTAINS "protect-gmail.com" OR destinationntdomain CONTAINS "protect-kraken.com" OR destinationntdomain CONTAINS "recoverme-coinbase.com" OR destinationntdomain CONTAINS "recoveryportal-coinbase.com" OR destinationntdomain CONTAINS "refunds-coinbase.com" OR destinationntdomain CONTAINS "reset-okta.com" OR destinationntdomain CONTAINS "restore-coinbase.com" OR destinationntdomain CONTAINS "return-coinbase.com" OR destinationntdomain CONTAINS "reverts-coinbase.com" OR destinationntdomain CONTAINS "secure-binance.us" OR destinationntdomain CONTAINS "secure-icloud.com" OR destinationntdomain CONTAINS "secure-nexo.com" OR destinationntdomain CONTAINS "secure-shakepay.com" OR destinationntdomain CONTAINS "security-umusic.com" OR destinationntdomain CONTAINS "server694590423.tech" OR destinationntdomain CONTAINS "session-coinbase.com" OR destinationntdomain CONTAINS "startrecovery-coinbase.com" OR destinationntdomain CONTAINS "signin-kraken.com" OR destinationntdomain CONTAINS "suite-trezor.io" OR destinationntdomain CONTAINS "supportportal-coinbase.com" OR destinationntdomain CONTAINS "tech-icloud.com" OR destinationntdomain CONTAINS "threat-coinbase.com" OR destinationntdomain CONTAINS "ticket-apple.com" OR destinationntdomain CONTAINS "ticket-coinbase.com" OR destinationntdomain CONTAINS "tickets-apple.com" OR destinationntdomain CONTAINS "tokens-coinbase.com" OR destinationntdomain CONTAINS "unblock-coinbase.com" OR destinationntdomain CONTAINS "unlink-coinbase.com" OR destinationntdomain CONTAINS "your-coinbase.com" OR destinationntdomain CONTAINS "welcome-coinbase.com" OR destinationntdomain CONTAINS "www-coinbasewallet.com" OR destinationntdomain CONTAINS "www-help-coinbase.com" OR destinationntdomain CONTAINS "www-help-gemini.com")
index=activity AND rg_functionality="Web Proxy" AND requesturl NOT NULL AND (requesturl CONTAINS "helpdesk-apple.com" OR requesturl CONTAINS "helpdesk-gemini.com" OR requesturl CONTAINS "helpdesk-icloud.com" OR requesturl CONTAINS "identification-coinbase.com" OR requesturl CONTAINS "lockdown-coinbase.com" OR requesturl CONTAINS "login-nexo.com" OR requesturl CONTAINS "keys-coinbase.com" OR requesturl CONTAINS "messages-coinbase.com" OR requesturl CONTAINS "newpassword-coinbase.com" OR requesturl CONTAINS "prompt-coinbase.com" OR requesturl CONTAINS "protect-apple.com" OR requesturl CONTAINS "protect-coinbase.com" OR requesturl CONTAINS "protect-gmail.com" OR requesturl CONTAINS "protect-kraken.com" OR requesturl CONTAINS "recoverme-coinbase.com" OR requesturl CONTAINS "recoveryportal-coinbase.com" OR requesturl CONTAINS "refunds-coinbase.com" OR requesturl CONTAINS "reset-okta.com" OR requesturl CONTAINS "restore-coinbase.com" OR requesturl CONTAINS "return-coinbase.com" OR requesturl CONTAINS "reverts-coinbase.com" OR requesturl CONTAINS "secure-binance.us" OR requesturl CONTAINS "secure-icloud.com" OR requesturl CONTAINS "secure-nexo.com" OR requesturl CONTAINS "secure-shakepay.com" OR requesturl CONTAINS "security-umusic.com" OR requesturl CONTAINS "server694590423.tech" OR requesturl CONTAINS "session-coinbase.com" OR requesturl CONTAINS "startrecovery-coinbase.com" OR requesturl CONTAINS "signin-kraken.com" OR requesturl CONTAINS "suite-trezor.io" OR requesturl CONTAINS "supportportal-coinbase.com" OR requesturl CONTAINS "tech-icloud.com" OR requesturl CONTAINS "threat-coinbase.com" OR requesturl CONTAINS "ticket-apple.com" OR requesturl CONTAINS "ticket-coinbase.com" OR requesturl CONTAINS "tickets-apple.com" OR requesturl CONTAINS "tokens-coinbase.com" OR requesturl CONTAINS "unblock-coinbase.com" OR requesturl CONTAINS "unlink-coinbase.com" OR requesturl CONTAINS "your-coinbase.com" OR requesturl CONTAINS "welcome-coinbase.com" OR requesturl CONTAINS "www-coinbasewallet.com" OR requesturl CONTAINS "www-help-coinbase.com" OR requesturl CONTAINS "www-help-gemini.com")
index=activity AND rg_functionality="Flow" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "official-server.com" OR destinationhostname CONTAINS "server694590423.tech" OR destinationhostname CONTAINS "island-placid-bromine.glitch.me" OR destinationhostname CONTAINS "circular-noon-farmhouse.glitch.me" OR destinationhostname CONTAINS "talented-friendly-price.glitch.me" OR destinationhostname CONTAINS "dflfmgsdokasdcpl.com" OR destinationhostname CONTAINS "original-backend.com" OR destinationhostname CONTAINS "07159889-coinbase.com" OR destinationhostname CONTAINS "10195-coinbase.com" OR destinationhostname CONTAINS "11246-coinbase.com" OR destinationhostname CONTAINS "11247-coinbase.com" OR destinationhostname CONTAINS "11248-coinbase.com" OR destinationhostname CONTAINS "11258-coinbase.com" OR destinationhostname CONTAINS "11259-coinbase.com" OR destinationhostname CONTAINS "113912-coinbase.com" OR destinationhostname CONTAINS "11472-coinbase.com" OR destinationhostname CONTAINS "11923-coinbase.com" OR destinationhostname CONTAINS "11957-coinbase.com" OR destinationhostname CONTAINS "128147-coinbase.com" OR destinationhostname CONTAINS "12958-coinbase.com" OR destinationhostname CONTAINS "12984-okta.com" OR destinationhostname CONTAINS "12985-coinbase.com" OR destinationhostname CONTAINS "13130-coinbase.com" OR destinationhostname CONTAINS "13247-coinbase.com" OR destinationhostname CONTAINS "13247-icloud.com" OR destinationhostname CONTAINS "13267-coinbase.com" OR destinationhostname CONTAINS "146271510-coinbase.com" OR destinationhostname CONTAINS "146282-coinbase.com" OR destinationhostname CONTAINS "146284-coinbase.com" OR destinationhostname CONTAINS "147260-coinbase.com" OR destinationhostname CONTAINS "14765-coinbase.com" OR destinationhostname CONTAINS "14817582-coinbase.com" OR destinationhostname CONTAINS "14871904-coinbase.com" OR destinationhostname CONTAINS "14891902-coinbase.com" OR destinationhostname CONTAINS "1492864-coinbase.com" OR destinationhostname CONTAINS "158312-coinbase.com" OR destinationhostname CONTAINS "158372-coinbase.com" OR destinationhostname CONTAINS "158702-coinbase.com" OR destinationhostname CONTAINS "16171675-coinbase.com" OR destinationhostname CONTAINS "16171832-coinbase.com" OR destinationhostname CONTAINS "16178234-coinbase.com" OR destinationhostname CONTAINS "16178237-coinbase.com" OR destinationhostname CONTAINS "16178434-coinbase.com" OR destinationhostname CONTAINS "162178-coinbase.com" OR destinationhostname CONTAINS "162478-coinbase.com" OR destinationhostname CONTAINS "162782-coinbase.com" OR destinationhostname CONTAINS "162812-coinbase.com" OR destinationhostname CONTAINS "162814-coinbase.com" OR destinationhostname CONTAINS "16442580-coinbase.com" OR destinationhostname CONTAINS "16450107-coinbase.com")
index=activity AND rg_functionality="Flow" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "official-server.com" OR sourcentdomain CONTAINS "server694590423.tech" OR sourcentdomain CONTAINS "island-placid-bromine.glitch.me" OR sourcentdomain CONTAINS "circular-noon-farmhouse.glitch.me" OR sourcentdomain CONTAINS "talented-friendly-price.glitch.me" OR sourcentdomain CONTAINS "dflfmgsdokasdcpl.com" OR sourcentdomain CONTAINS "original-backend.com" OR sourcentdomain CONTAINS "07159889-coinbase.com" OR sourcentdomain CONTAINS "10195-coinbase.com" OR sourcentdomain CONTAINS "11246-coinbase.com" OR sourcentdomain CONTAINS "11247-coinbase.com" OR sourcentdomain CONTAINS "11248-coinbase.com" OR sourcentdomain CONTAINS "11258-coinbase.com" OR sourcentdomain CONTAINS "11259-coinbase.com" OR sourcentdomain CONTAINS "113912-coinbase.com" OR sourcentdomain CONTAINS "11472-coinbase.com" OR sourcentdomain CONTAINS "11923-coinbase.com" OR sourcentdomain CONTAINS "11957-coinbase.com" OR sourcentdomain CONTAINS "128147-coinbase.com" OR sourcentdomain CONTAINS "12958-coinbase.com" OR sourcentdomain CONTAINS "12984-okta.com" OR sourcentdomain CONTAINS "12985-coinbase.com" OR sourcentdomain CONTAINS "13130-coinbase.com" OR sourcentdomain CONTAINS "13247-coinbase.com" OR sourcentdomain CONTAINS "13247-icloud.com" OR sourcentdomain CONTAINS "13267-coinbase.com" OR sourcentdomain CONTAINS "146271510-coinbase.com" OR sourcentdomain CONTAINS "146282-coinbase.com" OR sourcentdomain CONTAINS "146284-coinbase.com" OR sourcentdomain CONTAINS "147260-coinbase.com" OR sourcentdomain CONTAINS "14765-coinbase.com" OR sourcentdomain CONTAINS "14817582-coinbase.com" OR sourcentdomain CONTAINS "14871904-coinbase.com" OR sourcentdomain CONTAINS "14891902-coinbase.com" OR sourcentdomain CONTAINS "1492864-coinbase.com" OR sourcentdomain CONTAINS "158312-coinbase.com" OR sourcentdomain CONTAINS "158372-coinbase.com" OR sourcentdomain CONTAINS "158702-coinbase.com" OR sourcentdomain CONTAINS "16171675-coinbase.com" OR sourcentdomain CONTAINS "16171832-coinbase.com" OR sourcentdomain CONTAINS "16178234-coinbase.com" OR sourcentdomain CONTAINS "16178237-coinbase.com" OR sourcentdomain CONTAINS "16178434-coinbase.com" OR sourcentdomain CONTAINS "162178-coinbase.com" OR sourcentdomain CONTAINS "162478-coinbase.com" OR sourcentdomain CONTAINS "162782-coinbase.com" OR sourcentdomain CONTAINS "162812-coinbase.com" OR sourcentdomain CONTAINS "162814-coinbase.com" OR sourcentdomain CONTAINS "16442580-coinbase.com" OR sourcentdomain CONTAINS "16450107-coinbase.com")
index=activity AND rg_functionality="Flow" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "official-server.com" OR sourcehostname CONTAINS "server694590423.tech" OR sourcehostname CONTAINS "island-placid-bromine.glitch.me" OR sourcehostname CONTAINS "circular-noon-farmhouse.glitch.me" OR sourcehostname CONTAINS "talented-friendly-price.glitch.me" OR sourcehostname CONTAINS "dflfmgsdokasdcpl.com" OR sourcehostname CONTAINS "original-backend.com" OR sourcehostname CONTAINS "07159889-coinbase.com" OR sourcehostname CONTAINS "10195-coinbase.com" OR sourcehostname CONTAINS "11246-coinbase.com" OR sourcehostname CONTAINS "11247-coinbase.com" OR sourcehostname CONTAINS "11248-coinbase.com" OR sourcehostname CONTAINS "11258-coinbase.com" OR sourcehostname CONTAINS "11259-coinbase.com" OR sourcehostname CONTAINS "113912-coinbase.com" OR sourcehostname CONTAINS "11472-coinbase.com" OR sourcehostname CONTAINS "11923-coinbase.com" OR sourcehostname CONTAINS "11957-coinbase.com" OR sourcehostname CONTAINS "128147-coinbase.com" OR sourcehostname CONTAINS "12958-coinbase.com" OR sourcehostname CONTAINS "12984-okta.com" OR sourcehostname CONTAINS "12985-coinbase.com" OR sourcehostname CONTAINS "13130-coinbase.com" OR sourcehostname CONTAINS "13247-coinbase.com" OR sourcehostname CONTAINS "13247-icloud.com" OR sourcehostname CONTAINS "13267-coinbase.com" OR sourcehostname CONTAINS "146271510-coinbase.com" OR sourcehostname CONTAINS "146282-coinbase.com" OR sourcehostname CONTAINS "146284-coinbase.com" OR sourcehostname CONTAINS "147260-coinbase.com" OR sourcehostname CONTAINS "14765-coinbase.com" OR sourcehostname CONTAINS "14817582-coinbase.com" OR sourcehostname CONTAINS "14871904-coinbase.com" OR sourcehostname CONTAINS "14891902-coinbase.com" OR sourcehostname CONTAINS "1492864-coinbase.com" OR sourcehostname CONTAINS "158312-coinbase.com" OR sourcehostname CONTAINS "158372-coinbase.com" OR sourcehostname CONTAINS "158702-coinbase.com" OR sourcehostname CONTAINS "16171675-coinbase.com" OR sourcehostname CONTAINS "16171832-coinbase.com" OR sourcehostname CONTAINS "16178234-coinbase.com" OR sourcehostname CONTAINS "16178237-coinbase.com" OR sourcehostname CONTAINS "16178434-coinbase.com" OR sourcehostname CONTAINS "162178-coinbase.com" OR sourcehostname CONTAINS "162478-coinbase.com" OR sourcehostname CONTAINS "162782-coinbase.com" OR sourcehostname CONTAINS "162812-coinbase.com" OR sourcehostname CONTAINS "162814-coinbase.com" OR sourcehostname CONTAINS "16442580-coinbase.com" OR sourcehostname CONTAINS "16450107-coinbase.com")
index=activity AND rg_functionality="Flow" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "official-server.com" OR destinationntdomain CONTAINS "server694590423.tech" OR destinationntdomain CONTAINS "island-placid-bromine.glitch.me" OR destinationntdomain CONTAINS "circular-noon-farmhouse.glitch.me" OR destinationntdomain CONTAINS "talented-friendly-price.glitch.me" OR destinationntdomain CONTAINS "dflfmgsdokasdcpl.com" OR destinationntdomain CONTAINS "original-backend.com" OR destinationntdomain CONTAINS "07159889-coinbase.com" OR destinationntdomain CONTAINS "10195-coinbase.com" OR destinationntdomain CONTAINS "11246-coinbase.com" OR destinationntdomain CONTAINS "11247-coinbase.com" OR destinationntdomain CONTAINS "11248-coinbase.com" OR destinationntdomain CONTAINS "11258-coinbase.com" OR destinationntdomain CONTAINS "11259-coinbase.com" OR destinationntdomain CONTAINS "113912-coinbase.com" OR destinationntdomain CONTAINS "11472-coinbase.com" OR destinationntdomain CONTAINS "11923-coinbase.com" OR destinationntdomain CONTAINS "11957-coinbase.com" OR destinationntdomain CONTAINS "128147-coinbase.com" OR destinationntdomain CONTAINS "12958-coinbase.com" OR destinationntdomain CONTAINS "12984-okta.com" OR destinationntdomain CONTAINS "12985-coinbase.com" OR destinationntdomain CONTAINS "13130-coinbase.com" OR destinationntdomain CONTAINS "13247-coinbase.com" OR destinationntdomain CONTAINS "13247-icloud.com" OR destinationntdomain CONTAINS "13267-coinbase.com" OR destinationntdomain CONTAINS "146271510-coinbase.com" OR destinationntdomain CONTAINS "146282-coinbase.com" OR destinationntdomain CONTAINS "146284-coinbase.com" OR destinationntdomain CONTAINS "147260-coinbase.com" OR destinationntdomain CONTAINS "14765-coinbase.com" OR destinationntdomain CONTAINS "14817582-coinbase.com" OR destinationntdomain CONTAINS "14871904-coinbase.com" OR destinationntdomain CONTAINS "14891902-coinbase.com" OR destinationntdomain CONTAINS "1492864-coinbase.com" OR destinationntdomain CONTAINS "158312-coinbase.com" OR destinationntdomain CONTAINS "158372-coinbase.com" OR destinationntdomain CONTAINS "158702-coinbase.com" OR destinationntdomain CONTAINS "16171675-coinbase.com" OR destinationntdomain CONTAINS "16171832-coinbase.com" OR destinationntdomain CONTAINS "16178234-coinbase.com" OR destinationntdomain CONTAINS "16178237-coinbase.com" OR destinationntdomain CONTAINS "16178434-coinbase.com" OR destinationntdomain CONTAINS "162178-coinbase.com" OR destinationntdomain CONTAINS "162478-coinbase.com" OR destinationntdomain CONTAINS "162782-coinbase.com" OR destinationntdomain CONTAINS "162812-coinbase.com" OR destinationntdomain CONTAINS "162814-coinbase.com" OR destinationntdomain CONTAINS "16442580-coinbase.com" OR destinationntdomain CONTAINS "16450107-coinbase.com")
index=activity AND rg_functionality="Flow" AND requesturl NOT NULL AND (requesturl CONTAINS "official-server.com" OR requesturl CONTAINS "server694590423.tech" OR requesturl CONTAINS "island-placid-bromine.glitch.me" OR requesturl CONTAINS "circular-noon-farmhouse.glitch.me" OR requesturl CONTAINS "talented-friendly-price.glitch.me" OR requesturl CONTAINS "dflfmgsdokasdcpl.com" OR requesturl CONTAINS "original-backend.com" OR requesturl CONTAINS "07159889-coinbase.com" OR requesturl CONTAINS "10195-coinbase.com" OR requesturl CONTAINS "11246-coinbase.com" OR requesturl CONTAINS "11247-coinbase.com" OR requesturl CONTAINS "11248-coinbase.com" OR requesturl CONTAINS "11258-coinbase.com" OR requesturl CONTAINS "11259-coinbase.com" OR requesturl CONTAINS "113912-coinbase.com" OR requesturl CONTAINS "11472-coinbase.com" OR requesturl CONTAINS "11923-coinbase.com" OR requesturl CONTAINS "11957-coinbase.com" OR requesturl CONTAINS "128147-coinbase.com" OR requesturl CONTAINS "12958-coinbase.com" OR requesturl CONTAINS "12984-okta.com" OR requesturl CONTAINS "12985-coinbase.com" OR requesturl CONTAINS "13130-coinbase.com" OR requesturl CONTAINS "13247-coinbase.com" OR requesturl CONTAINS "13247-icloud.com" OR requesturl CONTAINS "13267-coinbase.com" OR requesturl CONTAINS "146271510-coinbase.com" OR requesturl CONTAINS "146282-coinbase.com" OR requesturl CONTAINS "146284-coinbase.com" OR requesturl CONTAINS "147260-coinbase.com" OR requesturl CONTAINS "14765-coinbase.com" OR requesturl CONTAINS "14817582-coinbase.com" OR requesturl CONTAINS "14871904-coinbase.com" OR requesturl CONTAINS "14891902-coinbase.com" OR requesturl CONTAINS "1492864-coinbase.com" OR requesturl CONTAINS "158312-coinbase.com" OR requesturl CONTAINS "158372-coinbase.com" OR requesturl CONTAINS "158702-coinbase.com" OR requesturl CONTAINS "16171675-coinbase.com" OR requesturl CONTAINS "16171832-coinbase.com" OR requesturl CONTAINS "16178234-coinbase.com" OR requesturl CONTAINS "16178237-coinbase.com" OR requesturl CONTAINS "16178434-coinbase.com" OR requesturl CONTAINS "162178-coinbase.com" OR requesturl CONTAINS "162478-coinbase.com" OR requesturl CONTAINS "162782-coinbase.com" OR requesturl CONTAINS "162812-coinbase.com" OR requesturl CONTAINS "162814-coinbase.com" OR requesturl CONTAINS "16442580-coinbase.com" OR requesturl CONTAINS "16450107-coinbase.com")
index=activity AND rg_functionality="Flow" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "16450207-coinbase.com" OR destinationhostname CONTAINS "16458207-coinbase.com" OR destinationhostname CONTAINS "16478202-coinbase.com" OR destinationhostname CONTAINS "164872942-coinbase.com" OR destinationhostname CONTAINS "16590-coinbase.com" OR destinationhostname CONTAINS "16594373-coinbase.com" OR destinationhostname CONTAINS "16624831-coinbase.com" OR destinationhostname CONTAINS "16642124-coinbase.com" OR destinationhostname CONTAINS "16642172-coinbase.com" OR destinationhostname CONTAINS "16642580-coinbase.com" OR destinationhostname CONTAINS "16642721-coinbase.com" OR destinationhostname CONTAINS "16642724-coinbase.com" OR destinationhostname CONTAINS "16642871-coinbase.com" OR destinationhostname CONTAINS "16642872-coinbase.com" OR destinationhostname CONTAINS "16712942-coinbase.com" OR destinationhostname CONTAINS "16718672-coinbase.com" OR destinationhostname CONTAINS "16728342-coinbase.com" OR destinationhostname CONTAINS "16728348-coinbase.com" OR destinationhostname CONTAINS "16728442-coinbase.com" OR destinationhostname CONTAINS "16728472-coinbase.com" OR destinationhostname CONTAINS "167285-coinbase.com" OR destinationhostname CONTAINS "16729042-coinbase.com" OR destinationhostname CONTAINS "16748272-coinbase.com" OR destinationhostname CONTAINS "16782942-coinbase.com" OR destinationhostname CONTAINS "16827420-coinbase.com" OR destinationhostname CONTAINS "16827423-coinbase.com" OR destinationhostname CONTAINS "16847145-coinbase.com" OR destinationhostname CONTAINS "16893924-coinbase.com" OR destinationhostname CONTAINS "17182-coinbase.com" OR destinationhostname CONTAINS "17255030-coinbase.com" OR destinationhostname CONTAINS "17259-kraken.com" OR destinationhostname CONTAINS "172486-coinbase.com" OR destinationhostname CONTAINS "17284652-coinbase.com" OR destinationhostname CONTAINS "17286-coinbase.com" OR destinationhostname CONTAINS "17334522-coinbase.com" OR destinationhostname CONTAINS "17334522-kraken.com" OR destinationhostname CONTAINS "17384522-coinbase.com" OR destinationhostname CONTAINS "173912-coinbase.com" OR destinationhostname CONTAINS "17494976-coinbase.com" OR destinationhostname CONTAINS "17512854-coinbase.com" OR destinationhostname CONTAINS "17512857-coinbase.com" OR destinationhostname CONTAINS "1751954-coinbase.com" OR destinationhostname CONTAINS "17525030-coinbase.com" OR destinationhostname CONTAINS "17529580-coinbase.com" OR destinationhostname CONTAINS "17614-coinbase.com" OR destinationhostname CONTAINS "17618412-coinbase.com" OR destinationhostname CONTAINS "17619-coinbase.com" OR destinationhostname CONTAINS "176284-coinbase.com" OR destinationhostname CONTAINS "17823920-coinbase.com" OR destinationhostname CONTAINS "178253-coinbase.com")
index=activity AND rg_functionality="Flow" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "16450207-coinbase.com" OR sourcentdomain CONTAINS "16458207-coinbase.com" OR sourcentdomain CONTAINS "16478202-coinbase.com" OR sourcentdomain CONTAINS "164872942-coinbase.com" OR sourcentdomain CONTAINS "16590-coinbase.com" OR sourcentdomain CONTAINS "16594373-coinbase.com" OR sourcentdomain CONTAINS "16624831-coinbase.com" OR sourcentdomain CONTAINS "16642124-coinbase.com" OR sourcentdomain CONTAINS "16642172-coinbase.com" OR sourcentdomain CONTAINS "16642580-coinbase.com" OR sourcentdomain CONTAINS "16642721-coinbase.com" OR sourcentdomain CONTAINS "16642724-coinbase.com" OR sourcentdomain CONTAINS "16642871-coinbase.com" OR sourcentdomain CONTAINS "16642872-coinbase.com" OR sourcentdomain CONTAINS "16712942-coinbase.com" OR sourcentdomain CONTAINS "16718672-coinbase.com" OR sourcentdomain CONTAINS "16728342-coinbase.com" OR sourcentdomain CONTAINS "16728348-coinbase.com" OR sourcentdomain CONTAINS "16728442-coinbase.com" OR sourcentdomain CONTAINS "16728472-coinbase.com" OR sourcentdomain CONTAINS "167285-coinbase.com" OR sourcentdomain CONTAINS "16729042-coinbase.com" OR sourcentdomain CONTAINS "16748272-coinbase.com" OR sourcentdomain CONTAINS "16782942-coinbase.com" OR sourcentdomain CONTAINS "16827420-coinbase.com" OR sourcentdomain CONTAINS "16827423-coinbase.com" OR sourcentdomain CONTAINS "16847145-coinbase.com" OR sourcentdomain CONTAINS "16893924-coinbase.com" OR sourcentdomain CONTAINS "17182-coinbase.com" OR sourcentdomain CONTAINS "17255030-coinbase.com" OR sourcentdomain CONTAINS "17259-kraken.com" OR sourcentdomain CONTAINS "172486-coinbase.com" OR sourcentdomain CONTAINS "17284652-coinbase.com" OR sourcentdomain CONTAINS "17286-coinbase.com" OR sourcentdomain CONTAINS "17334522-coinbase.com" OR sourcentdomain CONTAINS "17334522-kraken.com" OR sourcentdomain CONTAINS "17384522-coinbase.com" OR sourcentdomain CONTAINS "173912-coinbase.com" OR sourcentdomain CONTAINS "17494976-coinbase.com" OR sourcentdomain CONTAINS "17512854-coinbase.com" OR sourcentdomain CONTAINS "17512857-coinbase.com" OR sourcentdomain CONTAINS "1751954-coinbase.com" OR sourcentdomain CONTAINS "17525030-coinbase.com" OR sourcentdomain CONTAINS "17529580-coinbase.com" OR sourcentdomain CONTAINS "17614-coinbase.com" OR sourcentdomain CONTAINS "17618412-coinbase.com" OR sourcentdomain CONTAINS "17619-coinbase.com" OR sourcentdomain CONTAINS "176284-coinbase.com" OR sourcentdomain CONTAINS "17823920-coinbase.com" OR sourcentdomain CONTAINS "178253-coinbase.com")
index=activity AND rg_functionality="Flow" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "16450207-coinbase.com" OR sourcehostname CONTAINS "16458207-coinbase.com" OR sourcehostname CONTAINS "16478202-coinbase.com" OR sourcehostname CONTAINS "164872942-coinbase.com" OR sourcehostname CONTAINS "16590-coinbase.com" OR sourcehostname CONTAINS "16594373-coinbase.com" OR sourcehostname CONTAINS "16624831-coinbase.com" OR sourcehostname CONTAINS "16642124-coinbase.com" OR sourcehostname CONTAINS "16642172-coinbase.com" OR sourcehostname CONTAINS "16642580-coinbase.com" OR sourcehostname CONTAINS "16642721-coinbase.com" OR sourcehostname CONTAINS "16642724-coinbase.com" OR sourcehostname CONTAINS "16642871-coinbase.com" OR sourcehostname CONTAINS "16642872-coinbase.com" OR sourcehostname CONTAINS "16712942-coinbase.com" OR sourcehostname CONTAINS "16718672-coinbase.com" OR sourcehostname CONTAINS "16728342-coinbase.com" OR sourcehostname CONTAINS "16728348-coinbase.com" OR sourcehostname CONTAINS "16728442-coinbase.com" OR sourcehostname CONTAINS "16728472-coinbase.com" OR sourcehostname CONTAINS "167285-coinbase.com" OR sourcehostname CONTAINS "16729042-coinbase.com" OR sourcehostname CONTAINS "16748272-coinbase.com" OR sourcehostname CONTAINS "16782942-coinbase.com" OR sourcehostname CONTAINS "16827420-coinbase.com" OR sourcehostname CONTAINS "16827423-coinbase.com" OR sourcehostname CONTAINS "16847145-coinbase.com" OR sourcehostname CONTAINS "16893924-coinbase.com" OR sourcehostname CONTAINS "17182-coinbase.com" OR sourcehostname CONTAINS "17255030-coinbase.com" OR sourcehostname CONTAINS "17259-kraken.com" OR sourcehostname CONTAINS "172486-coinbase.com" OR sourcehostname CONTAINS "17284652-coinbase.com" OR sourcehostname CONTAINS "17286-coinbase.com" OR sourcehostname CONTAINS "17334522-coinbase.com" OR sourcehostname CONTAINS "17334522-kraken.com" OR sourcehostname CONTAINS "17384522-coinbase.com" OR sourcehostname CONTAINS "173912-coinbase.com" OR sourcehostname CONTAINS "17494976-coinbase.com" OR sourcehostname CONTAINS "17512854-coinbase.com" OR sourcehostname CONTAINS "17512857-coinbase.com" OR sourcehostname CONTAINS "1751954-coinbase.com" OR sourcehostname CONTAINS "17525030-coinbase.com" OR sourcehostname CONTAINS "17529580-coinbase.com" OR sourcehostname CONTAINS "17614-coinbase.com" OR sourcehostname CONTAINS "17618412-coinbase.com" OR sourcehostname CONTAINS "17619-coinbase.com" OR sourcehostname CONTAINS "176284-coinbase.com" OR sourcehostname CONTAINS "17823920-coinbase.com" OR sourcehostname CONTAINS "178253-coinbase.com")
index=activity AND rg_functionality="Flow" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "16450207-coinbase.com" OR destinationntdomain CONTAINS "16458207-coinbase.com" OR destinationntdomain CONTAINS "16478202-coinbase.com" OR destinationntdomain CONTAINS "164872942-coinbase.com" OR destinationntdomain CONTAINS "16590-coinbase.com" OR destinationntdomain CONTAINS "16594373-coinbase.com" OR destinationntdomain CONTAINS "16624831-coinbase.com" OR destinationntdomain CONTAINS "16642124-coinbase.com" OR destinationntdomain CONTAINS "16642172-coinbase.com" OR destinationntdomain CONTAINS "16642580-coinbase.com" OR destinationntdomain CONTAINS "16642721-coinbase.com" OR destinationntdomain CONTAINS "16642724-coinbase.com" OR destinationntdomain CONTAINS "16642871-coinbase.com" OR destinationntdomain CONTAINS "16642872-coinbase.com" OR destinationntdomain CONTAINS "16712942-coinbase.com" OR destinationntdomain CONTAINS "16718672-coinbase.com" OR destinationntdomain CONTAINS "16728342-coinbase.com" OR destinationntdomain CONTAINS "16728348-coinbase.com" OR destinationntdomain CONTAINS "16728442-coinbase.com" OR destinationntdomain CONTAINS "16728472-coinbase.com" OR destinationntdomain CONTAINS "167285-coinbase.com" OR destinationntdomain CONTAINS "16729042-coinbase.com" OR destinationntdomain CONTAINS "16748272-coinbase.com" OR destinationntdomain CONTAINS "16782942-coinbase.com" OR destinationntdomain CONTAINS "16827420-coinbase.com" OR destinationntdomain CONTAINS "16827423-coinbase.com" OR destinationntdomain CONTAINS "16847145-coinbase.com" OR destinationntdomain CONTAINS "16893924-coinbase.com" OR destinationntdomain CONTAINS "17182-coinbase.com" OR destinationntdomain CONTAINS "17255030-coinbase.com" OR destinationntdomain CONTAINS "17259-kraken.com" OR destinationntdomain CONTAINS "172486-coinbase.com" OR destinationntdomain CONTAINS "17284652-coinbase.com" OR destinationntdomain CONTAINS "17286-coinbase.com" OR destinationntdomain CONTAINS "17334522-coinbase.com" OR destinationntdomain CONTAINS "17334522-kraken.com" OR destinationntdomain CONTAINS "17384522-coinbase.com" OR destinationntdomain CONTAINS "173912-coinbase.com" OR destinationntdomain CONTAINS "17494976-coinbase.com" OR destinationntdomain CONTAINS "17512854-coinbase.com" OR destinationntdomain CONTAINS "17512857-coinbase.com" OR destinationntdomain CONTAINS "1751954-coinbase.com" OR destinationntdomain CONTAINS "17525030-coinbase.com" OR destinationntdomain CONTAINS "17529580-coinbase.com" OR destinationntdomain CONTAINS "17614-coinbase.com" OR destinationntdomain CONTAINS "17618412-coinbase.com" OR destinationntdomain CONTAINS "17619-coinbase.com" OR destinationntdomain CONTAINS "176284-coinbase.com" OR destinationntdomain CONTAINS "17823920-coinbase.com" OR destinationntdomain CONTAINS "178253-coinbase.com")
index=activity AND rg_functionality="Flow" AND requesturl NOT NULL AND (requesturl CONTAINS "16450207-coinbase.com" OR requesturl CONTAINS "16458207-coinbase.com" OR requesturl CONTAINS "16478202-coinbase.com" OR requesturl CONTAINS "164872942-coinbase.com" OR requesturl CONTAINS "16590-coinbase.com" OR requesturl CONTAINS "16594373-coinbase.com" OR requesturl CONTAINS "16624831-coinbase.com" OR requesturl CONTAINS "16642124-coinbase.com" OR requesturl CONTAINS "16642172-coinbase.com" OR requesturl CONTAINS "16642580-coinbase.com" OR requesturl CONTAINS "16642721-coinbase.com" OR requesturl CONTAINS "16642724-coinbase.com" OR requesturl CONTAINS "16642871-coinbase.com" OR requesturl CONTAINS "16642872-coinbase.com" OR requesturl CONTAINS "16712942-coinbase.com" OR requesturl CONTAINS "16718672-coinbase.com" OR requesturl CONTAINS "16728342-coinbase.com" OR requesturl CONTAINS "16728348-coinbase.com" OR requesturl CONTAINS "16728442-coinbase.com" OR requesturl CONTAINS "16728472-coinbase.com" OR requesturl CONTAINS "167285-coinbase.com" OR requesturl CONTAINS "16729042-coinbase.com" OR requesturl CONTAINS "16748272-coinbase.com" OR requesturl CONTAINS "16782942-coinbase.com" OR requesturl CONTAINS "16827420-coinbase.com" OR requesturl CONTAINS "16827423-coinbase.com" OR requesturl CONTAINS "16847145-coinbase.com" OR requesturl CONTAINS "16893924-coinbase.com" OR requesturl CONTAINS "17182-coinbase.com" OR requesturl CONTAINS "17255030-coinbase.com" OR requesturl CONTAINS "17259-kraken.com" OR requesturl CONTAINS "172486-coinbase.com" OR requesturl CONTAINS "17284652-coinbase.com" OR requesturl CONTAINS "17286-coinbase.com" OR requesturl CONTAINS "17334522-coinbase.com" OR requesturl CONTAINS "17334522-kraken.com" OR requesturl CONTAINS "17384522-coinbase.com" OR requesturl CONTAINS "173912-coinbase.com" OR requesturl CONTAINS "17494976-coinbase.com" OR requesturl CONTAINS "17512854-coinbase.com" OR requesturl CONTAINS "17512857-coinbase.com" OR requesturl CONTAINS "1751954-coinbase.com" OR requesturl CONTAINS "17525030-coinbase.com" OR requesturl CONTAINS "17529580-coinbase.com" OR requesturl CONTAINS "17614-coinbase.com" OR requesturl CONTAINS "17618412-coinbase.com" OR requesturl CONTAINS "17619-coinbase.com" OR requesturl CONTAINS "176284-coinbase.com" OR requesturl CONTAINS "17823920-coinbase.com" OR requesturl CONTAINS "178253-coinbase.com")
index=activity AND rg_functionality="Flow" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "178294-coinbase.com" OR destinationhostname CONTAINS "17912-coinbase.com" OR destinationhostname CONTAINS "17914-coinbase.com" OR destinationhostname CONTAINS "17917-coinbase.com" OR destinationhostname CONTAINS "17954-coinbase.com" OR destinationhostname CONTAINS "17958-coinbase.com" OR destinationhostname CONTAINS "182043-coinbase.com" OR destinationhostname CONTAINS "18275-gemini.com" OR destinationhostname CONTAINS "18276-coinbase.com" OR destinationhostname CONTAINS "18290185-coinbase.com" OR destinationhostname CONTAINS "182967-coinbase.com" OR destinationhostname CONTAINS "18560-coinbase.com" OR destinationhostname CONTAINS "18571-coinbase.com" OR destinationhostname CONTAINS "185912-coinbase.com" OR destinationhostname CONTAINS "185914-coinbase.com" OR destinationhostname CONTAINS "18592176-coinbase.com" OR destinationhostname CONTAINS "18594162-coinbase.com" OR destinationhostname CONTAINS "18594962-coinbase.com" OR destinationhostname CONTAINS "18597162-coinbase.com" OR destinationhostname CONTAINS "18719562-coinbase.com" OR destinationhostname CONTAINS "1875290-coinbase.com" OR destinationhostname CONTAINS "1882730-coinbase.com" OR destinationhostname CONTAINS "18902-coinbase.com" OR destinationhostname CONTAINS "18903-coinbase.com" OR destinationhostname CONTAINS "189126-coinbase.com" OR destinationhostname CONTAINS "18952-coinbase.com" OR destinationhostname CONTAINS "192854-coinbase.com" OR destinationhostname CONTAINS "192856-coinbase.com" OR destinationhostname CONTAINS "19287-binance.com" OR destinationhostname CONTAINS "19572-coinbase.com" OR destinationhostname CONTAINS "195812-coinbase.com" OR destinationhostname CONTAINS "195826-coinbase.com" OR destinationhostname CONTAINS "1958262-coinbase.com" OR destinationhostname CONTAINS "195827-binance.com" OR destinationhostname CONTAINS "1958297-coinbase.com" OR destinationhostname CONTAINS "19582970-coinbase.com" OR destinationhostname CONTAINS "19582971-coinbase.com" OR destinationhostname CONTAINS "19583-coinbase.com" OR destinationhostname CONTAINS "19592653-coinbase.com" OR destinationhostname CONTAINS "197304-coinbase.com" OR destinationhostname CONTAINS "19730492-coinbase.com" OR destinationhostname CONTAINS "19764162-coinbase.com" OR destinationhostname CONTAINS "19803-coinbase.com" OR destinationhostname CONTAINS "201784289-coinbase.com" OR destinationhostname CONTAINS "210823644-coinbase.com" OR destinationhostname CONTAINS "21158-coinbase.com" OR destinationhostname CONTAINS "21509-coinbase.com" OR destinationhostname CONTAINS "25985-coinbase.com" OR destinationhostname CONTAINS "27699-coinbase.com" OR destinationhostname CONTAINS "28367-coinbase.com")
index=activity AND rg_functionality="Flow" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "178294-coinbase.com" OR sourcentdomain CONTAINS "17912-coinbase.com" OR sourcentdomain CONTAINS "17914-coinbase.com" OR sourcentdomain CONTAINS "17917-coinbase.com" OR sourcentdomain CONTAINS "17954-coinbase.com" OR sourcentdomain CONTAINS "17958-coinbase.com" OR sourcentdomain CONTAINS "182043-coinbase.com" OR sourcentdomain CONTAINS "18275-gemini.com" OR sourcentdomain CONTAINS "18276-coinbase.com" OR sourcentdomain CONTAINS "18290185-coinbase.com" OR sourcentdomain CONTAINS "182967-coinbase.com" OR sourcentdomain CONTAINS "18560-coinbase.com" OR sourcentdomain CONTAINS "18571-coinbase.com" OR sourcentdomain CONTAINS "185912-coinbase.com" OR sourcentdomain CONTAINS "185914-coinbase.com" OR sourcentdomain CONTAINS "18592176-coinbase.com" OR sourcentdomain CONTAINS "18594162-coinbase.com" OR sourcentdomain CONTAINS "18594962-coinbase.com" OR sourcentdomain CONTAINS "18597162-coinbase.com" OR sourcentdomain CONTAINS "18719562-coinbase.com" OR sourcentdomain CONTAINS "1875290-coinbase.com" OR sourcentdomain CONTAINS "1882730-coinbase.com" OR sourcentdomain CONTAINS "18902-coinbase.com" OR sourcentdomain CONTAINS "18903-coinbase.com" OR sourcentdomain CONTAINS "189126-coinbase.com" OR sourcentdomain CONTAINS "18952-coinbase.com" OR sourcentdomain CONTAINS "192854-coinbase.com" OR sourcentdomain CONTAINS "192856-coinbase.com" OR sourcentdomain CONTAINS "19287-binance.com" OR sourcentdomain CONTAINS "19572-coinbase.com" OR sourcentdomain CONTAINS "195812-coinbase.com" OR sourcentdomain CONTAINS "195826-coinbase.com" OR sourcentdomain CONTAINS "1958262-coinbase.com" OR sourcentdomain CONTAINS "195827-binance.com" OR sourcentdomain CONTAINS "1958297-coinbase.com" OR sourcentdomain CONTAINS "19582970-coinbase.com" OR sourcentdomain CONTAINS "19582971-coinbase.com" OR sourcentdomain CONTAINS "19583-coinbase.com" OR sourcentdomain CONTAINS "19592653-coinbase.com" OR sourcentdomain CONTAINS "197304-coinbase.com" OR sourcentdomain CONTAINS "19730492-coinbase.com" OR sourcentdomain CONTAINS "19764162-coinbase.com" OR sourcentdomain CONTAINS "19803-coinbase.com" OR sourcentdomain CONTAINS "201784289-coinbase.com" OR sourcentdomain CONTAINS "210823644-coinbase.com" OR sourcentdomain CONTAINS "21158-coinbase.com" OR sourcentdomain CONTAINS "21509-coinbase.com" OR sourcentdomain CONTAINS "25985-coinbase.com" OR sourcentdomain CONTAINS "27699-coinbase.com" OR sourcentdomain CONTAINS "28367-coinbase.com")
index=activity AND rg_functionality="Flow" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "178294-coinbase.com" OR sourcehostname CONTAINS "17912-coinbase.com" OR sourcehostname CONTAINS "17914-coinbase.com" OR sourcehostname CONTAINS "17917-coinbase.com" OR sourcehostname CONTAINS "17954-coinbase.com" OR sourcehostname CONTAINS "17958-coinbase.com" OR sourcehostname CONTAINS "182043-coinbase.com" OR sourcehostname CONTAINS "18275-gemini.com" OR sourcehostname CONTAINS "18276-coinbase.com" OR sourcehostname CONTAINS "18290185-coinbase.com" OR sourcehostname CONTAINS "182967-coinbase.com" OR sourcehostname CONTAINS "18560-coinbase.com" OR sourcehostname CONTAINS "18571-coinbase.com" OR sourcehostname CONTAINS "185912-coinbase.com" OR sourcehostname CONTAINS "185914-coinbase.com" OR sourcehostname CONTAINS "18592176-coinbase.com" OR sourcehostname CONTAINS "18594162-coinbase.com" OR sourcehostname CONTAINS "18594962-coinbase.com" OR sourcehostname CONTAINS "18597162-coinbase.com" OR sourcehostname CONTAINS "18719562-coinbase.com" OR sourcehostname CONTAINS "1875290-coinbase.com" OR sourcehostname CONTAINS "1882730-coinbase.com" OR sourcehostname CONTAINS "18902-coinbase.com" OR sourcehostname CONTAINS "18903-coinbase.com" OR sourcehostname CONTAINS "189126-coinbase.com" OR sourcehostname CONTAINS "18952-coinbase.com" OR sourcehostname CONTAINS "192854-coinbase.com" OR sourcehostname CONTAINS "192856-coinbase.com" OR sourcehostname CONTAINS "19287-binance.com" OR sourcehostname CONTAINS "19572-coinbase.com" OR sourcehostname CONTAINS "195812-coinbase.com" OR sourcehostname CONTAINS "195826-coinbase.com" OR sourcehostname CONTAINS "1958262-coinbase.com" OR sourcehostname CONTAINS "195827-binance.com" OR sourcehostname CONTAINS "1958297-coinbase.com" OR sourcehostname CONTAINS "19582970-coinbase.com" OR sourcehostname CONTAINS "19582971-coinbase.com" OR sourcehostname CONTAINS "19583-coinbase.com" OR sourcehostname CONTAINS "19592653-coinbase.com" OR sourcehostname CONTAINS "197304-coinbase.com" OR sourcehostname CONTAINS "19730492-coinbase.com" OR sourcehostname CONTAINS "19764162-coinbase.com" OR sourcehostname CONTAINS "19803-coinbase.com" OR sourcehostname CONTAINS "201784289-coinbase.com" OR sourcehostname CONTAINS "210823644-coinbase.com" OR sourcehostname CONTAINS "21158-coinbase.com" OR sourcehostname CONTAINS "21509-coinbase.com" OR sourcehostname CONTAINS "25985-coinbase.com" OR sourcehostname CONTAINS "27699-coinbase.com" OR sourcehostname CONTAINS "28367-coinbase.com")
index=activity AND rg_functionality="Flow" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "178294-coinbase.com" OR destinationntdomain CONTAINS "17912-coinbase.com" OR destinationntdomain CONTAINS "17914-coinbase.com" OR destinationntdomain CONTAINS "17917-coinbase.com" OR destinationntdomain CONTAINS "17954-coinbase.com" OR destinationntdomain CONTAINS "17958-coinbase.com" OR destinationntdomain CONTAINS "182043-coinbase.com" OR destinationntdomain CONTAINS "18275-gemini.com" OR destinationntdomain CONTAINS "18276-coinbase.com" OR destinationntdomain CONTAINS "18290185-coinbase.com" OR destinationntdomain CONTAINS "182967-coinbase.com" OR destinationntdomain CONTAINS "18560-coinbase.com" OR destinationntdomain CONTAINS "18571-coinbase.com" OR destinationntdomain CONTAINS "185912-coinbase.com" OR destinationntdomain CONTAINS "185914-coinbase.com" OR destinationntdomain CONTAINS "18592176-coinbase.com" OR destinationntdomain CONTAINS "18594162-coinbase.com" OR destinationntdomain CONTAINS "18594962-coinbase.com" OR destinationntdomain CONTAINS "18597162-coinbase.com" OR destinationntdomain CONTAINS "18719562-coinbase.com" OR destinationntdomain CONTAINS "1875290-coinbase.com" OR destinationntdomain CONTAINS "1882730-coinbase.com" OR destinationntdomain CONTAINS "18902-coinbase.com" OR destinationntdomain CONTAINS "18903-coinbase.com" OR destinationntdomain CONTAINS "189126-coinbase.com" OR destinationntdomain CONTAINS "18952-coinbase.com" OR destinationntdomain CONTAINS "192854-coinbase.com" OR destinationntdomain CONTAINS "192856-coinbase.com" OR destinationntdomain CONTAINS "19287-binance.com" OR destinationntdomain CONTAINS "19572-coinbase.com" OR destinationntdomain CONTAINS "195812-coinbase.com" OR destinationntdomain CONTAINS "195826-coinbase.com" OR destinationntdomain CONTAINS "1958262-coinbase.com" OR destinationntdomain CONTAINS "195827-binance.com" OR destinationntdomain CONTAINS "1958297-coinbase.com" OR destinationntdomain CONTAINS "19582970-coinbase.com" OR destinationntdomain CONTAINS "19582971-coinbase.com" OR destinationntdomain CONTAINS "19583-coinbase.com" OR destinationntdomain CONTAINS "19592653-coinbase.com" OR destinationntdomain CONTAINS "197304-coinbase.com" OR destinationntdomain CONTAINS "19730492-coinbase.com" OR destinationntdomain CONTAINS "19764162-coinbase.com" OR destinationntdomain CONTAINS "19803-coinbase.com" OR destinationntdomain CONTAINS "201784289-coinbase.com" OR destinationntdomain CONTAINS "210823644-coinbase.com" OR destinationntdomain CONTAINS "21158-coinbase.com" OR destinationntdomain CONTAINS "21509-coinbase.com" OR destinationntdomain CONTAINS "25985-coinbase.com" OR destinationntdomain CONTAINS "27699-coinbase.com" OR destinationntdomain CONTAINS "28367-coinbase.com")
index=activity AND rg_functionality="Flow" AND requesturl NOT NULL AND (requesturl CONTAINS "178294-coinbase.com" OR requesturl CONTAINS "17912-coinbase.com" OR requesturl CONTAINS "17914-coinbase.com" OR requesturl CONTAINS "17917-coinbase.com" OR requesturl CONTAINS "17954-coinbase.com" OR requesturl CONTAINS "17958-coinbase.com" OR requesturl CONTAINS "182043-coinbase.com" OR requesturl CONTAINS "18275-gemini.com" OR requesturl CONTAINS "18276-coinbase.com" OR requesturl CONTAINS "18290185-coinbase.com" OR requesturl CONTAINS "182967-coinbase.com" OR requesturl CONTAINS "18560-coinbase.com" OR requesturl CONTAINS "18571-coinbase.com" OR requesturl CONTAINS "185912-coinbase.com" OR requesturl CONTAINS "185914-coinbase.com" OR requesturl CONTAINS "18592176-coinbase.com" OR requesturl CONTAINS "18594162-coinbase.com" OR requesturl CONTAINS "18594962-coinbase.com" OR requesturl CONTAINS "18597162-coinbase.com" OR requesturl CONTAINS "18719562-coinbase.com" OR requesturl CONTAINS "1875290-coinbase.com" OR requesturl CONTAINS "1882730-coinbase.com" OR requesturl CONTAINS "18902-coinbase.com" OR requesturl CONTAINS "18903-coinbase.com" OR requesturl CONTAINS "189126-coinbase.com" OR requesturl CONTAINS "18952-coinbase.com" OR requesturl CONTAINS "192854-coinbase.com" OR requesturl CONTAINS "192856-coinbase.com" OR requesturl CONTAINS "19287-binance.com" OR requesturl CONTAINS "19572-coinbase.com" OR requesturl CONTAINS "195812-coinbase.com" OR requesturl CONTAINS "195826-coinbase.com" OR requesturl CONTAINS "1958262-coinbase.com" OR requesturl CONTAINS "195827-binance.com" OR requesturl CONTAINS "1958297-coinbase.com" OR requesturl CONTAINS "19582970-coinbase.com" OR requesturl CONTAINS "19582971-coinbase.com" OR requesturl CONTAINS "19583-coinbase.com" OR requesturl CONTAINS "19592653-coinbase.com" OR requesturl CONTAINS "197304-coinbase.com" OR requesturl CONTAINS "19730492-coinbase.com" OR requesturl CONTAINS "19764162-coinbase.com" OR requesturl CONTAINS "19803-coinbase.com" OR requesturl CONTAINS "201784289-coinbase.com" OR requesturl CONTAINS "210823644-coinbase.com" OR requesturl CONTAINS "21158-coinbase.com" OR requesturl CONTAINS "21509-coinbase.com" OR requesturl CONTAINS "25985-coinbase.com" OR requesturl CONTAINS "27699-coinbase.com" OR requesturl CONTAINS "28367-coinbase.com")
index=activity AND rg_functionality="Flow" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "28676-coinbase.com" OR destinationhostname CONTAINS "29185-coinbase.com" OR destinationhostname CONTAINS "29195-coinbase.com" OR destinationhostname CONTAINS "2a-coinbase.com" OR destinationhostname CONTAINS "2b-coinbase.com" OR destinationhostname CONTAINS "2c-coinbase.com" OR destinationhostname CONTAINS "2f-coinbase.com" OR destinationhostname CONTAINS "2fas-coinbase.com" OR destinationhostname CONTAINS "2o-coinbase.com" OR destinationhostname CONTAINS "2r-coinbase.com" OR destinationhostname CONTAINS "2s-coinbase.com" OR destinationhostname CONTAINS "2sv-coinbase.com" OR destinationhostname CONTAINS "352134951-coinbase.com" OR destinationhostname CONTAINS "38468-coinbase.com" OR destinationhostname CONTAINS "39590-coinbase.com" OR destinationhostname CONTAINS "41260-coinbase.com" OR destinationhostname CONTAINS "427883-coinbase.com" OR destinationhostname CONTAINS "43017-coinbase.com" OR destinationhostname CONTAINS "47562-coinbase.com" OR destinationhostname CONTAINS "50195-coinbase.com" OR destinationhostname CONTAINS "5247-coinbase.com" OR destinationhostname CONTAINS "54765-coinbase.com" OR destinationhostname CONTAINS "57197-coinbase.com" OR destinationhostname CONTAINS "58176-coinbase.com" OR destinationhostname CONTAINS "58297-coinbase.com" OR destinationhostname CONTAINS "61250-coinbase.com" OR destinationhostname CONTAINS "61835-coinbase.com" OR destinationhostname CONTAINS "61851-coinbase.com" OR destinationhostname CONTAINS "61937-coinbase.com" OR destinationhostname CONTAINS "71925-coinbase.com" OR destinationhostname CONTAINS "72957-coinbase.com" OR destinationhostname CONTAINS "72985-coinbase.com" OR destinationhostname CONTAINS "74651-coinbase.com" OR destinationhostname CONTAINS "754668948-coinbase.com" OR destinationhostname CONTAINS "76159869-coinbase.com" OR destinationhostname CONTAINS "76153-coinbase.com" OR destinationhostname CONTAINS "81758-coinbase.com" OR destinationhostname CONTAINS "81920-coinbase.com" OR destinationhostname CONTAINS "81926-coinbase.com" OR destinationhostname CONTAINS "81958-coinbase.com" OR destinationhostname CONTAINS "826298-coinbase.com" OR destinationhostname CONTAINS "83216-coinbase.com" OR destinationhostname CONTAINS "837613-coinbase.com" OR destinationhostname CONTAINS "83956-coinbase.com" OR destinationhostname CONTAINS "87157-coinbase.com" OR destinationhostname CONTAINS "87312-coinbase.com" OR destinationhostname CONTAINS "89304-coinbase.com" OR destinationhostname CONTAINS "89375-coinbase.com" OR destinationhostname CONTAINS "91723-gemini.com" OR destinationhostname CONTAINS "91752-coinbase.com")
index=activity AND rg_functionality="Flow" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "28676-coinbase.com" OR sourcentdomain CONTAINS "29185-coinbase.com" OR sourcentdomain CONTAINS "29195-coinbase.com" OR sourcentdomain CONTAINS "2a-coinbase.com" OR sourcentdomain CONTAINS "2b-coinbase.com" OR sourcentdomain CONTAINS "2c-coinbase.com" OR sourcentdomain CONTAINS "2f-coinbase.com" OR sourcentdomain CONTAINS "2fas-coinbase.com" OR sourcentdomain CONTAINS "2o-coinbase.com" OR sourcentdomain CONTAINS "2r-coinbase.com" OR sourcentdomain CONTAINS "2s-coinbase.com" OR sourcentdomain CONTAINS "2sv-coinbase.com" OR sourcentdomain CONTAINS "352134951-coinbase.com" OR sourcentdomain CONTAINS "38468-coinbase.com" OR sourcentdomain CONTAINS "39590-coinbase.com" OR sourcentdomain CONTAINS "41260-coinbase.com" OR sourcentdomain CONTAINS "427883-coinbase.com" OR sourcentdomain CONTAINS "43017-coinbase.com" OR sourcentdomain CONTAINS "47562-coinbase.com" OR sourcentdomain CONTAINS "50195-coinbase.com" OR sourcentdomain CONTAINS "5247-coinbase.com" OR sourcentdomain CONTAINS "54765-coinbase.com" OR sourcentdomain CONTAINS "57197-coinbase.com" OR sourcentdomain CONTAINS "58176-coinbase.com" OR sourcentdomain CONTAINS "58297-coinbase.com" OR sourcentdomain CONTAINS "61250-coinbase.com" OR sourcentdomain CONTAINS "61835-coinbase.com" OR sourcentdomain CONTAINS "61851-coinbase.com" OR sourcentdomain CONTAINS "61937-coinbase.com" OR sourcentdomain CONTAINS "71925-coinbase.com" OR sourcentdomain CONTAINS "72957-coinbase.com" OR sourcentdomain CONTAINS "72985-coinbase.com" OR sourcentdomain CONTAINS "74651-coinbase.com" OR sourcentdomain CONTAINS "754668948-coinbase.com" OR sourcentdomain CONTAINS "76159869-coinbase.com" OR sourcentdomain CONTAINS "76153-coinbase.com" OR sourcentdomain CONTAINS "81758-coinbase.com" OR sourcentdomain CONTAINS "81920-coinbase.com" OR sourcentdomain CONTAINS "81926-coinbase.com" OR sourcentdomain CONTAINS "81958-coinbase.com" OR sourcentdomain CONTAINS "826298-coinbase.com" OR sourcentdomain CONTAINS "83216-coinbase.com" OR sourcentdomain CONTAINS "837613-coinbase.com" OR sourcentdomain CONTAINS "83956-coinbase.com" OR sourcentdomain CONTAINS "87157-coinbase.com" OR sourcentdomain CONTAINS "87312-coinbase.com" OR sourcentdomain CONTAINS "89304-coinbase.com" OR sourcentdomain CONTAINS "89375-coinbase.com" OR sourcentdomain CONTAINS "91723-gemini.com" OR sourcentdomain CONTAINS "91752-coinbase.com")
index=activity AND rg_functionality="Flow" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "28676-coinbase.com" OR sourcehostname CONTAINS "29185-coinbase.com" OR sourcehostname CONTAINS "29195-coinbase.com" OR sourcehostname CONTAINS "2a-coinbase.com" OR sourcehostname CONTAINS "2b-coinbase.com" OR sourcehostname CONTAINS "2c-coinbase.com" OR sourcehostname CONTAINS "2f-coinbase.com" OR sourcehostname CONTAINS "2fas-coinbase.com" OR sourcehostname CONTAINS "2o-coinbase.com" OR sourcehostname CONTAINS "2r-coinbase.com" OR sourcehostname CONTAINS "2s-coinbase.com" OR sourcehostname CONTAINS "2sv-coinbase.com" OR sourcehostname CONTAINS "352134951-coinbase.com" OR sourcehostname CONTAINS "38468-coinbase.com" OR sourcehostname CONTAINS "39590-coinbase.com" OR sourcehostname CONTAINS "41260-coinbase.com" OR sourcehostname CONTAINS "427883-coinbase.com" OR sourcehostname CONTAINS "43017-coinbase.com" OR sourcehostname CONTAINS "47562-coinbase.com" OR sourcehostname CONTAINS "50195-coinbase.com" OR sourcehostname CONTAINS "5247-coinbase.com" OR sourcehostname CONTAINS "54765-coinbase.com" OR sourcehostname CONTAINS "57197-coinbase.com" OR sourcehostname CONTAINS "58176-coinbase.com" OR sourcehostname CONTAINS "58297-coinbase.com" OR sourcehostname CONTAINS "61250-coinbase.com" OR sourcehostname CONTAINS "61835-coinbase.com" OR sourcehostname CONTAINS "61851-coinbase.com" OR sourcehostname CONTAINS "61937-coinbase.com" OR sourcehostname CONTAINS "71925-coinbase.com" OR sourcehostname CONTAINS "72957-coinbase.com" OR sourcehostname CONTAINS "72985-coinbase.com" OR sourcehostname CONTAINS "74651-coinbase.com" OR sourcehostname CONTAINS "754668948-coinbase.com" OR sourcehostname CONTAINS "76159869-coinbase.com" OR sourcehostname CONTAINS "76153-coinbase.com" OR sourcehostname CONTAINS "81758-coinbase.com" OR sourcehostname CONTAINS "81920-coinbase.com" OR sourcehostname CONTAINS "81926-coinbase.com" OR sourcehostname CONTAINS "81958-coinbase.com" OR sourcehostname CONTAINS "826298-coinbase.com" OR sourcehostname CONTAINS "83216-coinbase.com" OR sourcehostname CONTAINS "837613-coinbase.com" OR sourcehostname CONTAINS "83956-coinbase.com" OR sourcehostname CONTAINS "87157-coinbase.com" OR sourcehostname CONTAINS "87312-coinbase.com" OR sourcehostname CONTAINS "89304-coinbase.com" OR sourcehostname CONTAINS "89375-coinbase.com" OR sourcehostname CONTAINS "91723-gemini.com" OR sourcehostname CONTAINS "91752-coinbase.com")
index=activity AND rg_functionality="Flow" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "28676-coinbase.com" OR destinationntdomain CONTAINS "29185-coinbase.com" OR destinationntdomain CONTAINS "29195-coinbase.com" OR destinationntdomain CONTAINS "2a-coinbase.com" OR destinationntdomain CONTAINS "2b-coinbase.com" OR destinationntdomain CONTAINS "2c-coinbase.com" OR destinationntdomain CONTAINS "2f-coinbase.com" OR destinationntdomain CONTAINS "2fas-coinbase.com" OR destinationntdomain CONTAINS "2o-coinbase.com" OR destinationntdomain CONTAINS "2r-coinbase.com" OR destinationntdomain CONTAINS "2s-coinbase.com" OR destinationntdomain CONTAINS "2sv-coinbase.com" OR destinationntdomain CONTAINS "352134951-coinbase.com" OR destinationntdomain CONTAINS "38468-coinbase.com" OR destinationntdomain CONTAINS "39590-coinbase.com" OR destinationntdomain CONTAINS "41260-coinbase.com" OR destinationntdomain CONTAINS "427883-coinbase.com" OR destinationntdomain CONTAINS "43017-coinbase.com" OR destinationntdomain CONTAINS "47562-coinbase.com" OR destinationntdomain CONTAINS "50195-coinbase.com" OR destinationntdomain CONTAINS "5247-coinbase.com" OR destinationntdomain CONTAINS "54765-coinbase.com" OR destinationntdomain CONTAINS "57197-coinbase.com" OR destinationntdomain CONTAINS "58176-coinbase.com" OR destinationntdomain CONTAINS "58297-coinbase.com" OR destinationntdomain CONTAINS "61250-coinbase.com" OR destinationntdomain CONTAINS "61835-coinbase.com" OR destinationntdomain CONTAINS "61851-coinbase.com" OR destinationntdomain CONTAINS "61937-coinbase.com" OR destinationntdomain CONTAINS "71925-coinbase.com" OR destinationntdomain CONTAINS "72957-coinbase.com" OR destinationntdomain CONTAINS "72985-coinbase.com" OR destinationntdomain CONTAINS "74651-coinbase.com" OR destinationntdomain CONTAINS "754668948-coinbase.com" OR destinationntdomain CONTAINS "76159869-coinbase.com" OR destinationntdomain CONTAINS "76153-coinbase.com" OR destinationntdomain CONTAINS "81758-coinbase.com" OR destinationntdomain CONTAINS "81920-coinbase.com" OR destinationntdomain CONTAINS "81926-coinbase.com" OR destinationntdomain CONTAINS "81958-coinbase.com" OR destinationntdomain CONTAINS "826298-coinbase.com" OR destinationntdomain CONTAINS "83216-coinbase.com" OR destinationntdomain CONTAINS "837613-coinbase.com" OR destinationntdomain CONTAINS "83956-coinbase.com" OR destinationntdomain CONTAINS "87157-coinbase.com" OR destinationntdomain CONTAINS "87312-coinbase.com" OR destinationntdomain CONTAINS "89304-coinbase.com" OR destinationntdomain CONTAINS "89375-coinbase.com" OR destinationntdomain CONTAINS "91723-gemini.com" OR destinationntdomain CONTAINS "91752-coinbase.com")
index=activity AND rg_functionality="Flow" AND requesturl NOT NULL AND (requesturl CONTAINS "28676-coinbase.com" OR requesturl CONTAINS "29185-coinbase.com" OR requesturl CONTAINS "29195-coinbase.com" OR requesturl CONTAINS "2a-coinbase.com" OR requesturl CONTAINS "2b-coinbase.com" OR requesturl CONTAINS "2c-coinbase.com" OR requesturl CONTAINS "2f-coinbase.com" OR requesturl CONTAINS "2fas-coinbase.com" OR requesturl CONTAINS "2o-coinbase.com" OR requesturl CONTAINS "2r-coinbase.com" OR requesturl CONTAINS "2s-coinbase.com" OR requesturl CONTAINS "2sv-coinbase.com" OR requesturl CONTAINS "352134951-coinbase.com" OR requesturl CONTAINS "38468-coinbase.com" OR requesturl CONTAINS "39590-coinbase.com" OR requesturl CONTAINS "41260-coinbase.com" OR requesturl CONTAINS "427883-coinbase.com" OR requesturl CONTAINS "43017-coinbase.com" OR requesturl CONTAINS "47562-coinbase.com" OR requesturl CONTAINS "50195-coinbase.com" OR requesturl CONTAINS "5247-coinbase.com" OR requesturl CONTAINS "54765-coinbase.com" OR requesturl CONTAINS "57197-coinbase.com" OR requesturl CONTAINS "58176-coinbase.com" OR requesturl CONTAINS "58297-coinbase.com" OR requesturl CONTAINS "61250-coinbase.com" OR requesturl CONTAINS "61835-coinbase.com" OR requesturl CONTAINS "61851-coinbase.com" OR requesturl CONTAINS "61937-coinbase.com" OR requesturl CONTAINS "71925-coinbase.com" OR requesturl CONTAINS "72957-coinbase.com" OR requesturl CONTAINS "72985-coinbase.com" OR requesturl CONTAINS "74651-coinbase.com" OR requesturl CONTAINS "754668948-coinbase.com" OR requesturl CONTAINS "76159869-coinbase.com" OR requesturl CONTAINS "76153-coinbase.com" OR requesturl CONTAINS "81758-coinbase.com" OR requesturl CONTAINS "81920-coinbase.com" OR requesturl CONTAINS "81926-coinbase.com" OR requesturl CONTAINS "81958-coinbase.com" OR requesturl CONTAINS "826298-coinbase.com" OR requesturl CONTAINS "83216-coinbase.com" OR requesturl CONTAINS "837613-coinbase.com" OR requesturl CONTAINS "83956-coinbase.com" OR requesturl CONTAINS "87157-coinbase.com" OR requesturl CONTAINS "87312-coinbase.com" OR requesturl CONTAINS "89304-coinbase.com" OR requesturl CONTAINS "89375-coinbase.com" OR requesturl CONTAINS "91723-gemini.com" OR requesturl CONTAINS "91752-coinbase.com")
index=activity AND rg_functionality="Flow" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "91756-coinbase.com" OR destinationhostname CONTAINS "91782-coinbase.com" OR destinationhostname CONTAINS "91835-coinbase.com" OR destinationhostname CONTAINS "91845-coinbase.com" OR destinationhostname CONTAINS "91923-coinbase.com" OR destinationhostname CONTAINS "92758-coinbase.com" OR destinationhostname CONTAINS "948122061-coinbase.com" OR destinationhostname CONTAINS "978941-coinbase.com" OR destinationhostname CONTAINS "accountrecovery-coinbase.com" OR destinationhostname CONTAINS "action-shakepay.com" OR destinationhostname CONTAINS "adjust-coinbase.com" OR destinationhostname CONTAINS "admin-kraken.com" OR destinationhostname CONTAINS "applechargebacks.com" OR destinationhostname CONTAINS "authenticate-gemini.com" OR destinationhostname CONTAINS "authorize-gmail.com" OR destinationhostname CONTAINS "binance-okta.com" OR destinationhostname CONTAINS "captcha-coinbase.com" OR destinationhostname CONTAINS "cd-coinbase.com" OR destinationhostname CONTAINS "coinbase-heip.com" OR destinationhostname CONTAINS "coinbase-live.support" OR destinationhostname CONTAINS "coinbase-reject.com" OR destinationhostname CONTAINS "coinbase-ticket.com" OR destinationhostname CONTAINS "coinbaseheip.com" OR destinationhostname CONTAINS "com-2fa.help" OR destinationhostname CONTAINS "com-2fa.support" OR destinationhostname CONTAINS "com-3845.support" OR destinationhostname CONTAINS "com-connect.help" OR destinationhostname CONTAINS "com-fraud.support" OR destinationhostname CONTAINS "com-help.support" OR destinationhostname CONTAINS "com-reset.help" OR destinationhostname CONTAINS "com-reset.net" OR destinationhostname CONTAINS "com-ticket.live" OR destinationhostname CONTAINS "com-ticket.support" OR destinationhostname CONTAINS "contact-nexo.com" OR destinationhostname CONTAINS "convert-coinbase.com" OR destinationhostname CONTAINS "customerservice-coinbase.com" OR destinationhostname CONTAINS "default-coinbase.com" OR destinationhostname CONTAINS "defend-coinbase.com" OR destinationhostname CONTAINS "deny-coinbase.com" OR destinationhostname CONTAINS "disconnect-coinbase.com" OR destinationhostname CONTAINS "escalate-coinbase.com" OR destinationhostname CONTAINS "establish-coinbase.com" OR destinationhostname CONTAINS "fcc-okta.com" OR destinationhostname CONTAINS "fraudulent-coinbase.com" OR destinationhostname CONTAINS "guard-apple.com" OR destinationhostname CONTAINS "guard-icloud.com" OR destinationhostname CONTAINS "guardian-coinbase.com" OR destinationhostname CONTAINS "guide-gemini.com" OR destinationhostname CONTAINS "help-bitfinex.com" OR destinationhostname CONTAINS "help-shakepay.com")
index=activity AND rg_functionality="Flow" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "91756-coinbase.com" OR sourcentdomain CONTAINS "91782-coinbase.com" OR sourcentdomain CONTAINS "91835-coinbase.com" OR sourcentdomain CONTAINS "91845-coinbase.com" OR sourcentdomain CONTAINS "91923-coinbase.com" OR sourcentdomain CONTAINS "92758-coinbase.com" OR sourcentdomain CONTAINS "948122061-coinbase.com" OR sourcentdomain CONTAINS "978941-coinbase.com" OR sourcentdomain CONTAINS "accountrecovery-coinbase.com" OR sourcentdomain CONTAINS "action-shakepay.com" OR sourcentdomain CONTAINS "adjust-coinbase.com" OR sourcentdomain CONTAINS "admin-kraken.com" OR sourcentdomain CONTAINS "applechargebacks.com" OR sourcentdomain CONTAINS "authenticate-gemini.com" OR sourcentdomain CONTAINS "authorize-gmail.com" OR sourcentdomain CONTAINS "binance-okta.com" OR sourcentdomain CONTAINS "captcha-coinbase.com" OR sourcentdomain CONTAINS "cd-coinbase.com" OR sourcentdomain CONTAINS "coinbase-heip.com" OR sourcentdomain CONTAINS "coinbase-live.support" OR sourcentdomain CONTAINS "coinbase-reject.com" OR sourcentdomain CONTAINS "coinbase-ticket.com" OR sourcentdomain CONTAINS "coinbaseheip.com" OR sourcentdomain CONTAINS "com-2fa.help" OR sourcentdomain CONTAINS "com-2fa.support" OR sourcentdomain CONTAINS "com-3845.support" OR sourcentdomain CONTAINS "com-connect.help" OR sourcentdomain CONTAINS "com-fraud.support" OR sourcentdomain CONTAINS "com-help.support" OR sourcentdomain CONTAINS "com-reset.help" OR sourcentdomain CONTAINS "com-reset.net" OR sourcentdomain CONTAINS "com-ticket.live" OR sourcentdomain CONTAINS "com-ticket.support" OR sourcentdomain CONTAINS "contact-nexo.com" OR sourcentdomain CONTAINS "convert-coinbase.com" OR sourcentdomain CONTAINS "customerservice-coinbase.com" OR sourcentdomain CONTAINS "default-coinbase.com" OR sourcentdomain CONTAINS "defend-coinbase.com" OR sourcentdomain CONTAINS "deny-coinbase.com" OR sourcentdomain CONTAINS "disconnect-coinbase.com" OR sourcentdomain CONTAINS "escalate-coinbase.com" OR sourcentdomain CONTAINS "establish-coinbase.com" OR sourcentdomain CONTAINS "fcc-okta.com" OR sourcentdomain CONTAINS "fraudulent-coinbase.com" OR sourcentdomain CONTAINS "guard-apple.com" OR sourcentdomain CONTAINS "guard-icloud.com" OR sourcentdomain CONTAINS "guardian-coinbase.com" OR sourcentdomain CONTAINS "guide-gemini.com" OR sourcentdomain CONTAINS "help-bitfinex.com" OR sourcentdomain CONTAINS "help-shakepay.com")
index=activity AND rg_functionality="Flow" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "91756-coinbase.com" OR sourcehostname CONTAINS "91782-coinbase.com" OR sourcehostname CONTAINS "91835-coinbase.com" OR sourcehostname CONTAINS "91845-coinbase.com" OR sourcehostname CONTAINS "91923-coinbase.com" OR sourcehostname CONTAINS "92758-coinbase.com" OR sourcehostname CONTAINS "948122061-coinbase.com" OR sourcehostname CONTAINS "978941-coinbase.com" OR sourcehostname CONTAINS "accountrecovery-coinbase.com" OR sourcehostname CONTAINS "action-shakepay.com" OR sourcehostname CONTAINS "adjust-coinbase.com" OR sourcehostname CONTAINS "admin-kraken.com" OR sourcehostname CONTAINS "applechargebacks.com" OR sourcehostname CONTAINS "authenticate-gemini.com" OR sourcehostname CONTAINS "authorize-gmail.com" OR sourcehostname CONTAINS "binance-okta.com" OR sourcehostname CONTAINS "captcha-coinbase.com" OR sourcehostname CONTAINS "cd-coinbase.com" OR sourcehostname CONTAINS "coinbase-heip.com" OR sourcehostname CONTAINS "coinbase-live.support" OR sourcehostname CONTAINS "coinbase-reject.com" OR sourcehostname CONTAINS "coinbase-ticket.com" OR sourcehostname CONTAINS "coinbaseheip.com" OR sourcehostname CONTAINS "com-2fa.help" OR sourcehostname CONTAINS "com-2fa.support" OR sourcehostname CONTAINS "com-3845.support" OR sourcehostname CONTAINS "com-connect.help" OR sourcehostname CONTAINS "com-fraud.support" OR sourcehostname CONTAINS "com-help.support" OR sourcehostname CONTAINS "com-reset.help" OR sourcehostname CONTAINS "com-reset.net" OR sourcehostname CONTAINS "com-ticket.live" OR sourcehostname CONTAINS "com-ticket.support" OR sourcehostname CONTAINS "contact-nexo.com" OR sourcehostname CONTAINS "convert-coinbase.com" OR sourcehostname CONTAINS "customerservice-coinbase.com" OR sourcehostname CONTAINS "default-coinbase.com" OR sourcehostname CONTAINS "defend-coinbase.com" OR sourcehostname CONTAINS "deny-coinbase.com" OR sourcehostname CONTAINS "disconnect-coinbase.com" OR sourcehostname CONTAINS "escalate-coinbase.com" OR sourcehostname CONTAINS "establish-coinbase.com" OR sourcehostname CONTAINS "fcc-okta.com" OR sourcehostname CONTAINS "fraudulent-coinbase.com" OR sourcehostname CONTAINS "guard-apple.com" OR sourcehostname CONTAINS "guard-icloud.com" OR sourcehostname CONTAINS "guardian-coinbase.com" OR sourcehostname CONTAINS "guide-gemini.com" OR sourcehostname CONTAINS "help-bitfinex.com" OR sourcehostname CONTAINS "help-shakepay.com")
index=activity AND rg_functionality="Flow" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "91756-coinbase.com" OR destinationntdomain CONTAINS "91782-coinbase.com" OR destinationntdomain CONTAINS "91835-coinbase.com" OR destinationntdomain CONTAINS "91845-coinbase.com" OR destinationntdomain CONTAINS "91923-coinbase.com" OR destinationntdomain CONTAINS "92758-coinbase.com" OR destinationntdomain CONTAINS "948122061-coinbase.com" OR destinationntdomain CONTAINS "978941-coinbase.com" OR destinationntdomain CONTAINS "accountrecovery-coinbase.com" OR destinationntdomain CONTAINS "action-shakepay.com" OR destinationntdomain CONTAINS "adjust-coinbase.com" OR destinationntdomain CONTAINS "admin-kraken.com" OR destinationntdomain CONTAINS "applechargebacks.com" OR destinationntdomain CONTAINS "authenticate-gemini.com" OR destinationntdomain CONTAINS "authorize-gmail.com" OR destinationntdomain CONTAINS "binance-okta.com" OR destinationntdomain CONTAINS "captcha-coinbase.com" OR destinationntdomain CONTAINS "cd-coinbase.com" OR destinationntdomain CONTAINS "coinbase-heip.com" OR destinationntdomain CONTAINS "coinbase-live.support" OR destinationntdomain CONTAINS "coinbase-reject.com" OR destinationntdomain CONTAINS "coinbase-ticket.com" OR destinationntdomain CONTAINS "coinbaseheip.com" OR destinationntdomain CONTAINS "com-2fa.help" OR destinationntdomain CONTAINS "com-2fa.support" OR destinationntdomain CONTAINS "com-3845.support" OR destinationntdomain CONTAINS "com-connect.help" OR destinationntdomain CONTAINS "com-fraud.support" OR destinationntdomain CONTAINS "com-help.support" OR destinationntdomain CONTAINS "com-reset.help" OR destinationntdomain CONTAINS "com-reset.net" OR destinationntdomain CONTAINS "com-ticket.live" OR destinationntdomain CONTAINS "com-ticket.support" OR destinationntdomain CONTAINS "contact-nexo.com" OR destinationntdomain CONTAINS "convert-coinbase.com" OR destinationntdomain CONTAINS "customerservice-coinbase.com" OR destinationntdomain CONTAINS "default-coinbase.com" OR destinationntdomain CONTAINS "defend-coinbase.com" OR destinationntdomain CONTAINS "deny-coinbase.com" OR destinationntdomain CONTAINS "disconnect-coinbase.com" OR destinationntdomain CONTAINS "escalate-coinbase.com" OR destinationntdomain CONTAINS "establish-coinbase.com" OR destinationntdomain CONTAINS "fcc-okta.com" OR destinationntdomain CONTAINS "fraudulent-coinbase.com" OR destinationntdomain CONTAINS "guard-apple.com" OR destinationntdomain CONTAINS "guard-icloud.com" OR destinationntdomain CONTAINS "guardian-coinbase.com" OR destinationntdomain CONTAINS "guide-gemini.com" OR destinationntdomain CONTAINS "help-bitfinex.com" OR destinationntdomain CONTAINS "help-shakepay.com")
index=activity AND rg_functionality="Flow" AND requesturl NOT NULL AND (requesturl CONTAINS "91756-coinbase.com" OR requesturl CONTAINS "91782-coinbase.com" OR requesturl CONTAINS "91835-coinbase.com" OR requesturl CONTAINS "91845-coinbase.com" OR requesturl CONTAINS "91923-coinbase.com" OR requesturl CONTAINS "92758-coinbase.com" OR requesturl CONTAINS "948122061-coinbase.com" OR requesturl CONTAINS "978941-coinbase.com" OR requesturl CONTAINS "accountrecovery-coinbase.com" OR requesturl CONTAINS "action-shakepay.com" OR requesturl CONTAINS "adjust-coinbase.com" OR requesturl CONTAINS "admin-kraken.com" OR requesturl CONTAINS "applechargebacks.com" OR requesturl CONTAINS "authenticate-gemini.com" OR requesturl CONTAINS "authorize-gmail.com" OR requesturl CONTAINS "binance-okta.com" OR requesturl CONTAINS "captcha-coinbase.com" OR requesturl CONTAINS "cd-coinbase.com" OR requesturl CONTAINS "coinbase-heip.com" OR requesturl CONTAINS "coinbase-live.support" OR requesturl CONTAINS "coinbase-reject.com" OR requesturl CONTAINS "coinbase-ticket.com" OR requesturl CONTAINS "coinbaseheip.com" OR requesturl CONTAINS "com-2fa.help" OR requesturl CONTAINS "com-2fa.support" OR requesturl CONTAINS "com-3845.support" OR requesturl CONTAINS "com-connect.help" OR requesturl CONTAINS "com-fraud.support" OR requesturl CONTAINS "com-help.support" OR requesturl CONTAINS "com-reset.help" OR requesturl CONTAINS "com-reset.net" OR requesturl CONTAINS "com-ticket.live" OR requesturl CONTAINS "com-ticket.support" OR requesturl CONTAINS "contact-nexo.com" OR requesturl CONTAINS "convert-coinbase.com" OR requesturl CONTAINS "customerservice-coinbase.com" OR requesturl CONTAINS "default-coinbase.com" OR requesturl CONTAINS "defend-coinbase.com" OR requesturl CONTAINS "deny-coinbase.com" OR requesturl CONTAINS "disconnect-coinbase.com" OR requesturl CONTAINS "escalate-coinbase.com" OR requesturl CONTAINS "establish-coinbase.com" OR requesturl CONTAINS "fcc-okta.com" OR requesturl CONTAINS "fraudulent-coinbase.com" OR requesturl CONTAINS "guard-apple.com" OR requesturl CONTAINS "guard-icloud.com" OR requesturl CONTAINS "guardian-coinbase.com" OR requesturl CONTAINS "guide-gemini.com" OR requesturl CONTAINS "help-bitfinex.com" OR requesturl CONTAINS "help-shakepay.com")
index=activity AND rg_functionality="Flow" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "helpdesk-apple.com" OR destinationhostname CONTAINS "helpdesk-gemini.com" OR destinationhostname CONTAINS "helpdesk-icloud.com" OR destinationhostname CONTAINS "identification-coinbase.com" OR destinationhostname CONTAINS "lockdown-coinbase.com" OR destinationhostname CONTAINS "login-nexo.com" OR destinationhostname CONTAINS "keys-coinbase.com" OR destinationhostname CONTAINS "messages-coinbase.com" OR destinationhostname CONTAINS "newpassword-coinbase.com" OR destinationhostname CONTAINS "prompt-coinbase.com" OR destinationhostname CONTAINS "protect-apple.com" OR destinationhostname CONTAINS "protect-coinbase.com" OR destinationhostname CONTAINS "protect-gmail.com" OR destinationhostname CONTAINS "protect-kraken.com" OR destinationhostname CONTAINS "recoverme-coinbase.com" OR destinationhostname CONTAINS "recoveryportal-coinbase.com" OR destinationhostname CONTAINS "refunds-coinbase.com" OR destinationhostname CONTAINS "reset-okta.com" OR destinationhostname CONTAINS "restore-coinbase.com" OR destinationhostname CONTAINS "return-coinbase.com" OR destinationhostname CONTAINS "reverts-coinbase.com" OR destinationhostname CONTAINS "secure-binance.us" OR destinationhostname CONTAINS "secure-icloud.com" OR destinationhostname CONTAINS "secure-nexo.com" OR destinationhostname CONTAINS "secure-shakepay.com" OR destinationhostname CONTAINS "security-umusic.com" OR destinationhostname CONTAINS "server694590423.tech" OR destinationhostname CONTAINS "session-coinbase.com" OR destinationhostname CONTAINS "startrecovery-coinbase.com" OR destinationhostname CONTAINS "signin-kraken.com" OR destinationhostname CONTAINS "suite-trezor.io" OR destinationhostname CONTAINS "supportportal-coinbase.com" OR destinationhostname CONTAINS "tech-icloud.com" OR destinationhostname CONTAINS "threat-coinbase.com" OR destinationhostname CONTAINS "ticket-apple.com" OR destinationhostname CONTAINS "ticket-coinbase.com" OR destinationhostname CONTAINS "tickets-apple.com" OR destinationhostname CONTAINS "tokens-coinbase.com" OR destinationhostname CONTAINS "unblock-coinbase.com" OR destinationhostname CONTAINS "unlink-coinbase.com" OR destinationhostname CONTAINS "your-coinbase.com" OR destinationhostname CONTAINS "welcome-coinbase.com" OR destinationhostname CONTAINS "www-coinbasewallet.com" OR destinationhostname CONTAINS "www-help-coinbase.com" OR destinationhostname CONTAINS "www-help-gemini.com")
index=activity AND rg_functionality="Flow" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "helpdesk-apple.com" OR sourcentdomain CONTAINS "helpdesk-gemini.com" OR sourcentdomain CONTAINS "helpdesk-icloud.com" OR sourcentdomain CONTAINS "identification-coinbase.com" OR sourcentdomain CONTAINS "lockdown-coinbase.com" OR sourcentdomain CONTAINS "login-nexo.com" OR sourcentdomain CONTAINS "keys-coinbase.com" OR sourcentdomain CONTAINS "messages-coinbase.com" OR sourcentdomain CONTAINS "newpassword-coinbase.com" OR sourcentdomain CONTAINS "prompt-coinbase.com" OR sourcentdomain CONTAINS "protect-apple.com" OR sourcentdomain CONTAINS "protect-coinbase.com" OR sourcentdomain CONTAINS "protect-gmail.com" OR sourcentdomain CONTAINS "protect-kraken.com" OR sourcentdomain CONTAINS "recoverme-coinbase.com" OR sourcentdomain CONTAINS "recoveryportal-coinbase.com" OR sourcentdomain CONTAINS "refunds-coinbase.com" OR sourcentdomain CONTAINS "reset-okta.com" OR sourcentdomain CONTAINS "restore-coinbase.com" OR sourcentdomain CONTAINS "return-coinbase.com" OR sourcentdomain CONTAINS "reverts-coinbase.com" OR sourcentdomain CONTAINS "secure-binance.us" OR sourcentdomain CONTAINS "secure-icloud.com" OR sourcentdomain CONTAINS "secure-nexo.com" OR sourcentdomain CONTAINS "secure-shakepay.com" OR sourcentdomain CONTAINS "security-umusic.com" OR sourcentdomain CONTAINS "server694590423.tech" OR sourcentdomain CONTAINS "session-coinbase.com" OR sourcentdomain CONTAINS "startrecovery-coinbase.com" OR sourcentdomain CONTAINS "signin-kraken.com" OR sourcentdomain CONTAINS "suite-trezor.io" OR sourcentdomain CONTAINS "supportportal-coinbase.com" OR sourcentdomain CONTAINS "tech-icloud.com" OR sourcentdomain CONTAINS "threat-coinbase.com" OR sourcentdomain CONTAINS "ticket-apple.com" OR sourcentdomain CONTAINS "ticket-coinbase.com" OR sourcentdomain CONTAINS "tickets-apple.com" OR sourcentdomain CONTAINS "tokens-coinbase.com" OR sourcentdomain CONTAINS "unblock-coinbase.com" OR sourcentdomain CONTAINS "unlink-coinbase.com" OR sourcentdomain CONTAINS "your-coinbase.com" OR sourcentdomain CONTAINS "welcome-coinbase.com" OR sourcentdomain CONTAINS "www-coinbasewallet.com" OR sourcentdomain CONTAINS "www-help-coinbase.com" OR sourcentdomain CONTAINS "www-help-gemini.com")
index=activity AND rg_functionality="Flow" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "helpdesk-apple.com" OR sourcehostname CONTAINS "helpdesk-gemini.com" OR sourcehostname CONTAINS "helpdesk-icloud.com" OR sourcehostname CONTAINS "identification-coinbase.com" OR sourcehostname CONTAINS "lockdown-coinbase.com" OR sourcehostname CONTAINS "login-nexo.com" OR sourcehostname CONTAINS "keys-coinbase.com" OR sourcehostname CONTAINS "messages-coinbase.com" OR sourcehostname CONTAINS "newpassword-coinbase.com" OR sourcehostname CONTAINS "prompt-coinbase.com" OR sourcehostname CONTAINS "protect-apple.com" OR sourcehostname CONTAINS "protect-coinbase.com" OR sourcehostname CONTAINS "protect-gmail.com" OR sourcehostname CONTAINS "protect-kraken.com" OR sourcehostname CONTAINS "recoverme-coinbase.com" OR sourcehostname CONTAINS "recoveryportal-coinbase.com" OR sourcehostname CONTAINS "refunds-coinbase.com" OR sourcehostname CONTAINS "reset-okta.com" OR sourcehostname CONTAINS "restore-coinbase.com" OR sourcehostname CONTAINS "return-coinbase.com" OR sourcehostname CONTAINS "reverts-coinbase.com" OR sourcehostname CONTAINS "secure-binance.us" OR sourcehostname CONTAINS "secure-icloud.com" OR sourcehostname CONTAINS "secure-nexo.com" OR sourcehostname CONTAINS "secure-shakepay.com" OR sourcehostname CONTAINS "security-umusic.com" OR sourcehostname CONTAINS "server694590423.tech" OR sourcehostname CONTAINS "session-coinbase.com" OR sourcehostname CONTAINS "startrecovery-coinbase.com" OR sourcehostname CONTAINS "signin-kraken.com" OR sourcehostname CONTAINS "suite-trezor.io" OR sourcehostname CONTAINS "supportportal-coinbase.com" OR sourcehostname CONTAINS "tech-icloud.com" OR sourcehostname CONTAINS "threat-coinbase.com" OR sourcehostname CONTAINS "ticket-apple.com" OR sourcehostname CONTAINS "ticket-coinbase.com" OR sourcehostname CONTAINS "tickets-apple.com" OR sourcehostname CONTAINS "tokens-coinbase.com" OR sourcehostname CONTAINS "unblock-coinbase.com" OR sourcehostname CONTAINS "unlink-coinbase.com" OR sourcehostname CONTAINS "your-coinbase.com" OR sourcehostname CONTAINS "welcome-coinbase.com" OR sourcehostname CONTAINS "www-coinbasewallet.com" OR sourcehostname CONTAINS "www-help-coinbase.com" OR sourcehostname CONTAINS "www-help-gemini.com")
index=activity AND rg_functionality="Flow" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "helpdesk-apple.com" OR destinationntdomain CONTAINS "helpdesk-gemini.com" OR destinationntdomain CONTAINS "helpdesk-icloud.com" OR destinationntdomain CONTAINS "identification-coinbase.com" OR destinationntdomain CONTAINS "lockdown-coinbase.com" OR destinationntdomain CONTAINS "login-nexo.com" OR destinationntdomain CONTAINS "keys-coinbase.com" OR destinationntdomain CONTAINS "messages-coinbase.com" OR destinationntdomain CONTAINS "newpassword-coinbase.com" OR destinationntdomain CONTAINS "prompt-coinbase.com" OR destinationntdomain CONTAINS "protect-apple.com" OR destinationntdomain CONTAINS "protect-coinbase.com" OR destinationntdomain CONTAINS "protect-gmail.com" OR destinationntdomain CONTAINS "protect-kraken.com" OR destinationntdomain CONTAINS "recoverme-coinbase.com" OR destinationntdomain CONTAINS "recoveryportal-coinbase.com" OR destinationntdomain CONTAINS "refunds-coinbase.com" OR destinationntdomain CONTAINS "reset-okta.com" OR destinationntdomain CONTAINS "restore-coinbase.com" OR destinationntdomain CONTAINS "return-coinbase.com" OR destinationntdomain CONTAINS "reverts-coinbase.com" OR destinationntdomain CONTAINS "secure-binance.us" OR destinationntdomain CONTAINS "secure-icloud.com" OR destinationntdomain CONTAINS "secure-nexo.com" OR destinationntdomain CONTAINS "secure-shakepay.com" OR destinationntdomain CONTAINS "security-umusic.com" OR destinationntdomain CONTAINS "server694590423.tech" OR destinationntdomain CONTAINS "session-coinbase.com" OR destinationntdomain CONTAINS "startrecovery-coinbase.com" OR destinationntdomain CONTAINS "signin-kraken.com" OR destinationntdomain CONTAINS "suite-trezor.io" OR destinationntdomain CONTAINS "supportportal-coinbase.com" OR destinationntdomain CONTAINS "tech-icloud.com" OR destinationntdomain CONTAINS "threat-coinbase.com" OR destinationntdomain CONTAINS "ticket-apple.com" OR destinationntdomain CONTAINS "ticket-coinbase.com" OR destinationntdomain CONTAINS "tickets-apple.com" OR destinationntdomain CONTAINS "tokens-coinbase.com" OR destinationntdomain CONTAINS "unblock-coinbase.com" OR destinationntdomain CONTAINS "unlink-coinbase.com" OR destinationntdomain CONTAINS "your-coinbase.com" OR destinationntdomain CONTAINS "welcome-coinbase.com" OR destinationntdomain CONTAINS "www-coinbasewallet.com" OR destinationntdomain CONTAINS "www-help-coinbase.com" OR destinationntdomain CONTAINS "www-help-gemini.com")
index=activity AND rg_functionality="Flow" AND requesturl NOT NULL AND (requesturl CONTAINS "helpdesk-apple.com" OR requesturl CONTAINS "helpdesk-gemini.com" OR requesturl CONTAINS "helpdesk-icloud.com" OR requesturl CONTAINS "identification-coinbase.com" OR requesturl CONTAINS "lockdown-coinbase.com" OR requesturl CONTAINS "login-nexo.com" OR requesturl CONTAINS "keys-coinbase.com" OR requesturl CONTAINS "messages-coinbase.com" OR requesturl CONTAINS "newpassword-coinbase.com" OR requesturl CONTAINS "prompt-coinbase.com" OR requesturl CONTAINS "protect-apple.com" OR requesturl CONTAINS "protect-coinbase.com" OR requesturl CONTAINS "protect-gmail.com" OR requesturl CONTAINS "protect-kraken.com" OR requesturl CONTAINS "recoverme-coinbase.com" OR requesturl CONTAINS "recoveryportal-coinbase.com" OR requesturl CONTAINS "refunds-coinbase.com" OR requesturl CONTAINS "reset-okta.com" OR requesturl CONTAINS "restore-coinbase.com" OR requesturl CONTAINS "return-coinbase.com" OR requesturl CONTAINS "reverts-coinbase.com" OR requesturl CONTAINS "secure-binance.us" OR requesturl CONTAINS "secure-icloud.com" OR requesturl CONTAINS "secure-nexo.com" OR requesturl CONTAINS "secure-shakepay.com" OR requesturl CONTAINS "security-umusic.com" OR requesturl CONTAINS "server694590423.tech" OR requesturl CONTAINS "session-coinbase.com" OR requesturl CONTAINS "startrecovery-coinbase.com" OR requesturl CONTAINS "signin-kraken.com" OR requesturl CONTAINS "suite-trezor.io" OR requesturl CONTAINS "supportportal-coinbase.com" OR requesturl CONTAINS "tech-icloud.com" OR requesturl CONTAINS "threat-coinbase.com" OR requesturl CONTAINS "ticket-apple.com" OR requesturl CONTAINS "ticket-coinbase.com" OR requesturl CONTAINS "tickets-apple.com" OR requesturl CONTAINS "tokens-coinbase.com" OR requesturl CONTAINS "unblock-coinbase.com" OR requesturl CONTAINS "unlink-coinbase.com" OR requesturl CONTAINS "your-coinbase.com" OR requesturl CONTAINS "welcome-coinbase.com" OR requesturl CONTAINS "www-coinbasewallet.com" OR requesturl CONTAINS "www-help-coinbase.com" OR requesturl CONTAINS "www-help-gemini.com")
index=activity AND rg_functionality="Web Server" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "official-server.com" OR destinationhostname CONTAINS "server694590423.tech" OR destinationhostname CONTAINS "island-placid-bromine.glitch.me" OR destinationhostname CONTAINS "circular-noon-farmhouse.glitch.me" OR destinationhostname CONTAINS "talented-friendly-price.glitch.me" OR destinationhostname CONTAINS "dflfmgsdokasdcpl.com" OR destinationhostname CONTAINS "original-backend.com" OR destinationhostname CONTAINS "07159889-coinbase.com" OR destinationhostname CONTAINS "10195-coinbase.com" OR destinationhostname CONTAINS "11246-coinbase.com" OR destinationhostname CONTAINS "11247-coinbase.com" OR destinationhostname CONTAINS "11248-coinbase.com" OR destinationhostname CONTAINS "11258-coinbase.com" OR destinationhostname CONTAINS "11259-coinbase.com" OR destinationhostname CONTAINS "113912-coinbase.com" OR destinationhostname CONTAINS "11472-coinbase.com" OR destinationhostname CONTAINS "11923-coinbase.com" OR destinationhostname CONTAINS "11957-coinbase.com" OR destinationhostname CONTAINS "128147-coinbase.com" OR destinationhostname CONTAINS "12958-coinbase.com" OR destinationhostname CONTAINS "12984-okta.com" OR destinationhostname CONTAINS "12985-coinbase.com" OR destinationhostname CONTAINS "13130-coinbase.com" OR destinationhostname CONTAINS "13247-coinbase.com" OR destinationhostname CONTAINS "13247-icloud.com" OR destinationhostname CONTAINS "13267-coinbase.com" OR destinationhostname CONTAINS "146271510-coinbase.com" OR destinationhostname CONTAINS "146282-coinbase.com" OR destinationhostname CONTAINS "146284-coinbase.com" OR destinationhostname CONTAINS "147260-coinbase.com" OR destinationhostname CONTAINS "14765-coinbase.com" OR destinationhostname CONTAINS "14817582-coinbase.com" OR destinationhostname CONTAINS "14871904-coinbase.com" OR destinationhostname CONTAINS "14891902-coinbase.com" OR destinationhostname CONTAINS "1492864-coinbase.com" OR destinationhostname CONTAINS "158312-coinbase.com" OR destinationhostname CONTAINS "158372-coinbase.com" OR destinationhostname CONTAINS "158702-coinbase.com" OR destinationhostname CONTAINS "16171675-coinbase.com" OR destinationhostname CONTAINS "16171832-coinbase.com" OR destinationhostname CONTAINS "16178234-coinbase.com" OR destinationhostname CONTAINS "16178237-coinbase.com" OR destinationhostname CONTAINS "16178434-coinbase.com" OR destinationhostname CONTAINS "162178-coinbase.com" OR destinationhostname CONTAINS "162478-coinbase.com" OR destinationhostname CONTAINS "162782-coinbase.com" OR destinationhostname CONTAINS "162812-coinbase.com" OR destinationhostname CONTAINS "162814-coinbase.com" OR destinationhostname CONTAINS "16442580-coinbase.com" OR destinationhostname CONTAINS "16450107-coinbase.com")
index=activity AND rg_functionality="Web Server" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "official-server.com" OR sourcentdomain CONTAINS "server694590423.tech" OR sourcentdomain CONTAINS "island-placid-bromine.glitch.me" OR sourcentdomain CONTAINS "circular-noon-farmhouse.glitch.me" OR sourcentdomain CONTAINS "talented-friendly-price.glitch.me" OR sourcentdomain CONTAINS "dflfmgsdokasdcpl.com" OR sourcentdomain CONTAINS "original-backend.com" OR sourcentdomain CONTAINS "07159889-coinbase.com" OR sourcentdomain CONTAINS "10195-coinbase.com" OR sourcentdomain CONTAINS "11246-coinbase.com" OR sourcentdomain CONTAINS "11247-coinbase.com" OR sourcentdomain CONTAINS "11248-coinbase.com" OR sourcentdomain CONTAINS "11258-coinbase.com" OR sourcentdomain CONTAINS "11259-coinbase.com" OR sourcentdomain CONTAINS "113912-coinbase.com" OR sourcentdomain CONTAINS "11472-coinbase.com" OR sourcentdomain CONTAINS "11923-coinbase.com" OR sourcentdomain CONTAINS "11957-coinbase.com" OR sourcentdomain CONTAINS "128147-coinbase.com" OR sourcentdomain CONTAINS "12958-coinbase.com" OR sourcentdomain CONTAINS "12984-okta.com" OR sourcentdomain CONTAINS "12985-coinbase.com" OR sourcentdomain CONTAINS "13130-coinbase.com" OR sourcentdomain CONTAINS "13247-coinbase.com" OR sourcentdomain CONTAINS "13247-icloud.com" OR sourcentdomain CONTAINS "13267-coinbase.com" OR sourcentdomain CONTAINS "146271510-coinbase.com" OR sourcentdomain CONTAINS "146282-coinbase.com" OR sourcentdomain CONTAINS "146284-coinbase.com" OR sourcentdomain CONTAINS "147260-coinbase.com" OR sourcentdomain CONTAINS "14765-coinbase.com" OR sourcentdomain CONTAINS "14817582-coinbase.com" OR sourcentdomain CONTAINS "14871904-coinbase.com" OR sourcentdomain CONTAINS "14891902-coinbase.com" OR sourcentdomain CONTAINS "1492864-coinbase.com" OR sourcentdomain CONTAINS "158312-coinbase.com" OR sourcentdomain CONTAINS "158372-coinbase.com" OR sourcentdomain CONTAINS "158702-coinbase.com" OR sourcentdomain CONTAINS "16171675-coinbase.com" OR sourcentdomain CONTAINS "16171832-coinbase.com" OR sourcentdomain CONTAINS "16178234-coinbase.com" OR sourcentdomain CONTAINS "16178237-coinbase.com" OR sourcentdomain CONTAINS "16178434-coinbase.com" OR sourcentdomain CONTAINS "162178-coinbase.com" OR sourcentdomain CONTAINS "162478-coinbase.com" OR sourcentdomain CONTAINS "162782-coinbase.com" OR sourcentdomain CONTAINS "162812-coinbase.com" OR sourcentdomain CONTAINS "162814-coinbase.com" OR sourcentdomain CONTAINS "16442580-coinbase.com" OR sourcentdomain CONTAINS "16450107-coinbase.com")
index=activity AND rg_functionality="Web Server" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "official-server.com" OR sourcehostname CONTAINS "server694590423.tech" OR sourcehostname CONTAINS "island-placid-bromine.glitch.me" OR sourcehostname CONTAINS "circular-noon-farmhouse.glitch.me" OR sourcehostname CONTAINS "talented-friendly-price.glitch.me" OR sourcehostname CONTAINS "dflfmgsdokasdcpl.com" OR sourcehostname CONTAINS "original-backend.com" OR sourcehostname CONTAINS "07159889-coinbase.com" OR sourcehostname CONTAINS "10195-coinbase.com" OR sourcehostname CONTAINS "11246-coinbase.com" OR sourcehostname CONTAINS "11247-coinbase.com" OR sourcehostname CONTAINS "11248-coinbase.com" OR sourcehostname CONTAINS "11258-coinbase.com" OR sourcehostname CONTAINS "11259-coinbase.com" OR sourcehostname CONTAINS "113912-coinbase.com" OR sourcehostname CONTAINS "11472-coinbase.com" OR sourcehostname CONTAINS "11923-coinbase.com" OR sourcehostname CONTAINS "11957-coinbase.com" OR sourcehostname CONTAINS "128147-coinbase.com" OR sourcehostname CONTAINS "12958-coinbase.com" OR sourcehostname CONTAINS "12984-okta.com" OR sourcehostname CONTAINS "12985-coinbase.com" OR sourcehostname CONTAINS "13130-coinbase.com" OR sourcehostname CONTAINS "13247-coinbase.com" OR sourcehostname CONTAINS "13247-icloud.com" OR sourcehostname CONTAINS "13267-coinbase.com" OR sourcehostname CONTAINS "146271510-coinbase.com" OR sourcehostname CONTAINS "146282-coinbase.com" OR sourcehostname CONTAINS "146284-coinbase.com" OR sourcehostname CONTAINS "147260-coinbase.com" OR sourcehostname CONTAINS "14765-coinbase.com" OR sourcehostname CONTAINS "14817582-coinbase.com" OR sourcehostname CONTAINS "14871904-coinbase.com" OR sourcehostname CONTAINS "14891902-coinbase.com" OR sourcehostname CONTAINS "1492864-coinbase.com" OR sourcehostname CONTAINS "158312-coinbase.com" OR sourcehostname CONTAINS "158372-coinbase.com" OR sourcehostname CONTAINS "158702-coinbase.com" OR sourcehostname CONTAINS "16171675-coinbase.com" OR sourcehostname CONTAINS "16171832-coinbase.com" OR sourcehostname CONTAINS "16178234-coinbase.com" OR sourcehostname CONTAINS "16178237-coinbase.com" OR sourcehostname CONTAINS "16178434-coinbase.com" OR sourcehostname CONTAINS "162178-coinbase.com" OR sourcehostname CONTAINS "162478-coinbase.com" OR sourcehostname CONTAINS "162782-coinbase.com" OR sourcehostname CONTAINS "162812-coinbase.com" OR sourcehostname CONTAINS "162814-coinbase.com" OR sourcehostname CONTAINS "16442580-coinbase.com" OR sourcehostname CONTAINS "16450107-coinbase.com")
index=activity AND rg_functionality="Web Server" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "official-server.com" OR destinationntdomain CONTAINS "server694590423.tech" OR destinationntdomain CONTAINS "island-placid-bromine.glitch.me" OR destinationntdomain CONTAINS "circular-noon-farmhouse.glitch.me" OR destinationntdomain CONTAINS "talented-friendly-price.glitch.me" OR destinationntdomain CONTAINS "dflfmgsdokasdcpl.com" OR destinationntdomain CONTAINS "original-backend.com" OR destinationntdomain CONTAINS "07159889-coinbase.com" OR destinationntdomain CONTAINS "10195-coinbase.com" OR destinationntdomain CONTAINS "11246-coinbase.com" OR destinationntdomain CONTAINS "11247-coinbase.com" OR destinationntdomain CONTAINS "11248-coinbase.com" OR destinationntdomain CONTAINS "11258-coinbase.com" OR destinationntdomain CONTAINS "11259-coinbase.com" OR destinationntdomain CONTAINS "113912-coinbase.com" OR destinationntdomain CONTAINS "11472-coinbase.com" OR destinationntdomain CONTAINS "11923-coinbase.com" OR destinationntdomain CONTAINS "11957-coinbase.com" OR destinationntdomain CONTAINS "128147-coinbase.com" OR destinationntdomain CONTAINS "12958-coinbase.com" OR destinationntdomain CONTAINS "12984-okta.com" OR destinationntdomain CONTAINS "12985-coinbase.com" OR destinationntdomain CONTAINS "13130-coinbase.com" OR destinationntdomain CONTAINS "13247-coinbase.com" OR destinationntdomain CONTAINS "13247-icloud.com" OR destinationntdomain CONTAINS "13267-coinbase.com" OR destinationntdomain CONTAINS "146271510-coinbase.com" OR destinationntdomain CONTAINS "146282-coinbase.com" OR destinationntdomain CONTAINS "146284-coinbase.com" OR destinationntdomain CONTAINS "147260-coinbase.com" OR destinationntdomain CONTAINS "14765-coinbase.com" OR destinationntdomain CONTAINS "14817582-coinbase.com" OR destinationntdomain CONTAINS "14871904-coinbase.com" OR destinationntdomain CONTAINS "14891902-coinbase.com" OR destinationntdomain CONTAINS "1492864-coinbase.com" OR destinationntdomain CONTAINS "158312-coinbase.com" OR destinationntdomain CONTAINS "158372-coinbase.com" OR destinationntdomain CONTAINS "158702-coinbase.com" OR destinationntdomain CONTAINS "16171675-coinbase.com" OR destinationntdomain CONTAINS "16171832-coinbase.com" OR destinationntdomain CONTAINS "16178234-coinbase.com" OR destinationntdomain CONTAINS "16178237-coinbase.com" OR destinationntdomain CONTAINS "16178434-coinbase.com" OR destinationntdomain CONTAINS "162178-coinbase.com" OR destinationntdomain CONTAINS "162478-coinbase.com" OR destinationntdomain CONTAINS "162782-coinbase.com" OR destinationntdomain CONTAINS "162812-coinbase.com" OR destinationntdomain CONTAINS "162814-coinbase.com" OR destinationntdomain CONTAINS "16442580-coinbase.com" OR destinationntdomain CONTAINS "16450107-coinbase.com")
index=activity AND rg_functionality="Web Server" AND requesturl NOT NULL AND (requesturl CONTAINS "official-server.com" OR requesturl CONTAINS "server694590423.tech" OR requesturl CONTAINS "island-placid-bromine.glitch.me" OR requesturl CONTAINS "circular-noon-farmhouse.glitch.me" OR requesturl CONTAINS "talented-friendly-price.glitch.me" OR requesturl CONTAINS "dflfmgsdokasdcpl.com" OR requesturl CONTAINS "original-backend.com" OR requesturl CONTAINS "07159889-coinbase.com" OR requesturl CONTAINS "10195-coinbase.com" OR requesturl CONTAINS "11246-coinbase.com" OR requesturl CONTAINS "11247-coinbase.com" OR requesturl CONTAINS "11248-coinbase.com" OR requesturl CONTAINS "11258-coinbase.com" OR requesturl CONTAINS "11259-coinbase.com" OR requesturl CONTAINS "113912-coinbase.com" OR requesturl CONTAINS "11472-coinbase.com" OR requesturl CONTAINS "11923-coinbase.com" OR requesturl CONTAINS "11957-coinbase.com" OR requesturl CONTAINS "128147-coinbase.com" OR requesturl CONTAINS "12958-coinbase.com" OR requesturl CONTAINS "12984-okta.com" OR requesturl CONTAINS "12985-coinbase.com" OR requesturl CONTAINS "13130-coinbase.com" OR requesturl CONTAINS "13247-coinbase.com" OR requesturl CONTAINS "13247-icloud.com" OR requesturl CONTAINS "13267-coinbase.com" OR requesturl CONTAINS "146271510-coinbase.com" OR requesturl CONTAINS "146282-coinbase.com" OR requesturl CONTAINS "146284-coinbase.com" OR requesturl CONTAINS "147260-coinbase.com" OR requesturl CONTAINS "14765-coinbase.com" OR requesturl CONTAINS "14817582-coinbase.com" OR requesturl CONTAINS "14871904-coinbase.com" OR requesturl CONTAINS "14891902-coinbase.com" OR requesturl CONTAINS "1492864-coinbase.com" OR requesturl CONTAINS "158312-coinbase.com" OR requesturl CONTAINS "158372-coinbase.com" OR requesturl CONTAINS "158702-coinbase.com" OR requesturl CONTAINS "16171675-coinbase.com" OR requesturl CONTAINS "16171832-coinbase.com" OR requesturl CONTAINS "16178234-coinbase.com" OR requesturl CONTAINS "16178237-coinbase.com" OR requesturl CONTAINS "16178434-coinbase.com" OR requesturl CONTAINS "162178-coinbase.com" OR requesturl CONTAINS "162478-coinbase.com" OR requesturl CONTAINS "162782-coinbase.com" OR requesturl CONTAINS "162812-coinbase.com" OR requesturl CONTAINS "162814-coinbase.com" OR requesturl CONTAINS "16442580-coinbase.com" OR requesturl CONTAINS "16450107-coinbase.com")
index=activity AND rg_functionality="Web Server" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "16450207-coinbase.com" OR destinationhostname CONTAINS "16458207-coinbase.com" OR destinationhostname CONTAINS "16478202-coinbase.com" OR destinationhostname CONTAINS "164872942-coinbase.com" OR destinationhostname CONTAINS "16590-coinbase.com" OR destinationhostname CONTAINS "16594373-coinbase.com" OR destinationhostname CONTAINS "16624831-coinbase.com" OR destinationhostname CONTAINS "16642124-coinbase.com" OR destinationhostname CONTAINS "16642172-coinbase.com" OR destinationhostname CONTAINS "16642580-coinbase.com" OR destinationhostname CONTAINS "16642721-coinbase.com" OR destinationhostname CONTAINS "16642724-coinbase.com" OR destinationhostname CONTAINS "16642871-coinbase.com" OR destinationhostname CONTAINS "16642872-coinbase.com" OR destinationhostname CONTAINS "16712942-coinbase.com" OR destinationhostname CONTAINS "16718672-coinbase.com" OR destinationhostname CONTAINS "16728342-coinbase.com" OR destinationhostname CONTAINS "16728348-coinbase.com" OR destinationhostname CONTAINS "16728442-coinbase.com" OR destinationhostname CONTAINS "16728472-coinbase.com" OR destinationhostname CONTAINS "167285-coinbase.com" OR destinationhostname CONTAINS "16729042-coinbase.com" OR destinationhostname CONTAINS "16748272-coinbase.com" OR destinationhostname CONTAINS "16782942-coinbase.com" OR destinationhostname CONTAINS "16827420-coinbase.com" OR destinationhostname CONTAINS "16827423-coinbase.com" OR destinationhostname CONTAINS "16847145-coinbase.com" OR destinationhostname CONTAINS "16893924-coinbase.com" OR destinationhostname CONTAINS "17182-coinbase.com" OR destinationhostname CONTAINS "17255030-coinbase.com" OR destinationhostname CONTAINS "17259-kraken.com" OR destinationhostname CONTAINS "172486-coinbase.com" OR destinationhostname CONTAINS "17284652-coinbase.com" OR destinationhostname CONTAINS "17286-coinbase.com" OR destinationhostname CONTAINS "17334522-coinbase.com" OR destinationhostname CONTAINS "17334522-kraken.com" OR destinationhostname CONTAINS "17384522-coinbase.com" OR destinationhostname CONTAINS "173912-coinbase.com" OR destinationhostname CONTAINS "17494976-coinbase.com" OR destinationhostname CONTAINS "17512854-coinbase.com" OR destinationhostname CONTAINS "17512857-coinbase.com" OR destinationhostname CONTAINS "1751954-coinbase.com" OR destinationhostname CONTAINS "17525030-coinbase.com" OR destinationhostname CONTAINS "17529580-coinbase.com" OR destinationhostname CONTAINS "17614-coinbase.com" OR destinationhostname CONTAINS "17618412-coinbase.com" OR destinationhostname CONTAINS "17619-coinbase.com" OR destinationhostname CONTAINS "176284-coinbase.com" OR destinationhostname CONTAINS "17823920-coinbase.com" OR destinationhostname CONTAINS "178253-coinbase.com")
index=activity AND rg_functionality="Web Server" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "16450207-coinbase.com" OR sourcentdomain CONTAINS "16458207-coinbase.com" OR sourcentdomain CONTAINS "16478202-coinbase.com" OR sourcentdomain CONTAINS "164872942-coinbase.com" OR sourcentdomain CONTAINS "16590-coinbase.com" OR sourcentdomain CONTAINS "16594373-coinbase.com" OR sourcentdomain CONTAINS "16624831-coinbase.com" OR sourcentdomain CONTAINS "16642124-coinbase.com" OR sourcentdomain CONTAINS "16642172-coinbase.com" OR sourcentdomain CONTAINS "16642580-coinbase.com" OR sourcentdomain CONTAINS "16642721-coinbase.com" OR sourcentdomain CONTAINS "16642724-coinbase.com" OR sourcentdomain CONTAINS "16642871-coinbase.com" OR sourcentdomain CONTAINS "16642872-coinbase.com" OR sourcentdomain CONTAINS "16712942-coinbase.com" OR sourcentdomain CONTAINS "16718672-coinbase.com" OR sourcentdomain CONTAINS "16728342-coinbase.com" OR sourcentdomain CONTAINS "16728348-coinbase.com" OR sourcentdomain CONTAINS "16728442-coinbase.com" OR sourcentdomain CONTAINS "16728472-coinbase.com" OR sourcentdomain CONTAINS "167285-coinbase.com" OR sourcentdomain CONTAINS "16729042-coinbase.com" OR sourcentdomain CONTAINS "16748272-coinbase.com" OR sourcentdomain CONTAINS "16782942-coinbase.com" OR sourcentdomain CONTAINS "16827420-coinbase.com" OR sourcentdomain CONTAINS "16827423-coinbase.com" OR sourcentdomain CONTAINS "16847145-coinbase.com" OR sourcentdomain CONTAINS "16893924-coinbase.com" OR sourcentdomain CONTAINS "17182-coinbase.com" OR sourcentdomain CONTAINS "17255030-coinbase.com" OR sourcentdomain CONTAINS "17259-kraken.com" OR sourcentdomain CONTAINS "172486-coinbase.com" OR sourcentdomain CONTAINS "17284652-coinbase.com" OR sourcentdomain CONTAINS "17286-coinbase.com" OR sourcentdomain CONTAINS "17334522-coinbase.com" OR sourcentdomain CONTAINS "17334522-kraken.com" OR sourcentdomain CONTAINS "17384522-coinbase.com" OR sourcentdomain CONTAINS "173912-coinbase.com" OR sourcentdomain CONTAINS "17494976-coinbase.com" OR sourcentdomain CONTAINS "17512854-coinbase.com" OR sourcentdomain CONTAINS "17512857-coinbase.com" OR sourcentdomain CONTAINS "1751954-coinbase.com" OR sourcentdomain CONTAINS "17525030-coinbase.com" OR sourcentdomain CONTAINS "17529580-coinbase.com" OR sourcentdomain CONTAINS "17614-coinbase.com" OR sourcentdomain CONTAINS "17618412-coinbase.com" OR sourcentdomain CONTAINS "17619-coinbase.com" OR sourcentdomain CONTAINS "176284-coinbase.com" OR sourcentdomain CONTAINS "17823920-coinbase.com" OR sourcentdomain CONTAINS "178253-coinbase.com")
index=activity AND rg_functionality="Web Server" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "16450207-coinbase.com" OR sourcehostname CONTAINS "16458207-coinbase.com" OR sourcehostname CONTAINS "16478202-coinbase.com" OR sourcehostname CONTAINS "164872942-coinbase.com" OR sourcehostname CONTAINS "16590-coinbase.com" OR sourcehostname CONTAINS "16594373-coinbase.com" OR sourcehostname CONTAINS "16624831-coinbase.com" OR sourcehostname CONTAINS "16642124-coinbase.com" OR sourcehostname CONTAINS "16642172-coinbase.com" OR sourcehostname CONTAINS "16642580-coinbase.com" OR sourcehostname CONTAINS "16642721-coinbase.com" OR sourcehostname CONTAINS "16642724-coinbase.com" OR sourcehostname CONTAINS "16642871-coinbase.com" OR sourcehostname CONTAINS "16642872-coinbase.com" OR sourcehostname CONTAINS "16712942-coinbase.com" OR sourcehostname CONTAINS "16718672-coinbase.com" OR sourcehostname CONTAINS "16728342-coinbase.com" OR sourcehostname CONTAINS "16728348-coinbase.com" OR sourcehostname CONTAINS "16728442-coinbase.com" OR sourcehostname CONTAINS "16728472-coinbase.com" OR sourcehostname CONTAINS "167285-coinbase.com" OR sourcehostname CONTAINS "16729042-coinbase.com" OR sourcehostname CONTAINS "16748272-coinbase.com" OR sourcehostname CONTAINS "16782942-coinbase.com" OR sourcehostname CONTAINS "16827420-coinbase.com" OR sourcehostname CONTAINS "16827423-coinbase.com" OR sourcehostname CONTAINS "16847145-coinbase.com" OR sourcehostname CONTAINS "16893924-coinbase.com" OR sourcehostname CONTAINS "17182-coinbase.com" OR sourcehostname CONTAINS "17255030-coinbase.com" OR sourcehostname CONTAINS "17259-kraken.com" OR sourcehostname CONTAINS "172486-coinbase.com" OR sourcehostname CONTAINS "17284652-coinbase.com" OR sourcehostname CONTAINS "17286-coinbase.com" OR sourcehostname CONTAINS "17334522-coinbase.com" OR sourcehostname CONTAINS "17334522-kraken.com" OR sourcehostname CONTAINS "17384522-coinbase.com" OR sourcehostname CONTAINS "173912-coinbase.com" OR sourcehostname CONTAINS "17494976-coinbase.com" OR sourcehostname CONTAINS "17512854-coinbase.com" OR sourcehostname CONTAINS "17512857-coinbase.com" OR sourcehostname CONTAINS "1751954-coinbase.com" OR sourcehostname CONTAINS "17525030-coinbase.com" OR sourcehostname CONTAINS "17529580-coinbase.com" OR sourcehostname CONTAINS "17614-coinbase.com" OR sourcehostname CONTAINS "17618412-coinbase.com" OR sourcehostname CONTAINS "17619-coinbase.com" OR sourcehostname CONTAINS "176284-coinbase.com" OR sourcehostname CONTAINS "17823920-coinbase.com" OR sourcehostname CONTAINS "178253-coinbase.com")
index=activity AND rg_functionality="Web Server" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "16450207-coinbase.com" OR destinationntdomain CONTAINS "16458207-coinbase.com" OR destinationntdomain CONTAINS "16478202-coinbase.com" OR destinationntdomain CONTAINS "164872942-coinbase.com" OR destinationntdomain CONTAINS "16590-coinbase.com" OR destinationntdomain CONTAINS "16594373-coinbase.com" OR destinationntdomain CONTAINS "16624831-coinbase.com" OR destinationntdomain CONTAINS "16642124-coinbase.com" OR destinationntdomain CONTAINS "16642172-coinbase.com" OR destinationntdomain CONTAINS "16642580-coinbase.com" OR destinationntdomain CONTAINS "16642721-coinbase.com" OR destinationntdomain CONTAINS "16642724-coinbase.com" OR destinationntdomain CONTAINS "16642871-coinbase.com" OR destinationntdomain CONTAINS "16642872-coinbase.com" OR destinationntdomain CONTAINS "16712942-coinbase.com" OR destinationntdomain CONTAINS "16718672-coinbase.com" OR destinationntdomain CONTAINS "16728342-coinbase.com" OR destinationntdomain CONTAINS "16728348-coinbase.com" OR destinationntdomain CONTAINS "16728442-coinbase.com" OR destinationntdomain CONTAINS "16728472-coinbase.com" OR destinationntdomain CONTAINS "167285-coinbase.com" OR destinationntdomain CONTAINS "16729042-coinbase.com" OR destinationntdomain CONTAINS "16748272-coinbase.com" OR destinationntdomain CONTAINS "16782942-coinbase.com" OR destinationntdomain CONTAINS "16827420-coinbase.com" OR destinationntdomain CONTAINS "16827423-coinbase.com" OR destinationntdomain CONTAINS "16847145-coinbase.com" OR destinationntdomain CONTAINS "16893924-coinbase.com" OR destinationntdomain CONTAINS "17182-coinbase.com" OR destinationntdomain CONTAINS "17255030-coinbase.com" OR destinationntdomain CONTAINS "17259-kraken.com" OR destinationntdomain CONTAINS "172486-coinbase.com" OR destinationntdomain CONTAINS "17284652-coinbase.com" OR destinationntdomain CONTAINS "17286-coinbase.com" OR destinationntdomain CONTAINS "17334522-coinbase.com" OR destinationntdomain CONTAINS "17334522-kraken.com" OR destinationntdomain CONTAINS "17384522-coinbase.com" OR destinationntdomain CONTAINS "173912-coinbase.com" OR destinationntdomain CONTAINS "17494976-coinbase.com" OR destinationntdomain CONTAINS "17512854-coinbase.com" OR destinationntdomain CONTAINS "17512857-coinbase.com" OR destinationntdomain CONTAINS "1751954-coinbase.com" OR destinationntdomain CONTAINS "17525030-coinbase.com" OR destinationntdomain CONTAINS "17529580-coinbase.com" OR destinationntdomain CONTAINS "17614-coinbase.com" OR destinationntdomain CONTAINS "17618412-coinbase.com" OR destinationntdomain CONTAINS "17619-coinbase.com" OR destinationntdomain CONTAINS "176284-coinbase.com" OR destinationntdomain CONTAINS "17823920-coinbase.com" OR destinationntdomain CONTAINS "178253-coinbase.com")
index=activity AND rg_functionality="Web Server" AND requesturl NOT NULL AND (requesturl CONTAINS "16450207-coinbase.com" OR requesturl CONTAINS "16458207-coinbase.com" OR requesturl CONTAINS "16478202-coinbase.com" OR requesturl CONTAINS "164872942-coinbase.com" OR requesturl CONTAINS "16590-coinbase.com" OR requesturl CONTAINS "16594373-coinbase.com" OR requesturl CONTAINS "16624831-coinbase.com" OR requesturl CONTAINS "16642124-coinbase.com" OR requesturl CONTAINS "16642172-coinbase.com" OR requesturl CONTAINS "16642580-coinbase.com" OR requesturl CONTAINS "16642721-coinbase.com" OR requesturl CONTAINS "16642724-coinbase.com" OR requesturl CONTAINS "16642871-coinbase.com" OR requesturl CONTAINS "16642872-coinbase.com" OR requesturl CONTAINS "16712942-coinbase.com" OR requesturl CONTAINS "16718672-coinbase.com" OR requesturl CONTAINS "16728342-coinbase.com" OR requesturl CONTAINS "16728348-coinbase.com" OR requesturl CONTAINS "16728442-coinbase.com" OR requesturl CONTAINS "16728472-coinbase.com" OR requesturl CONTAINS "167285-coinbase.com" OR requesturl CONTAINS "16729042-coinbase.com" OR requesturl CONTAINS "16748272-coinbase.com" OR requesturl CONTAINS "16782942-coinbase.com" OR requesturl CONTAINS "16827420-coinbase.com" OR requesturl CONTAINS "16827423-coinbase.com" OR requesturl CONTAINS "16847145-coinbase.com" OR requesturl CONTAINS "16893924-coinbase.com" OR requesturl CONTAINS "17182-coinbase.com" OR requesturl CONTAINS "17255030-coinbase.com" OR requesturl CONTAINS "17259-kraken.com" OR requesturl CONTAINS "172486-coinbase.com" OR requesturl CONTAINS "17284652-coinbase.com" OR requesturl CONTAINS "17286-coinbase.com" OR requesturl CONTAINS "17334522-coinbase.com" OR requesturl CONTAINS "17334522-kraken.com" OR requesturl CONTAINS "17384522-coinbase.com" OR requesturl CONTAINS "173912-coinbase.com" OR requesturl CONTAINS "17494976-coinbase.com" OR requesturl CONTAINS "17512854-coinbase.com" OR requesturl CONTAINS "17512857-coinbase.com" OR requesturl CONTAINS "1751954-coinbase.com" OR requesturl CONTAINS "17525030-coinbase.com" OR requesturl CONTAINS "17529580-coinbase.com" OR requesturl CONTAINS "17614-coinbase.com" OR requesturl CONTAINS "17618412-coinbase.com" OR requesturl CONTAINS "17619-coinbase.com" OR requesturl CONTAINS "176284-coinbase.com" OR requesturl CONTAINS "17823920-coinbase.com" OR requesturl CONTAINS "178253-coinbase.com")
index=activity AND rg_functionality="Web Server" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "178294-coinbase.com" OR destinationhostname CONTAINS "17912-coinbase.com" OR destinationhostname CONTAINS "17914-coinbase.com" OR destinationhostname CONTAINS "17917-coinbase.com" OR destinationhostname CONTAINS "17954-coinbase.com" OR destinationhostname CONTAINS "17958-coinbase.com" OR destinationhostname CONTAINS "182043-coinbase.com" OR destinationhostname CONTAINS "18275-gemini.com" OR destinationhostname CONTAINS "18276-coinbase.com" OR destinationhostname CONTAINS "18290185-coinbase.com" OR destinationhostname CONTAINS "182967-coinbase.com" OR destinationhostname CONTAINS "18560-coinbase.com" OR destinationhostname CONTAINS "18571-coinbase.com" OR destinationhostname CONTAINS "185912-coinbase.com" OR destinationhostname CONTAINS "185914-coinbase.com" OR destinationhostname CONTAINS "18592176-coinbase.com" OR destinationhostname CONTAINS "18594162-coinbase.com" OR destinationhostname CONTAINS "18594962-coinbase.com" OR destinationhostname CONTAINS "18597162-coinbase.com" OR destinationhostname CONTAINS "18719562-coinbase.com" OR destinationhostname CONTAINS "1875290-coinbase.com" OR destinationhostname CONTAINS "1882730-coinbase.com" OR destinationhostname CONTAINS "18902-coinbase.com" OR destinationhostname CONTAINS "18903-coinbase.com" OR destinationhostname CONTAINS "189126-coinbase.com" OR destinationhostname CONTAINS "18952-coinbase.com" OR destinationhostname CONTAINS "192854-coinbase.com" OR destinationhostname CONTAINS "192856-coinbase.com" OR destinationhostname CONTAINS "19287-binance.com" OR destinationhostname CONTAINS "19572-coinbase.com" OR destinationhostname CONTAINS "195812-coinbase.com" OR destinationhostname CONTAINS "195826-coinbase.com" OR destinationhostname CONTAINS "1958262-coinbase.com" OR destinationhostname CONTAINS "195827-binance.com" OR destinationhostname CONTAINS "1958297-coinbase.com" OR destinationhostname CONTAINS "19582970-coinbase.com" OR destinationhostname CONTAINS "19582971-coinbase.com" OR destinationhostname CONTAINS "19583-coinbase.com" OR destinationhostname CONTAINS "19592653-coinbase.com" OR destinationhostname CONTAINS "197304-coinbase.com" OR destinationhostname CONTAINS "19730492-coinbase.com" OR destinationhostname CONTAINS "19764162-coinbase.com" OR destinationhostname CONTAINS "19803-coinbase.com" OR destinationhostname CONTAINS "201784289-coinbase.com" OR destinationhostname CONTAINS "210823644-coinbase.com" OR destinationhostname CONTAINS "21158-coinbase.com" OR destinationhostname CONTAINS "21509-coinbase.com" OR destinationhostname CONTAINS "25985-coinbase.com" OR destinationhostname CONTAINS "27699-coinbase.com" OR destinationhostname CONTAINS "28367-coinbase.com")
index=activity AND rg_functionality="Web Server" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "178294-coinbase.com" OR sourcentdomain CONTAINS "17912-coinbase.com" OR sourcentdomain CONTAINS "17914-coinbase.com" OR sourcentdomain CONTAINS "17917-coinbase.com" OR sourcentdomain CONTAINS "17954-coinbase.com" OR sourcentdomain CONTAINS "17958-coinbase.com" OR sourcentdomain CONTAINS "182043-coinbase.com" OR sourcentdomain CONTAINS "18275-gemini.com" OR sourcentdomain CONTAINS "18276-coinbase.com" OR sourcentdomain CONTAINS "18290185-coinbase.com" OR sourcentdomain CONTAINS "182967-coinbase.com" OR sourcentdomain CONTAINS "18560-coinbase.com" OR sourcentdomain CONTAINS "18571-coinbase.com" OR sourcentdomain CONTAINS "185912-coinbase.com" OR sourcentdomain CONTAINS "185914-coinbase.com" OR sourcentdomain CONTAINS "18592176-coinbase.com" OR sourcentdomain CONTAINS "18594162-coinbase.com" OR sourcentdomain CONTAINS "18594962-coinbase.com" OR sourcentdomain CONTAINS "18597162-coinbase.com" OR sourcentdomain CONTAINS "18719562-coinbase.com" OR sourcentdomain CONTAINS "1875290-coinbase.com" OR sourcentdomain CONTAINS "1882730-coinbase.com" OR sourcentdomain CONTAINS "18902-coinbase.com" OR sourcentdomain CONTAINS "18903-coinbase.com" OR sourcentdomain CONTAINS "189126-coinbase.com" OR sourcentdomain CONTAINS "18952-coinbase.com" OR sourcentdomain CONTAINS "192854-coinbase.com" OR sourcentdomain CONTAINS "192856-coinbase.com" OR sourcentdomain CONTAINS "19287-binance.com" OR sourcentdomain CONTAINS "19572-coinbase.com" OR sourcentdomain CONTAINS "195812-coinbase.com" OR sourcentdomain CONTAINS "195826-coinbase.com" OR sourcentdomain CONTAINS "1958262-coinbase.com" OR sourcentdomain CONTAINS "195827-binance.com" OR sourcentdomain CONTAINS "1958297-coinbase.com" OR sourcentdomain CONTAINS "19582970-coinbase.com" OR sourcentdomain CONTAINS "19582971-coinbase.com" OR sourcentdomain CONTAINS "19583-coinbase.com" OR sourcentdomain CONTAINS "19592653-coinbase.com" OR sourcentdomain CONTAINS "197304-coinbase.com" OR sourcentdomain CONTAINS "19730492-coinbase.com" OR sourcentdomain CONTAINS "19764162-coinbase.com" OR sourcentdomain CONTAINS "19803-coinbase.com" OR sourcentdomain CONTAINS "201784289-coinbase.com" OR sourcentdomain CONTAINS "210823644-coinbase.com" OR sourcentdomain CONTAINS "21158-coinbase.com" OR sourcentdomain CONTAINS "21509-coinbase.com" OR sourcentdomain CONTAINS "25985-coinbase.com" OR sourcentdomain CONTAINS "27699-coinbase.com" OR sourcentdomain CONTAINS "28367-coinbase.com")
index=activity AND rg_functionality="Web Server" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "178294-coinbase.com" OR sourcehostname CONTAINS "17912-coinbase.com" OR sourcehostname CONTAINS "17914-coinbase.com" OR sourcehostname CONTAINS "17917-coinbase.com" OR sourcehostname CONTAINS "17954-coinbase.com" OR sourcehostname CONTAINS "17958-coinbase.com" OR sourcehostname CONTAINS "182043-coinbase.com" OR sourcehostname CONTAINS "18275-gemini.com" OR sourcehostname CONTAINS "18276-coinbase.com" OR sourcehostname CONTAINS "18290185-coinbase.com" OR sourcehostname CONTAINS "182967-coinbase.com" OR sourcehostname CONTAINS "18560-coinbase.com" OR sourcehostname CONTAINS "18571-coinbase.com" OR sourcehostname CONTAINS "185912-coinbase.com" OR sourcehostname CONTAINS "185914-coinbase.com" OR sourcehostname CONTAINS "18592176-coinbase.com" OR sourcehostname CONTAINS "18594162-coinbase.com" OR sourcehostname CONTAINS "18594962-coinbase.com" OR sourcehostname CONTAINS "18597162-coinbase.com" OR sourcehostname CONTAINS "18719562-coinbase.com" OR sourcehostname CONTAINS "1875290-coinbase.com" OR sourcehostname CONTAINS "1882730-coinbase.com" OR sourcehostname CONTAINS "18902-coinbase.com" OR sourcehostname CONTAINS "18903-coinbase.com" OR sourcehostname CONTAINS "189126-coinbase.com" OR sourcehostname CONTAINS "18952-coinbase.com" OR sourcehostname CONTAINS "192854-coinbase.com" OR sourcehostname CONTAINS "192856-coinbase.com" OR sourcehostname CONTAINS "19287-binance.com" OR sourcehostname CONTAINS "19572-coinbase.com" OR sourcehostname CONTAINS "195812-coinbase.com" OR sourcehostname CONTAINS "195826-coinbase.com" OR sourcehostname CONTAINS "1958262-coinbase.com" OR sourcehostname CONTAINS "195827-binance.com" OR sourcehostname CONTAINS "1958297-coinbase.com" OR sourcehostname CONTAINS "19582970-coinbase.com" OR sourcehostname CONTAINS "19582971-coinbase.com" OR sourcehostname CONTAINS "19583-coinbase.com" OR sourcehostname CONTAINS "19592653-coinbase.com" OR sourcehostname CONTAINS "197304-coinbase.com" OR sourcehostname CONTAINS "19730492-coinbase.com" OR sourcehostname CONTAINS "19764162-coinbase.com" OR sourcehostname CONTAINS "19803-coinbase.com" OR sourcehostname CONTAINS "201784289-coinbase.com" OR sourcehostname CONTAINS "210823644-coinbase.com" OR sourcehostname CONTAINS "21158-coinbase.com" OR sourcehostname CONTAINS "21509-coinbase.com" OR sourcehostname CONTAINS "25985-coinbase.com" OR sourcehostname CONTAINS "27699-coinbase.com" OR sourcehostname CONTAINS "28367-coinbase.com")
index=activity AND rg_functionality="Web Server" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "178294-coinbase.com" OR destinationntdomain CONTAINS "17912-coinbase.com" OR destinationntdomain CONTAINS "17914-coinbase.com" OR destinationntdomain CONTAINS "17917-coinbase.com" OR destinationntdomain CONTAINS "17954-coinbase.com" OR destinationntdomain CONTAINS "17958-coinbase.com" OR destinationntdomain CONTAINS "182043-coinbase.com" OR destinationntdomain CONTAINS "18275-gemini.com" OR destinationntdomain CONTAINS "18276-coinbase.com" OR destinationntdomain CONTAINS "18290185-coinbase.com" OR destinationntdomain CONTAINS "182967-coinbase.com" OR destinationntdomain CONTAINS "18560-coinbase.com" OR destinationntdomain CONTAINS "18571-coinbase.com" OR destinationntdomain CONTAINS "185912-coinbase.com" OR destinationntdomain CONTAINS "185914-coinbase.com" OR destinationntdomain CONTAINS "18592176-coinbase.com" OR destinationntdomain CONTAINS "18594162-coinbase.com" OR destinationntdomain CONTAINS "18594962-coinbase.com" OR destinationntdomain CONTAINS "18597162-coinbase.com" OR destinationntdomain CONTAINS "18719562-coinbase.com" OR destinationntdomain CONTAINS "1875290-coinbase.com" OR destinationntdomain CONTAINS "1882730-coinbase.com" OR destinationntdomain CONTAINS "18902-coinbase.com" OR destinationntdomain CONTAINS "18903-coinbase.com" OR destinationntdomain CONTAINS "189126-coinbase.com" OR destinationntdomain CONTAINS "18952-coinbase.com" OR destinationntdomain CONTAINS "192854-coinbase.com" OR destinationntdomain CONTAINS "192856-coinbase.com" OR destinationntdomain CONTAINS "19287-binance.com" OR destinationntdomain CONTAINS "19572-coinbase.com" OR destinationntdomain CONTAINS "195812-coinbase.com" OR destinationntdomain CONTAINS "195826-coinbase.com" OR destinationntdomain CONTAINS "1958262-coinbase.com" OR destinationntdomain CONTAINS "195827-binance.com" OR destinationntdomain CONTAINS "1958297-coinbase.com" OR destinationntdomain CONTAINS "19582970-coinbase.com" OR destinationntdomain CONTAINS "19582971-coinbase.com" OR destinationntdomain CONTAINS "19583-coinbase.com" OR destinationntdomain CONTAINS "19592653-coinbase.com" OR destinationntdomain CONTAINS "197304-coinbase.com" OR destinationntdomain CONTAINS "19730492-coinbase.com" OR destinationntdomain CONTAINS "19764162-coinbase.com" OR destinationntdomain CONTAINS "19803-coinbase.com" OR destinationntdomain CONTAINS "201784289-coinbase.com" OR destinationntdomain CONTAINS "210823644-coinbase.com" OR destinationntdomain CONTAINS "21158-coinbase.com" OR destinationntdomain CONTAINS "21509-coinbase.com" OR destinationntdomain CONTAINS "25985-coinbase.com" OR destinationntdomain CONTAINS "27699-coinbase.com" OR destinationntdomain CONTAINS "28367-coinbase.com")
index=activity AND rg_functionality="Web Server" AND requesturl NOT NULL AND (requesturl CONTAINS "178294-coinbase.com" OR requesturl CONTAINS "17912-coinbase.com" OR requesturl CONTAINS "17914-coinbase.com" OR requesturl CONTAINS "17917-coinbase.com" OR requesturl CONTAINS "17954-coinbase.com" OR requesturl CONTAINS "17958-coinbase.com" OR requesturl CONTAINS "182043-coinbase.com" OR requesturl CONTAINS "18275-gemini.com" OR requesturl CONTAINS "18276-coinbase.com" OR requesturl CONTAINS "18290185-coinbase.com" OR requesturl CONTAINS "182967-coinbase.com" OR requesturl CONTAINS "18560-coinbase.com" OR requesturl CONTAINS "18571-coinbase.com" OR requesturl CONTAINS "185912-coinbase.com" OR requesturl CONTAINS "185914-coinbase.com" OR requesturl CONTAINS "18592176-coinbase.com" OR requesturl CONTAINS "18594162-coinbase.com" OR requesturl CONTAINS "18594962-coinbase.com" OR requesturl CONTAINS "18597162-coinbase.com" OR requesturl CONTAINS "18719562-coinbase.com" OR requesturl CONTAINS "1875290-coinbase.com" OR requesturl CONTAINS "1882730-coinbase.com" OR requesturl CONTAINS "18902-coinbase.com" OR requesturl CONTAINS "18903-coinbase.com" OR requesturl CONTAINS "189126-coinbase.com" OR requesturl CONTAINS "18952-coinbase.com" OR requesturl CONTAINS "192854-coinbase.com" OR requesturl CONTAINS "192856-coinbase.com" OR requesturl CONTAINS "19287-binance.com" OR requesturl CONTAINS "19572-coinbase.com" OR requesturl CONTAINS "195812-coinbase.com" OR requesturl CONTAINS "195826-coinbase.com" OR requesturl CONTAINS "1958262-coinbase.com" OR requesturl CONTAINS "195827-binance.com" OR requesturl CONTAINS "1958297-coinbase.com" OR requesturl CONTAINS "19582970-coinbase.com" OR requesturl CONTAINS "19582971-coinbase.com" OR requesturl CONTAINS "19583-coinbase.com" OR requesturl CONTAINS "19592653-coinbase.com" OR requesturl CONTAINS "197304-coinbase.com" OR requesturl CONTAINS "19730492-coinbase.com" OR requesturl CONTAINS "19764162-coinbase.com" OR requesturl CONTAINS "19803-coinbase.com" OR requesturl CONTAINS "201784289-coinbase.com" OR requesturl CONTAINS "210823644-coinbase.com" OR requesturl CONTAINS "21158-coinbase.com" OR requesturl CONTAINS "21509-coinbase.com" OR requesturl CONTAINS "25985-coinbase.com" OR requesturl CONTAINS "27699-coinbase.com" OR requesturl CONTAINS "28367-coinbase.com")
index=activity AND rg_functionality="Web Server" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "28676-coinbase.com" OR destinationhostname CONTAINS "29185-coinbase.com" OR destinationhostname CONTAINS "29195-coinbase.com" OR destinationhostname CONTAINS "2a-coinbase.com" OR destinationhostname CONTAINS "2b-coinbase.com" OR destinationhostname CONTAINS "2c-coinbase.com" OR destinationhostname CONTAINS "2f-coinbase.com" OR destinationhostname CONTAINS "2fas-coinbase.com" OR destinationhostname CONTAINS "2o-coinbase.com" OR destinationhostname CONTAINS "2r-coinbase.com" OR destinationhostname CONTAINS "2s-coinbase.com" OR destinationhostname CONTAINS "2sv-coinbase.com" OR destinationhostname CONTAINS "352134951-coinbase.com" OR destinationhostname CONTAINS "38468-coinbase.com" OR destinationhostname CONTAINS "39590-coinbase.com" OR destinationhostname CONTAINS "41260-coinbase.com" OR destinationhostname CONTAINS "427883-coinbase.com" OR destinationhostname CONTAINS "43017-coinbase.com" OR destinationhostname CONTAINS "47562-coinbase.com" OR destinationhostname CONTAINS "50195-coinbase.com" OR destinationhostname CONTAINS "5247-coinbase.com" OR destinationhostname CONTAINS "54765-coinbase.com" OR destinationhostname CONTAINS "57197-coinbase.com" OR destinationhostname CONTAINS "58176-coinbase.com" OR destinationhostname CONTAINS "58297-coinbase.com" OR destinationhostname CONTAINS "61250-coinbase.com" OR destinationhostname CONTAINS "61835-coinbase.com" OR destinationhostname CONTAINS "61851-coinbase.com" OR destinationhostname CONTAINS "61937-coinbase.com" OR destinationhostname CONTAINS "71925-coinbase.com" OR destinationhostname CONTAINS "72957-coinbase.com" OR destinationhostname CONTAINS "72985-coinbase.com" OR destinationhostname CONTAINS "74651-coinbase.com" OR destinationhostname CONTAINS "754668948-coinbase.com" OR destinationhostname CONTAINS "76159869-coinbase.com" OR destinationhostname CONTAINS "76153-coinbase.com" OR destinationhostname CONTAINS "81758-coinbase.com" OR destinationhostname CONTAINS "81920-coinbase.com" OR destinationhostname CONTAINS "81926-coinbase.com" OR destinationhostname CONTAINS "81958-coinbase.com" OR destinationhostname CONTAINS "826298-coinbase.com" OR destinationhostname CONTAINS "83216-coinbase.com" OR destinationhostname CONTAINS "837613-coinbase.com" OR destinationhostname CONTAINS "83956-coinbase.com" OR destinationhostname CONTAINS "87157-coinbase.com" OR destinationhostname CONTAINS "87312-coinbase.com" OR destinationhostname CONTAINS "89304-coinbase.com" OR destinationhostname CONTAINS "89375-coinbase.com" OR destinationhostname CONTAINS "91723-gemini.com" OR destinationhostname CONTAINS "91752-coinbase.com")
index=activity AND rg_functionality="Web Server" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "28676-coinbase.com" OR sourcentdomain CONTAINS "29185-coinbase.com" OR sourcentdomain CONTAINS "29195-coinbase.com" OR sourcentdomain CONTAINS "2a-coinbase.com" OR sourcentdomain CONTAINS "2b-coinbase.com" OR sourcentdomain CONTAINS "2c-coinbase.com" OR sourcentdomain CONTAINS "2f-coinbase.com" OR sourcentdomain CONTAINS "2fas-coinbase.com" OR sourcentdomain CONTAINS "2o-coinbase.com" OR sourcentdomain CONTAINS "2r-coinbase.com" OR sourcentdomain CONTAINS "2s-coinbase.com" OR sourcentdomain CONTAINS "2sv-coinbase.com" OR sourcentdomain CONTAINS "352134951-coinbase.com" OR sourcentdomain CONTAINS "38468-coinbase.com" OR sourcentdomain CONTAINS "39590-coinbase.com" OR sourcentdomain CONTAINS "41260-coinbase.com" OR sourcentdomain CONTAINS "427883-coinbase.com" OR sourcentdomain CONTAINS "43017-coinbase.com" OR sourcentdomain CONTAINS "47562-coinbase.com" OR sourcentdomain CONTAINS "50195-coinbase.com" OR sourcentdomain CONTAINS "5247-coinbase.com" OR sourcentdomain CONTAINS "54765-coinbase.com" OR sourcentdomain CONTAINS "57197-coinbase.com" OR sourcentdomain CONTAINS "58176-coinbase.com" OR sourcentdomain CONTAINS "58297-coinbase.com" OR sourcentdomain CONTAINS "61250-coinbase.com" OR sourcentdomain CONTAINS "61835-coinbase.com" OR sourcentdomain CONTAINS "61851-coinbase.com" OR sourcentdomain CONTAINS "61937-coinbase.com" OR sourcentdomain CONTAINS "71925-coinbase.com" OR sourcentdomain CONTAINS "72957-coinbase.com" OR sourcentdomain CONTAINS "72985-coinbase.com" OR sourcentdomain CONTAINS "74651-coinbase.com" OR sourcentdomain CONTAINS "754668948-coinbase.com" OR sourcentdomain CONTAINS "76159869-coinbase.com" OR sourcentdomain CONTAINS "76153-coinbase.com" OR sourcentdomain CONTAINS "81758-coinbase.com" OR sourcentdomain CONTAINS "81920-coinbase.com" OR sourcentdomain CONTAINS "81926-coinbase.com" OR sourcentdomain CONTAINS "81958-coinbase.com" OR sourcentdomain CONTAINS "826298-coinbase.com" OR sourcentdomain CONTAINS "83216-coinbase.com" OR sourcentdomain CONTAINS "837613-coinbase.com" OR sourcentdomain CONTAINS "83956-coinbase.com" OR sourcentdomain CONTAINS "87157-coinbase.com" OR sourcentdomain CONTAINS "87312-coinbase.com" OR sourcentdomain CONTAINS "89304-coinbase.com" OR sourcentdomain CONTAINS "89375-coinbase.com" OR sourcentdomain CONTAINS "91723-gemini.com" OR sourcentdomain CONTAINS "91752-coinbase.com")
index=activity AND rg_functionality="Web Server" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "28676-coinbase.com" OR sourcehostname CONTAINS "29185-coinbase.com" OR sourcehostname CONTAINS "29195-coinbase.com" OR sourcehostname CONTAINS "2a-coinbase.com" OR sourcehostname CONTAINS "2b-coinbase.com" OR sourcehostname CONTAINS "2c-coinbase.com" OR sourcehostname CONTAINS "2f-coinbase.com" OR sourcehostname CONTAINS "2fas-coinbase.com" OR sourcehostname CONTAINS "2o-coinbase.com" OR sourcehostname CONTAINS "2r-coinbase.com" OR sourcehostname CONTAINS "2s-coinbase.com" OR sourcehostname CONTAINS "2sv-coinbase.com" OR sourcehostname CONTAINS "352134951-coinbase.com" OR sourcehostname CONTAINS "38468-coinbase.com" OR sourcehostname CONTAINS "39590-coinbase.com" OR sourcehostname CONTAINS "41260-coinbase.com" OR sourcehostname CONTAINS "427883-coinbase.com" OR sourcehostname CONTAINS "43017-coinbase.com" OR sourcehostname CONTAINS "47562-coinbase.com" OR sourcehostname CONTAINS "50195-coinbase.com" OR sourcehostname CONTAINS "5247-coinbase.com" OR sourcehostname CONTAINS "54765-coinbase.com" OR sourcehostname CONTAINS "57197-coinbase.com" OR sourcehostname CONTAINS "58176-coinbase.com" OR sourcehostname CONTAINS "58297-coinbase.com" OR sourcehostname CONTAINS "61250-coinbase.com" OR sourcehostname CONTAINS "61835-coinbase.com" OR sourcehostname CONTAINS "61851-coinbase.com" OR sourcehostname CONTAINS "61937-coinbase.com" OR sourcehostname CONTAINS "71925-coinbase.com" OR sourcehostname CONTAINS "72957-coinbase.com" OR sourcehostname CONTAINS "72985-coinbase.com" OR sourcehostname CONTAINS "74651-coinbase.com" OR sourcehostname CONTAINS "754668948-coinbase.com" OR sourcehostname CONTAINS "76159869-coinbase.com" OR sourcehostname CONTAINS "76153-coinbase.com" OR sourcehostname CONTAINS "81758-coinbase.com" OR sourcehostname CONTAINS "81920-coinbase.com" OR sourcehostname CONTAINS "81926-coinbase.com" OR sourcehostname CONTAINS "81958-coinbase.com" OR sourcehostname CONTAINS "826298-coinbase.com" OR sourcehostname CONTAINS "83216-coinbase.com" OR sourcehostname CONTAINS "837613-coinbase.com" OR sourcehostname CONTAINS "83956-coinbase.com" OR sourcehostname CONTAINS "87157-coinbase.com" OR sourcehostname CONTAINS "87312-coinbase.com" OR sourcehostname CONTAINS "89304-coinbase.com" OR sourcehostname CONTAINS "89375-coinbase.com" OR sourcehostname CONTAINS "91723-gemini.com" OR sourcehostname CONTAINS "91752-coinbase.com")
index=activity AND rg_functionality="Web Server" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "28676-coinbase.com" OR destinationntdomain CONTAINS "29185-coinbase.com" OR destinationntdomain CONTAINS "29195-coinbase.com" OR destinationntdomain CONTAINS "2a-coinbase.com" OR destinationntdomain CONTAINS "2b-coinbase.com" OR destinationntdomain CONTAINS "2c-coinbase.com" OR destinationntdomain CONTAINS "2f-coinbase.com" OR destinationntdomain CONTAINS "2fas-coinbase.com" OR destinationntdomain CONTAINS "2o-coinbase.com" OR destinationntdomain CONTAINS "2r-coinbase.com" OR destinationntdomain CONTAINS "2s-coinbase.com" OR destinationntdomain CONTAINS "2sv-coinbase.com" OR destinationntdomain CONTAINS "352134951-coinbase.com" OR destinationntdomain CONTAINS "38468-coinbase.com" OR destinationntdomain CONTAINS "39590-coinbase.com" OR destinationntdomain CONTAINS "41260-coinbase.com" OR destinationntdomain CONTAINS "427883-coinbase.com" OR destinationntdomain CONTAINS "43017-coinbase.com" OR destinationntdomain CONTAINS "47562-coinbase.com" OR destinationntdomain CONTAINS "50195-coinbase.com" OR destinationntdomain CONTAINS "5247-coinbase.com" OR destinationntdomain CONTAINS "54765-coinbase.com" OR destinationntdomain CONTAINS "57197-coinbase.com" OR destinationntdomain CONTAINS "58176-coinbase.com" OR destinationntdomain CONTAINS "58297-coinbase.com" OR destinationntdomain CONTAINS "61250-coinbase.com" OR destinationntdomain CONTAINS "61835-coinbase.com" OR destinationntdomain CONTAINS "61851-coinbase.com" OR destinationntdomain CONTAINS "61937-coinbase.com" OR destinationntdomain CONTAINS "71925-coinbase.com" OR destinationntdomain CONTAINS "72957-coinbase.com" OR destinationntdomain CONTAINS "72985-coinbase.com" OR destinationntdomain CONTAINS "74651-coinbase.com" OR destinationntdomain CONTAINS "754668948-coinbase.com" OR destinationntdomain CONTAINS "76159869-coinbase.com" OR destinationntdomain CONTAINS "76153-coinbase.com" OR destinationntdomain CONTAINS "81758-coinbase.com" OR destinationntdomain CONTAINS "81920-coinbase.com" OR destinationntdomain CONTAINS "81926-coinbase.com" OR destinationntdomain CONTAINS "81958-coinbase.com" OR destinationntdomain CONTAINS "826298-coinbase.com" OR destinationntdomain CONTAINS "83216-coinbase.com" OR destinationntdomain CONTAINS "837613-coinbase.com" OR destinationntdomain CONTAINS "83956-coinbase.com" OR destinationntdomain CONTAINS "87157-coinbase.com" OR destinationntdomain CONTAINS "87312-coinbase.com" OR destinationntdomain CONTAINS "89304-coinbase.com" OR destinationntdomain CONTAINS "89375-coinbase.com" OR destinationntdomain CONTAINS "91723-gemini.com" OR destinationntdomain CONTAINS "91752-coinbase.com")
index=activity AND rg_functionality="Web Server" AND requesturl NOT NULL AND (requesturl CONTAINS "28676-coinbase.com" OR requesturl CONTAINS "29185-coinbase.com" OR requesturl CONTAINS "29195-coinbase.com" OR requesturl CONTAINS "2a-coinbase.com" OR requesturl CONTAINS "2b-coinbase.com" OR requesturl CONTAINS "2c-coinbase.com" OR requesturl CONTAINS "2f-coinbase.com" OR requesturl CONTAINS "2fas-coinbase.com" OR requesturl CONTAINS "2o-coinbase.com" OR requesturl CONTAINS "2r-coinbase.com" OR requesturl CONTAINS "2s-coinbase.com" OR requesturl CONTAINS "2sv-coinbase.com" OR requesturl CONTAINS "352134951-coinbase.com" OR requesturl CONTAINS "38468-coinbase.com" OR requesturl CONTAINS "39590-coinbase.com" OR requesturl CONTAINS "41260-coinbase.com" OR requesturl CONTAINS "427883-coinbase.com" OR requesturl CONTAINS "43017-coinbase.com" OR requesturl CONTAINS "47562-coinbase.com" OR requesturl CONTAINS "50195-coinbase.com" OR requesturl CONTAINS "5247-coinbase.com" OR requesturl CONTAINS "54765-coinbase.com" OR requesturl CONTAINS "57197-coinbase.com" OR requesturl CONTAINS "58176-coinbase.com" OR requesturl CONTAINS "58297-coinbase.com" OR requesturl CONTAINS "61250-coinbase.com" OR requesturl CONTAINS "61835-coinbase.com" OR requesturl CONTAINS "61851-coinbase.com" OR requesturl CONTAINS "61937-coinbase.com" OR requesturl CONTAINS "71925-coinbase.com" OR requesturl CONTAINS "72957-coinbase.com" OR requesturl CONTAINS "72985-coinbase.com" OR requesturl CONTAINS "74651-coinbase.com" OR requesturl CONTAINS "754668948-coinbase.com" OR requesturl CONTAINS "76159869-coinbase.com" OR requesturl CONTAINS "76153-coinbase.com" OR requesturl CONTAINS "81758-coinbase.com" OR requesturl CONTAINS "81920-coinbase.com" OR requesturl CONTAINS "81926-coinbase.com" OR requesturl CONTAINS "81958-coinbase.com" OR requesturl CONTAINS "826298-coinbase.com" OR requesturl CONTAINS "83216-coinbase.com" OR requesturl CONTAINS "837613-coinbase.com" OR requesturl CONTAINS "83956-coinbase.com" OR requesturl CONTAINS "87157-coinbase.com" OR requesturl CONTAINS "87312-coinbase.com" OR requesturl CONTAINS "89304-coinbase.com" OR requesturl CONTAINS "89375-coinbase.com" OR requesturl CONTAINS "91723-gemini.com" OR requesturl CONTAINS "91752-coinbase.com")
index=activity AND rg_functionality="Web Server" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "91756-coinbase.com" OR destinationhostname CONTAINS "91782-coinbase.com" OR destinationhostname CONTAINS "91835-coinbase.com" OR destinationhostname CONTAINS "91845-coinbase.com" OR destinationhostname CONTAINS "91923-coinbase.com" OR destinationhostname CONTAINS "92758-coinbase.com" OR destinationhostname CONTAINS "948122061-coinbase.com" OR destinationhostname CONTAINS "978941-coinbase.com" OR destinationhostname CONTAINS "accountrecovery-coinbase.com" OR destinationhostname CONTAINS "action-shakepay.com" OR destinationhostname CONTAINS "adjust-coinbase.com" OR destinationhostname CONTAINS "admin-kraken.com" OR destinationhostname CONTAINS "applechargebacks.com" OR destinationhostname CONTAINS "authenticate-gemini.com" OR destinationhostname CONTAINS "authorize-gmail.com" OR destinationhostname CONTAINS "binance-okta.com" OR destinationhostname CONTAINS "captcha-coinbase.com" OR destinationhostname CONTAINS "cd-coinbase.com" OR destinationhostname CONTAINS "coinbase-heip.com" OR destinationhostname CONTAINS "coinbase-live.support" OR destinationhostname CONTAINS "coinbase-reject.com" OR destinationhostname CONTAINS "coinbase-ticket.com" OR destinationhostname CONTAINS "coinbaseheip.com" OR destinationhostname CONTAINS "com-2fa.help" OR destinationhostname CONTAINS "com-2fa.support" OR destinationhostname CONTAINS "com-3845.support" OR destinationhostname CONTAINS "com-connect.help" OR destinationhostname CONTAINS "com-fraud.support" OR destinationhostname CONTAINS "com-help.support" OR destinationhostname CONTAINS "com-reset.help" OR destinationhostname CONTAINS "com-reset.net" OR destinationhostname CONTAINS "com-ticket.live" OR destinationhostname CONTAINS "com-ticket.support" OR destinationhostname CONTAINS "contact-nexo.com" OR destinationhostname CONTAINS "convert-coinbase.com" OR destinationhostname CONTAINS "customerservice-coinbase.com" OR destinationhostname CONTAINS "default-coinbase.com" OR destinationhostname CONTAINS "defend-coinbase.com" OR destinationhostname CONTAINS "deny-coinbase.com" OR destinationhostname CONTAINS "disconnect-coinbase.com" OR destinationhostname CONTAINS "escalate-coinbase.com" OR destinationhostname CONTAINS "establish-coinbase.com" OR destinationhostname CONTAINS "fcc-okta.com" OR destinationhostname CONTAINS "fraudulent-coinbase.com" OR destinationhostname CONTAINS "guard-apple.com" OR destinationhostname CONTAINS "guard-icloud.com" OR destinationhostname CONTAINS "guardian-coinbase.com" OR destinationhostname CONTAINS "guide-gemini.com" OR destinationhostname CONTAINS "help-bitfinex.com" OR destinationhostname CONTAINS "help-shakepay.com")
index=activity AND rg_functionality="Web Server" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "91756-coinbase.com" OR sourcentdomain CONTAINS "91782-coinbase.com" OR sourcentdomain CONTAINS "91835-coinbase.com" OR sourcentdomain CONTAINS "91845-coinbase.com" OR sourcentdomain CONTAINS "91923-coinbase.com" OR sourcentdomain CONTAINS "92758-coinbase.com" OR sourcentdomain CONTAINS "948122061-coinbase.com" OR sourcentdomain CONTAINS "978941-coinbase.com" OR sourcentdomain CONTAINS "accountrecovery-coinbase.com" OR sourcentdomain CONTAINS "action-shakepay.com" OR sourcentdomain CONTAINS "adjust-coinbase.com" OR sourcentdomain CONTAINS "admin-kraken.com" OR sourcentdomain CONTAINS "applechargebacks.com" OR sourcentdomain CONTAINS "authenticate-gemini.com" OR sourcentdomain CONTAINS "authorize-gmail.com" OR sourcentdomain CONTAINS "binance-okta.com" OR sourcentdomain CONTAINS "captcha-coinbase.com" OR sourcentdomain CONTAINS "cd-coinbase.com" OR sourcentdomain CONTAINS "coinbase-heip.com" OR sourcentdomain CONTAINS "coinbase-live.support" OR sourcentdomain CONTAINS "coinbase-reject.com" OR sourcentdomain CONTAINS "coinbase-ticket.com" OR sourcentdomain CONTAINS "coinbaseheip.com" OR sourcentdomain CONTAINS "com-2fa.help" OR sourcentdomain CONTAINS "com-2fa.support" OR sourcentdomain CONTAINS "com-3845.support" OR sourcentdomain CONTAINS "com-connect.help" OR sourcentdomain CONTAINS "com-fraud.support" OR sourcentdomain CONTAINS "com-help.support" OR sourcentdomain CONTAINS "com-reset.help" OR sourcentdomain CONTAINS "com-reset.net" OR sourcentdomain CONTAINS "com-ticket.live" OR sourcentdomain CONTAINS "com-ticket.support" OR sourcentdomain CONTAINS "contact-nexo.com" OR sourcentdomain CONTAINS "convert-coinbase.com" OR sourcentdomain CONTAINS "customerservice-coinbase.com" OR sourcentdomain CONTAINS "default-coinbase.com" OR sourcentdomain CONTAINS "defend-coinbase.com" OR sourcentdomain CONTAINS "deny-coinbase.com" OR sourcentdomain CONTAINS "disconnect-coinbase.com" OR sourcentdomain CONTAINS "escalate-coinbase.com" OR sourcentdomain CONTAINS "establish-coinbase.com" OR sourcentdomain CONTAINS "fcc-okta.com" OR sourcentdomain CONTAINS "fraudulent-coinbase.com" OR sourcentdomain CONTAINS "guard-apple.com" OR sourcentdomain CONTAINS "guard-icloud.com" OR sourcentdomain CONTAINS "guardian-coinbase.com" OR sourcentdomain CONTAINS "guide-gemini.com" OR sourcentdomain CONTAINS "help-bitfinex.com" OR sourcentdomain CONTAINS "help-shakepay.com")
index=activity AND rg_functionality="Web Server" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "91756-coinbase.com" OR sourcehostname CONTAINS "91782-coinbase.com" OR sourcehostname CONTAINS "91835-coinbase.com" OR sourcehostname CONTAINS "91845-coinbase.com" OR sourcehostname CONTAINS "91923-coinbase.com" OR sourcehostname CONTAINS "92758-coinbase.com" OR sourcehostname CONTAINS "948122061-coinbase.com" OR sourcehostname CONTAINS "978941-coinbase.com" OR sourcehostname CONTAINS "accountrecovery-coinbase.com" OR sourcehostname CONTAINS "action-shakepay.com" OR sourcehostname CONTAINS "adjust-coinbase.com" OR sourcehostname CONTAINS "admin-kraken.com" OR sourcehostname CONTAINS "applechargebacks.com" OR sourcehostname CONTAINS "authenticate-gemini.com" OR sourcehostname CONTAINS "authorize-gmail.com" OR sourcehostname CONTAINS "binance-okta.com" OR sourcehostname CONTAINS "captcha-coinbase.com" OR sourcehostname CONTAINS "cd-coinbase.com" OR sourcehostname CONTAINS "coinbase-heip.com" OR sourcehostname CONTAINS "coinbase-live.support" OR sourcehostname CONTAINS "coinbase-reject.com" OR sourcehostname CONTAINS "coinbase-ticket.com" OR sourcehostname CONTAINS "coinbaseheip.com" OR sourcehostname CONTAINS "com-2fa.help" OR sourcehostname CONTAINS "com-2fa.support" OR sourcehostname CONTAINS "com-3845.support" OR sourcehostname CONTAINS "com-connect.help" OR sourcehostname CONTAINS "com-fraud.support" OR sourcehostname CONTAINS "com-help.support" OR sourcehostname CONTAINS "com-reset.help" OR sourcehostname CONTAINS "com-reset.net" OR sourcehostname CONTAINS "com-ticket.live" OR sourcehostname CONTAINS "com-ticket.support" OR sourcehostname CONTAINS "contact-nexo.com" OR sourcehostname CONTAINS "convert-coinbase.com" OR sourcehostname CONTAINS "customerservice-coinbase.com" OR sourcehostname CONTAINS "default-coinbase.com" OR sourcehostname CONTAINS "defend-coinbase.com" OR sourcehostname CONTAINS "deny-coinbase.com" OR sourcehostname CONTAINS "disconnect-coinbase.com" OR sourcehostname CONTAINS "escalate-coinbase.com" OR sourcehostname CONTAINS "establish-coinbase.com" OR sourcehostname CONTAINS "fcc-okta.com" OR sourcehostname CONTAINS "fraudulent-coinbase.com" OR sourcehostname CONTAINS "guard-apple.com" OR sourcehostname CONTAINS "guard-icloud.com" OR sourcehostname CONTAINS "guardian-coinbase.com" OR sourcehostname CONTAINS "guide-gemini.com" OR sourcehostname CONTAINS "help-bitfinex.com" OR sourcehostname CONTAINS "help-shakepay.com")
index=activity AND rg_functionality="Web Server" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "91756-coinbase.com" OR destinationntdomain CONTAINS "91782-coinbase.com" OR destinationntdomain CONTAINS "91835-coinbase.com" OR destinationntdomain CONTAINS "91845-coinbase.com" OR destinationntdomain CONTAINS "91923-coinbase.com" OR destinationntdomain CONTAINS "92758-coinbase.com" OR destinationntdomain CONTAINS "948122061-coinbase.com" OR destinationntdomain CONTAINS "978941-coinbase.com" OR destinationntdomain CONTAINS "accountrecovery-coinbase.com" OR destinationntdomain CONTAINS "action-shakepay.com" OR destinationntdomain CONTAINS "adjust-coinbase.com" OR destinationntdomain CONTAINS "admin-kraken.com" OR destinationntdomain CONTAINS "applechargebacks.com" OR destinationntdomain CONTAINS "authenticate-gemini.com" OR destinationntdomain CONTAINS "authorize-gmail.com" OR destinationntdomain CONTAINS "binance-okta.com" OR destinationntdomain CONTAINS "captcha-coinbase.com" OR destinationntdomain CONTAINS "cd-coinbase.com" OR destinationntdomain CONTAINS "coinbase-heip.com" OR destinationntdomain CONTAINS "coinbase-live.support" OR destinationntdomain CONTAINS "coinbase-reject.com" OR destinationntdomain CONTAINS "coinbase-ticket.com" OR destinationntdomain CONTAINS "coinbaseheip.com" OR destinationntdomain CONTAINS "com-2fa.help" OR destinationntdomain CONTAINS "com-2fa.support" OR destinationntdomain CONTAINS "com-3845.support" OR destinationntdomain CONTAINS "com-connect.help" OR destinationntdomain CONTAINS "com-fraud.support" OR destinationntdomain CONTAINS "com-help.support" OR destinationntdomain CONTAINS "com-reset.help" OR destinationntdomain CONTAINS "com-reset.net" OR destinationntdomain CONTAINS "com-ticket.live" OR destinationntdomain CONTAINS "com-ticket.support" OR destinationntdomain CONTAINS "contact-nexo.com" OR destinationntdomain CONTAINS "convert-coinbase.com" OR destinationntdomain CONTAINS "customerservice-coinbase.com" OR destinationntdomain CONTAINS "default-coinbase.com" OR destinationntdomain CONTAINS "defend-coinbase.com" OR destinationntdomain CONTAINS "deny-coinbase.com" OR destinationntdomain CONTAINS "disconnect-coinbase.com" OR destinationntdomain CONTAINS "escalate-coinbase.com" OR destinationntdomain CONTAINS "establish-coinbase.com" OR destinationntdomain CONTAINS "fcc-okta.com" OR destinationntdomain CONTAINS "fraudulent-coinbase.com" OR destinationntdomain CONTAINS "guard-apple.com" OR destinationntdomain CONTAINS "guard-icloud.com" OR destinationntdomain CONTAINS "guardian-coinbase.com" OR destinationntdomain CONTAINS "guide-gemini.com" OR destinationntdomain CONTAINS "help-bitfinex.com" OR destinationntdomain CONTAINS "help-shakepay.com")
index=activity AND rg_functionality="Web Server" AND requesturl NOT NULL AND (requesturl CONTAINS "91756-coinbase.com" OR requesturl CONTAINS "91782-coinbase.com" OR requesturl CONTAINS "91835-coinbase.com" OR requesturl CONTAINS "91845-coinbase.com" OR requesturl CONTAINS "91923-coinbase.com" OR requesturl CONTAINS "92758-coinbase.com" OR requesturl CONTAINS "948122061-coinbase.com" OR requesturl CONTAINS "978941-coinbase.com" OR requesturl CONTAINS "accountrecovery-coinbase.com" OR requesturl CONTAINS "action-shakepay.com" OR requesturl CONTAINS "adjust-coinbase.com" OR requesturl CONTAINS "admin-kraken.com" OR requesturl CONTAINS "applechargebacks.com" OR requesturl CONTAINS "authenticate-gemini.com" OR requesturl CONTAINS "authorize-gmail.com" OR requesturl CONTAINS "binance-okta.com" OR requesturl CONTAINS "captcha-coinbase.com" OR requesturl CONTAINS "cd-coinbase.com" OR requesturl CONTAINS "coinbase-heip.com" OR requesturl CONTAINS "coinbase-live.support" OR requesturl CONTAINS "coinbase-reject.com" OR requesturl CONTAINS "coinbase-ticket.com" OR requesturl CONTAINS "coinbaseheip.com" OR requesturl CONTAINS "com-2fa.help" OR requesturl CONTAINS "com-2fa.support" OR requesturl CONTAINS "com-3845.support" OR requesturl CONTAINS "com-connect.help" OR requesturl CONTAINS "com-fraud.support" OR requesturl CONTAINS "com-help.support" OR requesturl CONTAINS "com-reset.help" OR requesturl CONTAINS "com-reset.net" OR requesturl CONTAINS "com-ticket.live" OR requesturl CONTAINS "com-ticket.support" OR requesturl CONTAINS "contact-nexo.com" OR requesturl CONTAINS "convert-coinbase.com" OR requesturl CONTAINS "customerservice-coinbase.com" OR requesturl CONTAINS "default-coinbase.com" OR requesturl CONTAINS "defend-coinbase.com" OR requesturl CONTAINS "deny-coinbase.com" OR requesturl CONTAINS "disconnect-coinbase.com" OR requesturl CONTAINS "escalate-coinbase.com" OR requesturl CONTAINS "establish-coinbase.com" OR requesturl CONTAINS "fcc-okta.com" OR requesturl CONTAINS "fraudulent-coinbase.com" OR requesturl CONTAINS "guard-apple.com" OR requesturl CONTAINS "guard-icloud.com" OR requesturl CONTAINS "guardian-coinbase.com" OR requesturl CONTAINS "guide-gemini.com" OR requesturl CONTAINS "help-bitfinex.com" OR requesturl CONTAINS "help-shakepay.com")
index=activity AND rg_functionality="Web Server" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "helpdesk-apple.com" OR destinationhostname CONTAINS "helpdesk-gemini.com" OR destinationhostname CONTAINS "helpdesk-icloud.com" OR destinationhostname CONTAINS "identification-coinbase.com" OR destinationhostname CONTAINS "lockdown-coinbase.com" OR destinationhostname CONTAINS "login-nexo.com" OR destinationhostname CONTAINS "keys-coinbase.com" OR destinationhostname CONTAINS "messages-coinbase.com" OR destinationhostname CONTAINS "newpassword-coinbase.com" OR destinationhostname CONTAINS "prompt-coinbase.com" OR destinationhostname CONTAINS "protect-apple.com" OR destinationhostname CONTAINS "protect-coinbase.com" OR destinationhostname CONTAINS "protect-gmail.com" OR destinationhostname CONTAINS "protect-kraken.com" OR destinationhostname CONTAINS "recoverme-coinbase.com" OR destinationhostname CONTAINS "recoveryportal-coinbase.com" OR destinationhostname CONTAINS "refunds-coinbase.com" OR destinationhostname CONTAINS "reset-okta.com" OR destinationhostname CONTAINS "restore-coinbase.com" OR destinationhostname CONTAINS "return-coinbase.com" OR destinationhostname CONTAINS "reverts-coinbase.com" OR destinationhostname CONTAINS "secure-binance.us" OR destinationhostname CONTAINS "secure-icloud.com" OR destinationhostname CONTAINS "secure-nexo.com" OR destinationhostname CONTAINS "secure-shakepay.com" OR destinationhostname CONTAINS "security-umusic.com" OR destinationhostname CONTAINS "server694590423.tech" OR destinationhostname CONTAINS "session-coinbase.com" OR destinationhostname CONTAINS "startrecovery-coinbase.com" OR destinationhostname CONTAINS "signin-kraken.com" OR destinationhostname CONTAINS "suite-trezor.io" OR destinationhostname CONTAINS "supportportal-coinbase.com" OR destinationhostname CONTAINS "tech-icloud.com" OR destinationhostname CONTAINS "threat-coinbase.com" OR destinationhostname CONTAINS "ticket-apple.com" OR destinationhostname CONTAINS "ticket-coinbase.com" OR destinationhostname CONTAINS "tickets-apple.com" OR destinationhostname CONTAINS "tokens-coinbase.com" OR destinationhostname CONTAINS "unblock-coinbase.com" OR destinationhostname CONTAINS "unlink-coinbase.com" OR destinationhostname CONTAINS "your-coinbase.com" OR destinationhostname CONTAINS "welcome-coinbase.com" OR destinationhostname CONTAINS "www-coinbasewallet.com" OR destinationhostname CONTAINS "www-help-coinbase.com" OR destinationhostname CONTAINS "www-help-gemini.com")
index=activity AND rg_functionality="Web Server" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "helpdesk-apple.com" OR sourcentdomain CONTAINS "helpdesk-gemini.com" OR sourcentdomain CONTAINS "helpdesk-icloud.com" OR sourcentdomain CONTAINS "identification-coinbase.com" OR sourcentdomain CONTAINS "lockdown-coinbase.com" OR sourcentdomain CONTAINS "login-nexo.com" OR sourcentdomain CONTAINS "keys-coinbase.com" OR sourcentdomain CONTAINS "messages-coinbase.com" OR sourcentdomain CONTAINS "newpassword-coinbase.com" OR sourcentdomain CONTAINS "prompt-coinbase.com" OR sourcentdomain CONTAINS "protect-apple.com" OR sourcentdomain CONTAINS "protect-coinbase.com" OR sourcentdomain CONTAINS "protect-gmail.com" OR sourcentdomain CONTAINS "protect-kraken.com" OR sourcentdomain CONTAINS "recoverme-coinbase.com" OR sourcentdomain CONTAINS "recoveryportal-coinbase.com" OR sourcentdomain CONTAINS "refunds-coinbase.com" OR sourcentdomain CONTAINS "reset-okta.com" OR sourcentdomain CONTAINS "restore-coinbase.com" OR sourcentdomain CONTAINS "return-coinbase.com" OR sourcentdomain CONTAINS "reverts-coinbase.com" OR sourcentdomain CONTAINS "secure-binance.us" OR sourcentdomain CONTAINS "secure-icloud.com" OR sourcentdomain CONTAINS "secure-nexo.com" OR sourcentdomain CONTAINS "secure-shakepay.com" OR sourcentdomain CONTAINS "security-umusic.com" OR sourcentdomain CONTAINS "server694590423.tech" OR sourcentdomain CONTAINS "session-coinbase.com" OR sourcentdomain CONTAINS "startrecovery-coinbase.com" OR sourcentdomain CONTAINS "signin-kraken.com" OR sourcentdomain CONTAINS "suite-trezor.io" OR sourcentdomain CONTAINS "supportportal-coinbase.com" OR sourcentdomain CONTAINS "tech-icloud.com" OR sourcentdomain CONTAINS "threat-coinbase.com" OR sourcentdomain CONTAINS "ticket-apple.com" OR sourcentdomain CONTAINS "ticket-coinbase.com" OR sourcentdomain CONTAINS "tickets-apple.com" OR sourcentdomain CONTAINS "tokens-coinbase.com" OR sourcentdomain CONTAINS "unblock-coinbase.com" OR sourcentdomain CONTAINS "unlink-coinbase.com" OR sourcentdomain CONTAINS "your-coinbase.com" OR sourcentdomain CONTAINS "welcome-coinbase.com" OR sourcentdomain CONTAINS "www-coinbasewallet.com" OR sourcentdomain CONTAINS "www-help-coinbase.com" OR sourcentdomain CONTAINS "www-help-gemini.com")
index=activity AND rg_functionality="Web Server" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "helpdesk-apple.com" OR sourcehostname CONTAINS "helpdesk-gemini.com" OR sourcehostname CONTAINS "helpdesk-icloud.com" OR sourcehostname CONTAINS "identification-coinbase.com" OR sourcehostname CONTAINS "lockdown-coinbase.com" OR sourcehostname CONTAINS "login-nexo.com" OR sourcehostname CONTAINS "keys-coinbase.com" OR sourcehostname CONTAINS "messages-coinbase.com" OR sourcehostname CONTAINS "newpassword-coinbase.com" OR sourcehostname CONTAINS "prompt-coinbase.com" OR sourcehostname CONTAINS "protect-apple.com" OR sourcehostname CONTAINS "protect-coinbase.com" OR sourcehostname CONTAINS "protect-gmail.com" OR sourcehostname CONTAINS "protect-kraken.com" OR sourcehostname CONTAINS "recoverme-coinbase.com" OR sourcehostname CONTAINS "recoveryportal-coinbase.com" OR sourcehostname CONTAINS "refunds-coinbase.com" OR sourcehostname CONTAINS "reset-okta.com" OR sourcehostname CONTAINS "restore-coinbase.com" OR sourcehostname CONTAINS "return-coinbase.com" OR sourcehostname CONTAINS "reverts-coinbase.com" OR sourcehostname CONTAINS "secure-binance.us" OR sourcehostname CONTAINS "secure-icloud.com" OR sourcehostname CONTAINS "secure-nexo.com" OR sourcehostname CONTAINS "secure-shakepay.com" OR sourcehostname CONTAINS "security-umusic.com" OR sourcehostname CONTAINS "server694590423.tech" OR sourcehostname CONTAINS "session-coinbase.com" OR sourcehostname CONTAINS "startrecovery-coinbase.com" OR sourcehostname CONTAINS "signin-kraken.com" OR sourcehostname CONTAINS "suite-trezor.io" OR sourcehostname CONTAINS "supportportal-coinbase.com" OR sourcehostname CONTAINS "tech-icloud.com" OR sourcehostname CONTAINS "threat-coinbase.com" OR sourcehostname CONTAINS "ticket-apple.com" OR sourcehostname CONTAINS "ticket-coinbase.com" OR sourcehostname CONTAINS "tickets-apple.com" OR sourcehostname CONTAINS "tokens-coinbase.com" OR sourcehostname CONTAINS "unblock-coinbase.com" OR sourcehostname CONTAINS "unlink-coinbase.com" OR sourcehostname CONTAINS "your-coinbase.com" OR sourcehostname CONTAINS "welcome-coinbase.com" OR sourcehostname CONTAINS "www-coinbasewallet.com" OR sourcehostname CONTAINS "www-help-coinbase.com" OR sourcehostname CONTAINS "www-help-gemini.com")
index=activity AND rg_functionality="Web Server" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "helpdesk-apple.com" OR destinationntdomain CONTAINS "helpdesk-gemini.com" OR destinationntdomain CONTAINS "helpdesk-icloud.com" OR destinationntdomain CONTAINS "identification-coinbase.com" OR destinationntdomain CONTAINS "lockdown-coinbase.com" OR destinationntdomain CONTAINS "login-nexo.com" OR destinationntdomain CONTAINS "keys-coinbase.com" OR destinationntdomain CONTAINS "messages-coinbase.com" OR destinationntdomain CONTAINS "newpassword-coinbase.com" OR destinationntdomain CONTAINS "prompt-coinbase.com" OR destinationntdomain CONTAINS "protect-apple.com" OR destinationntdomain CONTAINS "protect-coinbase.com" OR destinationntdomain CONTAINS "protect-gmail.com" OR destinationntdomain CONTAINS "protect-kraken.com" OR destinationntdomain CONTAINS "recoverme-coinbase.com" OR destinationntdomain CONTAINS "recoveryportal-coinbase.com" OR destinationntdomain CONTAINS "refunds-coinbase.com" OR destinationntdomain CONTAINS "reset-okta.com" OR destinationntdomain CONTAINS "restore-coinbase.com" OR destinationntdomain CONTAINS "return-coinbase.com" OR destinationntdomain CONTAINS "reverts-coinbase.com" OR destinationntdomain CONTAINS "secure-binance.us" OR destinationntdomain CONTAINS "secure-icloud.com" OR destinationntdomain CONTAINS "secure-nexo.com" OR destinationntdomain CONTAINS "secure-shakepay.com" OR destinationntdomain CONTAINS "security-umusic.com" OR destinationntdomain CONTAINS "server694590423.tech" OR destinationntdomain CONTAINS "session-coinbase.com" OR destinationntdomain CONTAINS "startrecovery-coinbase.com" OR destinationntdomain CONTAINS "signin-kraken.com" OR destinationntdomain CONTAINS "suite-trezor.io" OR destinationntdomain CONTAINS "supportportal-coinbase.com" OR destinationntdomain CONTAINS "tech-icloud.com" OR destinationntdomain CONTAINS "threat-coinbase.com" OR destinationntdomain CONTAINS "ticket-apple.com" OR destinationntdomain CONTAINS "ticket-coinbase.com" OR destinationntdomain CONTAINS "tickets-apple.com" OR destinationntdomain CONTAINS "tokens-coinbase.com" OR destinationntdomain CONTAINS "unblock-coinbase.com" OR destinationntdomain CONTAINS "unlink-coinbase.com" OR destinationntdomain CONTAINS "your-coinbase.com" OR destinationntdomain CONTAINS "welcome-coinbase.com" OR destinationntdomain CONTAINS "www-coinbasewallet.com" OR destinationntdomain CONTAINS "www-help-coinbase.com" OR destinationntdomain CONTAINS "www-help-gemini.com")
index=activity AND rg_functionality="Web Server" AND requesturl NOT NULL AND (requesturl CONTAINS "helpdesk-apple.com" OR requesturl CONTAINS "helpdesk-gemini.com" OR requesturl CONTAINS "helpdesk-icloud.com" OR requesturl CONTAINS "identification-coinbase.com" OR requesturl CONTAINS "lockdown-coinbase.com" OR requesturl CONTAINS "login-nexo.com" OR requesturl CONTAINS "keys-coinbase.com" OR requesturl CONTAINS "messages-coinbase.com" OR requesturl CONTAINS "newpassword-coinbase.com" OR requesturl CONTAINS "prompt-coinbase.com" OR requesturl CONTAINS "protect-apple.com" OR requesturl CONTAINS "protect-coinbase.com" OR requesturl CONTAINS "protect-gmail.com" OR requesturl CONTAINS "protect-kraken.com" OR requesturl CONTAINS "recoverme-coinbase.com" OR requesturl CONTAINS "recoveryportal-coinbase.com" OR requesturl CONTAINS "refunds-coinbase.com" OR requesturl CONTAINS "reset-okta.com" OR requesturl CONTAINS "restore-coinbase.com" OR requesturl CONTAINS "return-coinbase.com" OR requesturl CONTAINS "reverts-coinbase.com" OR requesturl CONTAINS "secure-binance.us" OR requesturl CONTAINS "secure-icloud.com" OR requesturl CONTAINS "secure-nexo.com" OR requesturl CONTAINS "secure-shakepay.com" OR requesturl CONTAINS "security-umusic.com" OR requesturl CONTAINS "server694590423.tech" OR requesturl CONTAINS "session-coinbase.com" OR requesturl CONTAINS "startrecovery-coinbase.com" OR requesturl CONTAINS "signin-kraken.com" OR requesturl CONTAINS "suite-trezor.io" OR requesturl CONTAINS "supportportal-coinbase.com" OR requesturl CONTAINS "tech-icloud.com" OR requesturl CONTAINS "threat-coinbase.com" OR requesturl CONTAINS "ticket-apple.com" OR requesturl CONTAINS "ticket-coinbase.com" OR requesturl CONTAINS "tickets-apple.com" OR requesturl CONTAINS "tokens-coinbase.com" OR requesturl CONTAINS "unblock-coinbase.com" OR requesturl CONTAINS "unlink-coinbase.com" OR requesturl CONTAINS "your-coinbase.com" OR requesturl CONTAINS "welcome-coinbase.com" OR requesturl CONTAINS "www-coinbasewallet.com" OR requesturl CONTAINS "www-help-coinbase.com" OR requesturl CONTAINS "www-help-gemini.com")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "official-server.com" OR destinationhostname CONTAINS "server694590423.tech" OR destinationhostname CONTAINS "island-placid-bromine.glitch.me" OR destinationhostname CONTAINS "circular-noon-farmhouse.glitch.me" OR destinationhostname CONTAINS "talented-friendly-price.glitch.me" OR destinationhostname CONTAINS "dflfmgsdokasdcpl.com" OR destinationhostname CONTAINS "original-backend.com" OR destinationhostname CONTAINS "07159889-coinbase.com" OR destinationhostname CONTAINS "10195-coinbase.com" OR destinationhostname CONTAINS "11246-coinbase.com" OR destinationhostname CONTAINS "11247-coinbase.com" OR destinationhostname CONTAINS "11248-coinbase.com" OR destinationhostname CONTAINS "11258-coinbase.com" OR destinationhostname CONTAINS "11259-coinbase.com" OR destinationhostname CONTAINS "113912-coinbase.com" OR destinationhostname CONTAINS "11472-coinbase.com" OR destinationhostname CONTAINS "11923-coinbase.com" OR destinationhostname CONTAINS "11957-coinbase.com" OR destinationhostname CONTAINS "128147-coinbase.com" OR destinationhostname CONTAINS "12958-coinbase.com" OR destinationhostname CONTAINS "12984-okta.com" OR destinationhostname CONTAINS "12985-coinbase.com" OR destinationhostname CONTAINS "13130-coinbase.com" OR destinationhostname CONTAINS "13247-coinbase.com" OR destinationhostname CONTAINS "13247-icloud.com" OR destinationhostname CONTAINS "13267-coinbase.com" OR destinationhostname CONTAINS "146271510-coinbase.com" OR destinationhostname CONTAINS "146282-coinbase.com" OR destinationhostname CONTAINS "146284-coinbase.com" OR destinationhostname CONTAINS "147260-coinbase.com" OR destinationhostname CONTAINS "14765-coinbase.com" OR destinationhostname CONTAINS "14817582-coinbase.com" OR destinationhostname CONTAINS "14871904-coinbase.com" OR destinationhostname CONTAINS "14891902-coinbase.com" OR destinationhostname CONTAINS "1492864-coinbase.com" OR destinationhostname CONTAINS "158312-coinbase.com" OR destinationhostname CONTAINS "158372-coinbase.com" OR destinationhostname CONTAINS "158702-coinbase.com" OR destinationhostname CONTAINS "16171675-coinbase.com" OR destinationhostname CONTAINS "16171832-coinbase.com" OR destinationhostname CONTAINS "16178234-coinbase.com" OR destinationhostname CONTAINS "16178237-coinbase.com" OR destinationhostname CONTAINS "16178434-coinbase.com" OR destinationhostname CONTAINS "162178-coinbase.com" OR destinationhostname CONTAINS "162478-coinbase.com" OR destinationhostname CONTAINS "162782-coinbase.com" OR destinationhostname CONTAINS "162812-coinbase.com" OR destinationhostname CONTAINS "162814-coinbase.com" OR destinationhostname CONTAINS "16442580-coinbase.com" OR destinationhostname CONTAINS "16450107-coinbase.com")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "official-server.com" OR sourcentdomain CONTAINS "server694590423.tech" OR sourcentdomain CONTAINS "island-placid-bromine.glitch.me" OR sourcentdomain CONTAINS "circular-noon-farmhouse.glitch.me" OR sourcentdomain CONTAINS "talented-friendly-price.glitch.me" OR sourcentdomain CONTAINS "dflfmgsdokasdcpl.com" OR sourcentdomain CONTAINS "original-backend.com" OR sourcentdomain CONTAINS "07159889-coinbase.com" OR sourcentdomain CONTAINS "10195-coinbase.com" OR sourcentdomain CONTAINS "11246-coinbase.com" OR sourcentdomain CONTAINS "11247-coinbase.com" OR sourcentdomain CONTAINS "11248-coinbase.com" OR sourcentdomain CONTAINS "11258-coinbase.com" OR sourcentdomain CONTAINS "11259-coinbase.com" OR sourcentdomain CONTAINS "113912-coinbase.com" OR sourcentdomain CONTAINS "11472-coinbase.com" OR sourcentdomain CONTAINS "11923-coinbase.com" OR sourcentdomain CONTAINS "11957-coinbase.com" OR sourcentdomain CONTAINS "128147-coinbase.com" OR sourcentdomain CONTAINS "12958-coinbase.com" OR sourcentdomain CONTAINS "12984-okta.com" OR sourcentdomain CONTAINS "12985-coinbase.com" OR sourcentdomain CONTAINS "13130-coinbase.com" OR sourcentdomain CONTAINS "13247-coinbase.com" OR sourcentdomain CONTAINS "13247-icloud.com" OR sourcentdomain CONTAINS "13267-coinbase.com" OR sourcentdomain CONTAINS "146271510-coinbase.com" OR sourcentdomain CONTAINS "146282-coinbase.com" OR sourcentdomain CONTAINS "146284-coinbase.com" OR sourcentdomain CONTAINS "147260-coinbase.com" OR sourcentdomain CONTAINS "14765-coinbase.com" OR sourcentdomain CONTAINS "14817582-coinbase.com" OR sourcentdomain CONTAINS "14871904-coinbase.com" OR sourcentdomain CONTAINS "14891902-coinbase.com" OR sourcentdomain CONTAINS "1492864-coinbase.com" OR sourcentdomain CONTAINS "158312-coinbase.com" OR sourcentdomain CONTAINS "158372-coinbase.com" OR sourcentdomain CONTAINS "158702-coinbase.com" OR sourcentdomain CONTAINS "16171675-coinbase.com" OR sourcentdomain CONTAINS "16171832-coinbase.com" OR sourcentdomain CONTAINS "16178234-coinbase.com" OR sourcentdomain CONTAINS "16178237-coinbase.com" OR sourcentdomain CONTAINS "16178434-coinbase.com" OR sourcentdomain CONTAINS "162178-coinbase.com" OR sourcentdomain CONTAINS "162478-coinbase.com" OR sourcentdomain CONTAINS "162782-coinbase.com" OR sourcentdomain CONTAINS "162812-coinbase.com" OR sourcentdomain CONTAINS "162814-coinbase.com" OR sourcentdomain CONTAINS "16442580-coinbase.com" OR sourcentdomain CONTAINS "16450107-coinbase.com")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "official-server.com" OR sourcehostname CONTAINS "server694590423.tech" OR sourcehostname CONTAINS "island-placid-bromine.glitch.me" OR sourcehostname CONTAINS "circular-noon-farmhouse.glitch.me" OR sourcehostname CONTAINS "talented-friendly-price.glitch.me" OR sourcehostname CONTAINS "dflfmgsdokasdcpl.com" OR sourcehostname CONTAINS "original-backend.com" OR sourcehostname CONTAINS "07159889-coinbase.com" OR sourcehostname CONTAINS "10195-coinbase.com" OR sourcehostname CONTAINS "11246-coinbase.com" OR sourcehostname CONTAINS "11247-coinbase.com" OR sourcehostname CONTAINS "11248-coinbase.com" OR sourcehostname CONTAINS "11258-coinbase.com" OR sourcehostname CONTAINS "11259-coinbase.com" OR sourcehostname CONTAINS "113912-coinbase.com" OR sourcehostname CONTAINS "11472-coinbase.com" OR sourcehostname CONTAINS "11923-coinbase.com" OR sourcehostname CONTAINS "11957-coinbase.com" OR sourcehostname CONTAINS "128147-coinbase.com" OR sourcehostname CONTAINS "12958-coinbase.com" OR sourcehostname CONTAINS "12984-okta.com" OR sourcehostname CONTAINS "12985-coinbase.com" OR sourcehostname CONTAINS "13130-coinbase.com" OR sourcehostname CONTAINS "13247-coinbase.com" OR sourcehostname CONTAINS "13247-icloud.com" OR sourcehostname CONTAINS "13267-coinbase.com" OR sourcehostname CONTAINS "146271510-coinbase.com" OR sourcehostname CONTAINS "146282-coinbase.com" OR sourcehostname CONTAINS "146284-coinbase.com" OR sourcehostname CONTAINS "147260-coinbase.com" OR sourcehostname CONTAINS "14765-coinbase.com" OR sourcehostname CONTAINS "14817582-coinbase.com" OR sourcehostname CONTAINS "14871904-coinbase.com" OR sourcehostname CONTAINS "14891902-coinbase.com" OR sourcehostname CONTAINS "1492864-coinbase.com" OR sourcehostname CONTAINS "158312-coinbase.com" OR sourcehostname CONTAINS "158372-coinbase.com" OR sourcehostname CONTAINS "158702-coinbase.com" OR sourcehostname CONTAINS "16171675-coinbase.com" OR sourcehostname CONTAINS "16171832-coinbase.com" OR sourcehostname CONTAINS "16178234-coinbase.com" OR sourcehostname CONTAINS "16178237-coinbase.com" OR sourcehostname CONTAINS "16178434-coinbase.com" OR sourcehostname CONTAINS "162178-coinbase.com" OR sourcehostname CONTAINS "162478-coinbase.com" OR sourcehostname CONTAINS "162782-coinbase.com" OR sourcehostname CONTAINS "162812-coinbase.com" OR sourcehostname CONTAINS "162814-coinbase.com" OR sourcehostname CONTAINS "16442580-coinbase.com" OR sourcehostname CONTAINS "16450107-coinbase.com")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "official-server.com" OR destinationntdomain CONTAINS "server694590423.tech" OR destinationntdomain CONTAINS "island-placid-bromine.glitch.me" OR destinationntdomain CONTAINS "circular-noon-farmhouse.glitch.me" OR destinationntdomain CONTAINS "talented-friendly-price.glitch.me" OR destinationntdomain CONTAINS "dflfmgsdokasdcpl.com" OR destinationntdomain CONTAINS "original-backend.com" OR destinationntdomain CONTAINS "07159889-coinbase.com" OR destinationntdomain CONTAINS "10195-coinbase.com" OR destinationntdomain CONTAINS "11246-coinbase.com" OR destinationntdomain CONTAINS "11247-coinbase.com" OR destinationntdomain CONTAINS "11248-coinbase.com" OR destinationntdomain CONTAINS "11258-coinbase.com" OR destinationntdomain CONTAINS "11259-coinbase.com" OR destinationntdomain CONTAINS "113912-coinbase.com" OR destinationntdomain CONTAINS "11472-coinbase.com" OR destinationntdomain CONTAINS "11923-coinbase.com" OR destinationntdomain CONTAINS "11957-coinbase.com" OR destinationntdomain CONTAINS "128147-coinbase.com" OR destinationntdomain CONTAINS "12958-coinbase.com" OR destinationntdomain CONTAINS "12984-okta.com" OR destinationntdomain CONTAINS "12985-coinbase.com" OR destinationntdomain CONTAINS "13130-coinbase.com" OR destinationntdomain CONTAINS "13247-coinbase.com" OR destinationntdomain CONTAINS "13247-icloud.com" OR destinationntdomain CONTAINS "13267-coinbase.com" OR destinationntdomain CONTAINS "146271510-coinbase.com" OR destinationntdomain CONTAINS "146282-coinbase.com" OR destinationntdomain CONTAINS "146284-coinbase.com" OR destinationntdomain CONTAINS "147260-coinbase.com" OR destinationntdomain CONTAINS "14765-coinbase.com" OR destinationntdomain CONTAINS "14817582-coinbase.com" OR destinationntdomain CONTAINS "14871904-coinbase.com" OR destinationntdomain CONTAINS "14891902-coinbase.com" OR destinationntdomain CONTAINS "1492864-coinbase.com" OR destinationntdomain CONTAINS "158312-coinbase.com" OR destinationntdomain CONTAINS "158372-coinbase.com" OR destinationntdomain CONTAINS "158702-coinbase.com" OR destinationntdomain CONTAINS "16171675-coinbase.com" OR destinationntdomain CONTAINS "16171832-coinbase.com" OR destinationntdomain CONTAINS "16178234-coinbase.com" OR destinationntdomain CONTAINS "16178237-coinbase.com" OR destinationntdomain CONTAINS "16178434-coinbase.com" OR destinationntdomain CONTAINS "162178-coinbase.com" OR destinationntdomain CONTAINS "162478-coinbase.com" OR destinationntdomain CONTAINS "162782-coinbase.com" OR destinationntdomain CONTAINS "162812-coinbase.com" OR destinationntdomain CONTAINS "162814-coinbase.com" OR destinationntdomain CONTAINS "16442580-coinbase.com" OR destinationntdomain CONTAINS "16450107-coinbase.com")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND requesturl NOT NULL AND (requesturl CONTAINS "official-server.com" OR requesturl CONTAINS "server694590423.tech" OR requesturl CONTAINS "island-placid-bromine.glitch.me" OR requesturl CONTAINS "circular-noon-farmhouse.glitch.me" OR requesturl CONTAINS "talented-friendly-price.glitch.me" OR requesturl CONTAINS "dflfmgsdokasdcpl.com" OR requesturl CONTAINS "original-backend.com" OR requesturl CONTAINS "07159889-coinbase.com" OR requesturl CONTAINS "10195-coinbase.com" OR requesturl CONTAINS "11246-coinbase.com" OR requesturl CONTAINS "11247-coinbase.com" OR requesturl CONTAINS "11248-coinbase.com" OR requesturl CONTAINS "11258-coinbase.com" OR requesturl CONTAINS "11259-coinbase.com" OR requesturl CONTAINS "113912-coinbase.com" OR requesturl CONTAINS "11472-coinbase.com" OR requesturl CONTAINS "11923-coinbase.com" OR requesturl CONTAINS "11957-coinbase.com" OR requesturl CONTAINS "128147-coinbase.com" OR requesturl CONTAINS "12958-coinbase.com" OR requesturl CONTAINS "12984-okta.com" OR requesturl CONTAINS "12985-coinbase.com" OR requesturl CONTAINS "13130-coinbase.com" OR requesturl CONTAINS "13247-coinbase.com" OR requesturl CONTAINS "13247-icloud.com" OR requesturl CONTAINS "13267-coinbase.com" OR requesturl CONTAINS "146271510-coinbase.com" OR requesturl CONTAINS "146282-coinbase.com" OR requesturl CONTAINS "146284-coinbase.com" OR requesturl CONTAINS "147260-coinbase.com" OR requesturl CONTAINS "14765-coinbase.com" OR requesturl CONTAINS "14817582-coinbase.com" OR requesturl CONTAINS "14871904-coinbase.com" OR requesturl CONTAINS "14891902-coinbase.com" OR requesturl CONTAINS "1492864-coinbase.com" OR requesturl CONTAINS "158312-coinbase.com" OR requesturl CONTAINS "158372-coinbase.com" OR requesturl CONTAINS "158702-coinbase.com" OR requesturl CONTAINS "16171675-coinbase.com" OR requesturl CONTAINS "16171832-coinbase.com" OR requesturl CONTAINS "16178234-coinbase.com" OR requesturl CONTAINS "16178237-coinbase.com" OR requesturl CONTAINS "16178434-coinbase.com" OR requesturl CONTAINS "162178-coinbase.com" OR requesturl CONTAINS "162478-coinbase.com" OR requesturl CONTAINS "162782-coinbase.com" OR requesturl CONTAINS "162812-coinbase.com" OR requesturl CONTAINS "162814-coinbase.com" OR requesturl CONTAINS "16442580-coinbase.com" OR requesturl CONTAINS "16450107-coinbase.com")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "16450207-coinbase.com" OR destinationhostname CONTAINS "16458207-coinbase.com" OR destinationhostname CONTAINS "16478202-coinbase.com" OR destinationhostname CONTAINS "164872942-coinbase.com" OR destinationhostname CONTAINS "16590-coinbase.com" OR destinationhostname CONTAINS "16594373-coinbase.com" OR destinationhostname CONTAINS "16624831-coinbase.com" OR destinationhostname CONTAINS "16642124-coinbase.com" OR destinationhostname CONTAINS "16642172-coinbase.com" OR destinationhostname CONTAINS "16642580-coinbase.com" OR destinationhostname CONTAINS "16642721-coinbase.com" OR destinationhostname CONTAINS "16642724-coinbase.com" OR destinationhostname CONTAINS "16642871-coinbase.com" OR destinationhostname CONTAINS "16642872-coinbase.com" OR destinationhostname CONTAINS "16712942-coinbase.com" OR destinationhostname CONTAINS "16718672-coinbase.com" OR destinationhostname CONTAINS "16728342-coinbase.com" OR destinationhostname CONTAINS "16728348-coinbase.com" OR destinationhostname CONTAINS "16728442-coinbase.com" OR destinationhostname CONTAINS "16728472-coinbase.com" OR destinationhostname CONTAINS "167285-coinbase.com" OR destinationhostname CONTAINS "16729042-coinbase.com" OR destinationhostname CONTAINS "16748272-coinbase.com" OR destinationhostname CONTAINS "16782942-coinbase.com" OR destinationhostname CONTAINS "16827420-coinbase.com" OR destinationhostname CONTAINS "16827423-coinbase.com" OR destinationhostname CONTAINS "16847145-coinbase.com" OR destinationhostname CONTAINS "16893924-coinbase.com" OR destinationhostname CONTAINS "17182-coinbase.com" OR destinationhostname CONTAINS "17255030-coinbase.com" OR destinationhostname CONTAINS "17259-kraken.com" OR destinationhostname CONTAINS "172486-coinbase.com" OR destinationhostname CONTAINS "17284652-coinbase.com" OR destinationhostname CONTAINS "17286-coinbase.com" OR destinationhostname CONTAINS "17334522-coinbase.com" OR destinationhostname CONTAINS "17334522-kraken.com" OR destinationhostname CONTAINS "17384522-coinbase.com" OR destinationhostname CONTAINS "173912-coinbase.com" OR destinationhostname CONTAINS "17494976-coinbase.com" OR destinationhostname CONTAINS "17512854-coinbase.com" OR destinationhostname CONTAINS "17512857-coinbase.com" OR destinationhostname CONTAINS "1751954-coinbase.com" OR destinationhostname CONTAINS "17525030-coinbase.com" OR destinationhostname CONTAINS "17529580-coinbase.com" OR destinationhostname CONTAINS "17614-coinbase.com" OR destinationhostname CONTAINS "17618412-coinbase.com" OR destinationhostname CONTAINS "17619-coinbase.com" OR destinationhostname CONTAINS "176284-coinbase.com" OR destinationhostname CONTAINS "17823920-coinbase.com" OR destinationhostname CONTAINS "178253-coinbase.com")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "16450207-coinbase.com" OR sourcentdomain CONTAINS "16458207-coinbase.com" OR sourcentdomain CONTAINS "16478202-coinbase.com" OR sourcentdomain CONTAINS "164872942-coinbase.com" OR sourcentdomain CONTAINS "16590-coinbase.com" OR sourcentdomain CONTAINS "16594373-coinbase.com" OR sourcentdomain CONTAINS "16624831-coinbase.com" OR sourcentdomain CONTAINS "16642124-coinbase.com" OR sourcentdomain CONTAINS "16642172-coinbase.com" OR sourcentdomain CONTAINS "16642580-coinbase.com" OR sourcentdomain CONTAINS "16642721-coinbase.com" OR sourcentdomain CONTAINS "16642724-coinbase.com" OR sourcentdomain CONTAINS "16642871-coinbase.com" OR sourcentdomain CONTAINS "16642872-coinbase.com" OR sourcentdomain CONTAINS "16712942-coinbase.com" OR sourcentdomain CONTAINS "16718672-coinbase.com" OR sourcentdomain CONTAINS "16728342-coinbase.com" OR sourcentdomain CONTAINS "16728348-coinbase.com" OR sourcentdomain CONTAINS "16728442-coinbase.com" OR sourcentdomain CONTAINS "16728472-coinbase.com" OR sourcentdomain CONTAINS "167285-coinbase.com" OR sourcentdomain CONTAINS "16729042-coinbase.com" OR sourcentdomain CONTAINS "16748272-coinbase.com" OR sourcentdomain CONTAINS "16782942-coinbase.com" OR sourcentdomain CONTAINS "16827420-coinbase.com" OR sourcentdomain CONTAINS "16827423-coinbase.com" OR sourcentdomain CONTAINS "16847145-coinbase.com" OR sourcentdomain CONTAINS "16893924-coinbase.com" OR sourcentdomain CONTAINS "17182-coinbase.com" OR sourcentdomain CONTAINS "17255030-coinbase.com" OR sourcentdomain CONTAINS "17259-kraken.com" OR sourcentdomain CONTAINS "172486-coinbase.com" OR sourcentdomain CONTAINS "17284652-coinbase.com" OR sourcentdomain CONTAINS "17286-coinbase.com" OR sourcentdomain CONTAINS "17334522-coinbase.com" OR sourcentdomain CONTAINS "17334522-kraken.com" OR sourcentdomain CONTAINS "17384522-coinbase.com" OR sourcentdomain CONTAINS "173912-coinbase.com" OR sourcentdomain CONTAINS "17494976-coinbase.com" OR sourcentdomain CONTAINS "17512854-coinbase.com" OR sourcentdomain CONTAINS "17512857-coinbase.com" OR sourcentdomain CONTAINS "1751954-coinbase.com" OR sourcentdomain CONTAINS "17525030-coinbase.com" OR sourcentdomain CONTAINS "17529580-coinbase.com" OR sourcentdomain CONTAINS "17614-coinbase.com" OR sourcentdomain CONTAINS "17618412-coinbase.com" OR sourcentdomain CONTAINS "17619-coinbase.com" OR sourcentdomain CONTAINS "176284-coinbase.com" OR sourcentdomain CONTAINS "17823920-coinbase.com" OR sourcentdomain CONTAINS "178253-coinbase.com")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "16450207-coinbase.com" OR sourcehostname CONTAINS "16458207-coinbase.com" OR sourcehostname CONTAINS "16478202-coinbase.com" OR sourcehostname CONTAINS "164872942-coinbase.com" OR sourcehostname CONTAINS "16590-coinbase.com" OR sourcehostname CONTAINS "16594373-coinbase.com" OR sourcehostname CONTAINS "16624831-coinbase.com" OR sourcehostname CONTAINS "16642124-coinbase.com" OR sourcehostname CONTAINS "16642172-coinbase.com" OR sourcehostname CONTAINS "16642580-coinbase.com" OR sourcehostname CONTAINS "16642721-coinbase.com" OR sourcehostname CONTAINS "16642724-coinbase.com" OR sourcehostname CONTAINS "16642871-coinbase.com" OR sourcehostname CONTAINS "16642872-coinbase.com" OR sourcehostname CONTAINS "16712942-coinbase.com" OR sourcehostname CONTAINS "16718672-coinbase.com" OR sourcehostname CONTAINS "16728342-coinbase.com" OR sourcehostname CONTAINS "16728348-coinbase.com" OR sourcehostname CONTAINS "16728442-coinbase.com" OR sourcehostname CONTAINS "16728472-coinbase.com" OR sourcehostname CONTAINS "167285-coinbase.com" OR sourcehostname CONTAINS "16729042-coinbase.com" OR sourcehostname CONTAINS "16748272-coinbase.com" OR sourcehostname CONTAINS "16782942-coinbase.com" OR sourcehostname CONTAINS "16827420-coinbase.com" OR sourcehostname CONTAINS "16827423-coinbase.com" OR sourcehostname CONTAINS "16847145-coinbase.com" OR sourcehostname CONTAINS "16893924-coinbase.com" OR sourcehostname CONTAINS "17182-coinbase.com" OR sourcehostname CONTAINS "17255030-coinbase.com" OR sourcehostname CONTAINS "17259-kraken.com" OR sourcehostname CONTAINS "172486-coinbase.com" OR sourcehostname CONTAINS "17284652-coinbase.com" OR sourcehostname CONTAINS "17286-coinbase.com" OR sourcehostname CONTAINS "17334522-coinbase.com" OR sourcehostname CONTAINS "17334522-kraken.com" OR sourcehostname CONTAINS "17384522-coinbase.com" OR sourcehostname CONTAINS "173912-coinbase.com" OR sourcehostname CONTAINS "17494976-coinbase.com" OR sourcehostname CONTAINS "17512854-coinbase.com" OR sourcehostname CONTAINS "17512857-coinbase.com" OR sourcehostname CONTAINS "1751954-coinbase.com" OR sourcehostname CONTAINS "17525030-coinbase.com" OR sourcehostname CONTAINS "17529580-coinbase.com" OR sourcehostname CONTAINS "17614-coinbase.com" OR sourcehostname CONTAINS "17618412-coinbase.com" OR sourcehostname CONTAINS "17619-coinbase.com" OR sourcehostname CONTAINS "176284-coinbase.com" OR sourcehostname CONTAINS "17823920-coinbase.com" OR sourcehostname CONTAINS "178253-coinbase.com")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "16450207-coinbase.com" OR destinationntdomain CONTAINS "16458207-coinbase.com" OR destinationntdomain CONTAINS "16478202-coinbase.com" OR destinationntdomain CONTAINS "164872942-coinbase.com" OR destinationntdomain CONTAINS "16590-coinbase.com" OR destinationntdomain CONTAINS "16594373-coinbase.com" OR destinationntdomain CONTAINS "16624831-coinbase.com" OR destinationntdomain CONTAINS "16642124-coinbase.com" OR destinationntdomain CONTAINS "16642172-coinbase.com" OR destinationntdomain CONTAINS "16642580-coinbase.com" OR destinationntdomain CONTAINS "16642721-coinbase.com" OR destinationntdomain CONTAINS "16642724-coinbase.com" OR destinationntdomain CONTAINS "16642871-coinbase.com" OR destinationntdomain CONTAINS "16642872-coinbase.com" OR destinationntdomain CONTAINS "16712942-coinbase.com" OR destinationntdomain CONTAINS "16718672-coinbase.com" OR destinationntdomain CONTAINS "16728342-coinbase.com" OR destinationntdomain CONTAINS "16728348-coinbase.com" OR destinationntdomain CONTAINS "16728442-coinbase.com" OR destinationntdomain CONTAINS "16728472-coinbase.com" OR destinationntdomain CONTAINS "167285-coinbase.com" OR destinationntdomain CONTAINS "16729042-coinbase.com" OR destinationntdomain CONTAINS "16748272-coinbase.com" OR destinationntdomain CONTAINS "16782942-coinbase.com" OR destinationntdomain CONTAINS "16827420-coinbase.com" OR destinationntdomain CONTAINS "16827423-coinbase.com" OR destinationntdomain CONTAINS "16847145-coinbase.com" OR destinationntdomain CONTAINS "16893924-coinbase.com" OR destinationntdomain CONTAINS "17182-coinbase.com" OR destinationntdomain CONTAINS "17255030-coinbase.com" OR destinationntdomain CONTAINS "17259-kraken.com" OR destinationntdomain CONTAINS "172486-coinbase.com" OR destinationntdomain CONTAINS "17284652-coinbase.com" OR destinationntdomain CONTAINS "17286-coinbase.com" OR destinationntdomain CONTAINS "17334522-coinbase.com" OR destinationntdomain CONTAINS "17334522-kraken.com" OR destinationntdomain CONTAINS "17384522-coinbase.com" OR destinationntdomain CONTAINS "173912-coinbase.com" OR destinationntdomain CONTAINS "17494976-coinbase.com" OR destinationntdomain CONTAINS "17512854-coinbase.com" OR destinationntdomain CONTAINS "17512857-coinbase.com" OR destinationntdomain CONTAINS "1751954-coinbase.com" OR destinationntdomain CONTAINS "17525030-coinbase.com" OR destinationntdomain CONTAINS "17529580-coinbase.com" OR destinationntdomain CONTAINS "17614-coinbase.com" OR destinationntdomain CONTAINS "17618412-coinbase.com" OR destinationntdomain CONTAINS "17619-coinbase.com" OR destinationntdomain CONTAINS "176284-coinbase.com" OR destinationntdomain CONTAINS "17823920-coinbase.com" OR destinationntdomain CONTAINS "178253-coinbase.com")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND requesturl NOT NULL AND (requesturl CONTAINS "16450207-coinbase.com" OR requesturl CONTAINS "16458207-coinbase.com" OR requesturl CONTAINS "16478202-coinbase.com" OR requesturl CONTAINS "164872942-coinbase.com" OR requesturl CONTAINS "16590-coinbase.com" OR requesturl CONTAINS "16594373-coinbase.com" OR requesturl CONTAINS "16624831-coinbase.com" OR requesturl CONTAINS "16642124-coinbase.com" OR requesturl CONTAINS "16642172-coinbase.com" OR requesturl CONTAINS "16642580-coinbase.com" OR requesturl CONTAINS "16642721-coinbase.com" OR requesturl CONTAINS "16642724-coinbase.com" OR requesturl CONTAINS "16642871-coinbase.com" OR requesturl CONTAINS "16642872-coinbase.com" OR requesturl CONTAINS "16712942-coinbase.com" OR requesturl CONTAINS "16718672-coinbase.com" OR requesturl CONTAINS "16728342-coinbase.com" OR requesturl CONTAINS "16728348-coinbase.com" OR requesturl CONTAINS "16728442-coinbase.com" OR requesturl CONTAINS "16728472-coinbase.com" OR requesturl CONTAINS "167285-coinbase.com" OR requesturl CONTAINS "16729042-coinbase.com" OR requesturl CONTAINS "16748272-coinbase.com" OR requesturl CONTAINS "16782942-coinbase.com" OR requesturl CONTAINS "16827420-coinbase.com" OR requesturl CONTAINS "16827423-coinbase.com" OR requesturl CONTAINS "16847145-coinbase.com" OR requesturl CONTAINS "16893924-coinbase.com" OR requesturl CONTAINS "17182-coinbase.com" OR requesturl CONTAINS "17255030-coinbase.com" OR requesturl CONTAINS "17259-kraken.com" OR requesturl CONTAINS "172486-coinbase.com" OR requesturl CONTAINS "17284652-coinbase.com" OR requesturl CONTAINS "17286-coinbase.com" OR requesturl CONTAINS "17334522-coinbase.com" OR requesturl CONTAINS "17334522-kraken.com" OR requesturl CONTAINS "17384522-coinbase.com" OR requesturl CONTAINS "173912-coinbase.com" OR requesturl CONTAINS "17494976-coinbase.com" OR requesturl CONTAINS "17512854-coinbase.com" OR requesturl CONTAINS "17512857-coinbase.com" OR requesturl CONTAINS "1751954-coinbase.com" OR requesturl CONTAINS "17525030-coinbase.com" OR requesturl CONTAINS "17529580-coinbase.com" OR requesturl CONTAINS "17614-coinbase.com" OR requesturl CONTAINS "17618412-coinbase.com" OR requesturl CONTAINS "17619-coinbase.com" OR requesturl CONTAINS "176284-coinbase.com" OR requesturl CONTAINS "17823920-coinbase.com" OR requesturl CONTAINS "178253-coinbase.com")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "178294-coinbase.com" OR destinationhostname CONTAINS "17912-coinbase.com" OR destinationhostname CONTAINS "17914-coinbase.com" OR destinationhostname CONTAINS "17917-coinbase.com" OR destinationhostname CONTAINS "17954-coinbase.com" OR destinationhostname CONTAINS "17958-coinbase.com" OR destinationhostname CONTAINS "182043-coinbase.com" OR destinationhostname CONTAINS "18275-gemini.com" OR destinationhostname CONTAINS "18276-coinbase.com" OR destinationhostname CONTAINS "18290185-coinbase.com" OR destinationhostname CONTAINS "182967-coinbase.com" OR destinationhostname CONTAINS "18560-coinbase.com" OR destinationhostname CONTAINS "18571-coinbase.com" OR destinationhostname CONTAINS "185912-coinbase.com" OR destinationhostname CONTAINS "185914-coinbase.com" OR destinationhostname CONTAINS "18592176-coinbase.com" OR destinationhostname CONTAINS "18594162-coinbase.com" OR destinationhostname CONTAINS "18594962-coinbase.com" OR destinationhostname CONTAINS "18597162-coinbase.com" OR destinationhostname CONTAINS "18719562-coinbase.com" OR destinationhostname CONTAINS "1875290-coinbase.com" OR destinationhostname CONTAINS "1882730-coinbase.com" OR destinationhostname CONTAINS "18902-coinbase.com" OR destinationhostname CONTAINS "18903-coinbase.com" OR destinationhostname CONTAINS "189126-coinbase.com" OR destinationhostname CONTAINS "18952-coinbase.com" OR destinationhostname CONTAINS "192854-coinbase.com" OR destinationhostname CONTAINS "192856-coinbase.com" OR destinationhostname CONTAINS "19287-binance.com" OR destinationhostname CONTAINS "19572-coinbase.com" OR destinationhostname CONTAINS "195812-coinbase.com" OR destinationhostname CONTAINS "195826-coinbase.com" OR destinationhostname CONTAINS "1958262-coinbase.com" OR destinationhostname CONTAINS "195827-binance.com" OR destinationhostname CONTAINS "1958297-coinbase.com" OR destinationhostname CONTAINS "19582970-coinbase.com" OR destinationhostname CONTAINS "19582971-coinbase.com" OR destinationhostname CONTAINS "19583-coinbase.com" OR destinationhostname CONTAINS "19592653-coinbase.com" OR destinationhostname CONTAINS "197304-coinbase.com" OR destinationhostname CONTAINS "19730492-coinbase.com" OR destinationhostname CONTAINS "19764162-coinbase.com" OR destinationhostname CONTAINS "19803-coinbase.com" OR destinationhostname CONTAINS "201784289-coinbase.com" OR destinationhostname CONTAINS "210823644-coinbase.com" OR destinationhostname CONTAINS "21158-coinbase.com" OR destinationhostname CONTAINS "21509-coinbase.com" OR destinationhostname CONTAINS "25985-coinbase.com" OR destinationhostname CONTAINS "27699-coinbase.com" OR destinationhostname CONTAINS "28367-coinbase.com")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "178294-coinbase.com" OR sourcentdomain CONTAINS "17912-coinbase.com" OR sourcentdomain CONTAINS "17914-coinbase.com" OR sourcentdomain CONTAINS "17917-coinbase.com" OR sourcentdomain CONTAINS "17954-coinbase.com" OR sourcentdomain CONTAINS "17958-coinbase.com" OR sourcentdomain CONTAINS "182043-coinbase.com" OR sourcentdomain CONTAINS "18275-gemini.com" OR sourcentdomain CONTAINS "18276-coinbase.com" OR sourcentdomain CONTAINS "18290185-coinbase.com" OR sourcentdomain CONTAINS "182967-coinbase.com" OR sourcentdomain CONTAINS "18560-coinbase.com" OR sourcentdomain CONTAINS "18571-coinbase.com" OR sourcentdomain CONTAINS "185912-coinbase.com" OR sourcentdomain CONTAINS "185914-coinbase.com" OR sourcentdomain CONTAINS "18592176-coinbase.com" OR sourcentdomain CONTAINS "18594162-coinbase.com" OR sourcentdomain CONTAINS "18594962-coinbase.com" OR sourcentdomain CONTAINS "18597162-coinbase.com" OR sourcentdomain CONTAINS "18719562-coinbase.com" OR sourcentdomain CONTAINS "1875290-coinbase.com" OR sourcentdomain CONTAINS "1882730-coinbase.com" OR sourcentdomain CONTAINS "18902-coinbase.com" OR sourcentdomain CONTAINS "18903-coinbase.com" OR sourcentdomain CONTAINS "189126-coinbase.com" OR sourcentdomain CONTAINS "18952-coinbase.com" OR sourcentdomain CONTAINS "192854-coinbase.com" OR sourcentdomain CONTAINS "192856-coinbase.com" OR sourcentdomain CONTAINS "19287-binance.com" OR sourcentdomain CONTAINS "19572-coinbase.com" OR sourcentdomain CONTAINS "195812-coinbase.com" OR sourcentdomain CONTAINS "195826-coinbase.com" OR sourcentdomain CONTAINS "1958262-coinbase.com" OR sourcentdomain CONTAINS "195827-binance.com" OR sourcentdomain CONTAINS "1958297-coinbase.com" OR sourcentdomain CONTAINS "19582970-coinbase.com" OR sourcentdomain CONTAINS "19582971-coinbase.com" OR sourcentdomain CONTAINS "19583-coinbase.com" OR sourcentdomain CONTAINS "19592653-coinbase.com" OR sourcentdomain CONTAINS "197304-coinbase.com" OR sourcentdomain CONTAINS "19730492-coinbase.com" OR sourcentdomain CONTAINS "19764162-coinbase.com" OR sourcentdomain CONTAINS "19803-coinbase.com" OR sourcentdomain CONTAINS "201784289-coinbase.com" OR sourcentdomain CONTAINS "210823644-coinbase.com" OR sourcentdomain CONTAINS "21158-coinbase.com" OR sourcentdomain CONTAINS "21509-coinbase.com" OR sourcentdomain CONTAINS "25985-coinbase.com" OR sourcentdomain CONTAINS "27699-coinbase.com" OR sourcentdomain CONTAINS "28367-coinbase.com")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "178294-coinbase.com" OR sourcehostname CONTAINS "17912-coinbase.com" OR sourcehostname CONTAINS "17914-coinbase.com" OR sourcehostname CONTAINS "17917-coinbase.com" OR sourcehostname CONTAINS "17954-coinbase.com" OR sourcehostname CONTAINS "17958-coinbase.com" OR sourcehostname CONTAINS "182043-coinbase.com" OR sourcehostname CONTAINS "18275-gemini.com" OR sourcehostname CONTAINS "18276-coinbase.com" OR sourcehostname CONTAINS "18290185-coinbase.com" OR sourcehostname CONTAINS "182967-coinbase.com" OR sourcehostname CONTAINS "18560-coinbase.com" OR sourcehostname CONTAINS "18571-coinbase.com" OR sourcehostname CONTAINS "185912-coinbase.com" OR sourcehostname CONTAINS "185914-coinbase.com" OR sourcehostname CONTAINS "18592176-coinbase.com" OR sourcehostname CONTAINS "18594162-coinbase.com" OR sourcehostname CONTAINS "18594962-coinbase.com" OR sourcehostname CONTAINS "18597162-coinbase.com" OR sourcehostname CONTAINS "18719562-coinbase.com" OR sourcehostname CONTAINS "1875290-coinbase.com" OR sourcehostname CONTAINS "1882730-coinbase.com" OR sourcehostname CONTAINS "18902-coinbase.com" OR sourcehostname CONTAINS "18903-coinbase.com" OR sourcehostname CONTAINS "189126-coinbase.com" OR sourcehostname CONTAINS "18952-coinbase.com" OR sourcehostname CONTAINS "192854-coinbase.com" OR sourcehostname CONTAINS "192856-coinbase.com" OR sourcehostname CONTAINS "19287-binance.com" OR sourcehostname CONTAINS "19572-coinbase.com" OR sourcehostname CONTAINS "195812-coinbase.com" OR sourcehostname CONTAINS "195826-coinbase.com" OR sourcehostname CONTAINS "1958262-coinbase.com" OR sourcehostname CONTAINS "195827-binance.com" OR sourcehostname CONTAINS "1958297-coinbase.com" OR sourcehostname CONTAINS "19582970-coinbase.com" OR sourcehostname CONTAINS "19582971-coinbase.com" OR sourcehostname CONTAINS "19583-coinbase.com" OR sourcehostname CONTAINS "19592653-coinbase.com" OR sourcehostname CONTAINS "197304-coinbase.com" OR sourcehostname CONTAINS "19730492-coinbase.com" OR sourcehostname CONTAINS "19764162-coinbase.com" OR sourcehostname CONTAINS "19803-coinbase.com" OR sourcehostname CONTAINS "201784289-coinbase.com" OR sourcehostname CONTAINS "210823644-coinbase.com" OR sourcehostname CONTAINS "21158-coinbase.com" OR sourcehostname CONTAINS "21509-coinbase.com" OR sourcehostname CONTAINS "25985-coinbase.com" OR sourcehostname CONTAINS "27699-coinbase.com" OR sourcehostname CONTAINS "28367-coinbase.com")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "178294-coinbase.com" OR destinationntdomain CONTAINS "17912-coinbase.com" OR destinationntdomain CONTAINS "17914-coinbase.com" OR destinationntdomain CONTAINS "17917-coinbase.com" OR destinationntdomain CONTAINS "17954-coinbase.com" OR destinationntdomain CONTAINS "17958-coinbase.com" OR destinationntdomain CONTAINS "182043-coinbase.com" OR destinationntdomain CONTAINS "18275-gemini.com" OR destinationntdomain CONTAINS "18276-coinbase.com" OR destinationntdomain CONTAINS "18290185-coinbase.com" OR destinationntdomain CONTAINS "182967-coinbase.com" OR destinationntdomain CONTAINS "18560-coinbase.com" OR destinationntdomain CONTAINS "18571-coinbase.com" OR destinationntdomain CONTAINS "185912-coinbase.com" OR destinationntdomain CONTAINS "185914-coinbase.com" OR destinationntdomain CONTAINS "18592176-coinbase.com" OR destinationntdomain CONTAINS "18594162-coinbase.com" OR destinationntdomain CONTAINS "18594962-coinbase.com" OR destinationntdomain CONTAINS "18597162-coinbase.com" OR destinationntdomain CONTAINS "18719562-coinbase.com" OR destinationntdomain CONTAINS "1875290-coinbase.com" OR destinationntdomain CONTAINS "1882730-coinbase.com" OR destinationntdomain CONTAINS "18902-coinbase.com" OR destinationntdomain CONTAINS "18903-coinbase.com" OR destinationntdomain CONTAINS "189126-coinbase.com" OR destinationntdomain CONTAINS "18952-coinbase.com" OR destinationntdomain CONTAINS "192854-coinbase.com" OR destinationntdomain CONTAINS "192856-coinbase.com" OR destinationntdomain CONTAINS "19287-binance.com" OR destinationntdomain CONTAINS "19572-coinbase.com" OR destinationntdomain CONTAINS "195812-coinbase.com" OR destinationntdomain CONTAINS "195826-coinbase.com" OR destinationntdomain CONTAINS "1958262-coinbase.com" OR destinationntdomain CONTAINS "195827-binance.com" OR destinationntdomain CONTAINS "1958297-coinbase.com" OR destinationntdomain CONTAINS "19582970-coinbase.com" OR destinationntdomain CONTAINS "19582971-coinbase.com" OR destinationntdomain CONTAINS "19583-coinbase.com" OR destinationntdomain CONTAINS "19592653-coinbase.com" OR destinationntdomain CONTAINS "197304-coinbase.com" OR destinationntdomain CONTAINS "19730492-coinbase.com" OR destinationntdomain CONTAINS "19764162-coinbase.com" OR destinationntdomain CONTAINS "19803-coinbase.com" OR destinationntdomain CONTAINS "201784289-coinbase.com" OR destinationntdomain CONTAINS "210823644-coinbase.com" OR destinationntdomain CONTAINS "21158-coinbase.com" OR destinationntdomain CONTAINS "21509-coinbase.com" OR destinationntdomain CONTAINS "25985-coinbase.com" OR destinationntdomain CONTAINS "27699-coinbase.com" OR destinationntdomain CONTAINS "28367-coinbase.com")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND requesturl NOT NULL AND (requesturl CONTAINS "178294-coinbase.com" OR requesturl CONTAINS "17912-coinbase.com" OR requesturl CONTAINS "17914-coinbase.com" OR requesturl CONTAINS "17917-coinbase.com" OR requesturl CONTAINS "17954-coinbase.com" OR requesturl CONTAINS "17958-coinbase.com" OR requesturl CONTAINS "182043-coinbase.com" OR requesturl CONTAINS "18275-gemini.com" OR requesturl CONTAINS "18276-coinbase.com" OR requesturl CONTAINS "18290185-coinbase.com" OR requesturl CONTAINS "182967-coinbase.com" OR requesturl CONTAINS "18560-coinbase.com" OR requesturl CONTAINS "18571-coinbase.com" OR requesturl CONTAINS "185912-coinbase.com" OR requesturl CONTAINS "185914-coinbase.com" OR requesturl CONTAINS "18592176-coinbase.com" OR requesturl CONTAINS "18594162-coinbase.com" OR requesturl CONTAINS "18594962-coinbase.com" OR requesturl CONTAINS "18597162-coinbase.com" OR requesturl CONTAINS "18719562-coinbase.com" OR requesturl CONTAINS "1875290-coinbase.com" OR requesturl CONTAINS "1882730-coinbase.com" OR requesturl CONTAINS "18902-coinbase.com" OR requesturl CONTAINS "18903-coinbase.com" OR requesturl CONTAINS "189126-coinbase.com" OR requesturl CONTAINS "18952-coinbase.com" OR requesturl CONTAINS "192854-coinbase.com" OR requesturl CONTAINS "192856-coinbase.com" OR requesturl CONTAINS "19287-binance.com" OR requesturl CONTAINS "19572-coinbase.com" OR requesturl CONTAINS "195812-coinbase.com" OR requesturl CONTAINS "195826-coinbase.com" OR requesturl CONTAINS "1958262-coinbase.com" OR requesturl CONTAINS "195827-binance.com" OR requesturl CONTAINS "1958297-coinbase.com" OR requesturl CONTAINS "19582970-coinbase.com" OR requesturl CONTAINS "19582971-coinbase.com" OR requesturl CONTAINS "19583-coinbase.com" OR requesturl CONTAINS "19592653-coinbase.com" OR requesturl CONTAINS "197304-coinbase.com" OR requesturl CONTAINS "19730492-coinbase.com" OR requesturl CONTAINS "19764162-coinbase.com" OR requesturl CONTAINS "19803-coinbase.com" OR requesturl CONTAINS "201784289-coinbase.com" OR requesturl CONTAINS "210823644-coinbase.com" OR requesturl CONTAINS "21158-coinbase.com" OR requesturl CONTAINS "21509-coinbase.com" OR requesturl CONTAINS "25985-coinbase.com" OR requesturl CONTAINS "27699-coinbase.com" OR requesturl CONTAINS "28367-coinbase.com")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "28676-coinbase.com" OR destinationhostname CONTAINS "29185-coinbase.com" OR destinationhostname CONTAINS "29195-coinbase.com" OR destinationhostname CONTAINS "2a-coinbase.com" OR destinationhostname CONTAINS "2b-coinbase.com" OR destinationhostname CONTAINS "2c-coinbase.com" OR destinationhostname CONTAINS "2f-coinbase.com" OR destinationhostname CONTAINS "2fas-coinbase.com" OR destinationhostname CONTAINS "2o-coinbase.com" OR destinationhostname CONTAINS "2r-coinbase.com" OR destinationhostname CONTAINS "2s-coinbase.com" OR destinationhostname CONTAINS "2sv-coinbase.com" OR destinationhostname CONTAINS "352134951-coinbase.com" OR destinationhostname CONTAINS "38468-coinbase.com" OR destinationhostname CONTAINS "39590-coinbase.com" OR destinationhostname CONTAINS "41260-coinbase.com" OR destinationhostname CONTAINS "427883-coinbase.com" OR destinationhostname CONTAINS "43017-coinbase.com" OR destinationhostname CONTAINS "47562-coinbase.com" OR destinationhostname CONTAINS "50195-coinbase.com" OR destinationhostname CONTAINS "5247-coinbase.com" OR destinationhostname CONTAINS "54765-coinbase.com" OR destinationhostname CONTAINS "57197-coinbase.com" OR destinationhostname CONTAINS "58176-coinbase.com" OR destinationhostname CONTAINS "58297-coinbase.com" OR destinationhostname CONTAINS "61250-coinbase.com" OR destinationhostname CONTAINS "61835-coinbase.com" OR destinationhostname CONTAINS "61851-coinbase.com" OR destinationhostname CONTAINS "61937-coinbase.com" OR destinationhostname CONTAINS "71925-coinbase.com" OR destinationhostname CONTAINS "72957-coinbase.com" OR destinationhostname CONTAINS "72985-coinbase.com" OR destinationhostname CONTAINS "74651-coinbase.com" OR destinationhostname CONTAINS "754668948-coinbase.com" OR destinationhostname CONTAINS "76159869-coinbase.com" OR destinationhostname CONTAINS "76153-coinbase.com" OR destinationhostname CONTAINS "81758-coinbase.com" OR destinationhostname CONTAINS "81920-coinbase.com" OR destinationhostname CONTAINS "81926-coinbase.com" OR destinationhostname CONTAINS "81958-coinbase.com" OR destinationhostname CONTAINS "826298-coinbase.com" OR destinationhostname CONTAINS "83216-coinbase.com" OR destinationhostname CONTAINS "837613-coinbase.com" OR destinationhostname CONTAINS "83956-coinbase.com" OR destinationhostname CONTAINS "87157-coinbase.com" OR destinationhostname CONTAINS "87312-coinbase.com" OR destinationhostname CONTAINS "89304-coinbase.com" OR destinationhostname CONTAINS "89375-coinbase.com" OR destinationhostname CONTAINS "91723-gemini.com" OR destinationhostname CONTAINS "91752-coinbase.com")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "28676-coinbase.com" OR sourcentdomain CONTAINS "29185-coinbase.com" OR sourcentdomain CONTAINS "29195-coinbase.com" OR sourcentdomain CONTAINS "2a-coinbase.com" OR sourcentdomain CONTAINS "2b-coinbase.com" OR sourcentdomain CONTAINS "2c-coinbase.com" OR sourcentdomain CONTAINS "2f-coinbase.com" OR sourcentdomain CONTAINS "2fas-coinbase.com" OR sourcentdomain CONTAINS "2o-coinbase.com" OR sourcentdomain CONTAINS "2r-coinbase.com" OR sourcentdomain CONTAINS "2s-coinbase.com" OR sourcentdomain CONTAINS "2sv-coinbase.com" OR sourcentdomain CONTAINS "352134951-coinbase.com" OR sourcentdomain CONTAINS "38468-coinbase.com" OR sourcentdomain CONTAINS "39590-coinbase.com" OR sourcentdomain CONTAINS "41260-coinbase.com" OR sourcentdomain CONTAINS "427883-coinbase.com" OR sourcentdomain CONTAINS "43017-coinbase.com" OR sourcentdomain CONTAINS "47562-coinbase.com" OR sourcentdomain CONTAINS "50195-coinbase.com" OR sourcentdomain CONTAINS "5247-coinbase.com" OR sourcentdomain CONTAINS "54765-coinbase.com" OR sourcentdomain CONTAINS "57197-coinbase.com" OR sourcentdomain CONTAINS "58176-coinbase.com" OR sourcentdomain CONTAINS "58297-coinbase.com" OR sourcentdomain CONTAINS "61250-coinbase.com" OR sourcentdomain CONTAINS "61835-coinbase.com" OR sourcentdomain CONTAINS "61851-coinbase.com" OR sourcentdomain CONTAINS "61937-coinbase.com" OR sourcentdomain CONTAINS "71925-coinbase.com" OR sourcentdomain CONTAINS "72957-coinbase.com" OR sourcentdomain CONTAINS "72985-coinbase.com" OR sourcentdomain CONTAINS "74651-coinbase.com" OR sourcentdomain CONTAINS "754668948-coinbase.com" OR sourcentdomain CONTAINS "76159869-coinbase.com" OR sourcentdomain CONTAINS "76153-coinbase.com" OR sourcentdomain CONTAINS "81758-coinbase.com" OR sourcentdomain CONTAINS "81920-coinbase.com" OR sourcentdomain CONTAINS "81926-coinbase.com" OR sourcentdomain CONTAINS "81958-coinbase.com" OR sourcentdomain CONTAINS "826298-coinbase.com" OR sourcentdomain CONTAINS "83216-coinbase.com" OR sourcentdomain CONTAINS "837613-coinbase.com" OR sourcentdomain CONTAINS "83956-coinbase.com" OR sourcentdomain CONTAINS "87157-coinbase.com" OR sourcentdomain CONTAINS "87312-coinbase.com" OR sourcentdomain CONTAINS "89304-coinbase.com" OR sourcentdomain CONTAINS "89375-coinbase.com" OR sourcentdomain CONTAINS "91723-gemini.com" OR sourcentdomain CONTAINS "91752-coinbase.com")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "28676-coinbase.com" OR sourcehostname CONTAINS "29185-coinbase.com" OR sourcehostname CONTAINS "29195-coinbase.com" OR sourcehostname CONTAINS "2a-coinbase.com" OR sourcehostname CONTAINS "2b-coinbase.com" OR sourcehostname CONTAINS "2c-coinbase.com" OR sourcehostname CONTAINS "2f-coinbase.com" OR sourcehostname CONTAINS "2fas-coinbase.com" OR sourcehostname CONTAINS "2o-coinbase.com" OR sourcehostname CONTAINS "2r-coinbase.com" OR sourcehostname CONTAINS "2s-coinbase.com" OR sourcehostname CONTAINS "2sv-coinbase.com" OR sourcehostname CONTAINS "352134951-coinbase.com" OR sourcehostname CONTAINS "38468-coinbase.com" OR sourcehostname CONTAINS "39590-coinbase.com" OR sourcehostname CONTAINS "41260-coinbase.com" OR sourcehostname CONTAINS "427883-coinbase.com" OR sourcehostname CONTAINS "43017-coinbase.com" OR sourcehostname CONTAINS "47562-coinbase.com" OR sourcehostname CONTAINS "50195-coinbase.com" OR sourcehostname CONTAINS "5247-coinbase.com" OR sourcehostname CONTAINS "54765-coinbase.com" OR sourcehostname CONTAINS "57197-coinbase.com" OR sourcehostname CONTAINS "58176-coinbase.com" OR sourcehostname CONTAINS "58297-coinbase.com" OR sourcehostname CONTAINS "61250-coinbase.com" OR sourcehostname CONTAINS "61835-coinbase.com" OR sourcehostname CONTAINS "61851-coinbase.com" OR sourcehostname CONTAINS "61937-coinbase.com" OR sourcehostname CONTAINS "71925-coinbase.com" OR sourcehostname CONTAINS "72957-coinbase.com" OR sourcehostname CONTAINS "72985-coinbase.com" OR sourcehostname CONTAINS "74651-coinbase.com" OR sourcehostname CONTAINS "754668948-coinbase.com" OR sourcehostname CONTAINS "76159869-coinbase.com" OR sourcehostname CONTAINS "76153-coinbase.com" OR sourcehostname CONTAINS "81758-coinbase.com" OR sourcehostname CONTAINS "81920-coinbase.com" OR sourcehostname CONTAINS "81926-coinbase.com" OR sourcehostname CONTAINS "81958-coinbase.com" OR sourcehostname CONTAINS "826298-coinbase.com" OR sourcehostname CONTAINS "83216-coinbase.com" OR sourcehostname CONTAINS "837613-coinbase.com" OR sourcehostname CONTAINS "83956-coinbase.com" OR sourcehostname CONTAINS "87157-coinbase.com" OR sourcehostname CONTAINS "87312-coinbase.com" OR sourcehostname CONTAINS "89304-coinbase.com" OR sourcehostname CONTAINS "89375-coinbase.com" OR sourcehostname CONTAINS "91723-gemini.com" OR sourcehostname CONTAINS "91752-coinbase.com")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "28676-coinbase.com" OR destinationntdomain CONTAINS "29185-coinbase.com" OR destinationntdomain CONTAINS "29195-coinbase.com" OR destinationntdomain CONTAINS "2a-coinbase.com" OR destinationntdomain CONTAINS "2b-coinbase.com" OR destinationntdomain CONTAINS "2c-coinbase.com" OR destinationntdomain CONTAINS "2f-coinbase.com" OR destinationntdomain CONTAINS "2fas-coinbase.com" OR destinationntdomain CONTAINS "2o-coinbase.com" OR destinationntdomain CONTAINS "2r-coinbase.com" OR destinationntdomain CONTAINS "2s-coinbase.com" OR destinationntdomain CONTAINS "2sv-coinbase.com" OR destinationntdomain CONTAINS "352134951-coinbase.com" OR destinationntdomain CONTAINS "38468-coinbase.com" OR destinationntdomain CONTAINS "39590-coinbase.com" OR destinationntdomain CONTAINS "41260-coinbase.com" OR destinationntdomain CONTAINS "427883-coinbase.com" OR destinationntdomain CONTAINS "43017-coinbase.com" OR destinationntdomain CONTAINS "47562-coinbase.com" OR destinationntdomain CONTAINS "50195-coinbase.com" OR destinationntdomain CONTAINS "5247-coinbase.com" OR destinationntdomain CONTAINS "54765-coinbase.com" OR destinationntdomain CONTAINS "57197-coinbase.com" OR destinationntdomain CONTAINS "58176-coinbase.com" OR destinationntdomain CONTAINS "58297-coinbase.com" OR destinationntdomain CONTAINS "61250-coinbase.com" OR destinationntdomain CONTAINS "61835-coinbase.com" OR destinationntdomain CONTAINS "61851-coinbase.com" OR destinationntdomain CONTAINS "61937-coinbase.com" OR destinationntdomain CONTAINS "71925-coinbase.com" OR destinationntdomain CONTAINS "72957-coinbase.com" OR destinationntdomain CONTAINS "72985-coinbase.com" OR destinationntdomain CONTAINS "74651-coinbase.com" OR destinationntdomain CONTAINS "754668948-coinbase.com" OR destinationntdomain CONTAINS "76159869-coinbase.com" OR destinationntdomain CONTAINS "76153-coinbase.com" OR destinationntdomain CONTAINS "81758-coinbase.com" OR destinationntdomain CONTAINS "81920-coinbase.com" OR destinationntdomain CONTAINS "81926-coinbase.com" OR destinationntdomain CONTAINS "81958-coinbase.com" OR destinationntdomain CONTAINS "826298-coinbase.com" OR destinationntdomain CONTAINS "83216-coinbase.com" OR destinationntdomain CONTAINS "837613-coinbase.com" OR destinationntdomain CONTAINS "83956-coinbase.com" OR destinationntdomain CONTAINS "87157-coinbase.com" OR destinationntdomain CONTAINS "87312-coinbase.com" OR destinationntdomain CONTAINS "89304-coinbase.com" OR destinationntdomain CONTAINS "89375-coinbase.com" OR destinationntdomain CONTAINS "91723-gemini.com" OR destinationntdomain CONTAINS "91752-coinbase.com")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND requesturl NOT NULL AND (requesturl CONTAINS "28676-coinbase.com" OR requesturl CONTAINS "29185-coinbase.com" OR requesturl CONTAINS "29195-coinbase.com" OR requesturl CONTAINS "2a-coinbase.com" OR requesturl CONTAINS "2b-coinbase.com" OR requesturl CONTAINS "2c-coinbase.com" OR requesturl CONTAINS "2f-coinbase.com" OR requesturl CONTAINS "2fas-coinbase.com" OR requesturl CONTAINS "2o-coinbase.com" OR requesturl CONTAINS "2r-coinbase.com" OR requesturl CONTAINS "2s-coinbase.com" OR requesturl CONTAINS "2sv-coinbase.com" OR requesturl CONTAINS "352134951-coinbase.com" OR requesturl CONTAINS "38468-coinbase.com" OR requesturl CONTAINS "39590-coinbase.com" OR requesturl CONTAINS "41260-coinbase.com" OR requesturl CONTAINS "427883-coinbase.com" OR requesturl CONTAINS "43017-coinbase.com" OR requesturl CONTAINS "47562-coinbase.com" OR requesturl CONTAINS "50195-coinbase.com" OR requesturl CONTAINS "5247-coinbase.com" OR requesturl CONTAINS "54765-coinbase.com" OR requesturl CONTAINS "57197-coinbase.com" OR requesturl CONTAINS "58176-coinbase.com" OR requesturl CONTAINS "58297-coinbase.com" OR requesturl CONTAINS "61250-coinbase.com" OR requesturl CONTAINS "61835-coinbase.com" OR requesturl CONTAINS "61851-coinbase.com" OR requesturl CONTAINS "61937-coinbase.com" OR requesturl CONTAINS "71925-coinbase.com" OR requesturl CONTAINS "72957-coinbase.com" OR requesturl CONTAINS "72985-coinbase.com" OR requesturl CONTAINS "74651-coinbase.com" OR requesturl CONTAINS "754668948-coinbase.com" OR requesturl CONTAINS "76159869-coinbase.com" OR requesturl CONTAINS "76153-coinbase.com" OR requesturl CONTAINS "81758-coinbase.com" OR requesturl CONTAINS "81920-coinbase.com" OR requesturl CONTAINS "81926-coinbase.com" OR requesturl CONTAINS "81958-coinbase.com" OR requesturl CONTAINS "826298-coinbase.com" OR requesturl CONTAINS "83216-coinbase.com" OR requesturl CONTAINS "837613-coinbase.com" OR requesturl CONTAINS "83956-coinbase.com" OR requesturl CONTAINS "87157-coinbase.com" OR requesturl CONTAINS "87312-coinbase.com" OR requesturl CONTAINS "89304-coinbase.com" OR requesturl CONTAINS "89375-coinbase.com" OR requesturl CONTAINS "91723-gemini.com" OR requesturl CONTAINS "91752-coinbase.com")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "91756-coinbase.com" OR destinationhostname CONTAINS "91782-coinbase.com" OR destinationhostname CONTAINS "91835-coinbase.com" OR destinationhostname CONTAINS "91845-coinbase.com" OR destinationhostname CONTAINS "91923-coinbase.com" OR destinationhostname CONTAINS "92758-coinbase.com" OR destinationhostname CONTAINS "948122061-coinbase.com" OR destinationhostname CONTAINS "978941-coinbase.com" OR destinationhostname CONTAINS "accountrecovery-coinbase.com" OR destinationhostname CONTAINS "action-shakepay.com" OR destinationhostname CONTAINS "adjust-coinbase.com" OR destinationhostname CONTAINS "admin-kraken.com" OR destinationhostname CONTAINS "applechargebacks.com" OR destinationhostname CONTAINS "authenticate-gemini.com" OR destinationhostname CONTAINS "authorize-gmail.com" OR destinationhostname CONTAINS "binance-okta.com" OR destinationhostname CONTAINS "captcha-coinbase.com" OR destinationhostname CONTAINS "cd-coinbase.com" OR destinationhostname CONTAINS "coinbase-heip.com" OR destinationhostname CONTAINS "coinbase-live.support" OR destinationhostname CONTAINS "coinbase-reject.com" OR destinationhostname CONTAINS "coinbase-ticket.com" OR destinationhostname CONTAINS "coinbaseheip.com" OR destinationhostname CONTAINS "com-2fa.help" OR destinationhostname CONTAINS "com-2fa.support" OR destinationhostname CONTAINS "com-3845.support" OR destinationhostname CONTAINS "com-connect.help" OR destinationhostname CONTAINS "com-fraud.support" OR destinationhostname CONTAINS "com-help.support" OR destinationhostname CONTAINS "com-reset.help" OR destinationhostname CONTAINS "com-reset.net" OR destinationhostname CONTAINS "com-ticket.live" OR destinationhostname CONTAINS "com-ticket.support" OR destinationhostname CONTAINS "contact-nexo.com" OR destinationhostname CONTAINS "convert-coinbase.com" OR destinationhostname CONTAINS "customerservice-coinbase.com" OR destinationhostname CONTAINS "default-coinbase.com" OR destinationhostname CONTAINS "defend-coinbase.com" OR destinationhostname CONTAINS "deny-coinbase.com" OR destinationhostname CONTAINS "disconnect-coinbase.com" OR destinationhostname CONTAINS "escalate-coinbase.com" OR destinationhostname CONTAINS "establish-coinbase.com" OR destinationhostname CONTAINS "fcc-okta.com" OR destinationhostname CONTAINS "fraudulent-coinbase.com" OR destinationhostname CONTAINS "guard-apple.com" OR destinationhostname CONTAINS "guard-icloud.com" OR destinationhostname CONTAINS "guardian-coinbase.com" OR destinationhostname CONTAINS "guide-gemini.com" OR destinationhostname CONTAINS "help-bitfinex.com" OR destinationhostname CONTAINS "help-shakepay.com")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "91756-coinbase.com" OR sourcentdomain CONTAINS "91782-coinbase.com" OR sourcentdomain CONTAINS "91835-coinbase.com" OR sourcentdomain CONTAINS "91845-coinbase.com" OR sourcentdomain CONTAINS "91923-coinbase.com" OR sourcentdomain CONTAINS "92758-coinbase.com" OR sourcentdomain CONTAINS "948122061-coinbase.com" OR sourcentdomain CONTAINS "978941-coinbase.com" OR sourcentdomain CONTAINS "accountrecovery-coinbase.com" OR sourcentdomain CONTAINS "action-shakepay.com" OR sourcentdomain CONTAINS "adjust-coinbase.com" OR sourcentdomain CONTAINS "admin-kraken.com" OR sourcentdomain CONTAINS "applechargebacks.com" OR sourcentdomain CONTAINS "authenticate-gemini.com" OR sourcentdomain CONTAINS "authorize-gmail.com" OR sourcentdomain CONTAINS "binance-okta.com" OR sourcentdomain CONTAINS "captcha-coinbase.com" OR sourcentdomain CONTAINS "cd-coinbase.com" OR sourcentdomain CONTAINS "coinbase-heip.com" OR sourcentdomain CONTAINS "coinbase-live.support" OR sourcentdomain CONTAINS "coinbase-reject.com" OR sourcentdomain CONTAINS "coinbase-ticket.com" OR sourcentdomain CONTAINS "coinbaseheip.com" OR sourcentdomain CONTAINS "com-2fa.help" OR sourcentdomain CONTAINS "com-2fa.support" OR sourcentdomain CONTAINS "com-3845.support" OR sourcentdomain CONTAINS "com-connect.help" OR sourcentdomain CONTAINS "com-fraud.support" OR sourcentdomain CONTAINS "com-help.support" OR sourcentdomain CONTAINS "com-reset.help" OR sourcentdomain CONTAINS "com-reset.net" OR sourcentdomain CONTAINS "com-ticket.live" OR sourcentdomain CONTAINS "com-ticket.support" OR sourcentdomain CONTAINS "contact-nexo.com" OR sourcentdomain CONTAINS "convert-coinbase.com" OR sourcentdomain CONTAINS "customerservice-coinbase.com" OR sourcentdomain CONTAINS "default-coinbase.com" OR sourcentdomain CONTAINS "defend-coinbase.com" OR sourcentdomain CONTAINS "deny-coinbase.com" OR sourcentdomain CONTAINS "disconnect-coinbase.com" OR sourcentdomain CONTAINS "escalate-coinbase.com" OR sourcentdomain CONTAINS "establish-coinbase.com" OR sourcentdomain CONTAINS "fcc-okta.com" OR sourcentdomain CONTAINS "fraudulent-coinbase.com" OR sourcentdomain CONTAINS "guard-apple.com" OR sourcentdomain CONTAINS "guard-icloud.com" OR sourcentdomain CONTAINS "guardian-coinbase.com" OR sourcentdomain CONTAINS "guide-gemini.com" OR sourcentdomain CONTAINS "help-bitfinex.com" OR sourcentdomain CONTAINS "help-shakepay.com")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "91756-coinbase.com" OR sourcehostname CONTAINS "91782-coinbase.com" OR sourcehostname CONTAINS "91835-coinbase.com" OR sourcehostname CONTAINS "91845-coinbase.com" OR sourcehostname CONTAINS "91923-coinbase.com" OR sourcehostname CONTAINS "92758-coinbase.com" OR sourcehostname CONTAINS "948122061-coinbase.com" OR sourcehostname CONTAINS "978941-coinbase.com" OR sourcehostname CONTAINS "accountrecovery-coinbase.com" OR sourcehostname CONTAINS "action-shakepay.com" OR sourcehostname CONTAINS "adjust-coinbase.com" OR sourcehostname CONTAINS "admin-kraken.com" OR sourcehostname CONTAINS "applechargebacks.com" OR sourcehostname CONTAINS "authenticate-gemini.com" OR sourcehostname CONTAINS "authorize-gmail.com" OR sourcehostname CONTAINS "binance-okta.com" OR sourcehostname CONTAINS "captcha-coinbase.com" OR sourcehostname CONTAINS "cd-coinbase.com" OR sourcehostname CONTAINS "coinbase-heip.com" OR sourcehostname CONTAINS "coinbase-live.support" OR sourcehostname CONTAINS "coinbase-reject.com" OR sourcehostname CONTAINS "coinbase-ticket.com" OR sourcehostname CONTAINS "coinbaseheip.com" OR sourcehostname CONTAINS "com-2fa.help" OR sourcehostname CONTAINS "com-2fa.support" OR sourcehostname CONTAINS "com-3845.support" OR sourcehostname CONTAINS "com-connect.help" OR sourcehostname CONTAINS "com-fraud.support" OR sourcehostname CONTAINS "com-help.support" OR sourcehostname CONTAINS "com-reset.help" OR sourcehostname CONTAINS "com-reset.net" OR sourcehostname CONTAINS "com-ticket.live" OR sourcehostname CONTAINS "com-ticket.support" OR sourcehostname CONTAINS "contact-nexo.com" OR sourcehostname CONTAINS "convert-coinbase.com" OR sourcehostname CONTAINS "customerservice-coinbase.com" OR sourcehostname CONTAINS "default-coinbase.com" OR sourcehostname CONTAINS "defend-coinbase.com" OR sourcehostname CONTAINS "deny-coinbase.com" OR sourcehostname CONTAINS "disconnect-coinbase.com" OR sourcehostname CONTAINS "escalate-coinbase.com" OR sourcehostname CONTAINS "establish-coinbase.com" OR sourcehostname CONTAINS "fcc-okta.com" OR sourcehostname CONTAINS "fraudulent-coinbase.com" OR sourcehostname CONTAINS "guard-apple.com" OR sourcehostname CONTAINS "guard-icloud.com" OR sourcehostname CONTAINS "guardian-coinbase.com" OR sourcehostname CONTAINS "guide-gemini.com" OR sourcehostname CONTAINS "help-bitfinex.com" OR sourcehostname CONTAINS "help-shakepay.com")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "91756-coinbase.com" OR destinationntdomain CONTAINS "91782-coinbase.com" OR destinationntdomain CONTAINS "91835-coinbase.com" OR destinationntdomain CONTAINS "91845-coinbase.com" OR destinationntdomain CONTAINS "91923-coinbase.com" OR destinationntdomain CONTAINS "92758-coinbase.com" OR destinationntdomain CONTAINS "948122061-coinbase.com" OR destinationntdomain CONTAINS "978941-coinbase.com" OR destinationntdomain CONTAINS "accountrecovery-coinbase.com" OR destinationntdomain CONTAINS "action-shakepay.com" OR destinationntdomain CONTAINS "adjust-coinbase.com" OR destinationntdomain CONTAINS "admin-kraken.com" OR destinationntdomain CONTAINS "applechargebacks.com" OR destinationntdomain CONTAINS "authenticate-gemini.com" OR destinationntdomain CONTAINS "authorize-gmail.com" OR destinationntdomain CONTAINS "binance-okta.com" OR destinationntdomain CONTAINS "captcha-coinbase.com" OR destinationntdomain CONTAINS "cd-coinbase.com" OR destinationntdomain CONTAINS "coinbase-heip.com" OR destinationntdomain CONTAINS "coinbase-live.support" OR destinationntdomain CONTAINS "coinbase-reject.com" OR destinationntdomain CONTAINS "coinbase-ticket.com" OR destinationntdomain CONTAINS "coinbaseheip.com" OR destinationntdomain CONTAINS "com-2fa.help" OR destinationntdomain CONTAINS "com-2fa.support" OR destinationntdomain CONTAINS "com-3845.support" OR destinationntdomain CONTAINS "com-connect.help" OR destinationntdomain CONTAINS "com-fraud.support" OR destinationntdomain CONTAINS "com-help.support" OR destinationntdomain CONTAINS "com-reset.help" OR destinationntdomain CONTAINS "com-reset.net" OR destinationntdomain CONTAINS "com-ticket.live" OR destinationntdomain CONTAINS "com-ticket.support" OR destinationntdomain CONTAINS "contact-nexo.com" OR destinationntdomain CONTAINS "convert-coinbase.com" OR destinationntdomain CONTAINS "customerservice-coinbase.com" OR destinationntdomain CONTAINS "default-coinbase.com" OR destinationntdomain CONTAINS "defend-coinbase.com" OR destinationntdomain CONTAINS "deny-coinbase.com" OR destinationntdomain CONTAINS "disconnect-coinbase.com" OR destinationntdomain CONTAINS "escalate-coinbase.com" OR destinationntdomain CONTAINS "establish-coinbase.com" OR destinationntdomain CONTAINS "fcc-okta.com" OR destinationntdomain CONTAINS "fraudulent-coinbase.com" OR destinationntdomain CONTAINS "guard-apple.com" OR destinationntdomain CONTAINS "guard-icloud.com" OR destinationntdomain CONTAINS "guardian-coinbase.com" OR destinationntdomain CONTAINS "guide-gemini.com" OR destinationntdomain CONTAINS "help-bitfinex.com" OR destinationntdomain CONTAINS "help-shakepay.com")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND requesturl NOT NULL AND (requesturl CONTAINS "91756-coinbase.com" OR requesturl CONTAINS "91782-coinbase.com" OR requesturl CONTAINS "91835-coinbase.com" OR requesturl CONTAINS "91845-coinbase.com" OR requesturl CONTAINS "91923-coinbase.com" OR requesturl CONTAINS "92758-coinbase.com" OR requesturl CONTAINS "948122061-coinbase.com" OR requesturl CONTAINS "978941-coinbase.com" OR requesturl CONTAINS "accountrecovery-coinbase.com" OR requesturl CONTAINS "action-shakepay.com" OR requesturl CONTAINS "adjust-coinbase.com" OR requesturl CONTAINS "admin-kraken.com" OR requesturl CONTAINS "applechargebacks.com" OR requesturl CONTAINS "authenticate-gemini.com" OR requesturl CONTAINS "authorize-gmail.com" OR requesturl CONTAINS "binance-okta.com" OR requesturl CONTAINS "captcha-coinbase.com" OR requesturl CONTAINS "cd-coinbase.com" OR requesturl CONTAINS "coinbase-heip.com" OR requesturl CONTAINS "coinbase-live.support" OR requesturl CONTAINS "coinbase-reject.com" OR requesturl CONTAINS "coinbase-ticket.com" OR requesturl CONTAINS "coinbaseheip.com" OR requesturl CONTAINS "com-2fa.help" OR requesturl CONTAINS "com-2fa.support" OR requesturl CONTAINS "com-3845.support" OR requesturl CONTAINS "com-connect.help" OR requesturl CONTAINS "com-fraud.support" OR requesturl CONTAINS "com-help.support" OR requesturl CONTAINS "com-reset.help" OR requesturl CONTAINS "com-reset.net" OR requesturl CONTAINS "com-ticket.live" OR requesturl CONTAINS "com-ticket.support" OR requesturl CONTAINS "contact-nexo.com" OR requesturl CONTAINS "convert-coinbase.com" OR requesturl CONTAINS "customerservice-coinbase.com" OR requesturl CONTAINS "default-coinbase.com" OR requesturl CONTAINS "defend-coinbase.com" OR requesturl CONTAINS "deny-coinbase.com" OR requesturl CONTAINS "disconnect-coinbase.com" OR requesturl CONTAINS "escalate-coinbase.com" OR requesturl CONTAINS "establish-coinbase.com" OR requesturl CONTAINS "fcc-okta.com" OR requesturl CONTAINS "fraudulent-coinbase.com" OR requesturl CONTAINS "guard-apple.com" OR requesturl CONTAINS "guard-icloud.com" OR requesturl CONTAINS "guardian-coinbase.com" OR requesturl CONTAINS "guide-gemini.com" OR requesturl CONTAINS "help-bitfinex.com" OR requesturl CONTAINS "help-shakepay.com")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "helpdesk-apple.com" OR destinationhostname CONTAINS "helpdesk-gemini.com" OR destinationhostname CONTAINS "helpdesk-icloud.com" OR destinationhostname CONTAINS "identification-coinbase.com" OR destinationhostname CONTAINS "lockdown-coinbase.com" OR destinationhostname CONTAINS "login-nexo.com" OR destinationhostname CONTAINS "keys-coinbase.com" OR destinationhostname CONTAINS "messages-coinbase.com" OR destinationhostname CONTAINS "newpassword-coinbase.com" OR destinationhostname CONTAINS "prompt-coinbase.com" OR destinationhostname CONTAINS "protect-apple.com" OR destinationhostname CONTAINS "protect-coinbase.com" OR destinationhostname CONTAINS "protect-gmail.com" OR destinationhostname CONTAINS "protect-kraken.com" OR destinationhostname CONTAINS "recoverme-coinbase.com" OR destinationhostname CONTAINS "recoveryportal-coinbase.com" OR destinationhostname CONTAINS "refunds-coinbase.com" OR destinationhostname CONTAINS "reset-okta.com" OR destinationhostname CONTAINS "restore-coinbase.com" OR destinationhostname CONTAINS "return-coinbase.com" OR destinationhostname CONTAINS "reverts-coinbase.com" OR destinationhostname CONTAINS "secure-binance.us" OR destinationhostname CONTAINS "secure-icloud.com" OR destinationhostname CONTAINS "secure-nexo.com" OR destinationhostname CONTAINS "secure-shakepay.com" OR destinationhostname CONTAINS "security-umusic.com" OR destinationhostname CONTAINS "server694590423.tech" OR destinationhostname CONTAINS "session-coinbase.com" OR destinationhostname CONTAINS "startrecovery-coinbase.com" OR destinationhostname CONTAINS "signin-kraken.com" OR destinationhostname CONTAINS "suite-trezor.io" OR destinationhostname CONTAINS "supportportal-coinbase.com" OR destinationhostname CONTAINS "tech-icloud.com" OR destinationhostname CONTAINS "threat-coinbase.com" OR destinationhostname CONTAINS "ticket-apple.com" OR destinationhostname CONTAINS "ticket-coinbase.com" OR destinationhostname CONTAINS "tickets-apple.com" OR destinationhostname CONTAINS "tokens-coinbase.com" OR destinationhostname CONTAINS "unblock-coinbase.com" OR destinationhostname CONTAINS "unlink-coinbase.com" OR destinationhostname CONTAINS "your-coinbase.com" OR destinationhostname CONTAINS "welcome-coinbase.com" OR destinationhostname CONTAINS "www-coinbasewallet.com" OR destinationhostname CONTAINS "www-help-coinbase.com" OR destinationhostname CONTAINS "www-help-gemini.com")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "helpdesk-apple.com" OR sourcentdomain CONTAINS "helpdesk-gemini.com" OR sourcentdomain CONTAINS "helpdesk-icloud.com" OR sourcentdomain CONTAINS "identification-coinbase.com" OR sourcentdomain CONTAINS "lockdown-coinbase.com" OR sourcentdomain CONTAINS "login-nexo.com" OR sourcentdomain CONTAINS "keys-coinbase.com" OR sourcentdomain CONTAINS "messages-coinbase.com" OR sourcentdomain CONTAINS "newpassword-coinbase.com" OR sourcentdomain CONTAINS "prompt-coinbase.com" OR sourcentdomain CONTAINS "protect-apple.com" OR sourcentdomain CONTAINS "protect-coinbase.com" OR sourcentdomain CONTAINS "protect-gmail.com" OR sourcentdomain CONTAINS "protect-kraken.com" OR sourcentdomain CONTAINS "recoverme-coinbase.com" OR sourcentdomain CONTAINS "recoveryportal-coinbase.com" OR sourcentdomain CONTAINS "refunds-coinbase.com" OR sourcentdomain CONTAINS "reset-okta.com" OR sourcentdomain CONTAINS "restore-coinbase.com" OR sourcentdomain CONTAINS "return-coinbase.com" OR sourcentdomain CONTAINS "reverts-coinbase.com" OR sourcentdomain CONTAINS "secure-binance.us" OR sourcentdomain CONTAINS "secure-icloud.com" OR sourcentdomain CONTAINS "secure-nexo.com" OR sourcentdomain CONTAINS "secure-shakepay.com" OR sourcentdomain CONTAINS "security-umusic.com" OR sourcentdomain CONTAINS "server694590423.tech" OR sourcentdomain CONTAINS "session-coinbase.com" OR sourcentdomain CONTAINS "startrecovery-coinbase.com" OR sourcentdomain CONTAINS "signin-kraken.com" OR sourcentdomain CONTAINS "suite-trezor.io" OR sourcentdomain CONTAINS "supportportal-coinbase.com" OR sourcentdomain CONTAINS "tech-icloud.com" OR sourcentdomain CONTAINS "threat-coinbase.com" OR sourcentdomain CONTAINS "ticket-apple.com" OR sourcentdomain CONTAINS "ticket-coinbase.com" OR sourcentdomain CONTAINS "tickets-apple.com" OR sourcentdomain CONTAINS "tokens-coinbase.com" OR sourcentdomain CONTAINS "unblock-coinbase.com" OR sourcentdomain CONTAINS "unlink-coinbase.com" OR sourcentdomain CONTAINS "your-coinbase.com" OR sourcentdomain CONTAINS "welcome-coinbase.com" OR sourcentdomain CONTAINS "www-coinbasewallet.com" OR sourcentdomain CONTAINS "www-help-coinbase.com" OR sourcentdomain CONTAINS "www-help-gemini.com")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "helpdesk-apple.com" OR sourcehostname CONTAINS "helpdesk-gemini.com" OR sourcehostname CONTAINS "helpdesk-icloud.com" OR sourcehostname CONTAINS "identification-coinbase.com" OR sourcehostname CONTAINS "lockdown-coinbase.com" OR sourcehostname CONTAINS "login-nexo.com" OR sourcehostname CONTAINS "keys-coinbase.com" OR sourcehostname CONTAINS "messages-coinbase.com" OR sourcehostname CONTAINS "newpassword-coinbase.com" OR sourcehostname CONTAINS "prompt-coinbase.com" OR sourcehostname CONTAINS "protect-apple.com" OR sourcehostname CONTAINS "protect-coinbase.com" OR sourcehostname CONTAINS "protect-gmail.com" OR sourcehostname CONTAINS "protect-kraken.com" OR sourcehostname CONTAINS "recoverme-coinbase.com" OR sourcehostname CONTAINS "recoveryportal-coinbase.com" OR sourcehostname CONTAINS "refunds-coinbase.com" OR sourcehostname CONTAINS "reset-okta.com" OR sourcehostname CONTAINS "restore-coinbase.com" OR sourcehostname CONTAINS "return-coinbase.com" OR sourcehostname CONTAINS "reverts-coinbase.com" OR sourcehostname CONTAINS "secure-binance.us" OR sourcehostname CONTAINS "secure-icloud.com" OR sourcehostname CONTAINS "secure-nexo.com" OR sourcehostname CONTAINS "secure-shakepay.com" OR sourcehostname CONTAINS "security-umusic.com" OR sourcehostname CONTAINS "server694590423.tech" OR sourcehostname CONTAINS "session-coinbase.com" OR sourcehostname CONTAINS "startrecovery-coinbase.com" OR sourcehostname CONTAINS "signin-kraken.com" OR sourcehostname CONTAINS "suite-trezor.io" OR sourcehostname CONTAINS "supportportal-coinbase.com" OR sourcehostname CONTAINS "tech-icloud.com" OR sourcehostname CONTAINS "threat-coinbase.com" OR sourcehostname CONTAINS "ticket-apple.com" OR sourcehostname CONTAINS "ticket-coinbase.com" OR sourcehostname CONTAINS "tickets-apple.com" OR sourcehostname CONTAINS "tokens-coinbase.com" OR sourcehostname CONTAINS "unblock-coinbase.com" OR sourcehostname CONTAINS "unlink-coinbase.com" OR sourcehostname CONTAINS "your-coinbase.com" OR sourcehostname CONTAINS "welcome-coinbase.com" OR sourcehostname CONTAINS "www-coinbasewallet.com" OR sourcehostname CONTAINS "www-help-coinbase.com" OR sourcehostname CONTAINS "www-help-gemini.com")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "helpdesk-apple.com" OR destinationntdomain CONTAINS "helpdesk-gemini.com" OR destinationntdomain CONTAINS "helpdesk-icloud.com" OR destinationntdomain CONTAINS "identification-coinbase.com" OR destinationntdomain CONTAINS "lockdown-coinbase.com" OR destinationntdomain CONTAINS "login-nexo.com" OR destinationntdomain CONTAINS "keys-coinbase.com" OR destinationntdomain CONTAINS "messages-coinbase.com" OR destinationntdomain CONTAINS "newpassword-coinbase.com" OR destinationntdomain CONTAINS "prompt-coinbase.com" OR destinationntdomain CONTAINS "protect-apple.com" OR destinationntdomain CONTAINS "protect-coinbase.com" OR destinationntdomain CONTAINS "protect-gmail.com" OR destinationntdomain CONTAINS "protect-kraken.com" OR destinationntdomain CONTAINS "recoverme-coinbase.com" OR destinationntdomain CONTAINS "recoveryportal-coinbase.com" OR destinationntdomain CONTAINS "refunds-coinbase.com" OR destinationntdomain CONTAINS "reset-okta.com" OR destinationntdomain CONTAINS "restore-coinbase.com" OR destinationntdomain CONTAINS "return-coinbase.com" OR destinationntdomain CONTAINS "reverts-coinbase.com" OR destinationntdomain CONTAINS "secure-binance.us" OR destinationntdomain CONTAINS "secure-icloud.com" OR destinationntdomain CONTAINS "secure-nexo.com" OR destinationntdomain CONTAINS "secure-shakepay.com" OR destinationntdomain CONTAINS "security-umusic.com" OR destinationntdomain CONTAINS "server694590423.tech" OR destinationntdomain CONTAINS "session-coinbase.com" OR destinationntdomain CONTAINS "startrecovery-coinbase.com" OR destinationntdomain CONTAINS "signin-kraken.com" OR destinationntdomain CONTAINS "suite-trezor.io" OR destinationntdomain CONTAINS "supportportal-coinbase.com" OR destinationntdomain CONTAINS "tech-icloud.com" OR destinationntdomain CONTAINS "threat-coinbase.com" OR destinationntdomain CONTAINS "ticket-apple.com" OR destinationntdomain CONTAINS "ticket-coinbase.com" OR destinationntdomain CONTAINS "tickets-apple.com" OR destinationntdomain CONTAINS "tokens-coinbase.com" OR destinationntdomain CONTAINS "unblock-coinbase.com" OR destinationntdomain CONTAINS "unlink-coinbase.com" OR destinationntdomain CONTAINS "your-coinbase.com" OR destinationntdomain CONTAINS "welcome-coinbase.com" OR destinationntdomain CONTAINS "www-coinbasewallet.com" OR destinationntdomain CONTAINS "www-help-coinbase.com" OR destinationntdomain CONTAINS "www-help-gemini.com")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND requesturl NOT NULL AND (requesturl CONTAINS "helpdesk-apple.com" OR requesturl CONTAINS "helpdesk-gemini.com" OR requesturl CONTAINS "helpdesk-icloud.com" OR requesturl CONTAINS "identification-coinbase.com" OR requesturl CONTAINS "lockdown-coinbase.com" OR requesturl CONTAINS "login-nexo.com" OR requesturl CONTAINS "keys-coinbase.com" OR requesturl CONTAINS "messages-coinbase.com" OR requesturl CONTAINS "newpassword-coinbase.com" OR requesturl CONTAINS "prompt-coinbase.com" OR requesturl CONTAINS "protect-apple.com" OR requesturl CONTAINS "protect-coinbase.com" OR requesturl CONTAINS "protect-gmail.com" OR requesturl CONTAINS "protect-kraken.com" OR requesturl CONTAINS "recoverme-coinbase.com" OR requesturl CONTAINS "recoveryportal-coinbase.com" OR requesturl CONTAINS "refunds-coinbase.com" OR requesturl CONTAINS "reset-okta.com" OR requesturl CONTAINS "restore-coinbase.com" OR requesturl CONTAINS "return-coinbase.com" OR requesturl CONTAINS "reverts-coinbase.com" OR requesturl CONTAINS "secure-binance.us" OR requesturl CONTAINS "secure-icloud.com" OR requesturl CONTAINS "secure-nexo.com" OR requesturl CONTAINS "secure-shakepay.com" OR requesturl CONTAINS "security-umusic.com" OR requesturl CONTAINS "server694590423.tech" OR requesturl CONTAINS "session-coinbase.com" OR requesturl CONTAINS "startrecovery-coinbase.com" OR requesturl CONTAINS "signin-kraken.com" OR requesturl CONTAINS "suite-trezor.io" OR requesturl CONTAINS "supportportal-coinbase.com" OR requesturl CONTAINS "tech-icloud.com" OR requesturl CONTAINS "threat-coinbase.com" OR requesturl CONTAINS "ticket-apple.com" OR requesturl CONTAINS "ticket-coinbase.com" OR requesturl CONTAINS "tickets-apple.com" OR requesturl CONTAINS "tokens-coinbase.com" OR requesturl CONTAINS "unblock-coinbase.com" OR requesturl CONTAINS "unlink-coinbase.com" OR requesturl CONTAINS "your-coinbase.com" OR requesturl CONTAINS "welcome-coinbase.com" OR requesturl CONTAINS "www-coinbasewallet.com" OR requesturl CONTAINS "www-help-coinbase.com" OR requesturl CONTAINS "www-help-gemini.com")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "official-server.com" OR destinationhostname CONTAINS "server694590423.tech" OR destinationhostname CONTAINS "island-placid-bromine.glitch.me" OR destinationhostname CONTAINS "circular-noon-farmhouse.glitch.me" OR destinationhostname CONTAINS "talented-friendly-price.glitch.me" OR destinationhostname CONTAINS "dflfmgsdokasdcpl.com" OR destinationhostname CONTAINS "original-backend.com" OR destinationhostname CONTAINS "07159889-coinbase.com" OR destinationhostname CONTAINS "10195-coinbase.com" OR destinationhostname CONTAINS "11246-coinbase.com" OR destinationhostname CONTAINS "11247-coinbase.com" OR destinationhostname CONTAINS "11248-coinbase.com" OR destinationhostname CONTAINS "11258-coinbase.com" OR destinationhostname CONTAINS "11259-coinbase.com" OR destinationhostname CONTAINS "113912-coinbase.com" OR destinationhostname CONTAINS "11472-coinbase.com" OR destinationhostname CONTAINS "11923-coinbase.com" OR destinationhostname CONTAINS "11957-coinbase.com" OR destinationhostname CONTAINS "128147-coinbase.com" OR destinationhostname CONTAINS "12958-coinbase.com" OR destinationhostname CONTAINS "12984-okta.com" OR destinationhostname CONTAINS "12985-coinbase.com" OR destinationhostname CONTAINS "13130-coinbase.com" OR destinationhostname CONTAINS "13247-coinbase.com" OR destinationhostname CONTAINS "13247-icloud.com" OR destinationhostname CONTAINS "13267-coinbase.com" OR destinationhostname CONTAINS "146271510-coinbase.com" OR destinationhostname CONTAINS "146282-coinbase.com" OR destinationhostname CONTAINS "146284-coinbase.com" OR destinationhostname CONTAINS "147260-coinbase.com" OR destinationhostname CONTAINS "14765-coinbase.com" OR destinationhostname CONTAINS "14817582-coinbase.com" OR destinationhostname CONTAINS "14871904-coinbase.com" OR destinationhostname CONTAINS "14891902-coinbase.com" OR destinationhostname CONTAINS "1492864-coinbase.com" OR destinationhostname CONTAINS "158312-coinbase.com" OR destinationhostname CONTAINS "158372-coinbase.com" OR destinationhostname CONTAINS "158702-coinbase.com" OR destinationhostname CONTAINS "16171675-coinbase.com" OR destinationhostname CONTAINS "16171832-coinbase.com" OR destinationhostname CONTAINS "16178234-coinbase.com" OR destinationhostname CONTAINS "16178237-coinbase.com" OR destinationhostname CONTAINS "16178434-coinbase.com" OR destinationhostname CONTAINS "162178-coinbase.com" OR destinationhostname CONTAINS "162478-coinbase.com" OR destinationhostname CONTAINS "162782-coinbase.com" OR destinationhostname CONTAINS "162812-coinbase.com" OR destinationhostname CONTAINS "162814-coinbase.com" OR destinationhostname CONTAINS "16442580-coinbase.com" OR destinationhostname CONTAINS "16450107-coinbase.com")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "official-server.com" OR sourcentdomain CONTAINS "server694590423.tech" OR sourcentdomain CONTAINS "island-placid-bromine.glitch.me" OR sourcentdomain CONTAINS "circular-noon-farmhouse.glitch.me" OR sourcentdomain CONTAINS "talented-friendly-price.glitch.me" OR sourcentdomain CONTAINS "dflfmgsdokasdcpl.com" OR sourcentdomain CONTAINS "original-backend.com" OR sourcentdomain CONTAINS "07159889-coinbase.com" OR sourcentdomain CONTAINS "10195-coinbase.com" OR sourcentdomain CONTAINS "11246-coinbase.com" OR sourcentdomain CONTAINS "11247-coinbase.com" OR sourcentdomain CONTAINS "11248-coinbase.com" OR sourcentdomain CONTAINS "11258-coinbase.com" OR sourcentdomain CONTAINS "11259-coinbase.com" OR sourcentdomain CONTAINS "113912-coinbase.com" OR sourcentdomain CONTAINS "11472-coinbase.com" OR sourcentdomain CONTAINS "11923-coinbase.com" OR sourcentdomain CONTAINS "11957-coinbase.com" OR sourcentdomain CONTAINS "128147-coinbase.com" OR sourcentdomain CONTAINS "12958-coinbase.com" OR sourcentdomain CONTAINS "12984-okta.com" OR sourcentdomain CONTAINS "12985-coinbase.com" OR sourcentdomain CONTAINS "13130-coinbase.com" OR sourcentdomain CONTAINS "13247-coinbase.com" OR sourcentdomain CONTAINS "13247-icloud.com" OR sourcentdomain CONTAINS "13267-coinbase.com" OR sourcentdomain CONTAINS "146271510-coinbase.com" OR sourcentdomain CONTAINS "146282-coinbase.com" OR sourcentdomain CONTAINS "146284-coinbase.com" OR sourcentdomain CONTAINS "147260-coinbase.com" OR sourcentdomain CONTAINS "14765-coinbase.com" OR sourcentdomain CONTAINS "14817582-coinbase.com" OR sourcentdomain CONTAINS "14871904-coinbase.com" OR sourcentdomain CONTAINS "14891902-coinbase.com" OR sourcentdomain CONTAINS "1492864-coinbase.com" OR sourcentdomain CONTAINS "158312-coinbase.com" OR sourcentdomain CONTAINS "158372-coinbase.com" OR sourcentdomain CONTAINS "158702-coinbase.com" OR sourcentdomain CONTAINS "16171675-coinbase.com" OR sourcentdomain CONTAINS "16171832-coinbase.com" OR sourcentdomain CONTAINS "16178234-coinbase.com" OR sourcentdomain CONTAINS "16178237-coinbase.com" OR sourcentdomain CONTAINS "16178434-coinbase.com" OR sourcentdomain CONTAINS "162178-coinbase.com" OR sourcentdomain CONTAINS "162478-coinbase.com" OR sourcentdomain CONTAINS "162782-coinbase.com" OR sourcentdomain CONTAINS "162812-coinbase.com" OR sourcentdomain CONTAINS "162814-coinbase.com" OR sourcentdomain CONTAINS "16442580-coinbase.com" OR sourcentdomain CONTAINS "16450107-coinbase.com")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "official-server.com" OR sourcehostname CONTAINS "server694590423.tech" OR sourcehostname CONTAINS "island-placid-bromine.glitch.me" OR sourcehostname CONTAINS "circular-noon-farmhouse.glitch.me" OR sourcehostname CONTAINS "talented-friendly-price.glitch.me" OR sourcehostname CONTAINS "dflfmgsdokasdcpl.com" OR sourcehostname CONTAINS "original-backend.com" OR sourcehostname CONTAINS "07159889-coinbase.com" OR sourcehostname CONTAINS "10195-coinbase.com" OR sourcehostname CONTAINS "11246-coinbase.com" OR sourcehostname CONTAINS "11247-coinbase.com" OR sourcehostname CONTAINS "11248-coinbase.com" OR sourcehostname CONTAINS "11258-coinbase.com" OR sourcehostname CONTAINS "11259-coinbase.com" OR sourcehostname CONTAINS "113912-coinbase.com" OR sourcehostname CONTAINS "11472-coinbase.com" OR sourcehostname CONTAINS "11923-coinbase.com" OR sourcehostname CONTAINS "11957-coinbase.com" OR sourcehostname CONTAINS "128147-coinbase.com" OR sourcehostname CONTAINS "12958-coinbase.com" OR sourcehostname CONTAINS "12984-okta.com" OR sourcehostname CONTAINS "12985-coinbase.com" OR sourcehostname CONTAINS "13130-coinbase.com" OR sourcehostname CONTAINS "13247-coinbase.com" OR sourcehostname CONTAINS "13247-icloud.com" OR sourcehostname CONTAINS "13267-coinbase.com" OR sourcehostname CONTAINS "146271510-coinbase.com" OR sourcehostname CONTAINS "146282-coinbase.com" OR sourcehostname CONTAINS "146284-coinbase.com" OR sourcehostname CONTAINS "147260-coinbase.com" OR sourcehostname CONTAINS "14765-coinbase.com" OR sourcehostname CONTAINS "14817582-coinbase.com" OR sourcehostname CONTAINS "14871904-coinbase.com" OR sourcehostname CONTAINS "14891902-coinbase.com" OR sourcehostname CONTAINS "1492864-coinbase.com" OR sourcehostname CONTAINS "158312-coinbase.com" OR sourcehostname CONTAINS "158372-coinbase.com" OR sourcehostname CONTAINS "158702-coinbase.com" OR sourcehostname CONTAINS "16171675-coinbase.com" OR sourcehostname CONTAINS "16171832-coinbase.com" OR sourcehostname CONTAINS "16178234-coinbase.com" OR sourcehostname CONTAINS "16178237-coinbase.com" OR sourcehostname CONTAINS "16178434-coinbase.com" OR sourcehostname CONTAINS "162178-coinbase.com" OR sourcehostname CONTAINS "162478-coinbase.com" OR sourcehostname CONTAINS "162782-coinbase.com" OR sourcehostname CONTAINS "162812-coinbase.com" OR sourcehostname CONTAINS "162814-coinbase.com" OR sourcehostname CONTAINS "16442580-coinbase.com" OR sourcehostname CONTAINS "16450107-coinbase.com")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "official-server.com" OR destinationntdomain CONTAINS "server694590423.tech" OR destinationntdomain CONTAINS "island-placid-bromine.glitch.me" OR destinationntdomain CONTAINS "circular-noon-farmhouse.glitch.me" OR destinationntdomain CONTAINS "talented-friendly-price.glitch.me" OR destinationntdomain CONTAINS "dflfmgsdokasdcpl.com" OR destinationntdomain CONTAINS "original-backend.com" OR destinationntdomain CONTAINS "07159889-coinbase.com" OR destinationntdomain CONTAINS "10195-coinbase.com" OR destinationntdomain CONTAINS "11246-coinbase.com" OR destinationntdomain CONTAINS "11247-coinbase.com" OR destinationntdomain CONTAINS "11248-coinbase.com" OR destinationntdomain CONTAINS "11258-coinbase.com" OR destinationntdomain CONTAINS "11259-coinbase.com" OR destinationntdomain CONTAINS "113912-coinbase.com" OR destinationntdomain CONTAINS "11472-coinbase.com" OR destinationntdomain CONTAINS "11923-coinbase.com" OR destinationntdomain CONTAINS "11957-coinbase.com" OR destinationntdomain CONTAINS "128147-coinbase.com" OR destinationntdomain CONTAINS "12958-coinbase.com" OR destinationntdomain CONTAINS "12984-okta.com" OR destinationntdomain CONTAINS "12985-coinbase.com" OR destinationntdomain CONTAINS "13130-coinbase.com" OR destinationntdomain CONTAINS "13247-coinbase.com" OR destinationntdomain CONTAINS "13247-icloud.com" OR destinationntdomain CONTAINS "13267-coinbase.com" OR destinationntdomain CONTAINS "146271510-coinbase.com" OR destinationntdomain CONTAINS "146282-coinbase.com" OR destinationntdomain CONTAINS "146284-coinbase.com" OR destinationntdomain CONTAINS "147260-coinbase.com" OR destinationntdomain CONTAINS "14765-coinbase.com" OR destinationntdomain CONTAINS "14817582-coinbase.com" OR destinationntdomain CONTAINS "14871904-coinbase.com" OR destinationntdomain CONTAINS "14891902-coinbase.com" OR destinationntdomain CONTAINS "1492864-coinbase.com" OR destinationntdomain CONTAINS "158312-coinbase.com" OR destinationntdomain CONTAINS "158372-coinbase.com" OR destinationntdomain CONTAINS "158702-coinbase.com" OR destinationntdomain CONTAINS "16171675-coinbase.com" OR destinationntdomain CONTAINS "16171832-coinbase.com" OR destinationntdomain CONTAINS "16178234-coinbase.com" OR destinationntdomain CONTAINS "16178237-coinbase.com" OR destinationntdomain CONTAINS "16178434-coinbase.com" OR destinationntdomain CONTAINS "162178-coinbase.com" OR destinationntdomain CONTAINS "162478-coinbase.com" OR destinationntdomain CONTAINS "162782-coinbase.com" OR destinationntdomain CONTAINS "162812-coinbase.com" OR destinationntdomain CONTAINS "162814-coinbase.com" OR destinationntdomain CONTAINS "16442580-coinbase.com" OR destinationntdomain CONTAINS "16450107-coinbase.com")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND requesturl NOT NULL AND (requesturl CONTAINS "official-server.com" OR requesturl CONTAINS "server694590423.tech" OR requesturl CONTAINS "island-placid-bromine.glitch.me" OR requesturl CONTAINS "circular-noon-farmhouse.glitch.me" OR requesturl CONTAINS "talented-friendly-price.glitch.me" OR requesturl CONTAINS "dflfmgsdokasdcpl.com" OR requesturl CONTAINS "original-backend.com" OR requesturl CONTAINS "07159889-coinbase.com" OR requesturl CONTAINS "10195-coinbase.com" OR requesturl CONTAINS "11246-coinbase.com" OR requesturl CONTAINS "11247-coinbase.com" OR requesturl CONTAINS "11248-coinbase.com" OR requesturl CONTAINS "11258-coinbase.com" OR requesturl CONTAINS "11259-coinbase.com" OR requesturl CONTAINS "113912-coinbase.com" OR requesturl CONTAINS "11472-coinbase.com" OR requesturl CONTAINS "11923-coinbase.com" OR requesturl CONTAINS "11957-coinbase.com" OR requesturl CONTAINS "128147-coinbase.com" OR requesturl CONTAINS "12958-coinbase.com" OR requesturl CONTAINS "12984-okta.com" OR requesturl CONTAINS "12985-coinbase.com" OR requesturl CONTAINS "13130-coinbase.com" OR requesturl CONTAINS "13247-coinbase.com" OR requesturl CONTAINS "13247-icloud.com" OR requesturl CONTAINS "13267-coinbase.com" OR requesturl CONTAINS "146271510-coinbase.com" OR requesturl CONTAINS "146282-coinbase.com" OR requesturl CONTAINS "146284-coinbase.com" OR requesturl CONTAINS "147260-coinbase.com" OR requesturl CONTAINS "14765-coinbase.com" OR requesturl CONTAINS "14817582-coinbase.com" OR requesturl CONTAINS "14871904-coinbase.com" OR requesturl CONTAINS "14891902-coinbase.com" OR requesturl CONTAINS "1492864-coinbase.com" OR requesturl CONTAINS "158312-coinbase.com" OR requesturl CONTAINS "158372-coinbase.com" OR requesturl CONTAINS "158702-coinbase.com" OR requesturl CONTAINS "16171675-coinbase.com" OR requesturl CONTAINS "16171832-coinbase.com" OR requesturl CONTAINS "16178234-coinbase.com" OR requesturl CONTAINS "16178237-coinbase.com" OR requesturl CONTAINS "16178434-coinbase.com" OR requesturl CONTAINS "162178-coinbase.com" OR requesturl CONTAINS "162478-coinbase.com" OR requesturl CONTAINS "162782-coinbase.com" OR requesturl CONTAINS "162812-coinbase.com" OR requesturl CONTAINS "162814-coinbase.com" OR requesturl CONTAINS "16442580-coinbase.com" OR requesturl CONTAINS "16450107-coinbase.com")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "16450207-coinbase.com" OR destinationhostname CONTAINS "16458207-coinbase.com" OR destinationhostname CONTAINS "16478202-coinbase.com" OR destinationhostname CONTAINS "164872942-coinbase.com" OR destinationhostname CONTAINS "16590-coinbase.com" OR destinationhostname CONTAINS "16594373-coinbase.com" OR destinationhostname CONTAINS "16624831-coinbase.com" OR destinationhostname CONTAINS "16642124-coinbase.com" OR destinationhostname CONTAINS "16642172-coinbase.com" OR destinationhostname CONTAINS "16642580-coinbase.com" OR destinationhostname CONTAINS "16642721-coinbase.com" OR destinationhostname CONTAINS "16642724-coinbase.com" OR destinationhostname CONTAINS "16642871-coinbase.com" OR destinationhostname CONTAINS "16642872-coinbase.com" OR destinationhostname CONTAINS "16712942-coinbase.com" OR destinationhostname CONTAINS "16718672-coinbase.com" OR destinationhostname CONTAINS "16728342-coinbase.com" OR destinationhostname CONTAINS "16728348-coinbase.com" OR destinationhostname CONTAINS "16728442-coinbase.com" OR destinationhostname CONTAINS "16728472-coinbase.com" OR destinationhostname CONTAINS "167285-coinbase.com" OR destinationhostname CONTAINS "16729042-coinbase.com" OR destinationhostname CONTAINS "16748272-coinbase.com" OR destinationhostname CONTAINS "16782942-coinbase.com" OR destinationhostname CONTAINS "16827420-coinbase.com" OR destinationhostname CONTAINS "16827423-coinbase.com" OR destinationhostname CONTAINS "16847145-coinbase.com" OR destinationhostname CONTAINS "16893924-coinbase.com" OR destinationhostname CONTAINS "17182-coinbase.com" OR destinationhostname CONTAINS "17255030-coinbase.com" OR destinationhostname CONTAINS "17259-kraken.com" OR destinationhostname CONTAINS "172486-coinbase.com" OR destinationhostname CONTAINS "17284652-coinbase.com" OR destinationhostname CONTAINS "17286-coinbase.com" OR destinationhostname CONTAINS "17334522-coinbase.com" OR destinationhostname CONTAINS "17334522-kraken.com" OR destinationhostname CONTAINS "17384522-coinbase.com" OR destinationhostname CONTAINS "173912-coinbase.com" OR destinationhostname CONTAINS "17494976-coinbase.com" OR destinationhostname CONTAINS "17512854-coinbase.com" OR destinationhostname CONTAINS "17512857-coinbase.com" OR destinationhostname CONTAINS "1751954-coinbase.com" OR destinationhostname CONTAINS "17525030-coinbase.com" OR destinationhostname CONTAINS "17529580-coinbase.com" OR destinationhostname CONTAINS "17614-coinbase.com" OR destinationhostname CONTAINS "17618412-coinbase.com" OR destinationhostname CONTAINS "17619-coinbase.com" OR destinationhostname CONTAINS "176284-coinbase.com" OR destinationhostname CONTAINS "17823920-coinbase.com" OR destinationhostname CONTAINS "178253-coinbase.com")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "16450207-coinbase.com" OR sourcentdomain CONTAINS "16458207-coinbase.com" OR sourcentdomain CONTAINS "16478202-coinbase.com" OR sourcentdomain CONTAINS "164872942-coinbase.com" OR sourcentdomain CONTAINS "16590-coinbase.com" OR sourcentdomain CONTAINS "16594373-coinbase.com" OR sourcentdomain CONTAINS "16624831-coinbase.com" OR sourcentdomain CONTAINS "16642124-coinbase.com" OR sourcentdomain CONTAINS "16642172-coinbase.com" OR sourcentdomain CONTAINS "16642580-coinbase.com" OR sourcentdomain CONTAINS "16642721-coinbase.com" OR sourcentdomain CONTAINS "16642724-coinbase.com" OR sourcentdomain CONTAINS "16642871-coinbase.com" OR sourcentdomain CONTAINS "16642872-coinbase.com" OR sourcentdomain CONTAINS "16712942-coinbase.com" OR sourcentdomain CONTAINS "16718672-coinbase.com" OR sourcentdomain CONTAINS "16728342-coinbase.com" OR sourcentdomain CONTAINS "16728348-coinbase.com" OR sourcentdomain CONTAINS "16728442-coinbase.com" OR sourcentdomain CONTAINS "16728472-coinbase.com" OR sourcentdomain CONTAINS "167285-coinbase.com" OR sourcentdomain CONTAINS "16729042-coinbase.com" OR sourcentdomain CONTAINS "16748272-coinbase.com" OR sourcentdomain CONTAINS "16782942-coinbase.com" OR sourcentdomain CONTAINS "16827420-coinbase.com" OR sourcentdomain CONTAINS "16827423-coinbase.com" OR sourcentdomain CONTAINS "16847145-coinbase.com" OR sourcentdomain CONTAINS "16893924-coinbase.com" OR sourcentdomain CONTAINS "17182-coinbase.com" OR sourcentdomain CONTAINS "17255030-coinbase.com" OR sourcentdomain CONTAINS "17259-kraken.com" OR sourcentdomain CONTAINS "172486-coinbase.com" OR sourcentdomain CONTAINS "17284652-coinbase.com" OR sourcentdomain CONTAINS "17286-coinbase.com" OR sourcentdomain CONTAINS "17334522-coinbase.com" OR sourcentdomain CONTAINS "17334522-kraken.com" OR sourcentdomain CONTAINS "17384522-coinbase.com" OR sourcentdomain CONTAINS "173912-coinbase.com" OR sourcentdomain CONTAINS "17494976-coinbase.com" OR sourcentdomain CONTAINS "17512854-coinbase.com" OR sourcentdomain CONTAINS "17512857-coinbase.com" OR sourcentdomain CONTAINS "1751954-coinbase.com" OR sourcentdomain CONTAINS "17525030-coinbase.com" OR sourcentdomain CONTAINS "17529580-coinbase.com" OR sourcentdomain CONTAINS "17614-coinbase.com" OR sourcentdomain CONTAINS "17618412-coinbase.com" OR sourcentdomain CONTAINS "17619-coinbase.com" OR sourcentdomain CONTAINS "176284-coinbase.com" OR sourcentdomain CONTAINS "17823920-coinbase.com" OR sourcentdomain CONTAINS "178253-coinbase.com")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "16450207-coinbase.com" OR sourcehostname CONTAINS "16458207-coinbase.com" OR sourcehostname CONTAINS "16478202-coinbase.com" OR sourcehostname CONTAINS "164872942-coinbase.com" OR sourcehostname CONTAINS "16590-coinbase.com" OR sourcehostname CONTAINS "16594373-coinbase.com" OR sourcehostname CONTAINS "16624831-coinbase.com" OR sourcehostname CONTAINS "16642124-coinbase.com" OR sourcehostname CONTAINS "16642172-coinbase.com" OR sourcehostname CONTAINS "16642580-coinbase.com" OR sourcehostname CONTAINS "16642721-coinbase.com" OR sourcehostname CONTAINS "16642724-coinbase.com" OR sourcehostname CONTAINS "16642871-coinbase.com" OR sourcehostname CONTAINS "16642872-coinbase.com" OR sourcehostname CONTAINS "16712942-coinbase.com" OR sourcehostname CONTAINS "16718672-coinbase.com" OR sourcehostname CONTAINS "16728342-coinbase.com" OR sourcehostname CONTAINS "16728348-coinbase.com" OR sourcehostname CONTAINS "16728442-coinbase.com" OR sourcehostname CONTAINS "16728472-coinbase.com" OR sourcehostname CONTAINS "167285-coinbase.com" OR sourcehostname CONTAINS "16729042-coinbase.com" OR sourcehostname CONTAINS "16748272-coinbase.com" OR sourcehostname CONTAINS "16782942-coinbase.com" OR sourcehostname CONTAINS "16827420-coinbase.com" OR sourcehostname CONTAINS "16827423-coinbase.com" OR sourcehostname CONTAINS "16847145-coinbase.com" OR sourcehostname CONTAINS "16893924-coinbase.com" OR sourcehostname CONTAINS "17182-coinbase.com" OR sourcehostname CONTAINS "17255030-coinbase.com" OR sourcehostname CONTAINS "17259-kraken.com" OR sourcehostname CONTAINS "172486-coinbase.com" OR sourcehostname CONTAINS "17284652-coinbase.com" OR sourcehostname CONTAINS "17286-coinbase.com" OR sourcehostname CONTAINS "17334522-coinbase.com" OR sourcehostname CONTAINS "17334522-kraken.com" OR sourcehostname CONTAINS "17384522-coinbase.com" OR sourcehostname CONTAINS "173912-coinbase.com" OR sourcehostname CONTAINS "17494976-coinbase.com" OR sourcehostname CONTAINS "17512854-coinbase.com" OR sourcehostname CONTAINS "17512857-coinbase.com" OR sourcehostname CONTAINS "1751954-coinbase.com" OR sourcehostname CONTAINS "17525030-coinbase.com" OR sourcehostname CONTAINS "17529580-coinbase.com" OR sourcehostname CONTAINS "17614-coinbase.com" OR sourcehostname CONTAINS "17618412-coinbase.com" OR sourcehostname CONTAINS "17619-coinbase.com" OR sourcehostname CONTAINS "176284-coinbase.com" OR sourcehostname CONTAINS "17823920-coinbase.com" OR sourcehostname CONTAINS "178253-coinbase.com")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "16450207-coinbase.com" OR destinationntdomain CONTAINS "16458207-coinbase.com" OR destinationntdomain CONTAINS "16478202-coinbase.com" OR destinationntdomain CONTAINS "164872942-coinbase.com" OR destinationntdomain CONTAINS "16590-coinbase.com" OR destinationntdomain CONTAINS "16594373-coinbase.com" OR destinationntdomain CONTAINS "16624831-coinbase.com" OR destinationntdomain CONTAINS "16642124-coinbase.com" OR destinationntdomain CONTAINS "16642172-coinbase.com" OR destinationntdomain CONTAINS "16642580-coinbase.com" OR destinationntdomain CONTAINS "16642721-coinbase.com" OR destinationntdomain CONTAINS "16642724-coinbase.com" OR destinationntdomain CONTAINS "16642871-coinbase.com" OR destinationntdomain CONTAINS "16642872-coinbase.com" OR destinationntdomain CONTAINS "16712942-coinbase.com" OR destinationntdomain CONTAINS "16718672-coinbase.com" OR destinationntdomain CONTAINS "16728342-coinbase.com" OR destinationntdomain CONTAINS "16728348-coinbase.com" OR destinationntdomain CONTAINS "16728442-coinbase.com" OR destinationntdomain CONTAINS "16728472-coinbase.com" OR destinationntdomain CONTAINS "167285-coinbase.com" OR destinationntdomain CONTAINS "16729042-coinbase.com" OR destinationntdomain CONTAINS "16748272-coinbase.com" OR destinationntdomain CONTAINS "16782942-coinbase.com" OR destinationntdomain CONTAINS "16827420-coinbase.com" OR destinationntdomain CONTAINS "16827423-coinbase.com" OR destinationntdomain CONTAINS "16847145-coinbase.com" OR destinationntdomain CONTAINS "16893924-coinbase.com" OR destinationntdomain CONTAINS "17182-coinbase.com" OR destinationntdomain CONTAINS "17255030-coinbase.com" OR destinationntdomain CONTAINS "17259-kraken.com" OR destinationntdomain CONTAINS "172486-coinbase.com" OR destinationntdomain CONTAINS "17284652-coinbase.com" OR destinationntdomain CONTAINS "17286-coinbase.com" OR destinationntdomain CONTAINS "17334522-coinbase.com" OR destinationntdomain CONTAINS "17334522-kraken.com" OR destinationntdomain CONTAINS "17384522-coinbase.com" OR destinationntdomain CONTAINS "173912-coinbase.com" OR destinationntdomain CONTAINS "17494976-coinbase.com" OR destinationntdomain CONTAINS "17512854-coinbase.com" OR destinationntdomain CONTAINS "17512857-coinbase.com" OR destinationntdomain CONTAINS "1751954-coinbase.com" OR destinationntdomain CONTAINS "17525030-coinbase.com" OR destinationntdomain CONTAINS "17529580-coinbase.com" OR destinationntdomain CONTAINS "17614-coinbase.com" OR destinationntdomain CONTAINS "17618412-coinbase.com" OR destinationntdomain CONTAINS "17619-coinbase.com" OR destinationntdomain CONTAINS "176284-coinbase.com" OR destinationntdomain CONTAINS "17823920-coinbase.com" OR destinationntdomain CONTAINS "178253-coinbase.com")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND requesturl NOT NULL AND (requesturl CONTAINS "16450207-coinbase.com" OR requesturl CONTAINS "16458207-coinbase.com" OR requesturl CONTAINS "16478202-coinbase.com" OR requesturl CONTAINS "164872942-coinbase.com" OR requesturl CONTAINS "16590-coinbase.com" OR requesturl CONTAINS "16594373-coinbase.com" OR requesturl CONTAINS "16624831-coinbase.com" OR requesturl CONTAINS "16642124-coinbase.com" OR requesturl CONTAINS "16642172-coinbase.com" OR requesturl CONTAINS "16642580-coinbase.com" OR requesturl CONTAINS "16642721-coinbase.com" OR requesturl CONTAINS "16642724-coinbase.com" OR requesturl CONTAINS "16642871-coinbase.com" OR requesturl CONTAINS "16642872-coinbase.com" OR requesturl CONTAINS "16712942-coinbase.com" OR requesturl CONTAINS "16718672-coinbase.com" OR requesturl CONTAINS "16728342-coinbase.com" OR requesturl CONTAINS "16728348-coinbase.com" OR requesturl CONTAINS "16728442-coinbase.com" OR requesturl CONTAINS "16728472-coinbase.com" OR requesturl CONTAINS "167285-coinbase.com" OR requesturl CONTAINS "16729042-coinbase.com" OR requesturl CONTAINS "16748272-coinbase.com" OR requesturl CONTAINS "16782942-coinbase.com" OR requesturl CONTAINS "16827420-coinbase.com" OR requesturl CONTAINS "16827423-coinbase.com" OR requesturl CONTAINS "16847145-coinbase.com" OR requesturl CONTAINS "16893924-coinbase.com" OR requesturl CONTAINS "17182-coinbase.com" OR requesturl CONTAINS "17255030-coinbase.com" OR requesturl CONTAINS "17259-kraken.com" OR requesturl CONTAINS "172486-coinbase.com" OR requesturl CONTAINS "17284652-coinbase.com" OR requesturl CONTAINS "17286-coinbase.com" OR requesturl CONTAINS "17334522-coinbase.com" OR requesturl CONTAINS "17334522-kraken.com" OR requesturl CONTAINS "17384522-coinbase.com" OR requesturl CONTAINS "173912-coinbase.com" OR requesturl CONTAINS "17494976-coinbase.com" OR requesturl CONTAINS "17512854-coinbase.com" OR requesturl CONTAINS "17512857-coinbase.com" OR requesturl CONTAINS "1751954-coinbase.com" OR requesturl CONTAINS "17525030-coinbase.com" OR requesturl CONTAINS "17529580-coinbase.com" OR requesturl CONTAINS "17614-coinbase.com" OR requesturl CONTAINS "17618412-coinbase.com" OR requesturl CONTAINS "17619-coinbase.com" OR requesturl CONTAINS "176284-coinbase.com" OR requesturl CONTAINS "17823920-coinbase.com" OR requesturl CONTAINS "178253-coinbase.com")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "178294-coinbase.com" OR destinationhostname CONTAINS "17912-coinbase.com" OR destinationhostname CONTAINS "17914-coinbase.com" OR destinationhostname CONTAINS "17917-coinbase.com" OR destinationhostname CONTAINS "17954-coinbase.com" OR destinationhostname CONTAINS "17958-coinbase.com" OR destinationhostname CONTAINS "182043-coinbase.com" OR destinationhostname CONTAINS "18275-gemini.com" OR destinationhostname CONTAINS "18276-coinbase.com" OR destinationhostname CONTAINS "18290185-coinbase.com" OR destinationhostname CONTAINS "182967-coinbase.com" OR destinationhostname CONTAINS "18560-coinbase.com" OR destinationhostname CONTAINS "18571-coinbase.com" OR destinationhostname CONTAINS "185912-coinbase.com" OR destinationhostname CONTAINS "185914-coinbase.com" OR destinationhostname CONTAINS "18592176-coinbase.com" OR destinationhostname CONTAINS "18594162-coinbase.com" OR destinationhostname CONTAINS "18594962-coinbase.com" OR destinationhostname CONTAINS "18597162-coinbase.com" OR destinationhostname CONTAINS "18719562-coinbase.com" OR destinationhostname CONTAINS "1875290-coinbase.com" OR destinationhostname CONTAINS "1882730-coinbase.com" OR destinationhostname CONTAINS "18902-coinbase.com" OR destinationhostname CONTAINS "18903-coinbase.com" OR destinationhostname CONTAINS "189126-coinbase.com" OR destinationhostname CONTAINS "18952-coinbase.com" OR destinationhostname CONTAINS "192854-coinbase.com" OR destinationhostname CONTAINS "192856-coinbase.com" OR destinationhostname CONTAINS "19287-binance.com" OR destinationhostname CONTAINS "19572-coinbase.com" OR destinationhostname CONTAINS "195812-coinbase.com" OR destinationhostname CONTAINS "195826-coinbase.com" OR destinationhostname CONTAINS "1958262-coinbase.com" OR destinationhostname CONTAINS "195827-binance.com" OR destinationhostname CONTAINS "1958297-coinbase.com" OR destinationhostname CONTAINS "19582970-coinbase.com" OR destinationhostname CONTAINS "19582971-coinbase.com" OR destinationhostname CONTAINS "19583-coinbase.com" OR destinationhostname CONTAINS "19592653-coinbase.com" OR destinationhostname CONTAINS "197304-coinbase.com" OR destinationhostname CONTAINS "19730492-coinbase.com" OR destinationhostname CONTAINS "19764162-coinbase.com" OR destinationhostname CONTAINS "19803-coinbase.com" OR destinationhostname CONTAINS "201784289-coinbase.com" OR destinationhostname CONTAINS "210823644-coinbase.com" OR destinationhostname CONTAINS "21158-coinbase.com" OR destinationhostname CONTAINS "21509-coinbase.com" OR destinationhostname CONTAINS "25985-coinbase.com" OR destinationhostname CONTAINS "27699-coinbase.com" OR destinationhostname CONTAINS "28367-coinbase.com")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "178294-coinbase.com" OR sourcentdomain CONTAINS "17912-coinbase.com" OR sourcentdomain CONTAINS "17914-coinbase.com" OR sourcentdomain CONTAINS "17917-coinbase.com" OR sourcentdomain CONTAINS "17954-coinbase.com" OR sourcentdomain CONTAINS "17958-coinbase.com" OR sourcentdomain CONTAINS "182043-coinbase.com" OR sourcentdomain CONTAINS "18275-gemini.com" OR sourcentdomain CONTAINS "18276-coinbase.com" OR sourcentdomain CONTAINS "18290185-coinbase.com" OR sourcentdomain CONTAINS "182967-coinbase.com" OR sourcentdomain CONTAINS "18560-coinbase.com" OR sourcentdomain CONTAINS "18571-coinbase.com" OR sourcentdomain CONTAINS "185912-coinbase.com" OR sourcentdomain CONTAINS "185914-coinbase.com" OR sourcentdomain CONTAINS "18592176-coinbase.com" OR sourcentdomain CONTAINS "18594162-coinbase.com" OR sourcentdomain CONTAINS "18594962-coinbase.com" OR sourcentdomain CONTAINS "18597162-coinbase.com" OR sourcentdomain CONTAINS "18719562-coinbase.com" OR sourcentdomain CONTAINS "1875290-coinbase.com" OR sourcentdomain CONTAINS "1882730-coinbase.com" OR sourcentdomain CONTAINS "18902-coinbase.com" OR sourcentdomain CONTAINS "18903-coinbase.com" OR sourcentdomain CONTAINS "189126-coinbase.com" OR sourcentdomain CONTAINS "18952-coinbase.com" OR sourcentdomain CONTAINS "192854-coinbase.com" OR sourcentdomain CONTAINS "192856-coinbase.com" OR sourcentdomain CONTAINS "19287-binance.com" OR sourcentdomain CONTAINS "19572-coinbase.com" OR sourcentdomain CONTAINS "195812-coinbase.com" OR sourcentdomain CONTAINS "195826-coinbase.com" OR sourcentdomain CONTAINS "1958262-coinbase.com" OR sourcentdomain CONTAINS "195827-binance.com" OR sourcentdomain CONTAINS "1958297-coinbase.com" OR sourcentdomain CONTAINS "19582970-coinbase.com" OR sourcentdomain CONTAINS "19582971-coinbase.com" OR sourcentdomain CONTAINS "19583-coinbase.com" OR sourcentdomain CONTAINS "19592653-coinbase.com" OR sourcentdomain CONTAINS "197304-coinbase.com" OR sourcentdomain CONTAINS "19730492-coinbase.com" OR sourcentdomain CONTAINS "19764162-coinbase.com" OR sourcentdomain CONTAINS "19803-coinbase.com" OR sourcentdomain CONTAINS "201784289-coinbase.com" OR sourcentdomain CONTAINS "210823644-coinbase.com" OR sourcentdomain CONTAINS "21158-coinbase.com" OR sourcentdomain CONTAINS "21509-coinbase.com" OR sourcentdomain CONTAINS "25985-coinbase.com" OR sourcentdomain CONTAINS "27699-coinbase.com" OR sourcentdomain CONTAINS "28367-coinbase.com")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "178294-coinbase.com" OR sourcehostname CONTAINS "17912-coinbase.com" OR sourcehostname CONTAINS "17914-coinbase.com" OR sourcehostname CONTAINS "17917-coinbase.com" OR sourcehostname CONTAINS "17954-coinbase.com" OR sourcehostname CONTAINS "17958-coinbase.com" OR sourcehostname CONTAINS "182043-coinbase.com" OR sourcehostname CONTAINS "18275-gemini.com" OR sourcehostname CONTAINS "18276-coinbase.com" OR sourcehostname CONTAINS "18290185-coinbase.com" OR sourcehostname CONTAINS "182967-coinbase.com" OR sourcehostname CONTAINS "18560-coinbase.com" OR sourcehostname CONTAINS "18571-coinbase.com" OR sourcehostname CONTAINS "185912-coinbase.com" OR sourcehostname CONTAINS "185914-coinbase.com" OR sourcehostname CONTAINS "18592176-coinbase.com" OR sourcehostname CONTAINS "18594162-coinbase.com" OR sourcehostname CONTAINS "18594962-coinbase.com" OR sourcehostname CONTAINS "18597162-coinbase.com" OR sourcehostname CONTAINS "18719562-coinbase.com" OR sourcehostname CONTAINS "1875290-coinbase.com" OR sourcehostname CONTAINS "1882730-coinbase.com" OR sourcehostname CONTAINS "18902-coinbase.com" OR sourcehostname CONTAINS "18903-coinbase.com" OR sourcehostname CONTAINS "189126-coinbase.com" OR sourcehostname CONTAINS "18952-coinbase.com" OR sourcehostname CONTAINS "192854-coinbase.com" OR sourcehostname CONTAINS "192856-coinbase.com" OR sourcehostname CONTAINS "19287-binance.com" OR sourcehostname CONTAINS "19572-coinbase.com" OR sourcehostname CONTAINS "195812-coinbase.com" OR sourcehostname CONTAINS "195826-coinbase.com" OR sourcehostname CONTAINS "1958262-coinbase.com" OR sourcehostname CONTAINS "195827-binance.com" OR sourcehostname CONTAINS "1958297-coinbase.com" OR sourcehostname CONTAINS "19582970-coinbase.com" OR sourcehostname CONTAINS "19582971-coinbase.com" OR sourcehostname CONTAINS "19583-coinbase.com" OR sourcehostname CONTAINS "19592653-coinbase.com" OR sourcehostname CONTAINS "197304-coinbase.com" OR sourcehostname CONTAINS "19730492-coinbase.com" OR sourcehostname CONTAINS "19764162-coinbase.com" OR sourcehostname CONTAINS "19803-coinbase.com" OR sourcehostname CONTAINS "201784289-coinbase.com" OR sourcehostname CONTAINS "210823644-coinbase.com" OR sourcehostname CONTAINS "21158-coinbase.com" OR sourcehostname CONTAINS "21509-coinbase.com" OR sourcehostname CONTAINS "25985-coinbase.com" OR sourcehostname CONTAINS "27699-coinbase.com" OR sourcehostname CONTAINS "28367-coinbase.com")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "178294-coinbase.com" OR destinationntdomain CONTAINS "17912-coinbase.com" OR destinationntdomain CONTAINS "17914-coinbase.com" OR destinationntdomain CONTAINS "17917-coinbase.com" OR destinationntdomain CONTAINS "17954-coinbase.com" OR destinationntdomain CONTAINS "17958-coinbase.com" OR destinationntdomain CONTAINS "182043-coinbase.com" OR destinationntdomain CONTAINS "18275-gemini.com" OR destinationntdomain CONTAINS "18276-coinbase.com" OR destinationntdomain CONTAINS "18290185-coinbase.com" OR destinationntdomain CONTAINS "182967-coinbase.com" OR destinationntdomain CONTAINS "18560-coinbase.com" OR destinationntdomain CONTAINS "18571-coinbase.com" OR destinationntdomain CONTAINS "185912-coinbase.com" OR destinationntdomain CONTAINS "185914-coinbase.com" OR destinationntdomain CONTAINS "18592176-coinbase.com" OR destinationntdomain CONTAINS "18594162-coinbase.com" OR destinationntdomain CONTAINS "18594962-coinbase.com" OR destinationntdomain CONTAINS "18597162-coinbase.com" OR destinationntdomain CONTAINS "18719562-coinbase.com" OR destinationntdomain CONTAINS "1875290-coinbase.com" OR destinationntdomain CONTAINS "1882730-coinbase.com" OR destinationntdomain CONTAINS "18902-coinbase.com" OR destinationntdomain CONTAINS "18903-coinbase.com" OR destinationntdomain CONTAINS "189126-coinbase.com" OR destinationntdomain CONTAINS "18952-coinbase.com" OR destinationntdomain CONTAINS "192854-coinbase.com" OR destinationntdomain CONTAINS "192856-coinbase.com" OR destinationntdomain CONTAINS "19287-binance.com" OR destinationntdomain CONTAINS "19572-coinbase.com" OR destinationntdomain CONTAINS "195812-coinbase.com" OR destinationntdomain CONTAINS "195826-coinbase.com" OR destinationntdomain CONTAINS "1958262-coinbase.com" OR destinationntdomain CONTAINS "195827-binance.com" OR destinationntdomain CONTAINS "1958297-coinbase.com" OR destinationntdomain CONTAINS "19582970-coinbase.com" OR destinationntdomain CONTAINS "19582971-coinbase.com" OR destinationntdomain CONTAINS "19583-coinbase.com" OR destinationntdomain CONTAINS "19592653-coinbase.com" OR destinationntdomain CONTAINS "197304-coinbase.com" OR destinationntdomain CONTAINS "19730492-coinbase.com" OR destinationntdomain CONTAINS "19764162-coinbase.com" OR destinationntdomain CONTAINS "19803-coinbase.com" OR destinationntdomain CONTAINS "201784289-coinbase.com" OR destinationntdomain CONTAINS "210823644-coinbase.com" OR destinationntdomain CONTAINS "21158-coinbase.com" OR destinationntdomain CONTAINS "21509-coinbase.com" OR destinationntdomain CONTAINS "25985-coinbase.com" OR destinationntdomain CONTAINS "27699-coinbase.com" OR destinationntdomain CONTAINS "28367-coinbase.com")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND requesturl NOT NULL AND (requesturl CONTAINS "178294-coinbase.com" OR requesturl CONTAINS "17912-coinbase.com" OR requesturl CONTAINS "17914-coinbase.com" OR requesturl CONTAINS "17917-coinbase.com" OR requesturl CONTAINS "17954-coinbase.com" OR requesturl CONTAINS "17958-coinbase.com" OR requesturl CONTAINS "182043-coinbase.com" OR requesturl CONTAINS "18275-gemini.com" OR requesturl CONTAINS "18276-coinbase.com" OR requesturl CONTAINS "18290185-coinbase.com" OR requesturl CONTAINS "182967-coinbase.com" OR requesturl CONTAINS "18560-coinbase.com" OR requesturl CONTAINS "18571-coinbase.com" OR requesturl CONTAINS "185912-coinbase.com" OR requesturl CONTAINS "185914-coinbase.com" OR requesturl CONTAINS "18592176-coinbase.com" OR requesturl CONTAINS "18594162-coinbase.com" OR requesturl CONTAINS "18594962-coinbase.com" OR requesturl CONTAINS "18597162-coinbase.com" OR requesturl CONTAINS "18719562-coinbase.com" OR requesturl CONTAINS "1875290-coinbase.com" OR requesturl CONTAINS "1882730-coinbase.com" OR requesturl CONTAINS "18902-coinbase.com" OR requesturl CONTAINS "18903-coinbase.com" OR requesturl CONTAINS "189126-coinbase.com" OR requesturl CONTAINS "18952-coinbase.com" OR requesturl CONTAINS "192854-coinbase.com" OR requesturl CONTAINS "192856-coinbase.com" OR requesturl CONTAINS "19287-binance.com" OR requesturl CONTAINS "19572-coinbase.com" OR requesturl CONTAINS "195812-coinbase.com" OR requesturl CONTAINS "195826-coinbase.com" OR requesturl CONTAINS "1958262-coinbase.com" OR requesturl CONTAINS "195827-binance.com" OR requesturl CONTAINS "1958297-coinbase.com" OR requesturl CONTAINS "19582970-coinbase.com" OR requesturl CONTAINS "19582971-coinbase.com" OR requesturl CONTAINS "19583-coinbase.com" OR requesturl CONTAINS "19592653-coinbase.com" OR requesturl CONTAINS "197304-coinbase.com" OR requesturl CONTAINS "19730492-coinbase.com" OR requesturl CONTAINS "19764162-coinbase.com" OR requesturl CONTAINS "19803-coinbase.com" OR requesturl CONTAINS "201784289-coinbase.com" OR requesturl CONTAINS "210823644-coinbase.com" OR requesturl CONTAINS "21158-coinbase.com" OR requesturl CONTAINS "21509-coinbase.com" OR requesturl CONTAINS "25985-coinbase.com" OR requesturl CONTAINS "27699-coinbase.com" OR requesturl CONTAINS "28367-coinbase.com")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "28676-coinbase.com" OR destinationhostname CONTAINS "29185-coinbase.com" OR destinationhostname CONTAINS "29195-coinbase.com" OR destinationhostname CONTAINS "2a-coinbase.com" OR destinationhostname CONTAINS "2b-coinbase.com" OR destinationhostname CONTAINS "2c-coinbase.com" OR destinationhostname CONTAINS "2f-coinbase.com" OR destinationhostname CONTAINS "2fas-coinbase.com" OR destinationhostname CONTAINS "2o-coinbase.com" OR destinationhostname CONTAINS "2r-coinbase.com" OR destinationhostname CONTAINS "2s-coinbase.com" OR destinationhostname CONTAINS "2sv-coinbase.com" OR destinationhostname CONTAINS "352134951-coinbase.com" OR destinationhostname CONTAINS "38468-coinbase.com" OR destinationhostname CONTAINS "39590-coinbase.com" OR destinationhostname CONTAINS "41260-coinbase.com" OR destinationhostname CONTAINS "427883-coinbase.com" OR destinationhostname CONTAINS "43017-coinbase.com" OR destinationhostname CONTAINS "47562-coinbase.com" OR destinationhostname CONTAINS "50195-coinbase.com" OR destinationhostname CONTAINS "5247-coinbase.com" OR destinationhostname CONTAINS "54765-coinbase.com" OR destinationhostname CONTAINS "57197-coinbase.com" OR destinationhostname CONTAINS "58176-coinbase.com" OR destinationhostname CONTAINS "58297-coinbase.com" OR destinationhostname CONTAINS "61250-coinbase.com" OR destinationhostname CONTAINS "61835-coinbase.com" OR destinationhostname CONTAINS "61851-coinbase.com" OR destinationhostname CONTAINS "61937-coinbase.com" OR destinationhostname CONTAINS "71925-coinbase.com" OR destinationhostname CONTAINS "72957-coinbase.com" OR destinationhostname CONTAINS "72985-coinbase.com" OR destinationhostname CONTAINS "74651-coinbase.com" OR destinationhostname CONTAINS "754668948-coinbase.com" OR destinationhostname CONTAINS "76159869-coinbase.com" OR destinationhostname CONTAINS "76153-coinbase.com" OR destinationhostname CONTAINS "81758-coinbase.com" OR destinationhostname CONTAINS "81920-coinbase.com" OR destinationhostname CONTAINS "81926-coinbase.com" OR destinationhostname CONTAINS "81958-coinbase.com" OR destinationhostname CONTAINS "826298-coinbase.com" OR destinationhostname CONTAINS "83216-coinbase.com" OR destinationhostname CONTAINS "837613-coinbase.com" OR destinationhostname CONTAINS "83956-coinbase.com" OR destinationhostname CONTAINS "87157-coinbase.com" OR destinationhostname CONTAINS "87312-coinbase.com" OR destinationhostname CONTAINS "89304-coinbase.com" OR destinationhostname CONTAINS "89375-coinbase.com" OR destinationhostname CONTAINS "91723-gemini.com" OR destinationhostname CONTAINS "91752-coinbase.com")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "28676-coinbase.com" OR sourcentdomain CONTAINS "29185-coinbase.com" OR sourcentdomain CONTAINS "29195-coinbase.com" OR sourcentdomain CONTAINS "2a-coinbase.com" OR sourcentdomain CONTAINS "2b-coinbase.com" OR sourcentdomain CONTAINS "2c-coinbase.com" OR sourcentdomain CONTAINS "2f-coinbase.com" OR sourcentdomain CONTAINS "2fas-coinbase.com" OR sourcentdomain CONTAINS "2o-coinbase.com" OR sourcentdomain CONTAINS "2r-coinbase.com" OR sourcentdomain CONTAINS "2s-coinbase.com" OR sourcentdomain CONTAINS "2sv-coinbase.com" OR sourcentdomain CONTAINS "352134951-coinbase.com" OR sourcentdomain CONTAINS "38468-coinbase.com" OR sourcentdomain CONTAINS "39590-coinbase.com" OR sourcentdomain CONTAINS "41260-coinbase.com" OR sourcentdomain CONTAINS "427883-coinbase.com" OR sourcentdomain CONTAINS "43017-coinbase.com" OR sourcentdomain CONTAINS "47562-coinbase.com" OR sourcentdomain CONTAINS "50195-coinbase.com" OR sourcentdomain CONTAINS "5247-coinbase.com" OR sourcentdomain CONTAINS "54765-coinbase.com" OR sourcentdomain CONTAINS "57197-coinbase.com" OR sourcentdomain CONTAINS "58176-coinbase.com" OR sourcentdomain CONTAINS "58297-coinbase.com" OR sourcentdomain CONTAINS "61250-coinbase.com" OR sourcentdomain CONTAINS "61835-coinbase.com" OR sourcentdomain CONTAINS "61851-coinbase.com" OR sourcentdomain CONTAINS "61937-coinbase.com" OR sourcentdomain CONTAINS "71925-coinbase.com" OR sourcentdomain CONTAINS "72957-coinbase.com" OR sourcentdomain CONTAINS "72985-coinbase.com" OR sourcentdomain CONTAINS "74651-coinbase.com" OR sourcentdomain CONTAINS "754668948-coinbase.com" OR sourcentdomain CONTAINS "76159869-coinbase.com" OR sourcentdomain CONTAINS "76153-coinbase.com" OR sourcentdomain CONTAINS "81758-coinbase.com" OR sourcentdomain CONTAINS "81920-coinbase.com" OR sourcentdomain CONTAINS "81926-coinbase.com" OR sourcentdomain CONTAINS "81958-coinbase.com" OR sourcentdomain CONTAINS "826298-coinbase.com" OR sourcentdomain CONTAINS "83216-coinbase.com" OR sourcentdomain CONTAINS "837613-coinbase.com" OR sourcentdomain CONTAINS "83956-coinbase.com" OR sourcentdomain CONTAINS "87157-coinbase.com" OR sourcentdomain CONTAINS "87312-coinbase.com" OR sourcentdomain CONTAINS "89304-coinbase.com" OR sourcentdomain CONTAINS "89375-coinbase.com" OR sourcentdomain CONTAINS "91723-gemini.com" OR sourcentdomain CONTAINS "91752-coinbase.com")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "28676-coinbase.com" OR sourcehostname CONTAINS "29185-coinbase.com" OR sourcehostname CONTAINS "29195-coinbase.com" OR sourcehostname CONTAINS "2a-coinbase.com" OR sourcehostname CONTAINS "2b-coinbase.com" OR sourcehostname CONTAINS "2c-coinbase.com" OR sourcehostname CONTAINS "2f-coinbase.com" OR sourcehostname CONTAINS "2fas-coinbase.com" OR sourcehostname CONTAINS "2o-coinbase.com" OR sourcehostname CONTAINS "2r-coinbase.com" OR sourcehostname CONTAINS "2s-coinbase.com" OR sourcehostname CONTAINS "2sv-coinbase.com" OR sourcehostname CONTAINS "352134951-coinbase.com" OR sourcehostname CONTAINS "38468-coinbase.com" OR sourcehostname CONTAINS "39590-coinbase.com" OR sourcehostname CONTAINS "41260-coinbase.com" OR sourcehostname CONTAINS "427883-coinbase.com" OR sourcehostname CONTAINS "43017-coinbase.com" OR sourcehostname CONTAINS "47562-coinbase.com" OR sourcehostname CONTAINS "50195-coinbase.com" OR sourcehostname CONTAINS "5247-coinbase.com" OR sourcehostname CONTAINS "54765-coinbase.com" OR sourcehostname CONTAINS "57197-coinbase.com" OR sourcehostname CONTAINS "58176-coinbase.com" OR sourcehostname CONTAINS "58297-coinbase.com" OR sourcehostname CONTAINS "61250-coinbase.com" OR sourcehostname CONTAINS "61835-coinbase.com" OR sourcehostname CONTAINS "61851-coinbase.com" OR sourcehostname CONTAINS "61937-coinbase.com" OR sourcehostname CONTAINS "71925-coinbase.com" OR sourcehostname CONTAINS "72957-coinbase.com" OR sourcehostname CONTAINS "72985-coinbase.com" OR sourcehostname CONTAINS "74651-coinbase.com" OR sourcehostname CONTAINS "754668948-coinbase.com" OR sourcehostname CONTAINS "76159869-coinbase.com" OR sourcehostname CONTAINS "76153-coinbase.com" OR sourcehostname CONTAINS "81758-coinbase.com" OR sourcehostname CONTAINS "81920-coinbase.com" OR sourcehostname CONTAINS "81926-coinbase.com" OR sourcehostname CONTAINS "81958-coinbase.com" OR sourcehostname CONTAINS "826298-coinbase.com" OR sourcehostname CONTAINS "83216-coinbase.com" OR sourcehostname CONTAINS "837613-coinbase.com" OR sourcehostname CONTAINS "83956-coinbase.com" OR sourcehostname CONTAINS "87157-coinbase.com" OR sourcehostname CONTAINS "87312-coinbase.com" OR sourcehostname CONTAINS "89304-coinbase.com" OR sourcehostname CONTAINS "89375-coinbase.com" OR sourcehostname CONTAINS "91723-gemini.com" OR sourcehostname CONTAINS "91752-coinbase.com")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "28676-coinbase.com" OR destinationntdomain CONTAINS "29185-coinbase.com" OR destinationntdomain CONTAINS "29195-coinbase.com" OR destinationntdomain CONTAINS "2a-coinbase.com" OR destinationntdomain CONTAINS "2b-coinbase.com" OR destinationntdomain CONTAINS "2c-coinbase.com" OR destinationntdomain CONTAINS "2f-coinbase.com" OR destinationntdomain CONTAINS "2fas-coinbase.com" OR destinationntdomain CONTAINS "2o-coinbase.com" OR destinationntdomain CONTAINS "2r-coinbase.com" OR destinationntdomain CONTAINS "2s-coinbase.com" OR destinationntdomain CONTAINS "2sv-coinbase.com" OR destinationntdomain CONTAINS "352134951-coinbase.com" OR destinationntdomain CONTAINS "38468-coinbase.com" OR destinationntdomain CONTAINS "39590-coinbase.com" OR destinationntdomain CONTAINS "41260-coinbase.com" OR destinationntdomain CONTAINS "427883-coinbase.com" OR destinationntdomain CONTAINS "43017-coinbase.com" OR destinationntdomain CONTAINS "47562-coinbase.com" OR destinationntdomain CONTAINS "50195-coinbase.com" OR destinationntdomain CONTAINS "5247-coinbase.com" OR destinationntdomain CONTAINS "54765-coinbase.com" OR destinationntdomain CONTAINS "57197-coinbase.com" OR destinationntdomain CONTAINS "58176-coinbase.com" OR destinationntdomain CONTAINS "58297-coinbase.com" OR destinationntdomain CONTAINS "61250-coinbase.com" OR destinationntdomain CONTAINS "61835-coinbase.com" OR destinationntdomain CONTAINS "61851-coinbase.com" OR destinationntdomain CONTAINS "61937-coinbase.com" OR destinationntdomain CONTAINS "71925-coinbase.com" OR destinationntdomain CONTAINS "72957-coinbase.com" OR destinationntdomain CONTAINS "72985-coinbase.com" OR destinationntdomain CONTAINS "74651-coinbase.com" OR destinationntdomain CONTAINS "754668948-coinbase.com" OR destinationntdomain CONTAINS "76159869-coinbase.com" OR destinationntdomain CONTAINS "76153-coinbase.com" OR destinationntdomain CONTAINS "81758-coinbase.com" OR destinationntdomain CONTAINS "81920-coinbase.com" OR destinationntdomain CONTAINS "81926-coinbase.com" OR destinationntdomain CONTAINS "81958-coinbase.com" OR destinationntdomain CONTAINS "826298-coinbase.com" OR destinationntdomain CONTAINS "83216-coinbase.com" OR destinationntdomain CONTAINS "837613-coinbase.com" OR destinationntdomain CONTAINS "83956-coinbase.com" OR destinationntdomain CONTAINS "87157-coinbase.com" OR destinationntdomain CONTAINS "87312-coinbase.com" OR destinationntdomain CONTAINS "89304-coinbase.com" OR destinationntdomain CONTAINS "89375-coinbase.com" OR destinationntdomain CONTAINS "91723-gemini.com" OR destinationntdomain CONTAINS "91752-coinbase.com")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND requesturl NOT NULL AND (requesturl CONTAINS "28676-coinbase.com" OR requesturl CONTAINS "29185-coinbase.com" OR requesturl CONTAINS "29195-coinbase.com" OR requesturl CONTAINS "2a-coinbase.com" OR requesturl CONTAINS "2b-coinbase.com" OR requesturl CONTAINS "2c-coinbase.com" OR requesturl CONTAINS "2f-coinbase.com" OR requesturl CONTAINS "2fas-coinbase.com" OR requesturl CONTAINS "2o-coinbase.com" OR requesturl CONTAINS "2r-coinbase.com" OR requesturl CONTAINS "2s-coinbase.com" OR requesturl CONTAINS "2sv-coinbase.com" OR requesturl CONTAINS "352134951-coinbase.com" OR requesturl CONTAINS "38468-coinbase.com" OR requesturl CONTAINS "39590-coinbase.com" OR requesturl CONTAINS "41260-coinbase.com" OR requesturl CONTAINS "427883-coinbase.com" OR requesturl CONTAINS "43017-coinbase.com" OR requesturl CONTAINS "47562-coinbase.com" OR requesturl CONTAINS "50195-coinbase.com" OR requesturl CONTAINS "5247-coinbase.com" OR requesturl CONTAINS "54765-coinbase.com" OR requesturl CONTAINS "57197-coinbase.com" OR requesturl CONTAINS "58176-coinbase.com" OR requesturl CONTAINS "58297-coinbase.com" OR requesturl CONTAINS "61250-coinbase.com" OR requesturl CONTAINS "61835-coinbase.com" OR requesturl CONTAINS "61851-coinbase.com" OR requesturl CONTAINS "61937-coinbase.com" OR requesturl CONTAINS "71925-coinbase.com" OR requesturl CONTAINS "72957-coinbase.com" OR requesturl CONTAINS "72985-coinbase.com" OR requesturl CONTAINS "74651-coinbase.com" OR requesturl CONTAINS "754668948-coinbase.com" OR requesturl CONTAINS "76159869-coinbase.com" OR requesturl CONTAINS "76153-coinbase.com" OR requesturl CONTAINS "81758-coinbase.com" OR requesturl CONTAINS "81920-coinbase.com" OR requesturl CONTAINS "81926-coinbase.com" OR requesturl CONTAINS "81958-coinbase.com" OR requesturl CONTAINS "826298-coinbase.com" OR requesturl CONTAINS "83216-coinbase.com" OR requesturl CONTAINS "837613-coinbase.com" OR requesturl CONTAINS "83956-coinbase.com" OR requesturl CONTAINS "87157-coinbase.com" OR requesturl CONTAINS "87312-coinbase.com" OR requesturl CONTAINS "89304-coinbase.com" OR requesturl CONTAINS "89375-coinbase.com" OR requesturl CONTAINS "91723-gemini.com" OR requesturl CONTAINS "91752-coinbase.com")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "91756-coinbase.com" OR destinationhostname CONTAINS "91782-coinbase.com" OR destinationhostname CONTAINS "91835-coinbase.com" OR destinationhostname CONTAINS "91845-coinbase.com" OR destinationhostname CONTAINS "91923-coinbase.com" OR destinationhostname CONTAINS "92758-coinbase.com" OR destinationhostname CONTAINS "948122061-coinbase.com" OR destinationhostname CONTAINS "978941-coinbase.com" OR destinationhostname CONTAINS "accountrecovery-coinbase.com" OR destinationhostname CONTAINS "action-shakepay.com" OR destinationhostname CONTAINS "adjust-coinbase.com" OR destinationhostname CONTAINS "admin-kraken.com" OR destinationhostname CONTAINS "applechargebacks.com" OR destinationhostname CONTAINS "authenticate-gemini.com" OR destinationhostname CONTAINS "authorize-gmail.com" OR destinationhostname CONTAINS "binance-okta.com" OR destinationhostname CONTAINS "captcha-coinbase.com" OR destinationhostname CONTAINS "cd-coinbase.com" OR destinationhostname CONTAINS "coinbase-heip.com" OR destinationhostname CONTAINS "coinbase-live.support" OR destinationhostname CONTAINS "coinbase-reject.com" OR destinationhostname CONTAINS "coinbase-ticket.com" OR destinationhostname CONTAINS "coinbaseheip.com" OR destinationhostname CONTAINS "com-2fa.help" OR destinationhostname CONTAINS "com-2fa.support" OR destinationhostname CONTAINS "com-3845.support" OR destinationhostname CONTAINS "com-connect.help" OR destinationhostname CONTAINS "com-fraud.support" OR destinationhostname CONTAINS "com-help.support" OR destinationhostname CONTAINS "com-reset.help" OR destinationhostname CONTAINS "com-reset.net" OR destinationhostname CONTAINS "com-ticket.live" OR destinationhostname CONTAINS "com-ticket.support" OR destinationhostname CONTAINS "contact-nexo.com" OR destinationhostname CONTAINS "convert-coinbase.com" OR destinationhostname CONTAINS "customerservice-coinbase.com" OR destinationhostname CONTAINS "default-coinbase.com" OR destinationhostname CONTAINS "defend-coinbase.com" OR destinationhostname CONTAINS "deny-coinbase.com" OR destinationhostname CONTAINS "disconnect-coinbase.com" OR destinationhostname CONTAINS "escalate-coinbase.com" OR destinationhostname CONTAINS "establish-coinbase.com" OR destinationhostname CONTAINS "fcc-okta.com" OR destinationhostname CONTAINS "fraudulent-coinbase.com" OR destinationhostname CONTAINS "guard-apple.com" OR destinationhostname CONTAINS "guard-icloud.com" OR destinationhostname CONTAINS "guardian-coinbase.com" OR destinationhostname CONTAINS "guide-gemini.com" OR destinationhostname CONTAINS "help-bitfinex.com" OR destinationhostname CONTAINS "help-shakepay.com")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "91756-coinbase.com" OR sourcentdomain CONTAINS "91782-coinbase.com" OR sourcentdomain CONTAINS "91835-coinbase.com" OR sourcentdomain CONTAINS "91845-coinbase.com" OR sourcentdomain CONTAINS "91923-coinbase.com" OR sourcentdomain CONTAINS "92758-coinbase.com" OR sourcentdomain CONTAINS "948122061-coinbase.com" OR sourcentdomain CONTAINS "978941-coinbase.com" OR sourcentdomain CONTAINS "accountrecovery-coinbase.com" OR sourcentdomain CONTAINS "action-shakepay.com" OR sourcentdomain CONTAINS "adjust-coinbase.com" OR sourcentdomain CONTAINS "admin-kraken.com" OR sourcentdomain CONTAINS "applechargebacks.com" OR sourcentdomain CONTAINS "authenticate-gemini.com" OR sourcentdomain CONTAINS "authorize-gmail.com" OR sourcentdomain CONTAINS "binance-okta.com" OR sourcentdomain CONTAINS "captcha-coinbase.com" OR sourcentdomain CONTAINS "cd-coinbase.com" OR sourcentdomain CONTAINS "coinbase-heip.com" OR sourcentdomain CONTAINS "coinbase-live.support" OR sourcentdomain CONTAINS "coinbase-reject.com" OR sourcentdomain CONTAINS "coinbase-ticket.com" OR sourcentdomain CONTAINS "coinbaseheip.com" OR sourcentdomain CONTAINS "com-2fa.help" OR sourcentdomain CONTAINS "com-2fa.support" OR sourcentdomain CONTAINS "com-3845.support" OR sourcentdomain CONTAINS "com-connect.help" OR sourcentdomain CONTAINS "com-fraud.support" OR sourcentdomain CONTAINS "com-help.support" OR sourcentdomain CONTAINS "com-reset.help" OR sourcentdomain CONTAINS "com-reset.net" OR sourcentdomain CONTAINS "com-ticket.live" OR sourcentdomain CONTAINS "com-ticket.support" OR sourcentdomain CONTAINS "contact-nexo.com" OR sourcentdomain CONTAINS "convert-coinbase.com" OR sourcentdomain CONTAINS "customerservice-coinbase.com" OR sourcentdomain CONTAINS "default-coinbase.com" OR sourcentdomain CONTAINS "defend-coinbase.com" OR sourcentdomain CONTAINS "deny-coinbase.com" OR sourcentdomain CONTAINS "disconnect-coinbase.com" OR sourcentdomain CONTAINS "escalate-coinbase.com" OR sourcentdomain CONTAINS "establish-coinbase.com" OR sourcentdomain CONTAINS "fcc-okta.com" OR sourcentdomain CONTAINS "fraudulent-coinbase.com" OR sourcentdomain CONTAINS "guard-apple.com" OR sourcentdomain CONTAINS "guard-icloud.com" OR sourcentdomain CONTAINS "guardian-coinbase.com" OR sourcentdomain CONTAINS "guide-gemini.com" OR sourcentdomain CONTAINS "help-bitfinex.com" OR sourcentdomain CONTAINS "help-shakepay.com")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "91756-coinbase.com" OR sourcehostname CONTAINS "91782-coinbase.com" OR sourcehostname CONTAINS "91835-coinbase.com" OR sourcehostname CONTAINS "91845-coinbase.com" OR sourcehostname CONTAINS "91923-coinbase.com" OR sourcehostname CONTAINS "92758-coinbase.com" OR sourcehostname CONTAINS "948122061-coinbase.com" OR sourcehostname CONTAINS "978941-coinbase.com" OR sourcehostname CONTAINS "accountrecovery-coinbase.com" OR sourcehostname CONTAINS "action-shakepay.com" OR sourcehostname CONTAINS "adjust-coinbase.com" OR sourcehostname CONTAINS "admin-kraken.com" OR sourcehostname CONTAINS "applechargebacks.com" OR sourcehostname CONTAINS "authenticate-gemini.com" OR sourcehostname CONTAINS "authorize-gmail.com" OR sourcehostname CONTAINS "binance-okta.com" OR sourcehostname CONTAINS "captcha-coinbase.com" OR sourcehostname CONTAINS "cd-coinbase.com" OR sourcehostname CONTAINS "coinbase-heip.com" OR sourcehostname CONTAINS "coinbase-live.support" OR sourcehostname CONTAINS "coinbase-reject.com" OR sourcehostname CONTAINS "coinbase-ticket.com" OR sourcehostname CONTAINS "coinbaseheip.com" OR sourcehostname CONTAINS "com-2fa.help" OR sourcehostname CONTAINS "com-2fa.support" OR sourcehostname CONTAINS "com-3845.support" OR sourcehostname CONTAINS "com-connect.help" OR sourcehostname CONTAINS "com-fraud.support" OR sourcehostname CONTAINS "com-help.support" OR sourcehostname CONTAINS "com-reset.help" OR sourcehostname CONTAINS "com-reset.net" OR sourcehostname CONTAINS "com-ticket.live" OR sourcehostname CONTAINS "com-ticket.support" OR sourcehostname CONTAINS "contact-nexo.com" OR sourcehostname CONTAINS "convert-coinbase.com" OR sourcehostname CONTAINS "customerservice-coinbase.com" OR sourcehostname CONTAINS "default-coinbase.com" OR sourcehostname CONTAINS "defend-coinbase.com" OR sourcehostname CONTAINS "deny-coinbase.com" OR sourcehostname CONTAINS "disconnect-coinbase.com" OR sourcehostname CONTAINS "escalate-coinbase.com" OR sourcehostname CONTAINS "establish-coinbase.com" OR sourcehostname CONTAINS "fcc-okta.com" OR sourcehostname CONTAINS "fraudulent-coinbase.com" OR sourcehostname CONTAINS "guard-apple.com" OR sourcehostname CONTAINS "guard-icloud.com" OR sourcehostname CONTAINS "guardian-coinbase.com" OR sourcehostname CONTAINS "guide-gemini.com" OR sourcehostname CONTAINS "help-bitfinex.com" OR sourcehostname CONTAINS "help-shakepay.com")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "91756-coinbase.com" OR destinationntdomain CONTAINS "91782-coinbase.com" OR destinationntdomain CONTAINS "91835-coinbase.com" OR destinationntdomain CONTAINS "91845-coinbase.com" OR destinationntdomain CONTAINS "91923-coinbase.com" OR destinationntdomain CONTAINS "92758-coinbase.com" OR destinationntdomain CONTAINS "948122061-coinbase.com" OR destinationntdomain CONTAINS "978941-coinbase.com" OR destinationntdomain CONTAINS "accountrecovery-coinbase.com" OR destinationntdomain CONTAINS "action-shakepay.com" OR destinationntdomain CONTAINS "adjust-coinbase.com" OR destinationntdomain CONTAINS "admin-kraken.com" OR destinationntdomain CONTAINS "applechargebacks.com" OR destinationntdomain CONTAINS "authenticate-gemini.com" OR destinationntdomain CONTAINS "authorize-gmail.com" OR destinationntdomain CONTAINS "binance-okta.com" OR destinationntdomain CONTAINS "captcha-coinbase.com" OR destinationntdomain CONTAINS "cd-coinbase.com" OR destinationntdomain CONTAINS "coinbase-heip.com" OR destinationntdomain CONTAINS "coinbase-live.support" OR destinationntdomain CONTAINS "coinbase-reject.com" OR destinationntdomain CONTAINS "coinbase-ticket.com" OR destinationntdomain CONTAINS "coinbaseheip.com" OR destinationntdomain CONTAINS "com-2fa.help" OR destinationntdomain CONTAINS "com-2fa.support" OR destinationntdomain CONTAINS "com-3845.support" OR destinationntdomain CONTAINS "com-connect.help" OR destinationntdomain CONTAINS "com-fraud.support" OR destinationntdomain CONTAINS "com-help.support" OR destinationntdomain CONTAINS "com-reset.help" OR destinationntdomain CONTAINS "com-reset.net" OR destinationntdomain CONTAINS "com-ticket.live" OR destinationntdomain CONTAINS "com-ticket.support" OR destinationntdomain CONTAINS "contact-nexo.com" OR destinationntdomain CONTAINS "convert-coinbase.com" OR destinationntdomain CONTAINS "customerservice-coinbase.com" OR destinationntdomain CONTAINS "default-coinbase.com" OR destinationntdomain CONTAINS "defend-coinbase.com" OR destinationntdomain CONTAINS "deny-coinbase.com" OR destinationntdomain CONTAINS "disconnect-coinbase.com" OR destinationntdomain CONTAINS "escalate-coinbase.com" OR destinationntdomain CONTAINS "establish-coinbase.com" OR destinationntdomain CONTAINS "fcc-okta.com" OR destinationntdomain CONTAINS "fraudulent-coinbase.com" OR destinationntdomain CONTAINS "guard-apple.com" OR destinationntdomain CONTAINS "guard-icloud.com" OR destinationntdomain CONTAINS "guardian-coinbase.com" OR destinationntdomain CONTAINS "guide-gemini.com" OR destinationntdomain CONTAINS "help-bitfinex.com" OR destinationntdomain CONTAINS "help-shakepay.com")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND requesturl NOT NULL AND (requesturl CONTAINS "91756-coinbase.com" OR requesturl CONTAINS "91782-coinbase.com" OR requesturl CONTAINS "91835-coinbase.com" OR requesturl CONTAINS "91845-coinbase.com" OR requesturl CONTAINS "91923-coinbase.com" OR requesturl CONTAINS "92758-coinbase.com" OR requesturl CONTAINS "948122061-coinbase.com" OR requesturl CONTAINS "978941-coinbase.com" OR requesturl CONTAINS "accountrecovery-coinbase.com" OR requesturl CONTAINS "action-shakepay.com" OR requesturl CONTAINS "adjust-coinbase.com" OR requesturl CONTAINS "admin-kraken.com" OR requesturl CONTAINS "applechargebacks.com" OR requesturl CONTAINS "authenticate-gemini.com" OR requesturl CONTAINS "authorize-gmail.com" OR requesturl CONTAINS "binance-okta.com" OR requesturl CONTAINS "captcha-coinbase.com" OR requesturl CONTAINS "cd-coinbase.com" OR requesturl CONTAINS "coinbase-heip.com" OR requesturl CONTAINS "coinbase-live.support" OR requesturl CONTAINS "coinbase-reject.com" OR requesturl CONTAINS "coinbase-ticket.com" OR requesturl CONTAINS "coinbaseheip.com" OR requesturl CONTAINS "com-2fa.help" OR requesturl CONTAINS "com-2fa.support" OR requesturl CONTAINS "com-3845.support" OR requesturl CONTAINS "com-connect.help" OR requesturl CONTAINS "com-fraud.support" OR requesturl CONTAINS "com-help.support" OR requesturl CONTAINS "com-reset.help" OR requesturl CONTAINS "com-reset.net" OR requesturl CONTAINS "com-ticket.live" OR requesturl CONTAINS "com-ticket.support" OR requesturl CONTAINS "contact-nexo.com" OR requesturl CONTAINS "convert-coinbase.com" OR requesturl CONTAINS "customerservice-coinbase.com" OR requesturl CONTAINS "default-coinbase.com" OR requesturl CONTAINS "defend-coinbase.com" OR requesturl CONTAINS "deny-coinbase.com" OR requesturl CONTAINS "disconnect-coinbase.com" OR requesturl CONTAINS "escalate-coinbase.com" OR requesturl CONTAINS "establish-coinbase.com" OR requesturl CONTAINS "fcc-okta.com" OR requesturl CONTAINS "fraudulent-coinbase.com" OR requesturl CONTAINS "guard-apple.com" OR requesturl CONTAINS "guard-icloud.com" OR requesturl CONTAINS "guardian-coinbase.com" OR requesturl CONTAINS "guide-gemini.com" OR requesturl CONTAINS "help-bitfinex.com" OR requesturl CONTAINS "help-shakepay.com")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "helpdesk-apple.com" OR destinationhostname CONTAINS "helpdesk-gemini.com" OR destinationhostname CONTAINS "helpdesk-icloud.com" OR destinationhostname CONTAINS "identification-coinbase.com" OR destinationhostname CONTAINS "lockdown-coinbase.com" OR destinationhostname CONTAINS "login-nexo.com" OR destinationhostname CONTAINS "keys-coinbase.com" OR destinationhostname CONTAINS "messages-coinbase.com" OR destinationhostname CONTAINS "newpassword-coinbase.com" OR destinationhostname CONTAINS "prompt-coinbase.com" OR destinationhostname CONTAINS "protect-apple.com" OR destinationhostname CONTAINS "protect-coinbase.com" OR destinationhostname CONTAINS "protect-gmail.com" OR destinationhostname CONTAINS "protect-kraken.com" OR destinationhostname CONTAINS "recoverme-coinbase.com" OR destinationhostname CONTAINS "recoveryportal-coinbase.com" OR destinationhostname CONTAINS "refunds-coinbase.com" OR destinationhostname CONTAINS "reset-okta.com" OR destinationhostname CONTAINS "restore-coinbase.com" OR destinationhostname CONTAINS "return-coinbase.com" OR destinationhostname CONTAINS "reverts-coinbase.com" OR destinationhostname CONTAINS "secure-binance.us" OR destinationhostname CONTAINS "secure-icloud.com" OR destinationhostname CONTAINS "secure-nexo.com" OR destinationhostname CONTAINS "secure-shakepay.com" OR destinationhostname CONTAINS "security-umusic.com" OR destinationhostname CONTAINS "server694590423.tech" OR destinationhostname CONTAINS "session-coinbase.com" OR destinationhostname CONTAINS "startrecovery-coinbase.com" OR destinationhostname CONTAINS "signin-kraken.com" OR destinationhostname CONTAINS "suite-trezor.io" OR destinationhostname CONTAINS "supportportal-coinbase.com" OR destinationhostname CONTAINS "tech-icloud.com" OR destinationhostname CONTAINS "threat-coinbase.com" OR destinationhostname CONTAINS "ticket-apple.com" OR destinationhostname CONTAINS "ticket-coinbase.com" OR destinationhostname CONTAINS "tickets-apple.com" OR destinationhostname CONTAINS "tokens-coinbase.com" OR destinationhostname CONTAINS "unblock-coinbase.com" OR destinationhostname CONTAINS "unlink-coinbase.com" OR destinationhostname CONTAINS "your-coinbase.com" OR destinationhostname CONTAINS "welcome-coinbase.com" OR destinationhostname CONTAINS "www-coinbasewallet.com" OR destinationhostname CONTAINS "www-help-coinbase.com" OR destinationhostname CONTAINS "www-help-gemini.com")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "helpdesk-apple.com" OR sourcentdomain CONTAINS "helpdesk-gemini.com" OR sourcentdomain CONTAINS "helpdesk-icloud.com" OR sourcentdomain CONTAINS "identification-coinbase.com" OR sourcentdomain CONTAINS "lockdown-coinbase.com" OR sourcentdomain CONTAINS "login-nexo.com" OR sourcentdomain CONTAINS "keys-coinbase.com" OR sourcentdomain CONTAINS "messages-coinbase.com" OR sourcentdomain CONTAINS "newpassword-coinbase.com" OR sourcentdomain CONTAINS "prompt-coinbase.com" OR sourcentdomain CONTAINS "protect-apple.com" OR sourcentdomain CONTAINS "protect-coinbase.com" OR sourcentdomain CONTAINS "protect-gmail.com" OR sourcentdomain CONTAINS "protect-kraken.com" OR sourcentdomain CONTAINS "recoverme-coinbase.com" OR sourcentdomain CONTAINS "recoveryportal-coinbase.com" OR sourcentdomain CONTAINS "refunds-coinbase.com" OR sourcentdomain CONTAINS "reset-okta.com" OR sourcentdomain CONTAINS "restore-coinbase.com" OR sourcentdomain CONTAINS "return-coinbase.com" OR sourcentdomain CONTAINS "reverts-coinbase.com" OR sourcentdomain CONTAINS "secure-binance.us" OR sourcentdomain CONTAINS "secure-icloud.com" OR sourcentdomain CONTAINS "secure-nexo.com" OR sourcentdomain CONTAINS "secure-shakepay.com" OR sourcentdomain CONTAINS "security-umusic.com" OR sourcentdomain CONTAINS "server694590423.tech" OR sourcentdomain CONTAINS "session-coinbase.com" OR sourcentdomain CONTAINS "startrecovery-coinbase.com" OR sourcentdomain CONTAINS "signin-kraken.com" OR sourcentdomain CONTAINS "suite-trezor.io" OR sourcentdomain CONTAINS "supportportal-coinbase.com" OR sourcentdomain CONTAINS "tech-icloud.com" OR sourcentdomain CONTAINS "threat-coinbase.com" OR sourcentdomain CONTAINS "ticket-apple.com" OR sourcentdomain CONTAINS "ticket-coinbase.com" OR sourcentdomain CONTAINS "tickets-apple.com" OR sourcentdomain CONTAINS "tokens-coinbase.com" OR sourcentdomain CONTAINS "unblock-coinbase.com" OR sourcentdomain CONTAINS "unlink-coinbase.com" OR sourcentdomain CONTAINS "your-coinbase.com" OR sourcentdomain CONTAINS "welcome-coinbase.com" OR sourcentdomain CONTAINS "www-coinbasewallet.com" OR sourcentdomain CONTAINS "www-help-coinbase.com" OR sourcentdomain CONTAINS "www-help-gemini.com")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "helpdesk-apple.com" OR sourcehostname CONTAINS "helpdesk-gemini.com" OR sourcehostname CONTAINS "helpdesk-icloud.com" OR sourcehostname CONTAINS "identification-coinbase.com" OR sourcehostname CONTAINS "lockdown-coinbase.com" OR sourcehostname CONTAINS "login-nexo.com" OR sourcehostname CONTAINS "keys-coinbase.com" OR sourcehostname CONTAINS "messages-coinbase.com" OR sourcehostname CONTAINS "newpassword-coinbase.com" OR sourcehostname CONTAINS "prompt-coinbase.com" OR sourcehostname CONTAINS "protect-apple.com" OR sourcehostname CONTAINS "protect-coinbase.com" OR sourcehostname CONTAINS "protect-gmail.com" OR sourcehostname CONTAINS "protect-kraken.com" OR sourcehostname CONTAINS "recoverme-coinbase.com" OR sourcehostname CONTAINS "recoveryportal-coinbase.com" OR sourcehostname CONTAINS "refunds-coinbase.com" OR sourcehostname CONTAINS "reset-okta.com" OR sourcehostname CONTAINS "restore-coinbase.com" OR sourcehostname CONTAINS "return-coinbase.com" OR sourcehostname CONTAINS "reverts-coinbase.com" OR sourcehostname CONTAINS "secure-binance.us" OR sourcehostname CONTAINS "secure-icloud.com" OR sourcehostname CONTAINS "secure-nexo.com" OR sourcehostname CONTAINS "secure-shakepay.com" OR sourcehostname CONTAINS "security-umusic.com" OR sourcehostname CONTAINS "server694590423.tech" OR sourcehostname CONTAINS "session-coinbase.com" OR sourcehostname CONTAINS "startrecovery-coinbase.com" OR sourcehostname CONTAINS "signin-kraken.com" OR sourcehostname CONTAINS "suite-trezor.io" OR sourcehostname CONTAINS "supportportal-coinbase.com" OR sourcehostname CONTAINS "tech-icloud.com" OR sourcehostname CONTAINS "threat-coinbase.com" OR sourcehostname CONTAINS "ticket-apple.com" OR sourcehostname CONTAINS "ticket-coinbase.com" OR sourcehostname CONTAINS "tickets-apple.com" OR sourcehostname CONTAINS "tokens-coinbase.com" OR sourcehostname CONTAINS "unblock-coinbase.com" OR sourcehostname CONTAINS "unlink-coinbase.com" OR sourcehostname CONTAINS "your-coinbase.com" OR sourcehostname CONTAINS "welcome-coinbase.com" OR sourcehostname CONTAINS "www-coinbasewallet.com" OR sourcehostname CONTAINS "www-help-coinbase.com" OR sourcehostname CONTAINS "www-help-gemini.com")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "helpdesk-apple.com" OR destinationntdomain CONTAINS "helpdesk-gemini.com" OR destinationntdomain CONTAINS "helpdesk-icloud.com" OR destinationntdomain CONTAINS "identification-coinbase.com" OR destinationntdomain CONTAINS "lockdown-coinbase.com" OR destinationntdomain CONTAINS "login-nexo.com" OR destinationntdomain CONTAINS "keys-coinbase.com" OR destinationntdomain CONTAINS "messages-coinbase.com" OR destinationntdomain CONTAINS "newpassword-coinbase.com" OR destinationntdomain CONTAINS "prompt-coinbase.com" OR destinationntdomain CONTAINS "protect-apple.com" OR destinationntdomain CONTAINS "protect-coinbase.com" OR destinationntdomain CONTAINS "protect-gmail.com" OR destinationntdomain CONTAINS "protect-kraken.com" OR destinationntdomain CONTAINS "recoverme-coinbase.com" OR destinationntdomain CONTAINS "recoveryportal-coinbase.com" OR destinationntdomain CONTAINS "refunds-coinbase.com" OR destinationntdomain CONTAINS "reset-okta.com" OR destinationntdomain CONTAINS "restore-coinbase.com" OR destinationntdomain CONTAINS "return-coinbase.com" OR destinationntdomain CONTAINS "reverts-coinbase.com" OR destinationntdomain CONTAINS "secure-binance.us" OR destinationntdomain CONTAINS "secure-icloud.com" OR destinationntdomain CONTAINS "secure-nexo.com" OR destinationntdomain CONTAINS "secure-shakepay.com" OR destinationntdomain CONTAINS "security-umusic.com" OR destinationntdomain CONTAINS "server694590423.tech" OR destinationntdomain CONTAINS "session-coinbase.com" OR destinationntdomain CONTAINS "startrecovery-coinbase.com" OR destinationntdomain CONTAINS "signin-kraken.com" OR destinationntdomain CONTAINS "suite-trezor.io" OR destinationntdomain CONTAINS "supportportal-coinbase.com" OR destinationntdomain CONTAINS "tech-icloud.com" OR destinationntdomain CONTAINS "threat-coinbase.com" OR destinationntdomain CONTAINS "ticket-apple.com" OR destinationntdomain CONTAINS "ticket-coinbase.com" OR destinationntdomain CONTAINS "tickets-apple.com" OR destinationntdomain CONTAINS "tokens-coinbase.com" OR destinationntdomain CONTAINS "unblock-coinbase.com" OR destinationntdomain CONTAINS "unlink-coinbase.com" OR destinationntdomain CONTAINS "your-coinbase.com" OR destinationntdomain CONTAINS "welcome-coinbase.com" OR destinationntdomain CONTAINS "www-coinbasewallet.com" OR destinationntdomain CONTAINS "www-help-coinbase.com" OR destinationntdomain CONTAINS "www-help-gemini.com")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND requesturl NOT NULL AND (requesturl CONTAINS "helpdesk-apple.com" OR requesturl CONTAINS "helpdesk-gemini.com" OR requesturl CONTAINS "helpdesk-icloud.com" OR requesturl CONTAINS "identification-coinbase.com" OR requesturl CONTAINS "lockdown-coinbase.com" OR requesturl CONTAINS "login-nexo.com" OR requesturl CONTAINS "keys-coinbase.com" OR requesturl CONTAINS "messages-coinbase.com" OR requesturl CONTAINS "newpassword-coinbase.com" OR requesturl CONTAINS "prompt-coinbase.com" OR requesturl CONTAINS "protect-apple.com" OR requesturl CONTAINS "protect-coinbase.com" OR requesturl CONTAINS "protect-gmail.com" OR requesturl CONTAINS "protect-kraken.com" OR requesturl CONTAINS "recoverme-coinbase.com" OR requesturl CONTAINS "recoveryportal-coinbase.com" OR requesturl CONTAINS "refunds-coinbase.com" OR requesturl CONTAINS "reset-okta.com" OR requesturl CONTAINS "restore-coinbase.com" OR requesturl CONTAINS "return-coinbase.com" OR requesturl CONTAINS "reverts-coinbase.com" OR requesturl CONTAINS "secure-binance.us" OR requesturl CONTAINS "secure-icloud.com" OR requesturl CONTAINS "secure-nexo.com" OR requesturl CONTAINS "secure-shakepay.com" OR requesturl CONTAINS "security-umusic.com" OR requesturl CONTAINS "server694590423.tech" OR requesturl CONTAINS "session-coinbase.com" OR requesturl CONTAINS "startrecovery-coinbase.com" OR requesturl CONTAINS "signin-kraken.com" OR requesturl CONTAINS "suite-trezor.io" OR requesturl CONTAINS "supportportal-coinbase.com" OR requesturl CONTAINS "tech-icloud.com" OR requesturl CONTAINS "threat-coinbase.com" OR requesturl CONTAINS "ticket-apple.com" OR requesturl CONTAINS "ticket-coinbase.com" OR requesturl CONTAINS "tickets-apple.com" OR requesturl CONTAINS "tokens-coinbase.com" OR requesturl CONTAINS "unblock-coinbase.com" OR requesturl CONTAINS "unlink-coinbase.com" OR requesturl CONTAINS "your-coinbase.com" OR requesturl CONTAINS "welcome-coinbase.com" OR requesturl CONTAINS "www-coinbasewallet.com" OR requesturl CONTAINS "www-help-coinbase.com" OR requesturl CONTAINS "www-help-gemini.com")
index=activity AND rg_functionality="Web Application Firewall" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "official-server.com" OR destinationhostname CONTAINS "server694590423.tech" OR destinationhostname CONTAINS "island-placid-bromine.glitch.me" OR destinationhostname CONTAINS "circular-noon-farmhouse.glitch.me" OR destinationhostname CONTAINS "talented-friendly-price.glitch.me" OR destinationhostname CONTAINS "dflfmgsdokasdcpl.com" OR destinationhostname CONTAINS "original-backend.com" OR destinationhostname CONTAINS "07159889-coinbase.com" OR destinationhostname CONTAINS "10195-coinbase.com" OR destinationhostname CONTAINS "11246-coinbase.com" OR destinationhostname CONTAINS "11247-coinbase.com" OR destinationhostname CONTAINS "11248-coinbase.com" OR destinationhostname CONTAINS "11258-coinbase.com" OR destinationhostname CONTAINS "11259-coinbase.com" OR destinationhostname CONTAINS "113912-coinbase.com" OR destinationhostname CONTAINS "11472-coinbase.com" OR destinationhostname CONTAINS "11923-coinbase.com" OR destinationhostname CONTAINS "11957-coinbase.com" OR destinationhostname CONTAINS "128147-coinbase.com" OR destinationhostname CONTAINS "12958-coinbase.com" OR destinationhostname CONTAINS "12984-okta.com" OR destinationhostname CONTAINS "12985-coinbase.com" OR destinationhostname CONTAINS "13130-coinbase.com" OR destinationhostname CONTAINS "13247-coinbase.com" OR destinationhostname CONTAINS "13247-icloud.com" OR destinationhostname CONTAINS "13267-coinbase.com" OR destinationhostname CONTAINS "146271510-coinbase.com" OR destinationhostname CONTAINS "146282-coinbase.com" OR destinationhostname CONTAINS "146284-coinbase.com" OR destinationhostname CONTAINS "147260-coinbase.com" OR destinationhostname CONTAINS "14765-coinbase.com" OR destinationhostname CONTAINS "14817582-coinbase.com" OR destinationhostname CONTAINS "14871904-coinbase.com" OR destinationhostname CONTAINS "14891902-coinbase.com" OR destinationhostname CONTAINS "1492864-coinbase.com" OR destinationhostname CONTAINS "158312-coinbase.com" OR destinationhostname CONTAINS "158372-coinbase.com" OR destinationhostname CONTAINS "158702-coinbase.com" OR destinationhostname CONTAINS "16171675-coinbase.com" OR destinationhostname CONTAINS "16171832-coinbase.com" OR destinationhostname CONTAINS "16178234-coinbase.com" OR destinationhostname CONTAINS "16178237-coinbase.com" OR destinationhostname CONTAINS "16178434-coinbase.com" OR destinationhostname CONTAINS "162178-coinbase.com" OR destinationhostname CONTAINS "162478-coinbase.com" OR destinationhostname CONTAINS "162782-coinbase.com" OR destinationhostname CONTAINS "162812-coinbase.com" OR destinationhostname CONTAINS "162814-coinbase.com" OR destinationhostname CONTAINS "16442580-coinbase.com" OR destinationhostname CONTAINS "16450107-coinbase.com")
index=activity AND rg_functionality="Web Application Firewall" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "official-server.com" OR sourcentdomain CONTAINS "server694590423.tech" OR sourcentdomain CONTAINS "island-placid-bromine.glitch.me" OR sourcentdomain CONTAINS "circular-noon-farmhouse.glitch.me" OR sourcentdomain CONTAINS "talented-friendly-price.glitch.me" OR sourcentdomain CONTAINS "dflfmgsdokasdcpl.com" OR sourcentdomain CONTAINS "original-backend.com" OR sourcentdomain CONTAINS "07159889-coinbase.com" OR sourcentdomain CONTAINS "10195-coinbase.com" OR sourcentdomain CONTAINS "11246-coinbase.com" OR sourcentdomain CONTAINS "11247-coinbase.com" OR sourcentdomain CONTAINS "11248-coinbase.com" OR sourcentdomain CONTAINS "11258-coinbase.com" OR sourcentdomain CONTAINS "11259-coinbase.com" OR sourcentdomain CONTAINS "113912-coinbase.com" OR sourcentdomain CONTAINS "11472-coinbase.com" OR sourcentdomain CONTAINS "11923-coinbase.com" OR sourcentdomain CONTAINS "11957-coinbase.com" OR sourcentdomain CONTAINS "128147-coinbase.com" OR sourcentdomain CONTAINS "12958-coinbase.com" OR sourcentdomain CONTAINS "12984-okta.com" OR sourcentdomain CONTAINS "12985-coinbase.com" OR sourcentdomain CONTAINS "13130-coinbase.com" OR sourcentdomain CONTAINS "13247-coinbase.com" OR sourcentdomain CONTAINS "13247-icloud.com" OR sourcentdomain CONTAINS "13267-coinbase.com" OR sourcentdomain CONTAINS "146271510-coinbase.com" OR sourcentdomain CONTAINS "146282-coinbase.com" OR sourcentdomain CONTAINS "146284-coinbase.com" OR sourcentdomain CONTAINS "147260-coinbase.com" OR sourcentdomain CONTAINS "14765-coinbase.com" OR sourcentdomain CONTAINS "14817582-coinbase.com" OR sourcentdomain CONTAINS "14871904-coinbase.com" OR sourcentdomain CONTAINS "14891902-coinbase.com" OR sourcentdomain CONTAINS "1492864-coinbase.com" OR sourcentdomain CONTAINS "158312-coinbase.com" OR sourcentdomain CONTAINS "158372-coinbase.com" OR sourcentdomain CONTAINS "158702-coinbase.com" OR sourcentdomain CONTAINS "16171675-coinbase.com" OR sourcentdomain CONTAINS "16171832-coinbase.com" OR sourcentdomain CONTAINS "16178234-coinbase.com" OR sourcentdomain CONTAINS "16178237-coinbase.com" OR sourcentdomain CONTAINS "16178434-coinbase.com" OR sourcentdomain CONTAINS "162178-coinbase.com" OR sourcentdomain CONTAINS "162478-coinbase.com" OR sourcentdomain CONTAINS "162782-coinbase.com" OR sourcentdomain CONTAINS "162812-coinbase.com" OR sourcentdomain CONTAINS "162814-coinbase.com" OR sourcentdomain CONTAINS "16442580-coinbase.com" OR sourcentdomain CONTAINS "16450107-coinbase.com")
index=activity AND rg_functionality="Web Application Firewall" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "official-server.com" OR sourcehostname CONTAINS "server694590423.tech" OR sourcehostname CONTAINS "island-placid-bromine.glitch.me" OR sourcehostname CONTAINS "circular-noon-farmhouse.glitch.me" OR sourcehostname CONTAINS "talented-friendly-price.glitch.me" OR sourcehostname CONTAINS "dflfmgsdokasdcpl.com" OR sourcehostname CONTAINS "original-backend.com" OR sourcehostname CONTAINS "07159889-coinbase.com" OR sourcehostname CONTAINS "10195-coinbase.com" OR sourcehostname CONTAINS "11246-coinbase.com" OR sourcehostname CONTAINS "11247-coinbase.com" OR sourcehostname CONTAINS "11248-coinbase.com" OR sourcehostname CONTAINS "11258-coinbase.com" OR sourcehostname CONTAINS "11259-coinbase.com" OR sourcehostname CONTAINS "113912-coinbase.com" OR sourcehostname CONTAINS "11472-coinbase.com" OR sourcehostname CONTAINS "11923-coinbase.com" OR sourcehostname CONTAINS "11957-coinbase.com" OR sourcehostname CONTAINS "128147-coinbase.com" OR sourcehostname CONTAINS "12958-coinbase.com" OR sourcehostname CONTAINS "12984-okta.com" OR sourcehostname CONTAINS "12985-coinbase.com" OR sourcehostname CONTAINS "13130-coinbase.com" OR sourcehostname CONTAINS "13247-coinbase.com" OR sourcehostname CONTAINS "13247-icloud.com" OR sourcehostname CONTAINS "13267-coinbase.com" OR sourcehostname CONTAINS "146271510-coinbase.com" OR sourcehostname CONTAINS "146282-coinbase.com" OR sourcehostname CONTAINS "146284-coinbase.com" OR sourcehostname CONTAINS "147260-coinbase.com" OR sourcehostname CONTAINS "14765-coinbase.com" OR sourcehostname CONTAINS "14817582-coinbase.com" OR sourcehostname CONTAINS "14871904-coinbase.com" OR sourcehostname CONTAINS "14891902-coinbase.com" OR sourcehostname CONTAINS "1492864-coinbase.com" OR sourcehostname CONTAINS "158312-coinbase.com" OR sourcehostname CONTAINS "158372-coinbase.com" OR sourcehostname CONTAINS "158702-coinbase.com" OR sourcehostname CONTAINS "16171675-coinbase.com" OR sourcehostname CONTAINS "16171832-coinbase.com" OR sourcehostname CONTAINS "16178234-coinbase.com" OR sourcehostname CONTAINS "16178237-coinbase.com" OR sourcehostname CONTAINS "16178434-coinbase.com" OR sourcehostname CONTAINS "162178-coinbase.com" OR sourcehostname CONTAINS "162478-coinbase.com" OR sourcehostname CONTAINS "162782-coinbase.com" OR sourcehostname CONTAINS "162812-coinbase.com" OR sourcehostname CONTAINS "162814-coinbase.com" OR sourcehostname CONTAINS "16442580-coinbase.com" OR sourcehostname CONTAINS "16450107-coinbase.com")
index=activity AND rg_functionality="Web Application Firewall" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "official-server.com" OR destinationntdomain CONTAINS "server694590423.tech" OR destinationntdomain CONTAINS "island-placid-bromine.glitch.me" OR destinationntdomain CONTAINS "circular-noon-farmhouse.glitch.me" OR destinationntdomain CONTAINS "talented-friendly-price.glitch.me" OR destinationntdomain CONTAINS "dflfmgsdokasdcpl.com" OR destinationntdomain CONTAINS "original-backend.com" OR destinationntdomain CONTAINS "07159889-coinbase.com" OR destinationntdomain CONTAINS "10195-coinbase.com" OR destinationntdomain CONTAINS "11246-coinbase.com" OR destinationntdomain CONTAINS "11247-coinbase.com" OR destinationntdomain CONTAINS "11248-coinbase.com" OR destinationntdomain CONTAINS "11258-coinbase.com" OR destinationntdomain CONTAINS "11259-coinbase.com" OR destinationntdomain CONTAINS "113912-coinbase.com" OR destinationntdomain CONTAINS "11472-coinbase.com" OR destinationntdomain CONTAINS "11923-coinbase.com" OR destinationntdomain CONTAINS "11957-coinbase.com" OR destinationntdomain CONTAINS "128147-coinbase.com" OR destinationntdomain CONTAINS "12958-coinbase.com" OR destinationntdomain CONTAINS "12984-okta.com" OR destinationntdomain CONTAINS "12985-coinbase.com" OR destinationntdomain CONTAINS "13130-coinbase.com" OR destinationntdomain CONTAINS "13247-coinbase.com" OR destinationntdomain CONTAINS "13247-icloud.com" OR destinationntdomain CONTAINS "13267-coinbase.com" OR destinationntdomain CONTAINS "146271510-coinbase.com" OR destinationntdomain CONTAINS "146282-coinbase.com" OR destinationntdomain CONTAINS "146284-coinbase.com" OR destinationntdomain CONTAINS "147260-coinbase.com" OR destinationntdomain CONTAINS "14765-coinbase.com" OR destinationntdomain CONTAINS "14817582-coinbase.com" OR destinationntdomain CONTAINS "14871904-coinbase.com" OR destinationntdomain CONTAINS "14891902-coinbase.com" OR destinationntdomain CONTAINS "1492864-coinbase.com" OR destinationntdomain CONTAINS "158312-coinbase.com" OR destinationntdomain CONTAINS "158372-coinbase.com" OR destinationntdomain CONTAINS "158702-coinbase.com" OR destinationntdomain CONTAINS "16171675-coinbase.com" OR destinationntdomain CONTAINS "16171832-coinbase.com" OR destinationntdomain CONTAINS "16178234-coinbase.com" OR destinationntdomain CONTAINS "16178237-coinbase.com" OR destinationntdomain CONTAINS "16178434-coinbase.com" OR destinationntdomain CONTAINS "162178-coinbase.com" OR destinationntdomain CONTAINS "162478-coinbase.com" OR destinationntdomain CONTAINS "162782-coinbase.com" OR destinationntdomain CONTAINS "162812-coinbase.com" OR destinationntdomain CONTAINS "162814-coinbase.com" OR destinationntdomain CONTAINS "16442580-coinbase.com" OR destinationntdomain CONTAINS "16450107-coinbase.com")
index=activity AND rg_functionality="Web Application Firewall" AND requesturl NOT NULL AND (requesturl CONTAINS "official-server.com" OR requesturl CONTAINS "server694590423.tech" OR requesturl CONTAINS "island-placid-bromine.glitch.me" OR requesturl CONTAINS "circular-noon-farmhouse.glitch.me" OR requesturl CONTAINS "talented-friendly-price.glitch.me" OR requesturl CONTAINS "dflfmgsdokasdcpl.com" OR requesturl CONTAINS "original-backend.com" OR requesturl CONTAINS "07159889-coinbase.com" OR requesturl CONTAINS "10195-coinbase.com" OR requesturl CONTAINS "11246-coinbase.com" OR requesturl CONTAINS "11247-coinbase.com" OR requesturl CONTAINS "11248-coinbase.com" OR requesturl CONTAINS "11258-coinbase.com" OR requesturl CONTAINS "11259-coinbase.com" OR requesturl CONTAINS "113912-coinbase.com" OR requesturl CONTAINS "11472-coinbase.com" OR requesturl CONTAINS "11923-coinbase.com" OR requesturl CONTAINS "11957-coinbase.com" OR requesturl CONTAINS "128147-coinbase.com" OR requesturl CONTAINS "12958-coinbase.com" OR requesturl CONTAINS "12984-okta.com" OR requesturl CONTAINS "12985-coinbase.com" OR requesturl CONTAINS "13130-coinbase.com" OR requesturl CONTAINS "13247-coinbase.com" OR requesturl CONTAINS "13247-icloud.com" OR requesturl CONTAINS "13267-coinbase.com" OR requesturl CONTAINS "146271510-coinbase.com" OR requesturl CONTAINS "146282-coinbase.com" OR requesturl CONTAINS "146284-coinbase.com" OR requesturl CONTAINS "147260-coinbase.com" OR requesturl CONTAINS "14765-coinbase.com" OR requesturl CONTAINS "14817582-coinbase.com" OR requesturl CONTAINS "14871904-coinbase.com" OR requesturl CONTAINS "14891902-coinbase.com" OR requesturl CONTAINS "1492864-coinbase.com" OR requesturl CONTAINS "158312-coinbase.com" OR requesturl CONTAINS "158372-coinbase.com" OR requesturl CONTAINS "158702-coinbase.com" OR requesturl CONTAINS "16171675-coinbase.com" OR requesturl CONTAINS "16171832-coinbase.com" OR requesturl CONTAINS "16178234-coinbase.com" OR requesturl CONTAINS "16178237-coinbase.com" OR requesturl CONTAINS "16178434-coinbase.com" OR requesturl CONTAINS "162178-coinbase.com" OR requesturl CONTAINS "162478-coinbase.com" OR requesturl CONTAINS "162782-coinbase.com" OR requesturl CONTAINS "162812-coinbase.com" OR requesturl CONTAINS "162814-coinbase.com" OR requesturl CONTAINS "16442580-coinbase.com" OR requesturl CONTAINS "16450107-coinbase.com")
index=activity AND rg_functionality="Web Application Firewall" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "16450207-coinbase.com" OR destinationhostname CONTAINS "16458207-coinbase.com" OR destinationhostname CONTAINS "16478202-coinbase.com" OR destinationhostname CONTAINS "164872942-coinbase.com" OR destinationhostname CONTAINS "16590-coinbase.com" OR destinationhostname CONTAINS "16594373-coinbase.com" OR destinationhostname CONTAINS "16624831-coinbase.com" OR destinationhostname CONTAINS "16642124-coinbase.com" OR destinationhostname CONTAINS "16642172-coinbase.com" OR destinationhostname CONTAINS "16642580-coinbase.com" OR destinationhostname CONTAINS "16642721-coinbase.com" OR destinationhostname CONTAINS "16642724-coinbase.com" OR destinationhostname CONTAINS "16642871-coinbase.com" OR destinationhostname CONTAINS "16642872-coinbase.com" OR destinationhostname CONTAINS "16712942-coinbase.com" OR destinationhostname CONTAINS "16718672-coinbase.com" OR destinationhostname CONTAINS "16728342-coinbase.com" OR destinationhostname CONTAINS "16728348-coinbase.com" OR destinationhostname CONTAINS "16728442-coinbase.com" OR destinationhostname CONTAINS "16728472-coinbase.com" OR destinationhostname CONTAINS "167285-coinbase.com" OR destinationhostname CONTAINS "16729042-coinbase.com" OR destinationhostname CONTAINS "16748272-coinbase.com" OR destinationhostname CONTAINS "16782942-coinbase.com" OR destinationhostname CONTAINS "16827420-coinbase.com" OR destinationhostname CONTAINS "16827423-coinbase.com" OR destinationhostname CONTAINS "16847145-coinbase.com" OR destinationhostname CONTAINS "16893924-coinbase.com" OR destinationhostname CONTAINS "17182-coinbase.com" OR destinationhostname CONTAINS "17255030-coinbase.com" OR destinationhostname CONTAINS "17259-kraken.com" OR destinationhostname CONTAINS "172486-coinbase.com" OR destinationhostname CONTAINS "17284652-coinbase.com" OR destinationhostname CONTAINS "17286-coinbase.com" OR destinationhostname CONTAINS "17334522-coinbase.com" OR destinationhostname CONTAINS "17334522-kraken.com" OR destinationhostname CONTAINS "17384522-coinbase.com" OR destinationhostname CONTAINS "173912-coinbase.com" OR destinationhostname CONTAINS "17494976-coinbase.com" OR destinationhostname CONTAINS "17512854-coinbase.com" OR destinationhostname CONTAINS "17512857-coinbase.com" OR destinationhostname CONTAINS "1751954-coinbase.com" OR destinationhostname CONTAINS "17525030-coinbase.com" OR destinationhostname CONTAINS "17529580-coinbase.com" OR destinationhostname CONTAINS "17614-coinbase.com" OR destinationhostname CONTAINS "17618412-coinbase.com" OR destinationhostname CONTAINS "17619-coinbase.com" OR destinationhostname CONTAINS "176284-coinbase.com" OR destinationhostname CONTAINS "17823920-coinbase.com" OR destinationhostname CONTAINS "178253-coinbase.com")
index=activity AND rg_functionality="Web Application Firewall" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "16450207-coinbase.com" OR sourcentdomain CONTAINS "16458207-coinbase.com" OR sourcentdomain CONTAINS "16478202-coinbase.com" OR sourcentdomain CONTAINS "164872942-coinbase.com" OR sourcentdomain CONTAINS "16590-coinbase.com" OR sourcentdomain CONTAINS "16594373-coinbase.com" OR sourcentdomain CONTAINS "16624831-coinbase.com" OR sourcentdomain CONTAINS "16642124-coinbase.com" OR sourcentdomain CONTAINS "16642172-coinbase.com" OR sourcentdomain CONTAINS "16642580-coinbase.com" OR sourcentdomain CONTAINS "16642721-coinbase.com" OR sourcentdomain CONTAINS "16642724-coinbase.com" OR sourcentdomain CONTAINS "16642871-coinbase.com" OR sourcentdomain CONTAINS "16642872-coinbase.com" OR sourcentdomain CONTAINS "16712942-coinbase.com" OR sourcentdomain CONTAINS "16718672-coinbase.com" OR sourcentdomain CONTAINS "16728342-coinbase.com" OR sourcentdomain CONTAINS "16728348-coinbase.com" OR sourcentdomain CONTAINS "16728442-coinbase.com" OR sourcentdomain CONTAINS "16728472-coinbase.com" OR sourcentdomain CONTAINS "167285-coinbase.com" OR sourcentdomain CONTAINS "16729042-coinbase.com" OR sourcentdomain CONTAINS "16748272-coinbase.com" OR sourcentdomain CONTAINS "16782942-coinbase.com" OR sourcentdomain CONTAINS "16827420-coinbase.com" OR sourcentdomain CONTAINS "16827423-coinbase.com" OR sourcentdomain CONTAINS "16847145-coinbase.com" OR sourcentdomain CONTAINS "16893924-coinbase.com" OR sourcentdomain CONTAINS "17182-coinbase.com" OR sourcentdomain CONTAINS "17255030-coinbase.com" OR sourcentdomain CONTAINS "17259-kraken.com" OR sourcentdomain CONTAINS "172486-coinbase.com" OR sourcentdomain CONTAINS "17284652-coinbase.com" OR sourcentdomain CONTAINS "17286-coinbase.com" OR sourcentdomain CONTAINS "17334522-coinbase.com" OR sourcentdomain CONTAINS "17334522-kraken.com" OR sourcentdomain CONTAINS "17384522-coinbase.com" OR sourcentdomain CONTAINS "173912-coinbase.com" OR sourcentdomain CONTAINS "17494976-coinbase.com" OR sourcentdomain CONTAINS "17512854-coinbase.com" OR sourcentdomain CONTAINS "17512857-coinbase.com" OR sourcentdomain CONTAINS "1751954-coinbase.com" OR sourcentdomain CONTAINS "17525030-coinbase.com" OR sourcentdomain CONTAINS "17529580-coinbase.com" OR sourcentdomain CONTAINS "17614-coinbase.com" OR sourcentdomain CONTAINS "17618412-coinbase.com" OR sourcentdomain CONTAINS "17619-coinbase.com" OR sourcentdomain CONTAINS "176284-coinbase.com" OR sourcentdomain CONTAINS "17823920-coinbase.com" OR sourcentdomain CONTAINS "178253-coinbase.com")
index=activity AND rg_functionality="Web Application Firewall" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "16450207-coinbase.com" OR sourcehostname CONTAINS "16458207-coinbase.com" OR sourcehostname CONTAINS "16478202-coinbase.com" OR sourcehostname CONTAINS "164872942-coinbase.com" OR sourcehostname CONTAINS "16590-coinbase.com" OR sourcehostname CONTAINS "16594373-coinbase.com" OR sourcehostname CONTAINS "16624831-coinbase.com" OR sourcehostname CONTAINS "16642124-coinbase.com" OR sourcehostname CONTAINS "16642172-coinbase.com" OR sourcehostname CONTAINS "16642580-coinbase.com" OR sourcehostname CONTAINS "16642721-coinbase.com" OR sourcehostname CONTAINS "16642724-coinbase.com" OR sourcehostname CONTAINS "16642871-coinbase.com" OR sourcehostname CONTAINS "16642872-coinbase.com" OR sourcehostname CONTAINS "16712942-coinbase.com" OR sourcehostname CONTAINS "16718672-coinbase.com" OR sourcehostname CONTAINS "16728342-coinbase.com" OR sourcehostname CONTAINS "16728348-coinbase.com" OR sourcehostname CONTAINS "16728442-coinbase.com" OR sourcehostname CONTAINS "16728472-coinbase.com" OR sourcehostname CONTAINS "167285-coinbase.com" OR sourcehostname CONTAINS "16729042-coinbase.com" OR sourcehostname CONTAINS "16748272-coinbase.com" OR sourcehostname CONTAINS "16782942-coinbase.com" OR sourcehostname CONTAINS "16827420-coinbase.com" OR sourcehostname CONTAINS "16827423-coinbase.com" OR sourcehostname CONTAINS "16847145-coinbase.com" OR sourcehostname CONTAINS "16893924-coinbase.com" OR sourcehostname CONTAINS "17182-coinbase.com" OR sourcehostname CONTAINS "17255030-coinbase.com" OR sourcehostname CONTAINS "17259-kraken.com" OR sourcehostname CONTAINS "172486-coinbase.com" OR sourcehostname CONTAINS "17284652-coinbase.com" OR sourcehostname CONTAINS "17286-coinbase.com" OR sourcehostname CONTAINS "17334522-coinbase.com" OR sourcehostname CONTAINS "17334522-kraken.com" OR sourcehostname CONTAINS "17384522-coinbase.com" OR sourcehostname CONTAINS "173912-coinbase.com" OR sourcehostname CONTAINS "17494976-coinbase.com" OR sourcehostname CONTAINS "17512854-coinbase.com" OR sourcehostname CONTAINS "17512857-coinbase.com" OR sourcehostname CONTAINS "1751954-coinbase.com" OR sourcehostname CONTAINS "17525030-coinbase.com" OR sourcehostname CONTAINS "17529580-coinbase.com" OR sourcehostname CONTAINS "17614-coinbase.com" OR sourcehostname CONTAINS "17618412-coinbase.com" OR sourcehostname CONTAINS "17619-coinbase.com" OR sourcehostname CONTAINS "176284-coinbase.com" OR sourcehostname CONTAINS "17823920-coinbase.com" OR sourcehostname CONTAINS "178253-coinbase.com")
index=activity AND rg_functionality="Web Application Firewall" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "16450207-coinbase.com" OR destinationntdomain CONTAINS "16458207-coinbase.com" OR destinationntdomain CONTAINS "16478202-coinbase.com" OR destinationntdomain CONTAINS "164872942-coinbase.com" OR destinationntdomain CONTAINS "16590-coinbase.com" OR destinationntdomain CONTAINS "16594373-coinbase.com" OR destinationntdomain CONTAINS "16624831-coinbase.com" OR destinationntdomain CONTAINS "16642124-coinbase.com" OR destinationntdomain CONTAINS "16642172-coinbase.com" OR destinationntdomain CONTAINS "16642580-coinbase.com" OR destinationntdomain CONTAINS "16642721-coinbase.com" OR destinationntdomain CONTAINS "16642724-coinbase.com" OR destinationntdomain CONTAINS "16642871-coinbase.com" OR destinationntdomain CONTAINS "16642872-coinbase.com" OR destinationntdomain CONTAINS "16712942-coinbase.com" OR destinationntdomain CONTAINS "16718672-coinbase.com" OR destinationntdomain CONTAINS "16728342-coinbase.com" OR destinationntdomain CONTAINS "16728348-coinbase.com" OR destinationntdomain CONTAINS "16728442-coinbase.com" OR destinationntdomain CONTAINS "16728472-coinbase.com" OR destinationntdomain CONTAINS "167285-coinbase.com" OR destinationntdomain CONTAINS "16729042-coinbase.com" OR destinationntdomain CONTAINS "16748272-coinbase.com" OR destinationntdomain CONTAINS "16782942-coinbase.com" OR destinationntdomain CONTAINS "16827420-coinbase.com" OR destinationntdomain CONTAINS "16827423-coinbase.com" OR destinationntdomain CONTAINS "16847145-coinbase.com" OR destinationntdomain CONTAINS "16893924-coinbase.com" OR destinationntdomain CONTAINS "17182-coinbase.com" OR destinationntdomain CONTAINS "17255030-coinbase.com" OR destinationntdomain CONTAINS "17259-kraken.com" OR destinationntdomain CONTAINS "172486-coinbase.com" OR destinationntdomain CONTAINS "17284652-coinbase.com" OR destinationntdomain CONTAINS "17286-coinbase.com" OR destinationntdomain CONTAINS "17334522-coinbase.com" OR destinationntdomain CONTAINS "17334522-kraken.com" OR destinationntdomain CONTAINS "17384522-coinbase.com" OR destinationntdomain CONTAINS "173912-coinbase.com" OR destinationntdomain CONTAINS "17494976-coinbase.com" OR destinationntdomain CONTAINS "17512854-coinbase.com" OR destinationntdomain CONTAINS "17512857-coinbase.com" OR destinationntdomain CONTAINS "1751954-coinbase.com" OR destinationntdomain CONTAINS "17525030-coinbase.com" OR destinationntdomain CONTAINS "17529580-coinbase.com" OR destinationntdomain CONTAINS "17614-coinbase.com" OR destinationntdomain CONTAINS "17618412-coinbase.com" OR destinationntdomain CONTAINS "17619-coinbase.com" OR destinationntdomain CONTAINS "176284-coinbase.com" OR destinationntdomain CONTAINS "17823920-coinbase.com" OR destinationntdomain CONTAINS "178253-coinbase.com")
index=activity AND rg_functionality="Web Application Firewall" AND requesturl NOT NULL AND (requesturl CONTAINS "16450207-coinbase.com" OR requesturl CONTAINS "16458207-coinbase.com" OR requesturl CONTAINS "16478202-coinbase.com" OR requesturl CONTAINS "164872942-coinbase.com" OR requesturl CONTAINS "16590-coinbase.com" OR requesturl CONTAINS "16594373-coinbase.com" OR requesturl CONTAINS "16624831-coinbase.com" OR requesturl CONTAINS "16642124-coinbase.com" OR requesturl CONTAINS "16642172-coinbase.com" OR requesturl CONTAINS "16642580-coinbase.com" OR requesturl CONTAINS "16642721-coinbase.com" OR requesturl CONTAINS "16642724-coinbase.com" OR requesturl CONTAINS "16642871-coinbase.com" OR requesturl CONTAINS "16642872-coinbase.com" OR requesturl CONTAINS "16712942-coinbase.com" OR requesturl CONTAINS "16718672-coinbase.com" OR requesturl CONTAINS "16728342-coinbase.com" OR requesturl CONTAINS "16728348-coinbase.com" OR requesturl CONTAINS "16728442-coinbase.com" OR requesturl CONTAINS "16728472-coinbase.com" OR requesturl CONTAINS "167285-coinbase.com" OR requesturl CONTAINS "16729042-coinbase.com" OR requesturl CONTAINS "16748272-coinbase.com" OR requesturl CONTAINS "16782942-coinbase.com" OR requesturl CONTAINS "16827420-coinbase.com" OR requesturl CONTAINS "16827423-coinbase.com" OR requesturl CONTAINS "16847145-coinbase.com" OR requesturl CONTAINS "16893924-coinbase.com" OR requesturl CONTAINS "17182-coinbase.com" OR requesturl CONTAINS "17255030-coinbase.com" OR requesturl CONTAINS "17259-kraken.com" OR requesturl CONTAINS "172486-coinbase.com" OR requesturl CONTAINS "17284652-coinbase.com" OR requesturl CONTAINS "17286-coinbase.com" OR requesturl CONTAINS "17334522-coinbase.com" OR requesturl CONTAINS "17334522-kraken.com" OR requesturl CONTAINS "17384522-coinbase.com" OR requesturl CONTAINS "173912-coinbase.com" OR requesturl CONTAINS "17494976-coinbase.com" OR requesturl CONTAINS "17512854-coinbase.com" OR requesturl CONTAINS "17512857-coinbase.com" OR requesturl CONTAINS "1751954-coinbase.com" OR requesturl CONTAINS "17525030-coinbase.com" OR requesturl CONTAINS "17529580-coinbase.com" OR requesturl CONTAINS "17614-coinbase.com" OR requesturl CONTAINS "17618412-coinbase.com" OR requesturl CONTAINS "17619-coinbase.com" OR requesturl CONTAINS "176284-coinbase.com" OR requesturl CONTAINS "17823920-coinbase.com" OR requesturl CONTAINS "178253-coinbase.com")
index=activity AND rg_functionality="Web Application Firewall" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "178294-coinbase.com" OR destinationhostname CONTAINS "17912-coinbase.com" OR destinationhostname CONTAINS "17914-coinbase.com" OR destinationhostname CONTAINS "17917-coinbase.com" OR destinationhostname CONTAINS "17954-coinbase.com" OR destinationhostname CONTAINS "17958-coinbase.com" OR destinationhostname CONTAINS "182043-coinbase.com" OR destinationhostname CONTAINS "18275-gemini.com" OR destinationhostname CONTAINS "18276-coinbase.com" OR destinationhostname CONTAINS "18290185-coinbase.com" OR destinationhostname CONTAINS "182967-coinbase.com" OR destinationhostname CONTAINS "18560-coinbase.com" OR destinationhostname CONTAINS "18571-coinbase.com" OR destinationhostname CONTAINS "185912-coinbase.com" OR destinationhostname CONTAINS "185914-coinbase.com" OR destinationhostname CONTAINS "18592176-coinbase.com" OR destinationhostname CONTAINS "18594162-coinbase.com" OR destinationhostname CONTAINS "18594962-coinbase.com" OR destinationhostname CONTAINS "18597162-coinbase.com" OR destinationhostname CONTAINS "18719562-coinbase.com" OR destinationhostname CONTAINS "1875290-coinbase.com" OR destinationhostname CONTAINS "1882730-coinbase.com" OR destinationhostname CONTAINS "18902-coinbase.com" OR destinationhostname CONTAINS "18903-coinbase.com" OR destinationhostname CONTAINS "189126-coinbase.com" OR destinationhostname CONTAINS "18952-coinbase.com" OR destinationhostname CONTAINS "192854-coinbase.com" OR destinationhostname CONTAINS "192856-coinbase.com" OR destinationhostname CONTAINS "19287-binance.com" OR destinationhostname CONTAINS "19572-coinbase.com" OR destinationhostname CONTAINS "195812-coinbase.com" OR destinationhostname CONTAINS "195826-coinbase.com" OR destinationhostname CONTAINS "1958262-coinbase.com" OR destinationhostname CONTAINS "195827-binance.com" OR destinationhostname CONTAINS "1958297-coinbase.com" OR destinationhostname CONTAINS "19582970-coinbase.com" OR destinationhostname CONTAINS "19582971-coinbase.com" OR destinationhostname CONTAINS "19583-coinbase.com" OR destinationhostname CONTAINS "19592653-coinbase.com" OR destinationhostname CONTAINS "197304-coinbase.com" OR destinationhostname CONTAINS "19730492-coinbase.com" OR destinationhostname CONTAINS "19764162-coinbase.com" OR destinationhostname CONTAINS "19803-coinbase.com" OR destinationhostname CONTAINS "201784289-coinbase.com" OR destinationhostname CONTAINS "210823644-coinbase.com" OR destinationhostname CONTAINS "21158-coinbase.com" OR destinationhostname CONTAINS "21509-coinbase.com" OR destinationhostname CONTAINS "25985-coinbase.com" OR destinationhostname CONTAINS "27699-coinbase.com" OR destinationhostname CONTAINS "28367-coinbase.com")
index=activity AND rg_functionality="Web Application Firewall" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "178294-coinbase.com" OR sourcentdomain CONTAINS "17912-coinbase.com" OR sourcentdomain CONTAINS "17914-coinbase.com" OR sourcentdomain CONTAINS "17917-coinbase.com" OR sourcentdomain CONTAINS "17954-coinbase.com" OR sourcentdomain CONTAINS "17958-coinbase.com" OR sourcentdomain CONTAINS "182043-coinbase.com" OR sourcentdomain CONTAINS "18275-gemini.com" OR sourcentdomain CONTAINS "18276-coinbase.com" OR sourcentdomain CONTAINS "18290185-coinbase.com" OR sourcentdomain CONTAINS "182967-coinbase.com" OR sourcentdomain CONTAINS "18560-coinbase.com" OR sourcentdomain CONTAINS "18571-coinbase.com" OR sourcentdomain CONTAINS "185912-coinbase.com" OR sourcentdomain CONTAINS "185914-coinbase.com" OR sourcentdomain CONTAINS "18592176-coinbase.com" OR sourcentdomain CONTAINS "18594162-coinbase.com" OR sourcentdomain CONTAINS "18594962-coinbase.com" OR sourcentdomain CONTAINS "18597162-coinbase.com" OR sourcentdomain CONTAINS "18719562-coinbase.com" OR sourcentdomain CONTAINS "1875290-coinbase.com" OR sourcentdomain CONTAINS "1882730-coinbase.com" OR sourcentdomain CONTAINS "18902-coinbase.com" OR sourcentdomain CONTAINS "18903-coinbase.com" OR sourcentdomain CONTAINS "189126-coinbase.com" OR sourcentdomain CONTAINS "18952-coinbase.com" OR sourcentdomain CONTAINS "192854-coinbase.com" OR sourcentdomain CONTAINS "192856-coinbase.com" OR sourcentdomain CONTAINS "19287-binance.com" OR sourcentdomain CONTAINS "19572-coinbase.com" OR sourcentdomain CONTAINS "195812-coinbase.com" OR sourcentdomain CONTAINS "195826-coinbase.com" OR sourcentdomain CONTAINS "1958262-coinbase.com" OR sourcentdomain CONTAINS "195827-binance.com" OR sourcentdomain CONTAINS "1958297-coinbase.com" OR sourcentdomain CONTAINS "19582970-coinbase.com" OR sourcentdomain CONTAINS "19582971-coinbase.com" OR sourcentdomain CONTAINS "19583-coinbase.com" OR sourcentdomain CONTAINS "19592653-coinbase.com" OR sourcentdomain CONTAINS "197304-coinbase.com" OR sourcentdomain CONTAINS "19730492-coinbase.com" OR sourcentdomain CONTAINS "19764162-coinbase.com" OR sourcentdomain CONTAINS "19803-coinbase.com" OR sourcentdomain CONTAINS "201784289-coinbase.com" OR sourcentdomain CONTAINS "210823644-coinbase.com" OR sourcentdomain CONTAINS "21158-coinbase.com" OR sourcentdomain CONTAINS "21509-coinbase.com" OR sourcentdomain CONTAINS "25985-coinbase.com" OR sourcentdomain CONTAINS "27699-coinbase.com" OR sourcentdomain CONTAINS "28367-coinbase.com")
index=activity AND rg_functionality="Web Application Firewall" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "178294-coinbase.com" OR sourcehostname CONTAINS "17912-coinbase.com" OR sourcehostname CONTAINS "17914-coinbase.com" OR sourcehostname CONTAINS "17917-coinbase.com" OR sourcehostname CONTAINS "17954-coinbase.com" OR sourcehostname CONTAINS "17958-coinbase.com" OR sourcehostname CONTAINS "182043-coinbase.com" OR sourcehostname CONTAINS "18275-gemini.com" OR sourcehostname CONTAINS "18276-coinbase.com" OR sourcehostname CONTAINS "18290185-coinbase.com" OR sourcehostname CONTAINS "182967-coinbase.com" OR sourcehostname CONTAINS "18560-coinbase.com" OR sourcehostname CONTAINS "18571-coinbase.com" OR sourcehostname CONTAINS "185912-coinbase.com" OR sourcehostname CONTAINS "185914-coinbase.com" OR sourcehostname CONTAINS "18592176-coinbase.com" OR sourcehostname CONTAINS "18594162-coinbase.com" OR sourcehostname CONTAINS "18594962-coinbase.com" OR sourcehostname CONTAINS "18597162-coinbase.com" OR sourcehostname CONTAINS "18719562-coinbase.com" OR sourcehostname CONTAINS "1875290-coinbase.com" OR sourcehostname CONTAINS "1882730-coinbase.com" OR sourcehostname CONTAINS "18902-coinbase.com" OR sourcehostname CONTAINS "18903-coinbase.com" OR sourcehostname CONTAINS "189126-coinbase.com" OR sourcehostname CONTAINS "18952-coinbase.com" OR sourcehostname CONTAINS "192854-coinbase.com" OR sourcehostname CONTAINS "192856-coinbase.com" OR sourcehostname CONTAINS "19287-binance.com" OR sourcehostname CONTAINS "19572-coinbase.com" OR sourcehostname CONTAINS "195812-coinbase.com" OR sourcehostname CONTAINS "195826-coinbase.com" OR sourcehostname CONTAINS "1958262-coinbase.com" OR sourcehostname CONTAINS "195827-binance.com" OR sourcehostname CONTAINS "1958297-coinbase.com" OR sourcehostname CONTAINS "19582970-coinbase.com" OR sourcehostname CONTAINS "19582971-coinbase.com" OR sourcehostname CONTAINS "19583-coinbase.com" OR sourcehostname CONTAINS "19592653-coinbase.com" OR sourcehostname CONTAINS "197304-coinbase.com" OR sourcehostname CONTAINS "19730492-coinbase.com" OR sourcehostname CONTAINS "19764162-coinbase.com" OR sourcehostname CONTAINS "19803-coinbase.com" OR sourcehostname CONTAINS "201784289-coinbase.com" OR sourcehostname CONTAINS "210823644-coinbase.com" OR sourcehostname CONTAINS "21158-coinbase.com" OR sourcehostname CONTAINS "21509-coinbase.com" OR sourcehostname CONTAINS "25985-coinbase.com" OR sourcehostname CONTAINS "27699-coinbase.com" OR sourcehostname CONTAINS "28367-coinbase.com")
index=activity AND rg_functionality="Web Application Firewall" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "178294-coinbase.com" OR destinationntdomain CONTAINS "17912-coinbase.com" OR destinationntdomain CONTAINS "17914-coinbase.com" OR destinationntdomain CONTAINS "17917-coinbase.com" OR destinationntdomain CONTAINS "17954-coinbase.com" OR destinationntdomain CONTAINS "17958-coinbase.com" OR destinationntdomain CONTAINS "182043-coinbase.com" OR destinationntdomain CONTAINS "18275-gemini.com" OR destinationntdomain CONTAINS "18276-coinbase.com" OR destinationntdomain CONTAINS "18290185-coinbase.com" OR destinationntdomain CONTAINS "182967-coinbase.com" OR destinationntdomain CONTAINS "18560-coinbase.com" OR destinationntdomain CONTAINS "18571-coinbase.com" OR destinationntdomain CONTAINS "185912-coinbase.com" OR destinationntdomain CONTAINS "185914-coinbase.com" OR destinationntdomain CONTAINS "18592176-coinbase.com" OR destinationntdomain CONTAINS "18594162-coinbase.com" OR destinationntdomain CONTAINS "18594962-coinbase.com" OR destinationntdomain CONTAINS "18597162-coinbase.com" OR destinationntdomain CONTAINS "18719562-coinbase.com" OR destinationntdomain CONTAINS "1875290-coinbase.com" OR destinationntdomain CONTAINS "1882730-coinbase.com" OR destinationntdomain CONTAINS "18902-coinbase.com" OR destinationntdomain CONTAINS "18903-coinbase.com" OR destinationntdomain CONTAINS "189126-coinbase.com" OR destinationntdomain CONTAINS "18952-coinbase.com" OR destinationntdomain CONTAINS "192854-coinbase.com" OR destinationntdomain CONTAINS "192856-coinbase.com" OR destinationntdomain CONTAINS "19287-binance.com" OR destinationntdomain CONTAINS "19572-coinbase.com" OR destinationntdomain CONTAINS "195812-coinbase.com" OR destinationntdomain CONTAINS "195826-coinbase.com" OR destinationntdomain CONTAINS "1958262-coinbase.com" OR destinationntdomain CONTAINS "195827-binance.com" OR destinationntdomain CONTAINS "1958297-coinbase.com" OR destinationntdomain CONTAINS "19582970-coinbase.com" OR destinationntdomain CONTAINS "19582971-coinbase.com" OR destinationntdomain CONTAINS "19583-coinbase.com" OR destinationntdomain CONTAINS "19592653-coinbase.com" OR destinationntdomain CONTAINS "197304-coinbase.com" OR destinationntdomain CONTAINS "19730492-coinbase.com" OR destinationntdomain CONTAINS "19764162-coinbase.com" OR destinationntdomain CONTAINS "19803-coinbase.com" OR destinationntdomain CONTAINS "201784289-coinbase.com" OR destinationntdomain CONTAINS "210823644-coinbase.com" OR destinationntdomain CONTAINS "21158-coinbase.com" OR destinationntdomain CONTAINS "21509-coinbase.com" OR destinationntdomain CONTAINS "25985-coinbase.com" OR destinationntdomain CONTAINS "27699-coinbase.com" OR destinationntdomain CONTAINS "28367-coinbase.com")
index=activity AND rg_functionality="Web Application Firewall" AND requesturl NOT NULL AND (requesturl CONTAINS "178294-coinbase.com" OR requesturl CONTAINS "17912-coinbase.com" OR requesturl CONTAINS "17914-coinbase.com" OR requesturl CONTAINS "17917-coinbase.com" OR requesturl CONTAINS "17954-coinbase.com" OR requesturl CONTAINS "17958-coinbase.com" OR requesturl CONTAINS "182043-coinbase.com" OR requesturl CONTAINS "18275-gemini.com" OR requesturl CONTAINS "18276-coinbase.com" OR requesturl CONTAINS "18290185-coinbase.com" OR requesturl CONTAINS "182967-coinbase.com" OR requesturl CONTAINS "18560-coinbase.com" OR requesturl CONTAINS "18571-coinbase.com" OR requesturl CONTAINS "185912-coinbase.com" OR requesturl CONTAINS "185914-coinbase.com" OR requesturl CONTAINS "18592176-coinbase.com" OR requesturl CONTAINS "18594162-coinbase.com" OR requesturl CONTAINS "18594962-coinbase.com" OR requesturl CONTAINS "18597162-coinbase.com" OR requesturl CONTAINS "18719562-coinbase.com" OR requesturl CONTAINS "1875290-coinbase.com" OR requesturl CONTAINS "1882730-coinbase.com" OR requesturl CONTAINS "18902-coinbase.com" OR requesturl CONTAINS "18903-coinbase.com" OR requesturl CONTAINS "189126-coinbase.com" OR requesturl CONTAINS "18952-coinbase.com" OR requesturl CONTAINS "192854-coinbase.com" OR requesturl CONTAINS "192856-coinbase.com" OR requesturl CONTAINS "19287-binance.com" OR requesturl CONTAINS "19572-coinbase.com" OR requesturl CONTAINS "195812-coinbase.com" OR requesturl CONTAINS "195826-coinbase.com" OR requesturl CONTAINS "1958262-coinbase.com" OR requesturl CONTAINS "195827-binance.com" OR requesturl CONTAINS "1958297-coinbase.com" OR requesturl CONTAINS "19582970-coinbase.com" OR requesturl CONTAINS "19582971-coinbase.com" OR requesturl CONTAINS "19583-coinbase.com" OR requesturl CONTAINS "19592653-coinbase.com" OR requesturl CONTAINS "197304-coinbase.com" OR requesturl CONTAINS "19730492-coinbase.com" OR requesturl CONTAINS "19764162-coinbase.com" OR requesturl CONTAINS "19803-coinbase.com" OR requesturl CONTAINS "201784289-coinbase.com" OR requesturl CONTAINS "210823644-coinbase.com" OR requesturl CONTAINS "21158-coinbase.com" OR requesturl CONTAINS "21509-coinbase.com" OR requesturl CONTAINS "25985-coinbase.com" OR requesturl CONTAINS "27699-coinbase.com" OR requesturl CONTAINS "28367-coinbase.com")
index=activity AND rg_functionality="Web Application Firewall" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "28676-coinbase.com" OR destinationhostname CONTAINS "29185-coinbase.com" OR destinationhostname CONTAINS "29195-coinbase.com" OR destinationhostname CONTAINS "2a-coinbase.com" OR destinationhostname CONTAINS "2b-coinbase.com" OR destinationhostname CONTAINS "2c-coinbase.com" OR destinationhostname CONTAINS "2f-coinbase.com" OR destinationhostname CONTAINS "2fas-coinbase.com" OR destinationhostname CONTAINS "2o-coinbase.com" OR destinationhostname CONTAINS "2r-coinbase.com" OR destinationhostname CONTAINS "2s-coinbase.com" OR destinationhostname CONTAINS "2sv-coinbase.com" OR destinationhostname CONTAINS "352134951-coinbase.com" OR destinationhostname CONTAINS "38468-coinbase.com" OR destinationhostname CONTAINS "39590-coinbase.com" OR destinationhostname CONTAINS "41260-coinbase.com" OR destinationhostname CONTAINS "427883-coinbase.com" OR destinationhostname CONTAINS "43017-coinbase.com" OR destinationhostname CONTAINS "47562-coinbase.com" OR destinationhostname CONTAINS "50195-coinbase.com" OR destinationhostname CONTAINS "5247-coinbase.com" OR destinationhostname CONTAINS "54765-coinbase.com" OR destinationhostname CONTAINS "57197-coinbase.com" OR destinationhostname CONTAINS "58176-coinbase.com" OR destinationhostname CONTAINS "58297-coinbase.com" OR destinationhostname CONTAINS "61250-coinbase.com" OR destinationhostname CONTAINS "61835-coinbase.com" OR destinationhostname CONTAINS "61851-coinbase.com" OR destinationhostname CONTAINS "61937-coinbase.com" OR destinationhostname CONTAINS "71925-coinbase.com" OR destinationhostname CONTAINS "72957-coinbase.com" OR destinationhostname CONTAINS "72985-coinbase.com" OR destinationhostname CONTAINS "74651-coinbase.com" OR destinationhostname CONTAINS "754668948-coinbase.com" OR destinationhostname CONTAINS "76159869-coinbase.com" OR destinationhostname CONTAINS "76153-coinbase.com" OR destinationhostname CONTAINS "81758-coinbase.com" OR destinationhostname CONTAINS "81920-coinbase.com" OR destinationhostname CONTAINS "81926-coinbase.com" OR destinationhostname CONTAINS "81958-coinbase.com" OR destinationhostname CONTAINS "826298-coinbase.com" OR destinationhostname CONTAINS "83216-coinbase.com" OR destinationhostname CONTAINS "837613-coinbase.com" OR destinationhostname CONTAINS "83956-coinbase.com" OR destinationhostname CONTAINS "87157-coinbase.com" OR destinationhostname CONTAINS "87312-coinbase.com" OR destinationhostname CONTAINS "89304-coinbase.com" OR destinationhostname CONTAINS "89375-coinbase.com" OR destinationhostname CONTAINS "91723-gemini.com" OR destinationhostname CONTAINS "91752-coinbase.com")
index=activity AND rg_functionality="Web Application Firewall" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "28676-coinbase.com" OR sourcentdomain CONTAINS "29185-coinbase.com" OR sourcentdomain CONTAINS "29195-coinbase.com" OR sourcentdomain CONTAINS "2a-coinbase.com" OR sourcentdomain CONTAINS "2b-coinbase.com" OR sourcentdomain CONTAINS "2c-coinbase.com" OR sourcentdomain CONTAINS "2f-coinbase.com" OR sourcentdomain CONTAINS "2fas-coinbase.com" OR sourcentdomain CONTAINS "2o-coinbase.com" OR sourcentdomain CONTAINS "2r-coinbase.com" OR sourcentdomain CONTAINS "2s-coinbase.com" OR sourcentdomain CONTAINS "2sv-coinbase.com" OR sourcentdomain CONTAINS "352134951-coinbase.com" OR sourcentdomain CONTAINS "38468-coinbase.com" OR sourcentdomain CONTAINS "39590-coinbase.com" OR sourcentdomain CONTAINS "41260-coinbase.com" OR sourcentdomain CONTAINS "427883-coinbase.com" OR sourcentdomain CONTAINS "43017-coinbase.com" OR sourcentdomain CONTAINS "47562-coinbase.com" OR sourcentdomain CONTAINS "50195-coinbase.com" OR sourcentdomain CONTAINS "5247-coinbase.com" OR sourcentdomain CONTAINS "54765-coinbase.com" OR sourcentdomain CONTAINS "57197-coinbase.com" OR sourcentdomain CONTAINS "58176-coinbase.com" OR sourcentdomain CONTAINS "58297-coinbase.com" OR sourcentdomain CONTAINS "61250-coinbase.com" OR sourcentdomain CONTAINS "61835-coinbase.com" OR sourcentdomain CONTAINS "61851-coinbase.com" OR sourcentdomain CONTAINS "61937-coinbase.com" OR sourcentdomain CONTAINS "71925-coinbase.com" OR sourcentdomain CONTAINS "72957-coinbase.com" OR sourcentdomain CONTAINS "72985-coinbase.com" OR sourcentdomain CONTAINS "74651-coinbase.com" OR sourcentdomain CONTAINS "754668948-coinbase.com" OR sourcentdomain CONTAINS "76159869-coinbase.com" OR sourcentdomain CONTAINS "76153-coinbase.com" OR sourcentdomain CONTAINS "81758-coinbase.com" OR sourcentdomain CONTAINS "81920-coinbase.com" OR sourcentdomain CONTAINS "81926-coinbase.com" OR sourcentdomain CONTAINS "81958-coinbase.com" OR sourcentdomain CONTAINS "826298-coinbase.com" OR sourcentdomain CONTAINS "83216-coinbase.com" OR sourcentdomain CONTAINS "837613-coinbase.com" OR sourcentdomain CONTAINS "83956-coinbase.com" OR sourcentdomain CONTAINS "87157-coinbase.com" OR sourcentdomain CONTAINS "87312-coinbase.com" OR sourcentdomain CONTAINS "89304-coinbase.com" OR sourcentdomain CONTAINS "89375-coinbase.com" OR sourcentdomain CONTAINS "91723-gemini.com" OR sourcentdomain CONTAINS "91752-coinbase.com")
index=activity AND rg_functionality="Web Application Firewall" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "28676-coinbase.com" OR sourcehostname CONTAINS "29185-coinbase.com" OR sourcehostname CONTAINS "29195-coinbase.com" OR sourcehostname CONTAINS "2a-coinbase.com" OR sourcehostname CONTAINS "2b-coinbase.com" OR sourcehostname CONTAINS "2c-coinbase.com" OR sourcehostname CONTAINS "2f-coinbase.com" OR sourcehostname CONTAINS "2fas-coinbase.com" OR sourcehostname CONTAINS "2o-coinbase.com" OR sourcehostname CONTAINS "2r-coinbase.com" OR sourcehostname CONTAINS "2s-coinbase.com" OR sourcehostname CONTAINS "2sv-coinbase.com" OR sourcehostname CONTAINS "352134951-coinbase.com" OR sourcehostname CONTAINS "38468-coinbase.com" OR sourcehostname CONTAINS "39590-coinbase.com" OR sourcehostname CONTAINS "41260-coinbase.com" OR sourcehostname CONTAINS "427883-coinbase.com" OR sourcehostname CONTAINS "43017-coinbase.com" OR sourcehostname CONTAINS "47562-coinbase.com" OR sourcehostname CONTAINS "50195-coinbase.com" OR sourcehostname CONTAINS "5247-coinbase.com" OR sourcehostname CONTAINS "54765-coinbase.com" OR sourcehostname CONTAINS "57197-coinbase.com" OR sourcehostname CONTAINS "58176-coinbase.com" OR sourcehostname CONTAINS "58297-coinbase.com" OR sourcehostname CONTAINS "61250-coinbase.com" OR sourcehostname CONTAINS "61835-coinbase.com" OR sourcehostname CONTAINS "61851-coinbase.com" OR sourcehostname CONTAINS "61937-coinbase.com" OR sourcehostname CONTAINS "71925-coinbase.com" OR sourcehostname CONTAINS "72957-coinbase.com" OR sourcehostname CONTAINS "72985-coinbase.com" OR sourcehostname CONTAINS "74651-coinbase.com" OR sourcehostname CONTAINS "754668948-coinbase.com" OR sourcehostname CONTAINS "76159869-coinbase.com" OR sourcehostname CONTAINS "76153-coinbase.com" OR sourcehostname CONTAINS "81758-coinbase.com" OR sourcehostname CONTAINS "81920-coinbase.com" OR sourcehostname CONTAINS "81926-coinbase.com" OR sourcehostname CONTAINS "81958-coinbase.com" OR sourcehostname CONTAINS "826298-coinbase.com" OR sourcehostname CONTAINS "83216-coinbase.com" OR sourcehostname CONTAINS "837613-coinbase.com" OR sourcehostname CONTAINS "83956-coinbase.com" OR sourcehostname CONTAINS "87157-coinbase.com" OR sourcehostname CONTAINS "87312-coinbase.com" OR sourcehostname CONTAINS "89304-coinbase.com" OR sourcehostname CONTAINS "89375-coinbase.com" OR sourcehostname CONTAINS "91723-gemini.com" OR sourcehostname CONTAINS "91752-coinbase.com")
index=activity AND rg_functionality="Web Application Firewall" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "28676-coinbase.com" OR destinationntdomain CONTAINS "29185-coinbase.com" OR destinationntdomain CONTAINS "29195-coinbase.com" OR destinationntdomain CONTAINS "2a-coinbase.com" OR destinationntdomain CONTAINS "2b-coinbase.com" OR destinationntdomain CONTAINS "2c-coinbase.com" OR destinationntdomain CONTAINS "2f-coinbase.com" OR destinationntdomain CONTAINS "2fas-coinbase.com" OR destinationntdomain CONTAINS "2o-coinbase.com" OR destinationntdomain CONTAINS "2r-coinbase.com" OR destinationntdomain CONTAINS "2s-coinbase.com" OR destinationntdomain CONTAINS "2sv-coinbase.com" OR destinationntdomain CONTAINS "352134951-coinbase.com" OR destinationntdomain CONTAINS "38468-coinbase.com" OR destinationntdomain CONTAINS "39590-coinbase.com" OR destinationntdomain CONTAINS "41260-coinbase.com" OR destinationntdomain CONTAINS "427883-coinbase.com" OR destinationntdomain CONTAINS "43017-coinbase.com" OR destinationntdomain CONTAINS "47562-coinbase.com" OR destinationntdomain CONTAINS "50195-coinbase.com" OR destinationntdomain CONTAINS "5247-coinbase.com" OR destinationntdomain CONTAINS "54765-coinbase.com" OR destinationntdomain CONTAINS "57197-coinbase.com" OR destinationntdomain CONTAINS "58176-coinbase.com" OR destinationntdomain CONTAINS "58297-coinbase.com" OR destinationntdomain CONTAINS "61250-coinbase.com" OR destinationntdomain CONTAINS "61835-coinbase.com" OR destinationntdomain CONTAINS "61851-coinbase.com" OR destinationntdomain CONTAINS "61937-coinbase.com" OR destinationntdomain CONTAINS "71925-coinbase.com" OR destinationntdomain CONTAINS "72957-coinbase.com" OR destinationntdomain CONTAINS "72985-coinbase.com" OR destinationntdomain CONTAINS "74651-coinbase.com" OR destinationntdomain CONTAINS "754668948-coinbase.com" OR destinationntdomain CONTAINS "76159869-coinbase.com" OR destinationntdomain CONTAINS "76153-coinbase.com" OR destinationntdomain CONTAINS "81758-coinbase.com" OR destinationntdomain CONTAINS "81920-coinbase.com" OR destinationntdomain CONTAINS "81926-coinbase.com" OR destinationntdomain CONTAINS "81958-coinbase.com" OR destinationntdomain CONTAINS "826298-coinbase.com" OR destinationntdomain CONTAINS "83216-coinbase.com" OR destinationntdomain CONTAINS "837613-coinbase.com" OR destinationntdomain CONTAINS "83956-coinbase.com" OR destinationntdomain CONTAINS "87157-coinbase.com" OR destinationntdomain CONTAINS "87312-coinbase.com" OR destinationntdomain CONTAINS "89304-coinbase.com" OR destinationntdomain CONTAINS "89375-coinbase.com" OR destinationntdomain CONTAINS "91723-gemini.com" OR destinationntdomain CONTAINS "91752-coinbase.com")
index=activity AND rg_functionality="Web Application Firewall" AND requesturl NOT NULL AND (requesturl CONTAINS "28676-coinbase.com" OR requesturl CONTAINS "29185-coinbase.com" OR requesturl CONTAINS "29195-coinbase.com" OR requesturl CONTAINS "2a-coinbase.com" OR requesturl CONTAINS "2b-coinbase.com" OR requesturl CONTAINS "2c-coinbase.com" OR requesturl CONTAINS "2f-coinbase.com" OR requesturl CONTAINS "2fas-coinbase.com" OR requesturl CONTAINS "2o-coinbase.com" OR requesturl CONTAINS "2r-coinbase.com" OR requesturl CONTAINS "2s-coinbase.com" OR requesturl CONTAINS "2sv-coinbase.com" OR requesturl CONTAINS "352134951-coinbase.com" OR requesturl CONTAINS "38468-coinbase.com" OR requesturl CONTAINS "39590-coinbase.com" OR requesturl CONTAINS "41260-coinbase.com" OR requesturl CONTAINS "427883-coinbase.com" OR requesturl CONTAINS "43017-coinbase.com" OR requesturl CONTAINS "47562-coinbase.com" OR requesturl CONTAINS "50195-coinbase.com" OR requesturl CONTAINS "5247-coinbase.com" OR requesturl CONTAINS "54765-coinbase.com" OR requesturl CONTAINS "57197-coinbase.com" OR requesturl CONTAINS "58176-coinbase.com" OR requesturl CONTAINS "58297-coinbase.com" OR requesturl CONTAINS "61250-coinbase.com" OR requesturl CONTAINS "61835-coinbase.com" OR requesturl CONTAINS "61851-coinbase.com" OR requesturl CONTAINS "61937-coinbase.com" OR requesturl CONTAINS "71925-coinbase.com" OR requesturl CONTAINS "72957-coinbase.com" OR requesturl CONTAINS "72985-coinbase.com" OR requesturl CONTAINS "74651-coinbase.com" OR requesturl CONTAINS "754668948-coinbase.com" OR requesturl CONTAINS "76159869-coinbase.com" OR requesturl CONTAINS "76153-coinbase.com" OR requesturl CONTAINS "81758-coinbase.com" OR requesturl CONTAINS "81920-coinbase.com" OR requesturl CONTAINS "81926-coinbase.com" OR requesturl CONTAINS "81958-coinbase.com" OR requesturl CONTAINS "826298-coinbase.com" OR requesturl CONTAINS "83216-coinbase.com" OR requesturl CONTAINS "837613-coinbase.com" OR requesturl CONTAINS "83956-coinbase.com" OR requesturl CONTAINS "87157-coinbase.com" OR requesturl CONTAINS "87312-coinbase.com" OR requesturl CONTAINS "89304-coinbase.com" OR requesturl CONTAINS "89375-coinbase.com" OR requesturl CONTAINS "91723-gemini.com" OR requesturl CONTAINS "91752-coinbase.com")
index=activity AND rg_functionality="Web Application Firewall" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "91756-coinbase.com" OR destinationhostname CONTAINS "91782-coinbase.com" OR destinationhostname CONTAINS "91835-coinbase.com" OR destinationhostname CONTAINS "91845-coinbase.com" OR destinationhostname CONTAINS "91923-coinbase.com" OR destinationhostname CONTAINS "92758-coinbase.com" OR destinationhostname CONTAINS "948122061-coinbase.com" OR destinationhostname CONTAINS "978941-coinbase.com" OR destinationhostname CONTAINS "accountrecovery-coinbase.com" OR destinationhostname CONTAINS "action-shakepay.com" OR destinationhostname CONTAINS "adjust-coinbase.com" OR destinationhostname CONTAINS "admin-kraken.com" OR destinationhostname CONTAINS "applechargebacks.com" OR destinationhostname CONTAINS "authenticate-gemini.com" OR destinationhostname CONTAINS "authorize-gmail.com" OR destinationhostname CONTAINS "binance-okta.com" OR destinationhostname CONTAINS "captcha-coinbase.com" OR destinationhostname CONTAINS "cd-coinbase.com" OR destinationhostname CONTAINS "coinbase-heip.com" OR destinationhostname CONTAINS "coinbase-live.support" OR destinationhostname CONTAINS "coinbase-reject.com" OR destinationhostname CONTAINS "coinbase-ticket.com" OR destinationhostname CONTAINS "coinbaseheip.com" OR destinationhostname CONTAINS "com-2fa.help" OR destinationhostname CONTAINS "com-2fa.support" OR destinationhostname CONTAINS "com-3845.support" OR destinationhostname CONTAINS "com-connect.help" OR destinationhostname CONTAINS "com-fraud.support" OR destinationhostname CONTAINS "com-help.support" OR destinationhostname CONTAINS "com-reset.help" OR destinationhostname CONTAINS "com-reset.net" OR destinationhostname CONTAINS "com-ticket.live" OR destinationhostname CONTAINS "com-ticket.support" OR destinationhostname CONTAINS "contact-nexo.com" OR destinationhostname CONTAINS "convert-coinbase.com" OR destinationhostname CONTAINS "customerservice-coinbase.com" OR destinationhostname CONTAINS "default-coinbase.com" OR destinationhostname CONTAINS "defend-coinbase.com" OR destinationhostname CONTAINS "deny-coinbase.com" OR destinationhostname CONTAINS "disconnect-coinbase.com" OR destinationhostname CONTAINS "escalate-coinbase.com" OR destinationhostname CONTAINS "establish-coinbase.com" OR destinationhostname CONTAINS "fcc-okta.com" OR destinationhostname CONTAINS "fraudulent-coinbase.com" OR destinationhostname CONTAINS "guard-apple.com" OR destinationhostname CONTAINS "guard-icloud.com" OR destinationhostname CONTAINS "guardian-coinbase.com" OR destinationhostname CONTAINS "guide-gemini.com" OR destinationhostname CONTAINS "help-bitfinex.com" OR destinationhostname CONTAINS "help-shakepay.com")
index=activity AND rg_functionality="Web Application Firewall" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "91756-coinbase.com" OR sourcentdomain CONTAINS "91782-coinbase.com" OR sourcentdomain CONTAINS "91835-coinbase.com" OR sourcentdomain CONTAINS "91845-coinbase.com" OR sourcentdomain CONTAINS "91923-coinbase.com" OR sourcentdomain CONTAINS "92758-coinbase.com" OR sourcentdomain CONTAINS "948122061-coinbase.com" OR sourcentdomain CONTAINS "978941-coinbase.com" OR sourcentdomain CONTAINS "accountrecovery-coinbase.com" OR sourcentdomain CONTAINS "action-shakepay.com" OR sourcentdomain CONTAINS "adjust-coinbase.com" OR sourcentdomain CONTAINS "admin-kraken.com" OR sourcentdomain CONTAINS "applechargebacks.com" OR sourcentdomain CONTAINS "authenticate-gemini.com" OR sourcentdomain CONTAINS "authorize-gmail.com" OR sourcentdomain CONTAINS "binance-okta.com" OR sourcentdomain CONTAINS "captcha-coinbase.com" OR sourcentdomain CONTAINS "cd-coinbase.com" OR sourcentdomain CONTAINS "coinbase-heip.com" OR sourcentdomain CONTAINS "coinbase-live.support" OR sourcentdomain CONTAINS "coinbase-reject.com" OR sourcentdomain CONTAINS "coinbase-ticket.com" OR sourcentdomain CONTAINS "coinbaseheip.com" OR sourcentdomain CONTAINS "com-2fa.help" OR sourcentdomain CONTAINS "com-2fa.support" OR sourcentdomain CONTAINS "com-3845.support" OR sourcentdomain CONTAINS "com-connect.help" OR sourcentdomain CONTAINS "com-fraud.support" OR sourcentdomain CONTAINS "com-help.support" OR sourcentdomain CONTAINS "com-reset.help" OR sourcentdomain CONTAINS "com-reset.net" OR sourcentdomain CONTAINS "com-ticket.live" OR sourcentdomain CONTAINS "com-ticket.support" OR sourcentdomain CONTAINS "contact-nexo.com" OR sourcentdomain CONTAINS "convert-coinbase.com" OR sourcentdomain CONTAINS "customerservice-coinbase.com" OR sourcentdomain CONTAINS "default-coinbase.com" OR sourcentdomain CONTAINS "defend-coinbase.com" OR sourcentdomain CONTAINS "deny-coinbase.com" OR sourcentdomain CONTAINS "disconnect-coinbase.com" OR sourcentdomain CONTAINS "escalate-coinbase.com" OR sourcentdomain CONTAINS "establish-coinbase.com" OR sourcentdomain CONTAINS "fcc-okta.com" OR sourcentdomain CONTAINS "fraudulent-coinbase.com" OR sourcentdomain CONTAINS "guard-apple.com" OR sourcentdomain CONTAINS "guard-icloud.com" OR sourcentdomain CONTAINS "guardian-coinbase.com" OR sourcentdomain CONTAINS "guide-gemini.com" OR sourcentdomain CONTAINS "help-bitfinex.com" OR sourcentdomain CONTAINS "help-shakepay.com")
index=activity AND rg_functionality="Web Application Firewall" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "91756-coinbase.com" OR sourcehostname CONTAINS "91782-coinbase.com" OR sourcehostname CONTAINS "91835-coinbase.com" OR sourcehostname CONTAINS "91845-coinbase.com" OR sourcehostname CONTAINS "91923-coinbase.com" OR sourcehostname CONTAINS "92758-coinbase.com" OR sourcehostname CONTAINS "948122061-coinbase.com" OR sourcehostname CONTAINS "978941-coinbase.com" OR sourcehostname CONTAINS "accountrecovery-coinbase.com" OR sourcehostname CONTAINS "action-shakepay.com" OR sourcehostname CONTAINS "adjust-coinbase.com" OR sourcehostname CONTAINS "admin-kraken.com" OR sourcehostname CONTAINS "applechargebacks.com" OR sourcehostname CONTAINS "authenticate-gemini.com" OR sourcehostname CONTAINS "authorize-gmail.com" OR sourcehostname CONTAINS "binance-okta.com" OR sourcehostname CONTAINS "captcha-coinbase.com" OR sourcehostname CONTAINS "cd-coinbase.com" OR sourcehostname CONTAINS "coinbase-heip.com" OR sourcehostname CONTAINS "coinbase-live.support" OR sourcehostname CONTAINS "coinbase-reject.com" OR sourcehostname CONTAINS "coinbase-ticket.com" OR sourcehostname CONTAINS "coinbaseheip.com" OR sourcehostname CONTAINS "com-2fa.help" OR sourcehostname CONTAINS "com-2fa.support" OR sourcehostname CONTAINS "com-3845.support" OR sourcehostname CONTAINS "com-connect.help" OR sourcehostname CONTAINS "com-fraud.support" OR sourcehostname CONTAINS "com-help.support" OR sourcehostname CONTAINS "com-reset.help" OR sourcehostname CONTAINS "com-reset.net" OR sourcehostname CONTAINS "com-ticket.live" OR sourcehostname CONTAINS "com-ticket.support" OR sourcehostname CONTAINS "contact-nexo.com" OR sourcehostname CONTAINS "convert-coinbase.com" OR sourcehostname CONTAINS "customerservice-coinbase.com" OR sourcehostname CONTAINS "default-coinbase.com" OR sourcehostname CONTAINS "defend-coinbase.com" OR sourcehostname CONTAINS "deny-coinbase.com" OR sourcehostname CONTAINS "disconnect-coinbase.com" OR sourcehostname CONTAINS "escalate-coinbase.com" OR sourcehostname CONTAINS "establish-coinbase.com" OR sourcehostname CONTAINS "fcc-okta.com" OR sourcehostname CONTAINS "fraudulent-coinbase.com" OR sourcehostname CONTAINS "guard-apple.com" OR sourcehostname CONTAINS "guard-icloud.com" OR sourcehostname CONTAINS "guardian-coinbase.com" OR sourcehostname CONTAINS "guide-gemini.com" OR sourcehostname CONTAINS "help-bitfinex.com" OR sourcehostname CONTAINS "help-shakepay.com")
index=activity AND rg_functionality="Web Application Firewall" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "91756-coinbase.com" OR destinationntdomain CONTAINS "91782-coinbase.com" OR destinationntdomain CONTAINS "91835-coinbase.com" OR destinationntdomain CONTAINS "91845-coinbase.com" OR destinationntdomain CONTAINS "91923-coinbase.com" OR destinationntdomain CONTAINS "92758-coinbase.com" OR destinationntdomain CONTAINS "948122061-coinbase.com" OR destinationntdomain CONTAINS "978941-coinbase.com" OR destinationntdomain CONTAINS "accountrecovery-coinbase.com" OR destinationntdomain CONTAINS "action-shakepay.com" OR destinationntdomain CONTAINS "adjust-coinbase.com" OR destinationntdomain CONTAINS "admin-kraken.com" OR destinationntdomain CONTAINS "applechargebacks.com" OR destinationntdomain CONTAINS "authenticate-gemini.com" OR destinationntdomain CONTAINS "authorize-gmail.com" OR destinationntdomain CONTAINS "binance-okta.com" OR destinationntdomain CONTAINS "captcha-coinbase.com" OR destinationntdomain CONTAINS "cd-coinbase.com" OR destinationntdomain CONTAINS "coinbase-heip.com" OR destinationntdomain CONTAINS "coinbase-live.support" OR destinationntdomain CONTAINS "coinbase-reject.com" OR destinationntdomain CONTAINS "coinbase-ticket.com" OR destinationntdomain CONTAINS "coinbaseheip.com" OR destinationntdomain CONTAINS "com-2fa.help" OR destinationntdomain CONTAINS "com-2fa.support" OR destinationntdomain CONTAINS "com-3845.support" OR destinationntdomain CONTAINS "com-connect.help" OR destinationntdomain CONTAINS "com-fraud.support" OR destinationntdomain CONTAINS "com-help.support" OR destinationntdomain CONTAINS "com-reset.help" OR destinationntdomain CONTAINS "com-reset.net" OR destinationntdomain CONTAINS "com-ticket.live" OR destinationntdomain CONTAINS "com-ticket.support" OR destinationntdomain CONTAINS "contact-nexo.com" OR destinationntdomain CONTAINS "convert-coinbase.com" OR destinationntdomain CONTAINS "customerservice-coinbase.com" OR destinationntdomain CONTAINS "default-coinbase.com" OR destinationntdomain CONTAINS "defend-coinbase.com" OR destinationntdomain CONTAINS "deny-coinbase.com" OR destinationntdomain CONTAINS "disconnect-coinbase.com" OR destinationntdomain CONTAINS "escalate-coinbase.com" OR destinationntdomain CONTAINS "establish-coinbase.com" OR destinationntdomain CONTAINS "fcc-okta.com" OR destinationntdomain CONTAINS "fraudulent-coinbase.com" OR destinationntdomain CONTAINS "guard-apple.com" OR destinationntdomain CONTAINS "guard-icloud.com" OR destinationntdomain CONTAINS "guardian-coinbase.com" OR destinationntdomain CONTAINS "guide-gemini.com" OR destinationntdomain CONTAINS "help-bitfinex.com" OR destinationntdomain CONTAINS "help-shakepay.com")
index=activity AND rg_functionality="Web Application Firewall" AND requesturl NOT NULL AND (requesturl CONTAINS "91756-coinbase.com" OR requesturl CONTAINS "91782-coinbase.com" OR requesturl CONTAINS "91835-coinbase.com" OR requesturl CONTAINS "91845-coinbase.com" OR requesturl CONTAINS "91923-coinbase.com" OR requesturl CONTAINS "92758-coinbase.com" OR requesturl CONTAINS "948122061-coinbase.com" OR requesturl CONTAINS "978941-coinbase.com" OR requesturl CONTAINS "accountrecovery-coinbase.com" OR requesturl CONTAINS "action-shakepay.com" OR requesturl CONTAINS "adjust-coinbase.com" OR requesturl CONTAINS "admin-kraken.com" OR requesturl CONTAINS "applechargebacks.com" OR requesturl CONTAINS "authenticate-gemini.com" OR requesturl CONTAINS "authorize-gmail.com" OR requesturl CONTAINS "binance-okta.com" OR requesturl CONTAINS "captcha-coinbase.com" OR requesturl CONTAINS "cd-coinbase.com" OR requesturl CONTAINS "coinbase-heip.com" OR requesturl CONTAINS "coinbase-live.support" OR requesturl CONTAINS "coinbase-reject.com" OR requesturl CONTAINS "coinbase-ticket.com" OR requesturl CONTAINS "coinbaseheip.com" OR requesturl CONTAINS "com-2fa.help" OR requesturl CONTAINS "com-2fa.support" OR requesturl CONTAINS "com-3845.support" OR requesturl CONTAINS "com-connect.help" OR requesturl CONTAINS "com-fraud.support" OR requesturl CONTAINS "com-help.support" OR requesturl CONTAINS "com-reset.help" OR requesturl CONTAINS "com-reset.net" OR requesturl CONTAINS "com-ticket.live" OR requesturl CONTAINS "com-ticket.support" OR requesturl CONTAINS "contact-nexo.com" OR requesturl CONTAINS "convert-coinbase.com" OR requesturl CONTAINS "customerservice-coinbase.com" OR requesturl CONTAINS "default-coinbase.com" OR requesturl CONTAINS "defend-coinbase.com" OR requesturl CONTAINS "deny-coinbase.com" OR requesturl CONTAINS "disconnect-coinbase.com" OR requesturl CONTAINS "escalate-coinbase.com" OR requesturl CONTAINS "establish-coinbase.com" OR requesturl CONTAINS "fcc-okta.com" OR requesturl CONTAINS "fraudulent-coinbase.com" OR requesturl CONTAINS "guard-apple.com" OR requesturl CONTAINS "guard-icloud.com" OR requesturl CONTAINS "guardian-coinbase.com" OR requesturl CONTAINS "guide-gemini.com" OR requesturl CONTAINS "help-bitfinex.com" OR requesturl CONTAINS "help-shakepay.com")
index=activity AND rg_functionality="Web Application Firewall" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "helpdesk-apple.com" OR destinationhostname CONTAINS "helpdesk-gemini.com" OR destinationhostname CONTAINS "helpdesk-icloud.com" OR destinationhostname CONTAINS "identification-coinbase.com" OR destinationhostname CONTAINS "lockdown-coinbase.com" OR destinationhostname CONTAINS "login-nexo.com" OR destinationhostname CONTAINS "keys-coinbase.com" OR destinationhostname CONTAINS "messages-coinbase.com" OR destinationhostname CONTAINS "newpassword-coinbase.com" OR destinationhostname CONTAINS "prompt-coinbase.com" OR destinationhostname CONTAINS "protect-apple.com" OR destinationhostname CONTAINS "protect-coinbase.com" OR destinationhostname CONTAINS "protect-gmail.com" OR destinationhostname CONTAINS "protect-kraken.com" OR destinationhostname CONTAINS "recoverme-coinbase.com" OR destinationhostname CONTAINS "recoveryportal-coinbase.com" OR destinationhostname CONTAINS "refunds-coinbase.com" OR destinationhostname CONTAINS "reset-okta.com" OR destinationhostname CONTAINS "restore-coinbase.com" OR destinationhostname CONTAINS "return-coinbase.com" OR destinationhostname CONTAINS "reverts-coinbase.com" OR destinationhostname CONTAINS "secure-binance.us" OR destinationhostname CONTAINS "secure-icloud.com" OR destinationhostname CONTAINS "secure-nexo.com" OR destinationhostname CONTAINS "secure-shakepay.com" OR destinationhostname CONTAINS "security-umusic.com" OR destinationhostname CONTAINS "server694590423.tech" OR destinationhostname CONTAINS "session-coinbase.com" OR destinationhostname CONTAINS "startrecovery-coinbase.com" OR destinationhostname CONTAINS "signin-kraken.com" OR destinationhostname CONTAINS "suite-trezor.io" OR destinationhostname CONTAINS "supportportal-coinbase.com" OR destinationhostname CONTAINS "tech-icloud.com" OR destinationhostname CONTAINS "threat-coinbase.com" OR destinationhostname CONTAINS "ticket-apple.com" OR destinationhostname CONTAINS "ticket-coinbase.com" OR destinationhostname CONTAINS "tickets-apple.com" OR destinationhostname CONTAINS "tokens-coinbase.com" OR destinationhostname CONTAINS "unblock-coinbase.com" OR destinationhostname CONTAINS "unlink-coinbase.com" OR destinationhostname CONTAINS "your-coinbase.com" OR destinationhostname CONTAINS "welcome-coinbase.com" OR destinationhostname CONTAINS "www-coinbasewallet.com" OR destinationhostname CONTAINS "www-help-coinbase.com" OR destinationhostname CONTAINS "www-help-gemini.com")
index=activity AND rg_functionality="Web Application Firewall" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "helpdesk-apple.com" OR sourcentdomain CONTAINS "helpdesk-gemini.com" OR sourcentdomain CONTAINS "helpdesk-icloud.com" OR sourcentdomain CONTAINS "identification-coinbase.com" OR sourcentdomain CONTAINS "lockdown-coinbase.com" OR sourcentdomain CONTAINS "login-nexo.com" OR sourcentdomain CONTAINS "keys-coinbase.com" OR sourcentdomain CONTAINS "messages-coinbase.com" OR sourcentdomain CONTAINS "newpassword-coinbase.com" OR sourcentdomain CONTAINS "prompt-coinbase.com" OR sourcentdomain CONTAINS "protect-apple.com" OR sourcentdomain CONTAINS "protect-coinbase.com" OR sourcentdomain CONTAINS "protect-gmail.com" OR sourcentdomain CONTAINS "protect-kraken.com" OR sourcentdomain CONTAINS "recoverme-coinbase.com" OR sourcentdomain CONTAINS "recoveryportal-coinbase.com" OR sourcentdomain CONTAINS "refunds-coinbase.com" OR sourcentdomain CONTAINS "reset-okta.com" OR sourcentdomain CONTAINS "restore-coinbase.com" OR sourcentdomain CONTAINS "return-coinbase.com" OR sourcentdomain CONTAINS "reverts-coinbase.com" OR sourcentdomain CONTAINS "secure-binance.us" OR sourcentdomain CONTAINS "secure-icloud.com" OR sourcentdomain CONTAINS "secure-nexo.com" OR sourcentdomain CONTAINS "secure-shakepay.com" OR sourcentdomain CONTAINS "security-umusic.com" OR sourcentdomain CONTAINS "server694590423.tech" OR sourcentdomain CONTAINS "session-coinbase.com" OR sourcentdomain CONTAINS "startrecovery-coinbase.com" OR sourcentdomain CONTAINS "signin-kraken.com" OR sourcentdomain CONTAINS "suite-trezor.io" OR sourcentdomain CONTAINS "supportportal-coinbase.com" OR sourcentdomain CONTAINS "tech-icloud.com" OR sourcentdomain CONTAINS "threat-coinbase.com" OR sourcentdomain CONTAINS "ticket-apple.com" OR sourcentdomain CONTAINS "ticket-coinbase.com" OR sourcentdomain CONTAINS "tickets-apple.com" OR sourcentdomain CONTAINS "tokens-coinbase.com" OR sourcentdomain CONTAINS "unblock-coinbase.com" OR sourcentdomain CONTAINS "unlink-coinbase.com" OR sourcentdomain CONTAINS "your-coinbase.com" OR sourcentdomain CONTAINS "welcome-coinbase.com" OR sourcentdomain CONTAINS "www-coinbasewallet.com" OR sourcentdomain CONTAINS "www-help-coinbase.com" OR sourcentdomain CONTAINS "www-help-gemini.com")
index=activity AND rg_functionality="Web Application Firewall" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "helpdesk-apple.com" OR sourcehostname CONTAINS "helpdesk-gemini.com" OR sourcehostname CONTAINS "helpdesk-icloud.com" OR sourcehostname CONTAINS "identification-coinbase.com" OR sourcehostname CONTAINS "lockdown-coinbase.com" OR sourcehostname CONTAINS "login-nexo.com" OR sourcehostname CONTAINS "keys-coinbase.com" OR sourcehostname CONTAINS "messages-coinbase.com" OR sourcehostname CONTAINS "newpassword-coinbase.com" OR sourcehostname CONTAINS "prompt-coinbase.com" OR sourcehostname CONTAINS "protect-apple.com" OR sourcehostname CONTAINS "protect-coinbase.com" OR sourcehostname CONTAINS "protect-gmail.com" OR sourcehostname CONTAINS "protect-kraken.com" OR sourcehostname CONTAINS "recoverme-coinbase.com" OR sourcehostname CONTAINS "recoveryportal-coinbase.com" OR sourcehostname CONTAINS "refunds-coinbase.com" OR sourcehostname CONTAINS "reset-okta.com" OR sourcehostname CONTAINS "restore-coinbase.com" OR sourcehostname CONTAINS "return-coinbase.com" OR sourcehostname CONTAINS "reverts-coinbase.com" OR sourcehostname CONTAINS "secure-binance.us" OR sourcehostname CONTAINS "secure-icloud.com" OR sourcehostname CONTAINS "secure-nexo.com" OR sourcehostname CONTAINS "secure-shakepay.com" OR sourcehostname CONTAINS "security-umusic.com" OR sourcehostname CONTAINS "server694590423.tech" OR sourcehostname CONTAINS "session-coinbase.com" OR sourcehostname CONTAINS "startrecovery-coinbase.com" OR sourcehostname CONTAINS "signin-kraken.com" OR sourcehostname CONTAINS "suite-trezor.io" OR sourcehostname CONTAINS "supportportal-coinbase.com" OR sourcehostname CONTAINS "tech-icloud.com" OR sourcehostname CONTAINS "threat-coinbase.com" OR sourcehostname CONTAINS "ticket-apple.com" OR sourcehostname CONTAINS "ticket-coinbase.com" OR sourcehostname CONTAINS "tickets-apple.com" OR sourcehostname CONTAINS "tokens-coinbase.com" OR sourcehostname CONTAINS "unblock-coinbase.com" OR sourcehostname CONTAINS "unlink-coinbase.com" OR sourcehostname CONTAINS "your-coinbase.com" OR sourcehostname CONTAINS "welcome-coinbase.com" OR sourcehostname CONTAINS "www-coinbasewallet.com" OR sourcehostname CONTAINS "www-help-coinbase.com" OR sourcehostname CONTAINS "www-help-gemini.com")
index=activity AND rg_functionality="Web Application Firewall" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "helpdesk-apple.com" OR destinationntdomain CONTAINS "helpdesk-gemini.com" OR destinationntdomain CONTAINS "helpdesk-icloud.com" OR destinationntdomain CONTAINS "identification-coinbase.com" OR destinationntdomain CONTAINS "lockdown-coinbase.com" OR destinationntdomain CONTAINS "login-nexo.com" OR destinationntdomain CONTAINS "keys-coinbase.com" OR destinationntdomain CONTAINS "messages-coinbase.com" OR destinationntdomain CONTAINS "newpassword-coinbase.com" OR destinationntdomain CONTAINS "prompt-coinbase.com" OR destinationntdomain CONTAINS "protect-apple.com" OR destinationntdomain CONTAINS "protect-coinbase.com" OR destinationntdomain CONTAINS "protect-gmail.com" OR destinationntdomain CONTAINS "protect-kraken.com" OR destinationntdomain CONTAINS "recoverme-coinbase.com" OR destinationntdomain CONTAINS "recoveryportal-coinbase.com" OR destinationntdomain CONTAINS "refunds-coinbase.com" OR destinationntdomain CONTAINS "reset-okta.com" OR destinationntdomain CONTAINS "restore-coinbase.com" OR destinationntdomain CONTAINS "return-coinbase.com" OR destinationntdomain CONTAINS "reverts-coinbase.com" OR destinationntdomain CONTAINS "secure-binance.us" OR destinationntdomain CONTAINS "secure-icloud.com" OR destinationntdomain CONTAINS "secure-nexo.com" OR destinationntdomain CONTAINS "secure-shakepay.com" OR destinationntdomain CONTAINS "security-umusic.com" OR destinationntdomain CONTAINS "server694590423.tech" OR destinationntdomain CONTAINS "session-coinbase.com" OR destinationntdomain CONTAINS "startrecovery-coinbase.com" OR destinationntdomain CONTAINS "signin-kraken.com" OR destinationntdomain CONTAINS "suite-trezor.io" OR destinationntdomain CONTAINS "supportportal-coinbase.com" OR destinationntdomain CONTAINS "tech-icloud.com" OR destinationntdomain CONTAINS "threat-coinbase.com" OR destinationntdomain CONTAINS "ticket-apple.com" OR destinationntdomain CONTAINS "ticket-coinbase.com" OR destinationntdomain CONTAINS "tickets-apple.com" OR destinationntdomain CONTAINS "tokens-coinbase.com" OR destinationntdomain CONTAINS "unblock-coinbase.com" OR destinationntdomain CONTAINS "unlink-coinbase.com" OR destinationntdomain CONTAINS "your-coinbase.com" OR destinationntdomain CONTAINS "welcome-coinbase.com" OR destinationntdomain CONTAINS "www-coinbasewallet.com" OR destinationntdomain CONTAINS "www-help-coinbase.com" OR destinationntdomain CONTAINS "www-help-gemini.com")
index=activity AND rg_functionality="Web Application Firewall" AND requesturl NOT NULL AND (requesturl CONTAINS "helpdesk-apple.com" OR requesturl CONTAINS "helpdesk-gemini.com" OR requesturl CONTAINS "helpdesk-icloud.com" OR requesturl CONTAINS "identification-coinbase.com" OR requesturl CONTAINS "lockdown-coinbase.com" OR requesturl CONTAINS "login-nexo.com" OR requesturl CONTAINS "keys-coinbase.com" OR requesturl CONTAINS "messages-coinbase.com" OR requesturl CONTAINS "newpassword-coinbase.com" OR requesturl CONTAINS "prompt-coinbase.com" OR requesturl CONTAINS "protect-apple.com" OR requesturl CONTAINS "protect-coinbase.com" OR requesturl CONTAINS "protect-gmail.com" OR requesturl CONTAINS "protect-kraken.com" OR requesturl CONTAINS "recoverme-coinbase.com" OR requesturl CONTAINS "recoveryportal-coinbase.com" OR requesturl CONTAINS "refunds-coinbase.com" OR requesturl CONTAINS "reset-okta.com" OR requesturl CONTAINS "restore-coinbase.com" OR requesturl CONTAINS "return-coinbase.com" OR requesturl CONTAINS "reverts-coinbase.com" OR requesturl CONTAINS "secure-binance.us" OR requesturl CONTAINS "secure-icloud.com" OR requesturl CONTAINS "secure-nexo.com" OR requesturl CONTAINS "secure-shakepay.com" OR requesturl CONTAINS "security-umusic.com" OR requesturl CONTAINS "server694590423.tech" OR requesturl CONTAINS "session-coinbase.com" OR requesturl CONTAINS "startrecovery-coinbase.com" OR requesturl CONTAINS "signin-kraken.com" OR requesturl CONTAINS "suite-trezor.io" OR requesturl CONTAINS "supportportal-coinbase.com" OR requesturl CONTAINS "tech-icloud.com" OR requesturl CONTAINS "threat-coinbase.com" OR requesturl CONTAINS "ticket-apple.com" OR requesturl CONTAINS "ticket-coinbase.com" OR requesturl CONTAINS "tickets-apple.com" OR requesturl CONTAINS "tokens-coinbase.com" OR requesturl CONTAINS "unblock-coinbase.com" OR requesturl CONTAINS "unlink-coinbase.com" OR requesturl CONTAINS "your-coinbase.com" OR requesturl CONTAINS "welcome-coinbase.com" OR requesturl CONTAINS "www-coinbasewallet.com" OR requesturl CONTAINS "www-help-coinbase.com" OR requesturl CONTAINS "www-help-gemini.com")
index=activity AND rg_functionality="Endpoint management systems" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "official-server.com" OR destinationhostname CONTAINS "server694590423.tech" OR destinationhostname CONTAINS "island-placid-bromine.glitch.me" OR destinationhostname CONTAINS "circular-noon-farmhouse.glitch.me" OR destinationhostname CONTAINS "talented-friendly-price.glitch.me" OR destinationhostname CONTAINS "dflfmgsdokasdcpl.com" OR destinationhostname CONTAINS "original-backend.com" OR destinationhostname CONTAINS "07159889-coinbase.com" OR destinationhostname CONTAINS "10195-coinbase.com" OR destinationhostname CONTAINS "11246-coinbase.com" OR destinationhostname CONTAINS "11247-coinbase.com" OR destinationhostname CONTAINS "11248-coinbase.com" OR destinationhostname CONTAINS "11258-coinbase.com" OR destinationhostname CONTAINS "11259-coinbase.com" OR destinationhostname CONTAINS "113912-coinbase.com" OR destinationhostname CONTAINS "11472-coinbase.com" OR destinationhostname CONTAINS "11923-coinbase.com" OR destinationhostname CONTAINS "11957-coinbase.com" OR destinationhostname CONTAINS "128147-coinbase.com" OR destinationhostname CONTAINS "12958-coinbase.com" OR destinationhostname CONTAINS "12984-okta.com" OR destinationhostname CONTAINS "12985-coinbase.com" OR destinationhostname CONTAINS "13130-coinbase.com" OR destinationhostname CONTAINS "13247-coinbase.com" OR destinationhostname CONTAINS "13247-icloud.com" OR destinationhostname CONTAINS "13267-coinbase.com" OR destinationhostname CONTAINS "146271510-coinbase.com" OR destinationhostname CONTAINS "146282-coinbase.com" OR destinationhostname CONTAINS "146284-coinbase.com" OR destinationhostname CONTAINS "147260-coinbase.com" OR destinationhostname CONTAINS "14765-coinbase.com" OR destinationhostname CONTAINS "14817582-coinbase.com" OR destinationhostname CONTAINS "14871904-coinbase.com" OR destinationhostname CONTAINS "14891902-coinbase.com" OR destinationhostname CONTAINS "1492864-coinbase.com" OR destinationhostname CONTAINS "158312-coinbase.com" OR destinationhostname CONTAINS "158372-coinbase.com" OR destinationhostname CONTAINS "158702-coinbase.com" OR destinationhostname CONTAINS "16171675-coinbase.com" OR destinationhostname CONTAINS "16171832-coinbase.com" OR destinationhostname CONTAINS "16178234-coinbase.com" OR destinationhostname CONTAINS "16178237-coinbase.com" OR destinationhostname CONTAINS "16178434-coinbase.com" OR destinationhostname CONTAINS "162178-coinbase.com" OR destinationhostname CONTAINS "162478-coinbase.com" OR destinationhostname CONTAINS "162782-coinbase.com" OR destinationhostname CONTAINS "162812-coinbase.com" OR destinationhostname CONTAINS "162814-coinbase.com" OR destinationhostname CONTAINS "16442580-coinbase.com" OR destinationhostname CONTAINS "16450107-coinbase.com")
index=activity AND rg_functionality="Endpoint management systems" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "official-server.com" OR sourcentdomain CONTAINS "server694590423.tech" OR sourcentdomain CONTAINS "island-placid-bromine.glitch.me" OR sourcentdomain CONTAINS "circular-noon-farmhouse.glitch.me" OR sourcentdomain CONTAINS "talented-friendly-price.glitch.me" OR sourcentdomain CONTAINS "dflfmgsdokasdcpl.com" OR sourcentdomain CONTAINS "original-backend.com" OR sourcentdomain CONTAINS "07159889-coinbase.com" OR sourcentdomain CONTAINS "10195-coinbase.com" OR sourcentdomain CONTAINS "11246-coinbase.com" OR sourcentdomain CONTAINS "11247-coinbase.com" OR sourcentdomain CONTAINS "11248-coinbase.com" OR sourcentdomain CONTAINS "11258-coinbase.com" OR sourcentdomain CONTAINS "11259-coinbase.com" OR sourcentdomain CONTAINS "113912-coinbase.com" OR sourcentdomain CONTAINS "11472-coinbase.com" OR sourcentdomain CONTAINS "11923-coinbase.com" OR sourcentdomain CONTAINS "11957-coinbase.com" OR sourcentdomain CONTAINS "128147-coinbase.com" OR sourcentdomain CONTAINS "12958-coinbase.com" OR sourcentdomain CONTAINS "12984-okta.com" OR sourcentdomain CONTAINS "12985-coinbase.com" OR sourcentdomain CONTAINS "13130-coinbase.com" OR sourcentdomain CONTAINS "13247-coinbase.com" OR sourcentdomain CONTAINS "13247-icloud.com" OR sourcentdomain CONTAINS "13267-coinbase.com" OR sourcentdomain CONTAINS "146271510-coinbase.com" OR sourcentdomain CONTAINS "146282-coinbase.com" OR sourcentdomain CONTAINS "146284-coinbase.com" OR sourcentdomain CONTAINS "147260-coinbase.com" OR sourcentdomain CONTAINS "14765-coinbase.com" OR sourcentdomain CONTAINS "14817582-coinbase.com" OR sourcentdomain CONTAINS "14871904-coinbase.com" OR sourcentdomain CONTAINS "14891902-coinbase.com" OR sourcentdomain CONTAINS "1492864-coinbase.com" OR sourcentdomain CONTAINS "158312-coinbase.com" OR sourcentdomain CONTAINS "158372-coinbase.com" OR sourcentdomain CONTAINS "158702-coinbase.com" OR sourcentdomain CONTAINS "16171675-coinbase.com" OR sourcentdomain CONTAINS "16171832-coinbase.com" OR sourcentdomain CONTAINS "16178234-coinbase.com" OR sourcentdomain CONTAINS "16178237-coinbase.com" OR sourcentdomain CONTAINS "16178434-coinbase.com" OR sourcentdomain CONTAINS "162178-coinbase.com" OR sourcentdomain CONTAINS "162478-coinbase.com" OR sourcentdomain CONTAINS "162782-coinbase.com" OR sourcentdomain CONTAINS "162812-coinbase.com" OR sourcentdomain CONTAINS "162814-coinbase.com" OR sourcentdomain CONTAINS "16442580-coinbase.com" OR sourcentdomain CONTAINS "16450107-coinbase.com")
index=activity AND rg_functionality="Endpoint management systems" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "official-server.com" OR sourcehostname CONTAINS "server694590423.tech" OR sourcehostname CONTAINS "island-placid-bromine.glitch.me" OR sourcehostname CONTAINS "circular-noon-farmhouse.glitch.me" OR sourcehostname CONTAINS "talented-friendly-price.glitch.me" OR sourcehostname CONTAINS "dflfmgsdokasdcpl.com" OR sourcehostname CONTAINS "original-backend.com" OR sourcehostname CONTAINS "07159889-coinbase.com" OR sourcehostname CONTAINS "10195-coinbase.com" OR sourcehostname CONTAINS "11246-coinbase.com" OR sourcehostname CONTAINS "11247-coinbase.com" OR sourcehostname CONTAINS "11248-coinbase.com" OR sourcehostname CONTAINS "11258-coinbase.com" OR sourcehostname CONTAINS "11259-coinbase.com" OR sourcehostname CONTAINS "113912-coinbase.com" OR sourcehostname CONTAINS "11472-coinbase.com" OR sourcehostname CONTAINS "11923-coinbase.com" OR sourcehostname CONTAINS "11957-coinbase.com" OR sourcehostname CONTAINS "128147-coinbase.com" OR sourcehostname CONTAINS "12958-coinbase.com" OR sourcehostname CONTAINS "12984-okta.com" OR sourcehostname CONTAINS "12985-coinbase.com" OR sourcehostname CONTAINS "13130-coinbase.com" OR sourcehostname CONTAINS "13247-coinbase.com" OR sourcehostname CONTAINS "13247-icloud.com" OR sourcehostname CONTAINS "13267-coinbase.com" OR sourcehostname CONTAINS "146271510-coinbase.com" OR sourcehostname CONTAINS "146282-coinbase.com" OR sourcehostname CONTAINS "146284-coinbase.com" OR sourcehostname CONTAINS "147260-coinbase.com" OR sourcehostname CONTAINS "14765-coinbase.com" OR sourcehostname CONTAINS "14817582-coinbase.com" OR sourcehostname CONTAINS "14871904-coinbase.com" OR sourcehostname CONTAINS "14891902-coinbase.com" OR sourcehostname CONTAINS "1492864-coinbase.com" OR sourcehostname CONTAINS "158312-coinbase.com" OR sourcehostname CONTAINS "158372-coinbase.com" OR sourcehostname CONTAINS "158702-coinbase.com" OR sourcehostname CONTAINS "16171675-coinbase.com" OR sourcehostname CONTAINS "16171832-coinbase.com" OR sourcehostname CONTAINS "16178234-coinbase.com" OR sourcehostname CONTAINS "16178237-coinbase.com" OR sourcehostname CONTAINS "16178434-coinbase.com" OR sourcehostname CONTAINS "162178-coinbase.com" OR sourcehostname CONTAINS "162478-coinbase.com" OR sourcehostname CONTAINS "162782-coinbase.com" OR sourcehostname CONTAINS "162812-coinbase.com" OR sourcehostname CONTAINS "162814-coinbase.com" OR sourcehostname CONTAINS "16442580-coinbase.com" OR sourcehostname CONTAINS "16450107-coinbase.com")
index=activity AND rg_functionality="Endpoint management systems" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "official-server.com" OR destinationntdomain CONTAINS "server694590423.tech" OR destinationntdomain CONTAINS "island-placid-bromine.glitch.me" OR destinationntdomain CONTAINS "circular-noon-farmhouse.glitch.me" OR destinationntdomain CONTAINS "talented-friendly-price.glitch.me" OR destinationntdomain CONTAINS "dflfmgsdokasdcpl.com" OR destinationntdomain CONTAINS "original-backend.com" OR destinationntdomain CONTAINS "07159889-coinbase.com" OR destinationntdomain CONTAINS "10195-coinbase.com" OR destinationntdomain CONTAINS "11246-coinbase.com" OR destinationntdomain CONTAINS "11247-coinbase.com" OR destinationntdomain CONTAINS "11248-coinbase.com" OR destinationntdomain CONTAINS "11258-coinbase.com" OR destinationntdomain CONTAINS "11259-coinbase.com" OR destinationntdomain CONTAINS "113912-coinbase.com" OR destinationntdomain CONTAINS "11472-coinbase.com" OR destinationntdomain CONTAINS "11923-coinbase.com" OR destinationntdomain CONTAINS "11957-coinbase.com" OR destinationntdomain CONTAINS "128147-coinbase.com" OR destinationntdomain CONTAINS "12958-coinbase.com" OR destinationntdomain CONTAINS "12984-okta.com" OR destinationntdomain CONTAINS "12985-coinbase.com" OR destinationntdomain CONTAINS "13130-coinbase.com" OR destinationntdomain CONTAINS "13247-coinbase.com" OR destinationntdomain CONTAINS "13247-icloud.com" OR destinationntdomain CONTAINS "13267-coinbase.com" OR destinationntdomain CONTAINS "146271510-coinbase.com" OR destinationntdomain CONTAINS "146282-coinbase.com" OR destinationntdomain CONTAINS "146284-coinbase.com" OR destinationntdomain CONTAINS "147260-coinbase.com" OR destinationntdomain CONTAINS "14765-coinbase.com" OR destinationntdomain CONTAINS "14817582-coinbase.com" OR destinationntdomain CONTAINS "14871904-coinbase.com" OR destinationntdomain CONTAINS "14891902-coinbase.com" OR destinationntdomain CONTAINS "1492864-coinbase.com" OR destinationntdomain CONTAINS "158312-coinbase.com" OR destinationntdomain CONTAINS "158372-coinbase.com" OR destinationntdomain CONTAINS "158702-coinbase.com" OR destinationntdomain CONTAINS "16171675-coinbase.com" OR destinationntdomain CONTAINS "16171832-coinbase.com" OR destinationntdomain CONTAINS "16178234-coinbase.com" OR destinationntdomain CONTAINS "16178237-coinbase.com" OR destinationntdomain CONTAINS "16178434-coinbase.com" OR destinationntdomain CONTAINS "162178-coinbase.com" OR destinationntdomain CONTAINS "162478-coinbase.com" OR destinationntdomain CONTAINS "162782-coinbase.com" OR destinationntdomain CONTAINS "162812-coinbase.com" OR destinationntdomain CONTAINS "162814-coinbase.com" OR destinationntdomain CONTAINS "16442580-coinbase.com" OR destinationntdomain CONTAINS "16450107-coinbase.com")
index=activity AND rg_functionality="Endpoint management systems" AND requesturl NOT NULL AND (requesturl CONTAINS "official-server.com" OR requesturl CONTAINS "server694590423.tech" OR requesturl CONTAINS "island-placid-bromine.glitch.me" OR requesturl CONTAINS "circular-noon-farmhouse.glitch.me" OR requesturl CONTAINS "talented-friendly-price.glitch.me" OR requesturl CONTAINS "dflfmgsdokasdcpl.com" OR requesturl CONTAINS "original-backend.com" OR requesturl CONTAINS "07159889-coinbase.com" OR requesturl CONTAINS "10195-coinbase.com" OR requesturl CONTAINS "11246-coinbase.com" OR requesturl CONTAINS "11247-coinbase.com" OR requesturl CONTAINS "11248-coinbase.com" OR requesturl CONTAINS "11258-coinbase.com" OR requesturl CONTAINS "11259-coinbase.com" OR requesturl CONTAINS "113912-coinbase.com" OR requesturl CONTAINS "11472-coinbase.com" OR requesturl CONTAINS "11923-coinbase.com" OR requesturl CONTAINS "11957-coinbase.com" OR requesturl CONTAINS "128147-coinbase.com" OR requesturl CONTAINS "12958-coinbase.com" OR requesturl CONTAINS "12984-okta.com" OR requesturl CONTAINS "12985-coinbase.com" OR requesturl CONTAINS "13130-coinbase.com" OR requesturl CONTAINS "13247-coinbase.com" OR requesturl CONTAINS "13247-icloud.com" OR requesturl CONTAINS "13267-coinbase.com" OR requesturl CONTAINS "146271510-coinbase.com" OR requesturl CONTAINS "146282-coinbase.com" OR requesturl CONTAINS "146284-coinbase.com" OR requesturl CONTAINS "147260-coinbase.com" OR requesturl CONTAINS "14765-coinbase.com" OR requesturl CONTAINS "14817582-coinbase.com" OR requesturl CONTAINS "14871904-coinbase.com" OR requesturl CONTAINS "14891902-coinbase.com" OR requesturl CONTAINS "1492864-coinbase.com" OR requesturl CONTAINS "158312-coinbase.com" OR requesturl CONTAINS "158372-coinbase.com" OR requesturl CONTAINS "158702-coinbase.com" OR requesturl CONTAINS "16171675-coinbase.com" OR requesturl CONTAINS "16171832-coinbase.com" OR requesturl CONTAINS "16178234-coinbase.com" OR requesturl CONTAINS "16178237-coinbase.com" OR requesturl CONTAINS "16178434-coinbase.com" OR requesturl CONTAINS "162178-coinbase.com" OR requesturl CONTAINS "162478-coinbase.com" OR requesturl CONTAINS "162782-coinbase.com" OR requesturl CONTAINS "162812-coinbase.com" OR requesturl CONTAINS "162814-coinbase.com" OR requesturl CONTAINS "16442580-coinbase.com" OR requesturl CONTAINS "16450107-coinbase.com")
index=activity AND rg_functionality="Endpoint management systems" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "16450207-coinbase.com" OR destinationhostname CONTAINS "16458207-coinbase.com" OR destinationhostname CONTAINS "16478202-coinbase.com" OR destinationhostname CONTAINS "164872942-coinbase.com" OR destinationhostname CONTAINS "16590-coinbase.com" OR destinationhostname CONTAINS "16594373-coinbase.com" OR destinationhostname CONTAINS "16624831-coinbase.com" OR destinationhostname CONTAINS "16642124-coinbase.com" OR destinationhostname CONTAINS "16642172-coinbase.com" OR destinationhostname CONTAINS "16642580-coinbase.com" OR destinationhostname CONTAINS "16642721-coinbase.com" OR destinationhostname CONTAINS "16642724-coinbase.com" OR destinationhostname CONTAINS "16642871-coinbase.com" OR destinationhostname CONTAINS "16642872-coinbase.com" OR destinationhostname CONTAINS "16712942-coinbase.com" OR destinationhostname CONTAINS "16718672-coinbase.com" OR destinationhostname CONTAINS "16728342-coinbase.com" OR destinationhostname CONTAINS "16728348-coinbase.com" OR destinationhostname CONTAINS "16728442-coinbase.com" OR destinationhostname CONTAINS "16728472-coinbase.com" OR destinationhostname CONTAINS "167285-coinbase.com" OR destinationhostname CONTAINS "16729042-coinbase.com" OR destinationhostname CONTAINS "16748272-coinbase.com" OR destinationhostname CONTAINS "16782942-coinbase.com" OR destinationhostname CONTAINS "16827420-coinbase.com" OR destinationhostname CONTAINS "16827423-coinbase.com" OR destinationhostname CONTAINS "16847145-coinbase.com" OR destinationhostname CONTAINS "16893924-coinbase.com" OR destinationhostname CONTAINS "17182-coinbase.com" OR destinationhostname CONTAINS "17255030-coinbase.com" OR destinationhostname CONTAINS "17259-kraken.com" OR destinationhostname CONTAINS "172486-coinbase.com" OR destinationhostname CONTAINS "17284652-coinbase.com" OR destinationhostname CONTAINS "17286-coinbase.com" OR destinationhostname CONTAINS "17334522-coinbase.com" OR destinationhostname CONTAINS "17334522-kraken.com" OR destinationhostname CONTAINS "17384522-coinbase.com" OR destinationhostname CONTAINS "173912-coinbase.com" OR destinationhostname CONTAINS "17494976-coinbase.com" OR destinationhostname CONTAINS "17512854-coinbase.com" OR destinationhostname CONTAINS "17512857-coinbase.com" OR destinationhostname CONTAINS "1751954-coinbase.com" OR destinationhostname CONTAINS "17525030-coinbase.com" OR destinationhostname CONTAINS "17529580-coinbase.com" OR destinationhostname CONTAINS "17614-coinbase.com" OR destinationhostname CONTAINS "17618412-coinbase.com" OR destinationhostname CONTAINS "17619-coinbase.com" OR destinationhostname CONTAINS "176284-coinbase.com" OR destinationhostname CONTAINS "17823920-coinbase.com" OR destinationhostname CONTAINS "178253-coinbase.com")
index=activity AND rg_functionality="Endpoint management systems" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "16450207-coinbase.com" OR sourcentdomain CONTAINS "16458207-coinbase.com" OR sourcentdomain CONTAINS "16478202-coinbase.com" OR sourcentdomain CONTAINS "164872942-coinbase.com" OR sourcentdomain CONTAINS "16590-coinbase.com" OR sourcentdomain CONTAINS "16594373-coinbase.com" OR sourcentdomain CONTAINS "16624831-coinbase.com" OR sourcentdomain CONTAINS "16642124-coinbase.com" OR sourcentdomain CONTAINS "16642172-coinbase.com" OR sourcentdomain CONTAINS "16642580-coinbase.com" OR sourcentdomain CONTAINS "16642721-coinbase.com" OR sourcentdomain CONTAINS "16642724-coinbase.com" OR sourcentdomain CONTAINS "16642871-coinbase.com" OR sourcentdomain CONTAINS "16642872-coinbase.com" OR sourcentdomain CONTAINS "16712942-coinbase.com" OR sourcentdomain CONTAINS "16718672-coinbase.com" OR sourcentdomain CONTAINS "16728342-coinbase.com" OR sourcentdomain CONTAINS "16728348-coinbase.com" OR sourcentdomain CONTAINS "16728442-coinbase.com" OR sourcentdomain CONTAINS "16728472-coinbase.com" OR sourcentdomain CONTAINS "167285-coinbase.com" OR sourcentdomain CONTAINS "16729042-coinbase.com" OR sourcentdomain CONTAINS "16748272-coinbase.com" OR sourcentdomain CONTAINS "16782942-coinbase.com" OR sourcentdomain CONTAINS "16827420-coinbase.com" OR sourcentdomain CONTAINS "16827423-coinbase.com" OR sourcentdomain CONTAINS "16847145-coinbase.com" OR sourcentdomain CONTAINS "16893924-coinbase.com" OR sourcentdomain CONTAINS "17182-coinbase.com" OR sourcentdomain CONTAINS "17255030-coinbase.com" OR sourcentdomain CONTAINS "17259-kraken.com" OR sourcentdomain CONTAINS "172486-coinbase.com" OR sourcentdomain CONTAINS "17284652-coinbase.com" OR sourcentdomain CONTAINS "17286-coinbase.com" OR sourcentdomain CONTAINS "17334522-coinbase.com" OR sourcentdomain CONTAINS "17334522-kraken.com" OR sourcentdomain CONTAINS "17384522-coinbase.com" OR sourcentdomain CONTAINS "173912-coinbase.com" OR sourcentdomain CONTAINS "17494976-coinbase.com" OR sourcentdomain CONTAINS "17512854-coinbase.com" OR sourcentdomain CONTAINS "17512857-coinbase.com" OR sourcentdomain CONTAINS "1751954-coinbase.com" OR sourcentdomain CONTAINS "17525030-coinbase.com" OR sourcentdomain CONTAINS "17529580-coinbase.com" OR sourcentdomain CONTAINS "17614-coinbase.com" OR sourcentdomain CONTAINS "17618412-coinbase.com" OR sourcentdomain CONTAINS "17619-coinbase.com" OR sourcentdomain CONTAINS "176284-coinbase.com" OR sourcentdomain CONTAINS "17823920-coinbase.com" OR sourcentdomain CONTAINS "178253-coinbase.com")
index=activity AND rg_functionality="Endpoint management systems" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "16450207-coinbase.com" OR sourcehostname CONTAINS "16458207-coinbase.com" OR sourcehostname CONTAINS "16478202-coinbase.com" OR sourcehostname CONTAINS "164872942-coinbase.com" OR sourcehostname CONTAINS "16590-coinbase.com" OR sourcehostname CONTAINS "16594373-coinbase.com" OR sourcehostname CONTAINS "16624831-coinbase.com" OR sourcehostname CONTAINS "16642124-coinbase.com" OR sourcehostname CONTAINS "16642172-coinbase.com" OR sourcehostname CONTAINS "16642580-coinbase.com" OR sourcehostname CONTAINS "16642721-coinbase.com" OR sourcehostname CONTAINS "16642724-coinbase.com" OR sourcehostname CONTAINS "16642871-coinbase.com" OR sourcehostname CONTAINS "16642872-coinbase.com" OR sourcehostname CONTAINS "16712942-coinbase.com" OR sourcehostname CONTAINS "16718672-coinbase.com" OR sourcehostname CONTAINS "16728342-coinbase.com" OR sourcehostname CONTAINS "16728348-coinbase.com" OR sourcehostname CONTAINS "16728442-coinbase.com" OR sourcehostname CONTAINS "16728472-coinbase.com" OR sourcehostname CONTAINS "167285-coinbase.com" OR sourcehostname CONTAINS "16729042-coinbase.com" OR sourcehostname CONTAINS "16748272-coinbase.com" OR sourcehostname CONTAINS "16782942-coinbase.com" OR sourcehostname CONTAINS "16827420-coinbase.com" OR sourcehostname CONTAINS "16827423-coinbase.com" OR sourcehostname CONTAINS "16847145-coinbase.com" OR sourcehostname CONTAINS "16893924-coinbase.com" OR sourcehostname CONTAINS "17182-coinbase.com" OR sourcehostname CONTAINS "17255030-coinbase.com" OR sourcehostname CONTAINS "17259-kraken.com" OR sourcehostname CONTAINS "172486-coinbase.com" OR sourcehostname CONTAINS "17284652-coinbase.com" OR sourcehostname CONTAINS "17286-coinbase.com" OR sourcehostname CONTAINS "17334522-coinbase.com" OR sourcehostname CONTAINS "17334522-kraken.com" OR sourcehostname CONTAINS "17384522-coinbase.com" OR sourcehostname CONTAINS "173912-coinbase.com" OR sourcehostname CONTAINS "17494976-coinbase.com" OR sourcehostname CONTAINS "17512854-coinbase.com" OR sourcehostname CONTAINS "17512857-coinbase.com" OR sourcehostname CONTAINS "1751954-coinbase.com" OR sourcehostname CONTAINS "17525030-coinbase.com" OR sourcehostname CONTAINS "17529580-coinbase.com" OR sourcehostname CONTAINS "17614-coinbase.com" OR sourcehostname CONTAINS "17618412-coinbase.com" OR sourcehostname CONTAINS "17619-coinbase.com" OR sourcehostname CONTAINS "176284-coinbase.com" OR sourcehostname CONTAINS "17823920-coinbase.com" OR sourcehostname CONTAINS "178253-coinbase.com")
index=activity AND rg_functionality="Endpoint management systems" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "16450207-coinbase.com" OR destinationntdomain CONTAINS "16458207-coinbase.com" OR destinationntdomain CONTAINS "16478202-coinbase.com" OR destinationntdomain CONTAINS "164872942-coinbase.com" OR destinationntdomain CONTAINS "16590-coinbase.com" OR destinationntdomain CONTAINS "16594373-coinbase.com" OR destinationntdomain CONTAINS "16624831-coinbase.com" OR destinationntdomain CONTAINS "16642124-coinbase.com" OR destinationntdomain CONTAINS "16642172-coinbase.com" OR destinationntdomain CONTAINS "16642580-coinbase.com" OR destinationntdomain CONTAINS "16642721-coinbase.com" OR destinationntdomain CONTAINS "16642724-coinbase.com" OR destinationntdomain CONTAINS "16642871-coinbase.com" OR destinationntdomain CONTAINS "16642872-coinbase.com" OR destinationntdomain CONTAINS "16712942-coinbase.com" OR destinationntdomain CONTAINS "16718672-coinbase.com" OR destinationntdomain CONTAINS "16728342-coinbase.com" OR destinationntdomain CONTAINS "16728348-coinbase.com" OR destinationntdomain CONTAINS "16728442-coinbase.com" OR destinationntdomain CONTAINS "16728472-coinbase.com" OR destinationntdomain CONTAINS "167285-coinbase.com" OR destinationntdomain CONTAINS "16729042-coinbase.com" OR destinationntdomain CONTAINS "16748272-coinbase.com" OR destinationntdomain CONTAINS "16782942-coinbase.com" OR destinationntdomain CONTAINS "16827420-coinbase.com" OR destinationntdomain CONTAINS "16827423-coinbase.com" OR destinationntdomain CONTAINS "16847145-coinbase.com" OR destinationntdomain CONTAINS "16893924-coinbase.com" OR destinationntdomain CONTAINS "17182-coinbase.com" OR destinationntdomain CONTAINS "17255030-coinbase.com" OR destinationntdomain CONTAINS "17259-kraken.com" OR destinationntdomain CONTAINS "172486-coinbase.com" OR destinationntdomain CONTAINS "17284652-coinbase.com" OR destinationntdomain CONTAINS "17286-coinbase.com" OR destinationntdomain CONTAINS "17334522-coinbase.com" OR destinationntdomain CONTAINS "17334522-kraken.com" OR destinationntdomain CONTAINS "17384522-coinbase.com" OR destinationntdomain CONTAINS "173912-coinbase.com" OR destinationntdomain CONTAINS "17494976-coinbase.com" OR destinationntdomain CONTAINS "17512854-coinbase.com" OR destinationntdomain CONTAINS "17512857-coinbase.com" OR destinationntdomain CONTAINS "1751954-coinbase.com" OR destinationntdomain CONTAINS "17525030-coinbase.com" OR destinationntdomain CONTAINS "17529580-coinbase.com" OR destinationntdomain CONTAINS "17614-coinbase.com" OR destinationntdomain CONTAINS "17618412-coinbase.com" OR destinationntdomain CONTAINS "17619-coinbase.com" OR destinationntdomain CONTAINS "176284-coinbase.com" OR destinationntdomain CONTAINS "17823920-coinbase.com" OR destinationntdomain CONTAINS "178253-coinbase.com")
index=activity AND rg_functionality="Endpoint management systems" AND requesturl NOT NULL AND (requesturl CONTAINS "16450207-coinbase.com" OR requesturl CONTAINS "16458207-coinbase.com" OR requesturl CONTAINS "16478202-coinbase.com" OR requesturl CONTAINS "164872942-coinbase.com" OR requesturl CONTAINS "16590-coinbase.com" OR requesturl CONTAINS "16594373-coinbase.com" OR requesturl CONTAINS "16624831-coinbase.com" OR requesturl CONTAINS "16642124-coinbase.com" OR requesturl CONTAINS "16642172-coinbase.com" OR requesturl CONTAINS "16642580-coinbase.com" OR requesturl CONTAINS "16642721-coinbase.com" OR requesturl CONTAINS "16642724-coinbase.com" OR requesturl CONTAINS "16642871-coinbase.com" OR requesturl CONTAINS "16642872-coinbase.com" OR requesturl CONTAINS "16712942-coinbase.com" OR requesturl CONTAINS "16718672-coinbase.com" OR requesturl CONTAINS "16728342-coinbase.com" OR requesturl CONTAINS "16728348-coinbase.com" OR requesturl CONTAINS "16728442-coinbase.com" OR requesturl CONTAINS "16728472-coinbase.com" OR requesturl CONTAINS "167285-coinbase.com" OR requesturl CONTAINS "16729042-coinbase.com" OR requesturl CONTAINS "16748272-coinbase.com" OR requesturl CONTAINS "16782942-coinbase.com" OR requesturl CONTAINS "16827420-coinbase.com" OR requesturl CONTAINS "16827423-coinbase.com" OR requesturl CONTAINS "16847145-coinbase.com" OR requesturl CONTAINS "16893924-coinbase.com" OR requesturl CONTAINS "17182-coinbase.com" OR requesturl CONTAINS "17255030-coinbase.com" OR requesturl CONTAINS "17259-kraken.com" OR requesturl CONTAINS "172486-coinbase.com" OR requesturl CONTAINS "17284652-coinbase.com" OR requesturl CONTAINS "17286-coinbase.com" OR requesturl CONTAINS "17334522-coinbase.com" OR requesturl CONTAINS "17334522-kraken.com" OR requesturl CONTAINS "17384522-coinbase.com" OR requesturl CONTAINS "173912-coinbase.com" OR requesturl CONTAINS "17494976-coinbase.com" OR requesturl CONTAINS "17512854-coinbase.com" OR requesturl CONTAINS "17512857-coinbase.com" OR requesturl CONTAINS "1751954-coinbase.com" OR requesturl CONTAINS "17525030-coinbase.com" OR requesturl CONTAINS "17529580-coinbase.com" OR requesturl CONTAINS "17614-coinbase.com" OR requesturl CONTAINS "17618412-coinbase.com" OR requesturl CONTAINS "17619-coinbase.com" OR requesturl CONTAINS "176284-coinbase.com" OR requesturl CONTAINS "17823920-coinbase.com" OR requesturl CONTAINS "178253-coinbase.com")
index=activity AND rg_functionality="Endpoint management systems" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "178294-coinbase.com" OR destinationhostname CONTAINS "17912-coinbase.com" OR destinationhostname CONTAINS "17914-coinbase.com" OR destinationhostname CONTAINS "17917-coinbase.com" OR destinationhostname CONTAINS "17954-coinbase.com" OR destinationhostname CONTAINS "17958-coinbase.com" OR destinationhostname CONTAINS "182043-coinbase.com" OR destinationhostname CONTAINS "18275-gemini.com" OR destinationhostname CONTAINS "18276-coinbase.com" OR destinationhostname CONTAINS "18290185-coinbase.com" OR destinationhostname CONTAINS "182967-coinbase.com" OR destinationhostname CONTAINS "18560-coinbase.com" OR destinationhostname CONTAINS "18571-coinbase.com" OR destinationhostname CONTAINS "185912-coinbase.com" OR destinationhostname CONTAINS "185914-coinbase.com" OR destinationhostname CONTAINS "18592176-coinbase.com" OR destinationhostname CONTAINS "18594162-coinbase.com" OR destinationhostname CONTAINS "18594962-coinbase.com" OR destinationhostname CONTAINS "18597162-coinbase.com" OR destinationhostname CONTAINS "18719562-coinbase.com" OR destinationhostname CONTAINS "1875290-coinbase.com" OR destinationhostname CONTAINS "1882730-coinbase.com" OR destinationhostname CONTAINS "18902-coinbase.com" OR destinationhostname CONTAINS "18903-coinbase.com" OR destinationhostname CONTAINS "189126-coinbase.com" OR destinationhostname CONTAINS "18952-coinbase.com" OR destinationhostname CONTAINS "192854-coinbase.com" OR destinationhostname CONTAINS "192856-coinbase.com" OR destinationhostname CONTAINS "19287-binance.com" OR destinationhostname CONTAINS "19572-coinbase.com" OR destinationhostname CONTAINS "195812-coinbase.com" OR destinationhostname CONTAINS "195826-coinbase.com" OR destinationhostname CONTAINS "1958262-coinbase.com" OR destinationhostname CONTAINS "195827-binance.com" OR destinationhostname CONTAINS "1958297-coinbase.com" OR destinationhostname CONTAINS "19582970-coinbase.com" OR destinationhostname CONTAINS "19582971-coinbase.com" OR destinationhostname CONTAINS "19583-coinbase.com" OR destinationhostname CONTAINS "19592653-coinbase.com" OR destinationhostname CONTAINS "197304-coinbase.com" OR destinationhostname CONTAINS "19730492-coinbase.com" OR destinationhostname CONTAINS "19764162-coinbase.com" OR destinationhostname CONTAINS "19803-coinbase.com" OR destinationhostname CONTAINS "201784289-coinbase.com" OR destinationhostname CONTAINS "210823644-coinbase.com" OR destinationhostname CONTAINS "21158-coinbase.com" OR destinationhostname CONTAINS "21509-coinbase.com" OR destinationhostname CONTAINS "25985-coinbase.com" OR destinationhostname CONTAINS "27699-coinbase.com" OR destinationhostname CONTAINS "28367-coinbase.com")
index=activity AND rg_functionality="Endpoint management systems" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "178294-coinbase.com" OR sourcentdomain CONTAINS "17912-coinbase.com" OR sourcentdomain CONTAINS "17914-coinbase.com" OR sourcentdomain CONTAINS "17917-coinbase.com" OR sourcentdomain CONTAINS "17954-coinbase.com" OR sourcentdomain CONTAINS "17958-coinbase.com" OR sourcentdomain CONTAINS "182043-coinbase.com" OR sourcentdomain CONTAINS "18275-gemini.com" OR sourcentdomain CONTAINS "18276-coinbase.com" OR sourcentdomain CONTAINS "18290185-coinbase.com" OR sourcentdomain CONTAINS "182967-coinbase.com" OR sourcentdomain CONTAINS "18560-coinbase.com" OR sourcentdomain CONTAINS "18571-coinbase.com" OR sourcentdomain CONTAINS "185912-coinbase.com" OR sourcentdomain CONTAINS "185914-coinbase.com" OR sourcentdomain CONTAINS "18592176-coinbase.com" OR sourcentdomain CONTAINS "18594162-coinbase.com" OR sourcentdomain CONTAINS "18594962-coinbase.com" OR sourcentdomain CONTAINS "18597162-coinbase.com" OR sourcentdomain CONTAINS "18719562-coinbase.com" OR sourcentdomain CONTAINS "1875290-coinbase.com" OR sourcentdomain CONTAINS "1882730-coinbase.com" OR sourcentdomain CONTAINS "18902-coinbase.com" OR sourcentdomain CONTAINS "18903-coinbase.com" OR sourcentdomain CONTAINS "189126-coinbase.com" OR sourcentdomain CONTAINS "18952-coinbase.com" OR sourcentdomain CONTAINS "192854-coinbase.com" OR sourcentdomain CONTAINS "192856-coinbase.com" OR sourcentdomain CONTAINS "19287-binance.com" OR sourcentdomain CONTAINS "19572-coinbase.com" OR sourcentdomain CONTAINS "195812-coinbase.com" OR sourcentdomain CONTAINS "195826-coinbase.com" OR sourcentdomain CONTAINS "1958262-coinbase.com" OR sourcentdomain CONTAINS "195827-binance.com" OR sourcentdomain CONTAINS "1958297-coinbase.com" OR sourcentdomain CONTAINS "19582970-coinbase.com" OR sourcentdomain CONTAINS "19582971-coinbase.com" OR sourcentdomain CONTAINS "19583-coinbase.com" OR sourcentdomain CONTAINS "19592653-coinbase.com" OR sourcentdomain CONTAINS "197304-coinbase.com" OR sourcentdomain CONTAINS "19730492-coinbase.com" OR sourcentdomain CONTAINS "19764162-coinbase.com" OR sourcentdomain CONTAINS "19803-coinbase.com" OR sourcentdomain CONTAINS "201784289-coinbase.com" OR sourcentdomain CONTAINS "210823644-coinbase.com" OR sourcentdomain CONTAINS "21158-coinbase.com" OR sourcentdomain CONTAINS "21509-coinbase.com" OR sourcentdomain CONTAINS "25985-coinbase.com" OR sourcentdomain CONTAINS "27699-coinbase.com" OR sourcentdomain CONTAINS "28367-coinbase.com")
index=activity AND rg_functionality="Endpoint management systems" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "178294-coinbase.com" OR sourcehostname CONTAINS "17912-coinbase.com" OR sourcehostname CONTAINS "17914-coinbase.com" OR sourcehostname CONTAINS "17917-coinbase.com" OR sourcehostname CONTAINS "17954-coinbase.com" OR sourcehostname CONTAINS "17958-coinbase.com" OR sourcehostname CONTAINS "182043-coinbase.com" OR sourcehostname CONTAINS "18275-gemini.com" OR sourcehostname CONTAINS "18276-coinbase.com" OR sourcehostname CONTAINS "18290185-coinbase.com" OR sourcehostname CONTAINS "182967-coinbase.com" OR sourcehostname CONTAINS "18560-coinbase.com" OR sourcehostname CONTAINS "18571-coinbase.com" OR sourcehostname CONTAINS "185912-coinbase.com" OR sourcehostname CONTAINS "185914-coinbase.com" OR sourcehostname CONTAINS "18592176-coinbase.com" OR sourcehostname CONTAINS "18594162-coinbase.com" OR sourcehostname CONTAINS "18594962-coinbase.com" OR sourcehostname CONTAINS "18597162-coinbase.com" OR sourcehostname CONTAINS "18719562-coinbase.com" OR sourcehostname CONTAINS "1875290-coinbase.com" OR sourcehostname CONTAINS "1882730-coinbase.com" OR sourcehostname CONTAINS "18902-coinbase.com" OR sourcehostname CONTAINS "18903-coinbase.com" OR sourcehostname CONTAINS "189126-coinbase.com" OR sourcehostname CONTAINS "18952-coinbase.com" OR sourcehostname CONTAINS "192854-coinbase.com" OR sourcehostname CONTAINS "192856-coinbase.com" OR sourcehostname CONTAINS "19287-binance.com" OR sourcehostname CONTAINS "19572-coinbase.com" OR sourcehostname CONTAINS "195812-coinbase.com" OR sourcehostname CONTAINS "195826-coinbase.com" OR sourcehostname CONTAINS "1958262-coinbase.com" OR sourcehostname CONTAINS "195827-binance.com" OR sourcehostname CONTAINS "1958297-coinbase.com" OR sourcehostname CONTAINS "19582970-coinbase.com" OR sourcehostname CONTAINS "19582971-coinbase.com" OR sourcehostname CONTAINS "19583-coinbase.com" OR sourcehostname CONTAINS "19592653-coinbase.com" OR sourcehostname CONTAINS "197304-coinbase.com" OR sourcehostname CONTAINS "19730492-coinbase.com" OR sourcehostname CONTAINS "19764162-coinbase.com" OR sourcehostname CONTAINS "19803-coinbase.com" OR sourcehostname CONTAINS "201784289-coinbase.com" OR sourcehostname CONTAINS "210823644-coinbase.com" OR sourcehostname CONTAINS "21158-coinbase.com" OR sourcehostname CONTAINS "21509-coinbase.com" OR sourcehostname CONTAINS "25985-coinbase.com" OR sourcehostname CONTAINS "27699-coinbase.com" OR sourcehostname CONTAINS "28367-coinbase.com")
index=activity AND rg_functionality="Endpoint management systems" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "178294-coinbase.com" OR destinationntdomain CONTAINS "17912-coinbase.com" OR destinationntdomain CONTAINS "17914-coinbase.com" OR destinationntdomain CONTAINS "17917-coinbase.com" OR destinationntdomain CONTAINS "17954-coinbase.com" OR destinationntdomain CONTAINS "17958-coinbase.com" OR destinationntdomain CONTAINS "182043-coinbase.com" OR destinationntdomain CONTAINS "18275-gemini.com" OR destinationntdomain CONTAINS "18276-coinbase.com" OR destinationntdomain CONTAINS "18290185-coinbase.com" OR destinationntdomain CONTAINS "182967-coinbase.com" OR destinationntdomain CONTAINS "18560-coinbase.com" OR destinationntdomain CONTAINS "18571-coinbase.com" OR destinationntdomain CONTAINS "185912-coinbase.com" OR destinationntdomain CONTAINS "185914-coinbase.com" OR destinationntdomain CONTAINS "18592176-coinbase.com" OR destinationntdomain CONTAINS "18594162-coinbase.com" OR destinationntdomain CONTAINS "18594962-coinbase.com" OR destinationntdomain CONTAINS "18597162-coinbase.com" OR destinationntdomain CONTAINS "18719562-coinbase.com" OR destinationntdomain CONTAINS "1875290-coinbase.com" OR destinationntdomain CONTAINS "1882730-coinbase.com" OR destinationntdomain CONTAINS "18902-coinbase.com" OR destinationntdomain CONTAINS "18903-coinbase.com" OR destinationntdomain CONTAINS "189126-coinbase.com" OR destinationntdomain CONTAINS "18952-coinbase.com" OR destinationntdomain CONTAINS "192854-coinbase.com" OR destinationntdomain CONTAINS "192856-coinbase.com" OR destinationntdomain CONTAINS "19287-binance.com" OR destinationntdomain CONTAINS "19572-coinbase.com" OR destinationntdomain CONTAINS "195812-coinbase.com" OR destinationntdomain CONTAINS "195826-coinbase.com" OR destinationntdomain CONTAINS "1958262-coinbase.com" OR destinationntdomain CONTAINS "195827-binance.com" OR destinationntdomain CONTAINS "1958297-coinbase.com" OR destinationntdomain CONTAINS "19582970-coinbase.com" OR destinationntdomain CONTAINS "19582971-coinbase.com" OR destinationntdomain CONTAINS "19583-coinbase.com" OR destinationntdomain CONTAINS "19592653-coinbase.com" OR destinationntdomain CONTAINS "197304-coinbase.com" OR destinationntdomain CONTAINS "19730492-coinbase.com" OR destinationntdomain CONTAINS "19764162-coinbase.com" OR destinationntdomain CONTAINS "19803-coinbase.com" OR destinationntdomain CONTAINS "201784289-coinbase.com" OR destinationntdomain CONTAINS "210823644-coinbase.com" OR destinationntdomain CONTAINS "21158-coinbase.com" OR destinationntdomain CONTAINS "21509-coinbase.com" OR destinationntdomain CONTAINS "25985-coinbase.com" OR destinationntdomain CONTAINS "27699-coinbase.com" OR destinationntdomain CONTAINS "28367-coinbase.com")
index=activity AND rg_functionality="Endpoint management systems" AND requesturl NOT NULL AND (requesturl CONTAINS "178294-coinbase.com" OR requesturl CONTAINS "17912-coinbase.com" OR requesturl CONTAINS "17914-coinbase.com" OR requesturl CONTAINS "17917-coinbase.com" OR requesturl CONTAINS "17954-coinbase.com" OR requesturl CONTAINS "17958-coinbase.com" OR requesturl CONTAINS "182043-coinbase.com" OR requesturl CONTAINS "18275-gemini.com" OR requesturl CONTAINS "18276-coinbase.com" OR requesturl CONTAINS "18290185-coinbase.com" OR requesturl CONTAINS "182967-coinbase.com" OR requesturl CONTAINS "18560-coinbase.com" OR requesturl CONTAINS "18571-coinbase.com" OR requesturl CONTAINS "185912-coinbase.com" OR requesturl CONTAINS "185914-coinbase.com" OR requesturl CONTAINS "18592176-coinbase.com" OR requesturl CONTAINS "18594162-coinbase.com" OR requesturl CONTAINS "18594962-coinbase.com" OR requesturl CONTAINS "18597162-coinbase.com" OR requesturl CONTAINS "18719562-coinbase.com" OR requesturl CONTAINS "1875290-coinbase.com" OR requesturl CONTAINS "1882730-coinbase.com" OR requesturl CONTAINS "18902-coinbase.com" OR requesturl CONTAINS "18903-coinbase.com" OR requesturl CONTAINS "189126-coinbase.com" OR requesturl CONTAINS "18952-coinbase.com" OR requesturl CONTAINS "192854-coinbase.com" OR requesturl CONTAINS "192856-coinbase.com" OR requesturl CONTAINS "19287-binance.com" OR requesturl CONTAINS "19572-coinbase.com" OR requesturl CONTAINS "195812-coinbase.com" OR requesturl CONTAINS "195826-coinbase.com" OR requesturl CONTAINS "1958262-coinbase.com" OR requesturl CONTAINS "195827-binance.com" OR requesturl CONTAINS "1958297-coinbase.com" OR requesturl CONTAINS "19582970-coinbase.com" OR requesturl CONTAINS "19582971-coinbase.com" OR requesturl CONTAINS "19583-coinbase.com" OR requesturl CONTAINS "19592653-coinbase.com" OR requesturl CONTAINS "197304-coinbase.com" OR requesturl CONTAINS "19730492-coinbase.com" OR requesturl CONTAINS "19764162-coinbase.com" OR requesturl CONTAINS "19803-coinbase.com" OR requesturl CONTAINS "201784289-coinbase.com" OR requesturl CONTAINS "210823644-coinbase.com" OR requesturl CONTAINS "21158-coinbase.com" OR requesturl CONTAINS "21509-coinbase.com" OR requesturl CONTAINS "25985-coinbase.com" OR requesturl CONTAINS "27699-coinbase.com" OR requesturl CONTAINS "28367-coinbase.com")
index=activity AND rg_functionality="Endpoint management systems" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "28676-coinbase.com" OR destinationhostname CONTAINS "29185-coinbase.com" OR destinationhostname CONTAINS "29195-coinbase.com" OR destinationhostname CONTAINS "2a-coinbase.com" OR destinationhostname CONTAINS "2b-coinbase.com" OR destinationhostname CONTAINS "2c-coinbase.com" OR destinationhostname CONTAINS "2f-coinbase.com" OR destinationhostname CONTAINS "2fas-coinbase.com" OR destinationhostname CONTAINS "2o-coinbase.com" OR destinationhostname CONTAINS "2r-coinbase.com" OR destinationhostname CONTAINS "2s-coinbase.com" OR destinationhostname CONTAINS "2sv-coinbase.com" OR destinationhostname CONTAINS "352134951-coinbase.com" OR destinationhostname CONTAINS "38468-coinbase.com" OR destinationhostname CONTAINS "39590-coinbase.com" OR destinationhostname CONTAINS "41260-coinbase.com" OR destinationhostname CONTAINS "427883-coinbase.com" OR destinationhostname CONTAINS "43017-coinbase.com" OR destinationhostname CONTAINS "47562-coinbase.com" OR destinationhostname CONTAINS "50195-coinbase.com" OR destinationhostname CONTAINS "5247-coinbase.com" OR destinationhostname CONTAINS "54765-coinbase.com" OR destinationhostname CONTAINS "57197-coinbase.com" OR destinationhostname CONTAINS "58176-coinbase.com" OR destinationhostname CONTAINS "58297-coinbase.com" OR destinationhostname CONTAINS "61250-coinbase.com" OR destinationhostname CONTAINS "61835-coinbase.com" OR destinationhostname CONTAINS "61851-coinbase.com" OR destinationhostname CONTAINS "61937-coinbase.com" OR destinationhostname CONTAINS "71925-coinbase.com" OR destinationhostname CONTAINS "72957-coinbase.com" OR destinationhostname CONTAINS "72985-coinbase.com" OR destinationhostname CONTAINS "74651-coinbase.com" OR destinationhostname CONTAINS "754668948-coinbase.com" OR destinationhostname CONTAINS "76159869-coinbase.com" OR destinationhostname CONTAINS "76153-coinbase.com" OR destinationhostname CONTAINS "81758-coinbase.com" OR destinationhostname CONTAINS "81920-coinbase.com" OR destinationhostname CONTAINS "81926-coinbase.com" OR destinationhostname CONTAINS "81958-coinbase.com" OR destinationhostname CONTAINS "826298-coinbase.com" OR destinationhostname CONTAINS "83216-coinbase.com" OR destinationhostname CONTAINS "837613-coinbase.com" OR destinationhostname CONTAINS "83956-coinbase.com" OR destinationhostname CONTAINS "87157-coinbase.com" OR destinationhostname CONTAINS "87312-coinbase.com" OR destinationhostname CONTAINS "89304-coinbase.com" OR destinationhostname CONTAINS "89375-coinbase.com" OR destinationhostname CONTAINS "91723-gemini.com" OR destinationhostname CONTAINS "91752-coinbase.com")
index=activity AND rg_functionality="Endpoint management systems" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "28676-coinbase.com" OR sourcentdomain CONTAINS "29185-coinbase.com" OR sourcentdomain CONTAINS "29195-coinbase.com" OR sourcentdomain CONTAINS "2a-coinbase.com" OR sourcentdomain CONTAINS "2b-coinbase.com" OR sourcentdomain CONTAINS "2c-coinbase.com" OR sourcentdomain CONTAINS "2f-coinbase.com" OR sourcentdomain CONTAINS "2fas-coinbase.com" OR sourcentdomain CONTAINS "2o-coinbase.com" OR sourcentdomain CONTAINS "2r-coinbase.com" OR sourcentdomain CONTAINS "2s-coinbase.com" OR sourcentdomain CONTAINS "2sv-coinbase.com" OR sourcentdomain CONTAINS "352134951-coinbase.com" OR sourcentdomain CONTAINS "38468-coinbase.com" OR sourcentdomain CONTAINS "39590-coinbase.com" OR sourcentdomain CONTAINS "41260-coinbase.com" OR sourcentdomain CONTAINS "427883-coinbase.com" OR sourcentdomain CONTAINS "43017-coinbase.com" OR sourcentdomain CONTAINS "47562-coinbase.com" OR sourcentdomain CONTAINS "50195-coinbase.com" OR sourcentdomain CONTAINS "5247-coinbase.com" OR sourcentdomain CONTAINS "54765-coinbase.com" OR sourcentdomain CONTAINS "57197-coinbase.com" OR sourcentdomain CONTAINS "58176-coinbase.com" OR sourcentdomain CONTAINS "58297-coinbase.com" OR sourcentdomain CONTAINS "61250-coinbase.com" OR sourcentdomain CONTAINS "61835-coinbase.com" OR sourcentdomain CONTAINS "61851-coinbase.com" OR sourcentdomain CONTAINS "61937-coinbase.com" OR sourcentdomain CONTAINS "71925-coinbase.com" OR sourcentdomain CONTAINS "72957-coinbase.com" OR sourcentdomain CONTAINS "72985-coinbase.com" OR sourcentdomain CONTAINS "74651-coinbase.com" OR sourcentdomain CONTAINS "754668948-coinbase.com" OR sourcentdomain CONTAINS "76159869-coinbase.com" OR sourcentdomain CONTAINS "76153-coinbase.com" OR sourcentdomain CONTAINS "81758-coinbase.com" OR sourcentdomain CONTAINS "81920-coinbase.com" OR sourcentdomain CONTAINS "81926-coinbase.com" OR sourcentdomain CONTAINS "81958-coinbase.com" OR sourcentdomain CONTAINS "826298-coinbase.com" OR sourcentdomain CONTAINS "83216-coinbase.com" OR sourcentdomain CONTAINS "837613-coinbase.com" OR sourcentdomain CONTAINS "83956-coinbase.com" OR sourcentdomain CONTAINS "87157-coinbase.com" OR sourcentdomain CONTAINS "87312-coinbase.com" OR sourcentdomain CONTAINS "89304-coinbase.com" OR sourcentdomain CONTAINS "89375-coinbase.com" OR sourcentdomain CONTAINS "91723-gemini.com" OR sourcentdomain CONTAINS "91752-coinbase.com")
index=activity AND rg_functionality="Endpoint management systems" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "28676-coinbase.com" OR sourcehostname CONTAINS "29185-coinbase.com" OR sourcehostname CONTAINS "29195-coinbase.com" OR sourcehostname CONTAINS "2a-coinbase.com" OR sourcehostname CONTAINS "2b-coinbase.com" OR sourcehostname CONTAINS "2c-coinbase.com" OR sourcehostname CONTAINS "2f-coinbase.com" OR sourcehostname CONTAINS "2fas-coinbase.com" OR sourcehostname CONTAINS "2o-coinbase.com" OR sourcehostname CONTAINS "2r-coinbase.com" OR sourcehostname CONTAINS "2s-coinbase.com" OR sourcehostname CONTAINS "2sv-coinbase.com" OR sourcehostname CONTAINS "352134951-coinbase.com" OR sourcehostname CONTAINS "38468-coinbase.com" OR sourcehostname CONTAINS "39590-coinbase.com" OR sourcehostname CONTAINS "41260-coinbase.com" OR sourcehostname CONTAINS "427883-coinbase.com" OR sourcehostname CONTAINS "43017-coinbase.com" OR sourcehostname CONTAINS "47562-coinbase.com" OR sourcehostname CONTAINS "50195-coinbase.com" OR sourcehostname CONTAINS "5247-coinbase.com" OR sourcehostname CONTAINS "54765-coinbase.com" OR sourcehostname CONTAINS "57197-coinbase.com" OR sourcehostname CONTAINS "58176-coinbase.com" OR sourcehostname CONTAINS "58297-coinbase.com" OR sourcehostname CONTAINS "61250-coinbase.com" OR sourcehostname CONTAINS "61835-coinbase.com" OR sourcehostname CONTAINS "61851-coinbase.com" OR sourcehostname CONTAINS "61937-coinbase.com" OR sourcehostname CONTAINS "71925-coinbase.com" OR sourcehostname CONTAINS "72957-coinbase.com" OR sourcehostname CONTAINS "72985-coinbase.com" OR sourcehostname CONTAINS "74651-coinbase.com" OR sourcehostname CONTAINS "754668948-coinbase.com" OR sourcehostname CONTAINS "76159869-coinbase.com" OR sourcehostname CONTAINS "76153-coinbase.com" OR sourcehostname CONTAINS "81758-coinbase.com" OR sourcehostname CONTAINS "81920-coinbase.com" OR sourcehostname CONTAINS "81926-coinbase.com" OR sourcehostname CONTAINS "81958-coinbase.com" OR sourcehostname CONTAINS "826298-coinbase.com" OR sourcehostname CONTAINS "83216-coinbase.com" OR sourcehostname CONTAINS "837613-coinbase.com" OR sourcehostname CONTAINS "83956-coinbase.com" OR sourcehostname CONTAINS "87157-coinbase.com" OR sourcehostname CONTAINS "87312-coinbase.com" OR sourcehostname CONTAINS "89304-coinbase.com" OR sourcehostname CONTAINS "89375-coinbase.com" OR sourcehostname CONTAINS "91723-gemini.com" OR sourcehostname CONTAINS "91752-coinbase.com")
index=activity AND rg_functionality="Endpoint management systems" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "28676-coinbase.com" OR destinationntdomain CONTAINS "29185-coinbase.com" OR destinationntdomain CONTAINS "29195-coinbase.com" OR destinationntdomain CONTAINS "2a-coinbase.com" OR destinationntdomain CONTAINS "2b-coinbase.com" OR destinationntdomain CONTAINS "2c-coinbase.com" OR destinationntdomain CONTAINS "2f-coinbase.com" OR destinationntdomain CONTAINS "2fas-coinbase.com" OR destinationntdomain CONTAINS "2o-coinbase.com" OR destinationntdomain CONTAINS "2r-coinbase.com" OR destinationntdomain CONTAINS "2s-coinbase.com" OR destinationntdomain CONTAINS "2sv-coinbase.com" OR destinationntdomain CONTAINS "352134951-coinbase.com" OR destinationntdomain CONTAINS "38468-coinbase.com" OR destinationntdomain CONTAINS "39590-coinbase.com" OR destinationntdomain CONTAINS "41260-coinbase.com" OR destinationntdomain CONTAINS "427883-coinbase.com" OR destinationntdomain CONTAINS "43017-coinbase.com" OR destinationntdomain CONTAINS "47562-coinbase.com" OR destinationntdomain CONTAINS "50195-coinbase.com" OR destinationntdomain CONTAINS "5247-coinbase.com" OR destinationntdomain CONTAINS "54765-coinbase.com" OR destinationntdomain CONTAINS "57197-coinbase.com" OR destinationntdomain CONTAINS "58176-coinbase.com" OR destinationntdomain CONTAINS "58297-coinbase.com" OR destinationntdomain CONTAINS "61250-coinbase.com" OR destinationntdomain CONTAINS "61835-coinbase.com" OR destinationntdomain CONTAINS "61851-coinbase.com" OR destinationntdomain CONTAINS "61937-coinbase.com" OR destinationntdomain CONTAINS "71925-coinbase.com" OR destinationntdomain CONTAINS "72957-coinbase.com" OR destinationntdomain CONTAINS "72985-coinbase.com" OR destinationntdomain CONTAINS "74651-coinbase.com" OR destinationntdomain CONTAINS "754668948-coinbase.com" OR destinationntdomain CONTAINS "76159869-coinbase.com" OR destinationntdomain CONTAINS "76153-coinbase.com" OR destinationntdomain CONTAINS "81758-coinbase.com" OR destinationntdomain CONTAINS "81920-coinbase.com" OR destinationntdomain CONTAINS "81926-coinbase.com" OR destinationntdomain CONTAINS "81958-coinbase.com" OR destinationntdomain CONTAINS "826298-coinbase.com" OR destinationntdomain CONTAINS "83216-coinbase.com" OR destinationntdomain CONTAINS "837613-coinbase.com" OR destinationntdomain CONTAINS "83956-coinbase.com" OR destinationntdomain CONTAINS "87157-coinbase.com" OR destinationntdomain CONTAINS "87312-coinbase.com" OR destinationntdomain CONTAINS "89304-coinbase.com" OR destinationntdomain CONTAINS "89375-coinbase.com" OR destinationntdomain CONTAINS "91723-gemini.com" OR destinationntdomain CONTAINS "91752-coinbase.com")
index=activity AND rg_functionality="Endpoint management systems" AND requesturl NOT NULL AND (requesturl CONTAINS "28676-coinbase.com" OR requesturl CONTAINS "29185-coinbase.com" OR requesturl CONTAINS "29195-coinbase.com" OR requesturl CONTAINS "2a-coinbase.com" OR requesturl CONTAINS "2b-coinbase.com" OR requesturl CONTAINS "2c-coinbase.com" OR requesturl CONTAINS "2f-coinbase.com" OR requesturl CONTAINS "2fas-coinbase.com" OR requesturl CONTAINS "2o-coinbase.com" OR requesturl CONTAINS "2r-coinbase.com" OR requesturl CONTAINS "2s-coinbase.com" OR requesturl CONTAINS "2sv-coinbase.com" OR requesturl CONTAINS "352134951-coinbase.com" OR requesturl CONTAINS "38468-coinbase.com" OR requesturl CONTAINS "39590-coinbase.com" OR requesturl CONTAINS "41260-coinbase.com" OR requesturl CONTAINS "427883-coinbase.com" OR requesturl CONTAINS "43017-coinbase.com" OR requesturl CONTAINS "47562-coinbase.com" OR requesturl CONTAINS "50195-coinbase.com" OR requesturl CONTAINS "5247-coinbase.com" OR requesturl CONTAINS "54765-coinbase.com" OR requesturl CONTAINS "57197-coinbase.com" OR requesturl CONTAINS "58176-coinbase.com" OR requesturl CONTAINS "58297-coinbase.com" OR requesturl CONTAINS "61250-coinbase.com" OR requesturl CONTAINS "61835-coinbase.com" OR requesturl CONTAINS "61851-coinbase.com" OR requesturl CONTAINS "61937-coinbase.com" OR requesturl CONTAINS "71925-coinbase.com" OR requesturl CONTAINS "72957-coinbase.com" OR requesturl CONTAINS "72985-coinbase.com" OR requesturl CONTAINS "74651-coinbase.com" OR requesturl CONTAINS "754668948-coinbase.com" OR requesturl CONTAINS "76159869-coinbase.com" OR requesturl CONTAINS "76153-coinbase.com" OR requesturl CONTAINS "81758-coinbase.com" OR requesturl CONTAINS "81920-coinbase.com" OR requesturl CONTAINS "81926-coinbase.com" OR requesturl CONTAINS "81958-coinbase.com" OR requesturl CONTAINS "826298-coinbase.com" OR requesturl CONTAINS "83216-coinbase.com" OR requesturl CONTAINS "837613-coinbase.com" OR requesturl CONTAINS "83956-coinbase.com" OR requesturl CONTAINS "87157-coinbase.com" OR requesturl CONTAINS "87312-coinbase.com" OR requesturl CONTAINS "89304-coinbase.com" OR requesturl CONTAINS "89375-coinbase.com" OR requesturl CONTAINS "91723-gemini.com" OR requesturl CONTAINS "91752-coinbase.com")
index=activity AND rg_functionality="Endpoint management systems" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "91756-coinbase.com" OR destinationhostname CONTAINS "91782-coinbase.com" OR destinationhostname CONTAINS "91835-coinbase.com" OR destinationhostname CONTAINS "91845-coinbase.com" OR destinationhostname CONTAINS "91923-coinbase.com" OR destinationhostname CONTAINS "92758-coinbase.com" OR destinationhostname CONTAINS "948122061-coinbase.com" OR destinationhostname CONTAINS "978941-coinbase.com" OR destinationhostname CONTAINS "accountrecovery-coinbase.com" OR destinationhostname CONTAINS "action-shakepay.com" OR destinationhostname CONTAINS "adjust-coinbase.com" OR destinationhostname CONTAINS "admin-kraken.com" OR destinationhostname CONTAINS "applechargebacks.com" OR destinationhostname CONTAINS "authenticate-gemini.com" OR destinationhostname CONTAINS "authorize-gmail.com" OR destinationhostname CONTAINS "binance-okta.com" OR destinationhostname CONTAINS "captcha-coinbase.com" OR destinationhostname CONTAINS "cd-coinbase.com" OR destinationhostname CONTAINS "coinbase-heip.com" OR destinationhostname CONTAINS "coinbase-live.support" OR destinationhostname CONTAINS "coinbase-reject.com" OR destinationhostname CONTAINS "coinbase-ticket.com" OR destinationhostname CONTAINS "coinbaseheip.com" OR destinationhostname CONTAINS "com-2fa.help" OR destinationhostname CONTAINS "com-2fa.support" OR destinationhostname CONTAINS "com-3845.support" OR destinationhostname CONTAINS "com-connect.help" OR destinationhostname CONTAINS "com-fraud.support" OR destinationhostname CONTAINS "com-help.support" OR destinationhostname CONTAINS "com-reset.help" OR destinationhostname CONTAINS "com-reset.net" OR destinationhostname CONTAINS "com-ticket.live" OR destinationhostname CONTAINS "com-ticket.support" OR destinationhostname CONTAINS "contact-nexo.com" OR destinationhostname CONTAINS "convert-coinbase.com" OR destinationhostname CONTAINS "customerservice-coinbase.com" OR destinationhostname CONTAINS "default-coinbase.com" OR destinationhostname CONTAINS "defend-coinbase.com" OR destinationhostname CONTAINS "deny-coinbase.com" OR destinationhostname CONTAINS "disconnect-coinbase.com" OR destinationhostname CONTAINS "escalate-coinbase.com" OR destinationhostname CONTAINS "establish-coinbase.com" OR destinationhostname CONTAINS "fcc-okta.com" OR destinationhostname CONTAINS "fraudulent-coinbase.com" OR destinationhostname CONTAINS "guard-apple.com" OR destinationhostname CONTAINS "guard-icloud.com" OR destinationhostname CONTAINS "guardian-coinbase.com" OR destinationhostname CONTAINS "guide-gemini.com" OR destinationhostname CONTAINS "help-bitfinex.com" OR destinationhostname CONTAINS "help-shakepay.com")
index=activity AND rg_functionality="Endpoint management systems" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "91756-coinbase.com" OR sourcentdomain CONTAINS "91782-coinbase.com" OR sourcentdomain CONTAINS "91835-coinbase.com" OR sourcentdomain CONTAINS "91845-coinbase.com" OR sourcentdomain CONTAINS "91923-coinbase.com" OR sourcentdomain CONTAINS "92758-coinbase.com" OR sourcentdomain CONTAINS "948122061-coinbase.com" OR sourcentdomain CONTAINS "978941-coinbase.com" OR sourcentdomain CONTAINS "accountrecovery-coinbase.com" OR sourcentdomain CONTAINS "action-shakepay.com" OR sourcentdomain CONTAINS "adjust-coinbase.com" OR sourcentdomain CONTAINS "admin-kraken.com" OR sourcentdomain CONTAINS "applechargebacks.com" OR sourcentdomain CONTAINS "authenticate-gemini.com" OR sourcentdomain CONTAINS "authorize-gmail.com" OR sourcentdomain CONTAINS "binance-okta.com" OR sourcentdomain CONTAINS "captcha-coinbase.com" OR sourcentdomain CONTAINS "cd-coinbase.com" OR sourcentdomain CONTAINS "coinbase-heip.com" OR sourcentdomain CONTAINS "coinbase-live.support" OR sourcentdomain CONTAINS "coinbase-reject.com" OR sourcentdomain CONTAINS "coinbase-ticket.com" OR sourcentdomain CONTAINS "coinbaseheip.com" OR sourcentdomain CONTAINS "com-2fa.help" OR sourcentdomain CONTAINS "com-2fa.support" OR sourcentdomain CONTAINS "com-3845.support" OR sourcentdomain CONTAINS "com-connect.help" OR sourcentdomain CONTAINS "com-fraud.support" OR sourcentdomain CONTAINS "com-help.support" OR sourcentdomain CONTAINS "com-reset.help" OR sourcentdomain CONTAINS "com-reset.net" OR sourcentdomain CONTAINS "com-ticket.live" OR sourcentdomain CONTAINS "com-ticket.support" OR sourcentdomain CONTAINS "contact-nexo.com" OR sourcentdomain CONTAINS "convert-coinbase.com" OR sourcentdomain CONTAINS "customerservice-coinbase.com" OR sourcentdomain CONTAINS "default-coinbase.com" OR sourcentdomain CONTAINS "defend-coinbase.com" OR sourcentdomain CONTAINS "deny-coinbase.com" OR sourcentdomain CONTAINS "disconnect-coinbase.com" OR sourcentdomain CONTAINS "escalate-coinbase.com" OR sourcentdomain CONTAINS "establish-coinbase.com" OR sourcentdomain CONTAINS "fcc-okta.com" OR sourcentdomain CONTAINS "fraudulent-coinbase.com" OR sourcentdomain CONTAINS "guard-apple.com" OR sourcentdomain CONTAINS "guard-icloud.com" OR sourcentdomain CONTAINS "guardian-coinbase.com" OR sourcentdomain CONTAINS "guide-gemini.com" OR sourcentdomain CONTAINS "help-bitfinex.com" OR sourcentdomain CONTAINS "help-shakepay.com")
index=activity AND rg_functionality="Endpoint management systems" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "91756-coinbase.com" OR sourcehostname CONTAINS "91782-coinbase.com" OR sourcehostname CONTAINS "91835-coinbase.com" OR sourcehostname CONTAINS "91845-coinbase.com" OR sourcehostname CONTAINS "91923-coinbase.com" OR sourcehostname CONTAINS "92758-coinbase.com" OR sourcehostname CONTAINS "948122061-coinbase.com" OR sourcehostname CONTAINS "978941-coinbase.com" OR sourcehostname CONTAINS "accountrecovery-coinbase.com" OR sourcehostname CONTAINS "action-shakepay.com" OR sourcehostname CONTAINS "adjust-coinbase.com" OR sourcehostname CONTAINS "admin-kraken.com" OR sourcehostname CONTAINS "applechargebacks.com" OR sourcehostname CONTAINS "authenticate-gemini.com" OR sourcehostname CONTAINS "authorize-gmail.com" OR sourcehostname CONTAINS "binance-okta.com" OR sourcehostname CONTAINS "captcha-coinbase.com" OR sourcehostname CONTAINS "cd-coinbase.com" OR sourcehostname CONTAINS "coinbase-heip.com" OR sourcehostname CONTAINS "coinbase-live.support" OR sourcehostname CONTAINS "coinbase-reject.com" OR sourcehostname CONTAINS "coinbase-ticket.com" OR sourcehostname CONTAINS "coinbaseheip.com" OR sourcehostname CONTAINS "com-2fa.help" OR sourcehostname CONTAINS "com-2fa.support" OR sourcehostname CONTAINS "com-3845.support" OR sourcehostname CONTAINS "com-connect.help" OR sourcehostname CONTAINS "com-fraud.support" OR sourcehostname CONTAINS "com-help.support" OR sourcehostname CONTAINS "com-reset.help" OR sourcehostname CONTAINS "com-reset.net" OR sourcehostname CONTAINS "com-ticket.live" OR sourcehostname CONTAINS "com-ticket.support" OR sourcehostname CONTAINS "contact-nexo.com" OR sourcehostname CONTAINS "convert-coinbase.com" OR sourcehostname CONTAINS "customerservice-coinbase.com" OR sourcehostname CONTAINS "default-coinbase.com" OR sourcehostname CONTAINS "defend-coinbase.com" OR sourcehostname CONTAINS "deny-coinbase.com" OR sourcehostname CONTAINS "disconnect-coinbase.com" OR sourcehostname CONTAINS "escalate-coinbase.com" OR sourcehostname CONTAINS "establish-coinbase.com" OR sourcehostname CONTAINS "fcc-okta.com" OR sourcehostname CONTAINS "fraudulent-coinbase.com" OR sourcehostname CONTAINS "guard-apple.com" OR sourcehostname CONTAINS "guard-icloud.com" OR sourcehostname CONTAINS "guardian-coinbase.com" OR sourcehostname CONTAINS "guide-gemini.com" OR sourcehostname CONTAINS "help-bitfinex.com" OR sourcehostname CONTAINS "help-shakepay.com")
index=activity AND rg_functionality="Endpoint management systems" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "91756-coinbase.com" OR destinationntdomain CONTAINS "91782-coinbase.com" OR destinationntdomain CONTAINS "91835-coinbase.com" OR destinationntdomain CONTAINS "91845-coinbase.com" OR destinationntdomain CONTAINS "91923-coinbase.com" OR destinationntdomain CONTAINS "92758-coinbase.com" OR destinationntdomain CONTAINS "948122061-coinbase.com" OR destinationntdomain CONTAINS "978941-coinbase.com" OR destinationntdomain CONTAINS "accountrecovery-coinbase.com" OR destinationntdomain CONTAINS "action-shakepay.com" OR destinationntdomain CONTAINS "adjust-coinbase.com" OR destinationntdomain CONTAINS "admin-kraken.com" OR destinationntdomain CONTAINS "applechargebacks.com" OR destinationntdomain CONTAINS "authenticate-gemini.com" OR destinationntdomain CONTAINS "authorize-gmail.com" OR destinationntdomain CONTAINS "binance-okta.com" OR destinationntdomain CONTAINS "captcha-coinbase.com" OR destinationntdomain CONTAINS "cd-coinbase.com" OR destinationntdomain CONTAINS "coinbase-heip.com" OR destinationntdomain CONTAINS "coinbase-live.support" OR destinationntdomain CONTAINS "coinbase-reject.com" OR destinationntdomain CONTAINS "coinbase-ticket.com" OR destinationntdomain CONTAINS "coinbaseheip.com" OR destinationntdomain CONTAINS "com-2fa.help" OR destinationntdomain CONTAINS "com-2fa.support" OR destinationntdomain CONTAINS "com-3845.support" OR destinationntdomain CONTAINS "com-connect.help" OR destinationntdomain CONTAINS "com-fraud.support" OR destinationntdomain CONTAINS "com-help.support" OR destinationntdomain CONTAINS "com-reset.help" OR destinationntdomain CONTAINS "com-reset.net" OR destinationntdomain CONTAINS "com-ticket.live" OR destinationntdomain CONTAINS "com-ticket.support" OR destinationntdomain CONTAINS "contact-nexo.com" OR destinationntdomain CONTAINS "convert-coinbase.com" OR destinationntdomain CONTAINS "customerservice-coinbase.com" OR destinationntdomain CONTAINS "default-coinbase.com" OR destinationntdomain CONTAINS "defend-coinbase.com" OR destinationntdomain CONTAINS "deny-coinbase.com" OR destinationntdomain CONTAINS "disconnect-coinbase.com" OR destinationntdomain CONTAINS "escalate-coinbase.com" OR destinationntdomain CONTAINS "establish-coinbase.com" OR destinationntdomain CONTAINS "fcc-okta.com" OR destinationntdomain CONTAINS "fraudulent-coinbase.com" OR destinationntdomain CONTAINS "guard-apple.com" OR destinationntdomain CONTAINS "guard-icloud.com" OR destinationntdomain CONTAINS "guardian-coinbase.com" OR destinationntdomain CONTAINS "guide-gemini.com" OR destinationntdomain CONTAINS "help-bitfinex.com" OR destinationntdomain CONTAINS "help-shakepay.com")
index=activity AND rg_functionality="Endpoint management systems" AND requesturl NOT NULL AND (requesturl CONTAINS "91756-coinbase.com" OR requesturl CONTAINS "91782-coinbase.com" OR requesturl CONTAINS "91835-coinbase.com" OR requesturl CONTAINS "91845-coinbase.com" OR requesturl CONTAINS "91923-coinbase.com" OR requesturl CONTAINS "92758-coinbase.com" OR requesturl CONTAINS "948122061-coinbase.com" OR requesturl CONTAINS "978941-coinbase.com" OR requesturl CONTAINS "accountrecovery-coinbase.com" OR requesturl CONTAINS "action-shakepay.com" OR requesturl CONTAINS "adjust-coinbase.com" OR requesturl CONTAINS "admin-kraken.com" OR requesturl CONTAINS "applechargebacks.com" OR requesturl CONTAINS "authenticate-gemini.com" OR requesturl CONTAINS "authorize-gmail.com" OR requesturl CONTAINS "binance-okta.com" OR requesturl CONTAINS "captcha-coinbase.com" OR requesturl CONTAINS "cd-coinbase.com" OR requesturl CONTAINS "coinbase-heip.com" OR requesturl CONTAINS "coinbase-live.support" OR requesturl CONTAINS "coinbase-reject.com" OR requesturl CONTAINS "coinbase-ticket.com" OR requesturl CONTAINS "coinbaseheip.com" OR requesturl CONTAINS "com-2fa.help" OR requesturl CONTAINS "com-2fa.support" OR requesturl CONTAINS "com-3845.support" OR requesturl CONTAINS "com-connect.help" OR requesturl CONTAINS "com-fraud.support" OR requesturl CONTAINS "com-help.support" OR requesturl CONTAINS "com-reset.help" OR requesturl CONTAINS "com-reset.net" OR requesturl CONTAINS "com-ticket.live" OR requesturl CONTAINS "com-ticket.support" OR requesturl CONTAINS "contact-nexo.com" OR requesturl CONTAINS "convert-coinbase.com" OR requesturl CONTAINS "customerservice-coinbase.com" OR requesturl CONTAINS "default-coinbase.com" OR requesturl CONTAINS "defend-coinbase.com" OR requesturl CONTAINS "deny-coinbase.com" OR requesturl CONTAINS "disconnect-coinbase.com" OR requesturl CONTAINS "escalate-coinbase.com" OR requesturl CONTAINS "establish-coinbase.com" OR requesturl CONTAINS "fcc-okta.com" OR requesturl CONTAINS "fraudulent-coinbase.com" OR requesturl CONTAINS "guard-apple.com" OR requesturl CONTAINS "guard-icloud.com" OR requesturl CONTAINS "guardian-coinbase.com" OR requesturl CONTAINS "guide-gemini.com" OR requesturl CONTAINS "help-bitfinex.com" OR requesturl CONTAINS "help-shakepay.com")
index=activity AND rg_functionality="Endpoint management systems" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "helpdesk-apple.com" OR destinationhostname CONTAINS "helpdesk-gemini.com" OR destinationhostname CONTAINS "helpdesk-icloud.com" OR destinationhostname CONTAINS "identification-coinbase.com" OR destinationhostname CONTAINS "lockdown-coinbase.com" OR destinationhostname CONTAINS "login-nexo.com" OR destinationhostname CONTAINS "keys-coinbase.com" OR destinationhostname CONTAINS "messages-coinbase.com" OR destinationhostname CONTAINS "newpassword-coinbase.com" OR destinationhostname CONTAINS "prompt-coinbase.com" OR destinationhostname CONTAINS "protect-apple.com" OR destinationhostname CONTAINS "protect-coinbase.com" OR destinationhostname CONTAINS "protect-gmail.com" OR destinationhostname CONTAINS "protect-kraken.com" OR destinationhostname CONTAINS "recoverme-coinbase.com" OR destinationhostname CONTAINS "recoveryportal-coinbase.com" OR destinationhostname CONTAINS "refunds-coinbase.com" OR destinationhostname CONTAINS "reset-okta.com" OR destinationhostname CONTAINS "restore-coinbase.com" OR destinationhostname CONTAINS "return-coinbase.com" OR destinationhostname CONTAINS "reverts-coinbase.com" OR destinationhostname CONTAINS "secure-binance.us" OR destinationhostname CONTAINS "secure-icloud.com" OR destinationhostname CONTAINS "secure-nexo.com" OR destinationhostname CONTAINS "secure-shakepay.com" OR destinationhostname CONTAINS "security-umusic.com" OR destinationhostname CONTAINS "server694590423.tech" OR destinationhostname CONTAINS "session-coinbase.com" OR destinationhostname CONTAINS "startrecovery-coinbase.com" OR destinationhostname CONTAINS "signin-kraken.com" OR destinationhostname CONTAINS "suite-trezor.io" OR destinationhostname CONTAINS "supportportal-coinbase.com" OR destinationhostname CONTAINS "tech-icloud.com" OR destinationhostname CONTAINS "threat-coinbase.com" OR destinationhostname CONTAINS "ticket-apple.com" OR destinationhostname CONTAINS "ticket-coinbase.com" OR destinationhostname CONTAINS "tickets-apple.com" OR destinationhostname CONTAINS "tokens-coinbase.com" OR destinationhostname CONTAINS "unblock-coinbase.com" OR destinationhostname CONTAINS "unlink-coinbase.com" OR destinationhostname CONTAINS "your-coinbase.com" OR destinationhostname CONTAINS "welcome-coinbase.com" OR destinationhostname CONTAINS "www-coinbasewallet.com" OR destinationhostname CONTAINS "www-help-coinbase.com" OR destinationhostname CONTAINS "www-help-gemini.com")
index=activity AND rg_functionality="Endpoint management systems" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "helpdesk-apple.com" OR sourcentdomain CONTAINS "helpdesk-gemini.com" OR sourcentdomain CONTAINS "helpdesk-icloud.com" OR sourcentdomain CONTAINS "identification-coinbase.com" OR sourcentdomain CONTAINS "lockdown-coinbase.com" OR sourcentdomain CONTAINS "login-nexo.com" OR sourcentdomain CONTAINS "keys-coinbase.com" OR sourcentdomain CONTAINS "messages-coinbase.com" OR sourcentdomain CONTAINS "newpassword-coinbase.com" OR sourcentdomain CONTAINS "prompt-coinbase.com" OR sourcentdomain CONTAINS "protect-apple.com" OR sourcentdomain CONTAINS "protect-coinbase.com" OR sourcentdomain CONTAINS "protect-gmail.com" OR sourcentdomain CONTAINS "protect-kraken.com" OR sourcentdomain CONTAINS "recoverme-coinbase.com" OR sourcentdomain CONTAINS "recoveryportal-coinbase.com" OR sourcentdomain CONTAINS "refunds-coinbase.com" OR sourcentdomain CONTAINS "reset-okta.com" OR sourcentdomain CONTAINS "restore-coinbase.com" OR sourcentdomain CONTAINS "return-coinbase.com" OR sourcentdomain CONTAINS "reverts-coinbase.com" OR sourcentdomain CONTAINS "secure-binance.us" OR sourcentdomain CONTAINS "secure-icloud.com" OR sourcentdomain CONTAINS "secure-nexo.com" OR sourcentdomain CONTAINS "secure-shakepay.com" OR sourcentdomain CONTAINS "security-umusic.com" OR sourcentdomain CONTAINS "server694590423.tech" OR sourcentdomain CONTAINS "session-coinbase.com" OR sourcentdomain CONTAINS "startrecovery-coinbase.com" OR sourcentdomain CONTAINS "signin-kraken.com" OR sourcentdomain CONTAINS "suite-trezor.io" OR sourcentdomain CONTAINS "supportportal-coinbase.com" OR sourcentdomain CONTAINS "tech-icloud.com" OR sourcentdomain CONTAINS "threat-coinbase.com" OR sourcentdomain CONTAINS "ticket-apple.com" OR sourcentdomain CONTAINS "ticket-coinbase.com" OR sourcentdomain CONTAINS "tickets-apple.com" OR sourcentdomain CONTAINS "tokens-coinbase.com" OR sourcentdomain CONTAINS "unblock-coinbase.com" OR sourcentdomain CONTAINS "unlink-coinbase.com" OR sourcentdomain CONTAINS "your-coinbase.com" OR sourcentdomain CONTAINS "welcome-coinbase.com" OR sourcentdomain CONTAINS "www-coinbasewallet.com" OR sourcentdomain CONTAINS "www-help-coinbase.com" OR sourcentdomain CONTAINS "www-help-gemini.com")
index=activity AND rg_functionality="Endpoint management systems" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "helpdesk-apple.com" OR sourcehostname CONTAINS "helpdesk-gemini.com" OR sourcehostname CONTAINS "helpdesk-icloud.com" OR sourcehostname CONTAINS "identification-coinbase.com" OR sourcehostname CONTAINS "lockdown-coinbase.com" OR sourcehostname CONTAINS "login-nexo.com" OR sourcehostname CONTAINS "keys-coinbase.com" OR sourcehostname CONTAINS "messages-coinbase.com" OR sourcehostname CONTAINS "newpassword-coinbase.com" OR sourcehostname CONTAINS "prompt-coinbase.com" OR sourcehostname CONTAINS "protect-apple.com" OR sourcehostname CONTAINS "protect-coinbase.com" OR sourcehostname CONTAINS "protect-gmail.com" OR sourcehostname CONTAINS "protect-kraken.com" OR sourcehostname CONTAINS "recoverme-coinbase.com" OR sourcehostname CONTAINS "recoveryportal-coinbase.com" OR sourcehostname CONTAINS "refunds-coinbase.com" OR sourcehostname CONTAINS "reset-okta.com" OR sourcehostname CONTAINS "restore-coinbase.com" OR sourcehostname CONTAINS "return-coinbase.com" OR sourcehostname CONTAINS "reverts-coinbase.com" OR sourcehostname CONTAINS "secure-binance.us" OR sourcehostname CONTAINS "secure-icloud.com" OR sourcehostname CONTAINS "secure-nexo.com" OR sourcehostname CONTAINS "secure-shakepay.com" OR sourcehostname CONTAINS "security-umusic.com" OR sourcehostname CONTAINS "server694590423.tech" OR sourcehostname CONTAINS "session-coinbase.com" OR sourcehostname CONTAINS "startrecovery-coinbase.com" OR sourcehostname CONTAINS "signin-kraken.com" OR sourcehostname CONTAINS "suite-trezor.io" OR sourcehostname CONTAINS "supportportal-coinbase.com" OR sourcehostname CONTAINS "tech-icloud.com" OR sourcehostname CONTAINS "threat-coinbase.com" OR sourcehostname CONTAINS "ticket-apple.com" OR sourcehostname CONTAINS "ticket-coinbase.com" OR sourcehostname CONTAINS "tickets-apple.com" OR sourcehostname CONTAINS "tokens-coinbase.com" OR sourcehostname CONTAINS "unblock-coinbase.com" OR sourcehostname CONTAINS "unlink-coinbase.com" OR sourcehostname CONTAINS "your-coinbase.com" OR sourcehostname CONTAINS "welcome-coinbase.com" OR sourcehostname CONTAINS "www-coinbasewallet.com" OR sourcehostname CONTAINS "www-help-coinbase.com" OR sourcehostname CONTAINS "www-help-gemini.com")
index=activity AND rg_functionality="Endpoint management systems" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "helpdesk-apple.com" OR destinationntdomain CONTAINS "helpdesk-gemini.com" OR destinationntdomain CONTAINS "helpdesk-icloud.com" OR destinationntdomain CONTAINS "identification-coinbase.com" OR destinationntdomain CONTAINS "lockdown-coinbase.com" OR destinationntdomain CONTAINS "login-nexo.com" OR destinationntdomain CONTAINS "keys-coinbase.com" OR destinationntdomain CONTAINS "messages-coinbase.com" OR destinationntdomain CONTAINS "newpassword-coinbase.com" OR destinationntdomain CONTAINS "prompt-coinbase.com" OR destinationntdomain CONTAINS "protect-apple.com" OR destinationntdomain CONTAINS "protect-coinbase.com" OR destinationntdomain CONTAINS "protect-gmail.com" OR destinationntdomain CONTAINS "protect-kraken.com" OR destinationntdomain CONTAINS "recoverme-coinbase.com" OR destinationntdomain CONTAINS "recoveryportal-coinbase.com" OR destinationntdomain CONTAINS "refunds-coinbase.com" OR destinationntdomain CONTAINS "reset-okta.com" OR destinationntdomain CONTAINS "restore-coinbase.com" OR destinationntdomain CONTAINS "return-coinbase.com" OR destinationntdomain CONTAINS "reverts-coinbase.com" OR destinationntdomain CONTAINS "secure-binance.us" OR destinationntdomain CONTAINS "secure-icloud.com" OR destinationntdomain CONTAINS "secure-nexo.com" OR destinationntdomain CONTAINS "secure-shakepay.com" OR destinationntdomain CONTAINS "security-umusic.com" OR destinationntdomain CONTAINS "server694590423.tech" OR destinationntdomain CONTAINS "session-coinbase.com" OR destinationntdomain CONTAINS "startrecovery-coinbase.com" OR destinationntdomain CONTAINS "signin-kraken.com" OR destinationntdomain CONTAINS "suite-trezor.io" OR destinationntdomain CONTAINS "supportportal-coinbase.com" OR destinationntdomain CONTAINS "tech-icloud.com" OR destinationntdomain CONTAINS "threat-coinbase.com" OR destinationntdomain CONTAINS "ticket-apple.com" OR destinationntdomain CONTAINS "ticket-coinbase.com" OR destinationntdomain CONTAINS "tickets-apple.com" OR destinationntdomain CONTAINS "tokens-coinbase.com" OR destinationntdomain CONTAINS "unblock-coinbase.com" OR destinationntdomain CONTAINS "unlink-coinbase.com" OR destinationntdomain CONTAINS "your-coinbase.com" OR destinationntdomain CONTAINS "welcome-coinbase.com" OR destinationntdomain CONTAINS "www-coinbasewallet.com" OR destinationntdomain CONTAINS "www-help-coinbase.com" OR destinationntdomain CONTAINS "www-help-gemini.com")
index=activity AND rg_functionality="Endpoint management systems" AND requesturl NOT NULL AND (requesturl CONTAINS "helpdesk-apple.com" OR requesturl CONTAINS "helpdesk-gemini.com" OR requesturl CONTAINS "helpdesk-icloud.com" OR requesturl CONTAINS "identification-coinbase.com" OR requesturl CONTAINS "lockdown-coinbase.com" OR requesturl CONTAINS "login-nexo.com" OR requesturl CONTAINS "keys-coinbase.com" OR requesturl CONTAINS "messages-coinbase.com" OR requesturl CONTAINS "newpassword-coinbase.com" OR requesturl CONTAINS "prompt-coinbase.com" OR requesturl CONTAINS "protect-apple.com" OR requesturl CONTAINS "protect-coinbase.com" OR requesturl CONTAINS "protect-gmail.com" OR requesturl CONTAINS "protect-kraken.com" OR requesturl CONTAINS "recoverme-coinbase.com" OR requesturl CONTAINS "recoveryportal-coinbase.com" OR requesturl CONTAINS "refunds-coinbase.com" OR requesturl CONTAINS "reset-okta.com" OR requesturl CONTAINS "restore-coinbase.com" OR requesturl CONTAINS "return-coinbase.com" OR requesturl CONTAINS "reverts-coinbase.com" OR requesturl CONTAINS "secure-binance.us" OR requesturl CONTAINS "secure-icloud.com" OR requesturl CONTAINS "secure-nexo.com" OR requesturl CONTAINS "secure-shakepay.com" OR requesturl CONTAINS "security-umusic.com" OR requesturl CONTAINS "server694590423.tech" OR requesturl CONTAINS "session-coinbase.com" OR requesturl CONTAINS "startrecovery-coinbase.com" OR requesturl CONTAINS "signin-kraken.com" OR requesturl CONTAINS "suite-trezor.io" OR requesturl CONTAINS "supportportal-coinbase.com" OR requesturl CONTAINS "tech-icloud.com" OR requesturl CONTAINS "threat-coinbase.com" OR requesturl CONTAINS "ticket-apple.com" OR requesturl CONTAINS "ticket-coinbase.com" OR requesturl CONTAINS "tickets-apple.com" OR requesturl CONTAINS "tokens-coinbase.com" OR requesturl CONTAINS "unblock-coinbase.com" OR requesturl CONTAINS "unlink-coinbase.com" OR requesturl CONTAINS "your-coinbase.com" OR requesturl CONTAINS "welcome-coinbase.com" OR requesturl CONTAINS "www-coinbasewallet.com" OR requesturl CONTAINS "www-help-coinbase.com" OR requesturl CONTAINS "www-help-gemini.com")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "official-server.com" OR destinationhostname CONTAINS "server694590423.tech" OR destinationhostname CONTAINS "island-placid-bromine.glitch.me" OR destinationhostname CONTAINS "circular-noon-farmhouse.glitch.me" OR destinationhostname CONTAINS "talented-friendly-price.glitch.me" OR destinationhostname CONTAINS "dflfmgsdokasdcpl.com" OR destinationhostname CONTAINS "original-backend.com" OR destinationhostname CONTAINS "07159889-coinbase.com" OR destinationhostname CONTAINS "10195-coinbase.com" OR destinationhostname CONTAINS "11246-coinbase.com" OR destinationhostname CONTAINS "11247-coinbase.com" OR destinationhostname CONTAINS "11248-coinbase.com" OR destinationhostname CONTAINS "11258-coinbase.com" OR destinationhostname CONTAINS "11259-coinbase.com" OR destinationhostname CONTAINS "113912-coinbase.com" OR destinationhostname CONTAINS "11472-coinbase.com" OR destinationhostname CONTAINS "11923-coinbase.com" OR destinationhostname CONTAINS "11957-coinbase.com" OR destinationhostname CONTAINS "128147-coinbase.com" OR destinationhostname CONTAINS "12958-coinbase.com" OR destinationhostname CONTAINS "12984-okta.com" OR destinationhostname CONTAINS "12985-coinbase.com" OR destinationhostname CONTAINS "13130-coinbase.com" OR destinationhostname CONTAINS "13247-coinbase.com" OR destinationhostname CONTAINS "13247-icloud.com" OR destinationhostname CONTAINS "13267-coinbase.com" OR destinationhostname CONTAINS "146271510-coinbase.com" OR destinationhostname CONTAINS "146282-coinbase.com" OR destinationhostname CONTAINS "146284-coinbase.com" OR destinationhostname CONTAINS "147260-coinbase.com" OR destinationhostname CONTAINS "14765-coinbase.com" OR destinationhostname CONTAINS "14817582-coinbase.com" OR destinationhostname CONTAINS "14871904-coinbase.com" OR destinationhostname CONTAINS "14891902-coinbase.com" OR destinationhostname CONTAINS "1492864-coinbase.com" OR destinationhostname CONTAINS "158312-coinbase.com" OR destinationhostname CONTAINS "158372-coinbase.com" OR destinationhostname CONTAINS "158702-coinbase.com" OR destinationhostname CONTAINS "16171675-coinbase.com" OR destinationhostname CONTAINS "16171832-coinbase.com" OR destinationhostname CONTAINS "16178234-coinbase.com" OR destinationhostname CONTAINS "16178237-coinbase.com" OR destinationhostname CONTAINS "16178434-coinbase.com" OR destinationhostname CONTAINS "162178-coinbase.com" OR destinationhostname CONTAINS "162478-coinbase.com" OR destinationhostname CONTAINS "162782-coinbase.com" OR destinationhostname CONTAINS "162812-coinbase.com" OR destinationhostname CONTAINS "162814-coinbase.com" OR destinationhostname CONTAINS "16442580-coinbase.com" OR destinationhostname CONTAINS "16450107-coinbase.com")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "official-server.com" OR sourcentdomain CONTAINS "server694590423.tech" OR sourcentdomain CONTAINS "island-placid-bromine.glitch.me" OR sourcentdomain CONTAINS "circular-noon-farmhouse.glitch.me" OR sourcentdomain CONTAINS "talented-friendly-price.glitch.me" OR sourcentdomain CONTAINS "dflfmgsdokasdcpl.com" OR sourcentdomain CONTAINS "original-backend.com" OR sourcentdomain CONTAINS "07159889-coinbase.com" OR sourcentdomain CONTAINS "10195-coinbase.com" OR sourcentdomain CONTAINS "11246-coinbase.com" OR sourcentdomain CONTAINS "11247-coinbase.com" OR sourcentdomain CONTAINS "11248-coinbase.com" OR sourcentdomain CONTAINS "11258-coinbase.com" OR sourcentdomain CONTAINS "11259-coinbase.com" OR sourcentdomain CONTAINS "113912-coinbase.com" OR sourcentdomain CONTAINS "11472-coinbase.com" OR sourcentdomain CONTAINS "11923-coinbase.com" OR sourcentdomain CONTAINS "11957-coinbase.com" OR sourcentdomain CONTAINS "128147-coinbase.com" OR sourcentdomain CONTAINS "12958-coinbase.com" OR sourcentdomain CONTAINS "12984-okta.com" OR sourcentdomain CONTAINS "12985-coinbase.com" OR sourcentdomain CONTAINS "13130-coinbase.com" OR sourcentdomain CONTAINS "13247-coinbase.com" OR sourcentdomain CONTAINS "13247-icloud.com" OR sourcentdomain CONTAINS "13267-coinbase.com" OR sourcentdomain CONTAINS "146271510-coinbase.com" OR sourcentdomain CONTAINS "146282-coinbase.com" OR sourcentdomain CONTAINS "146284-coinbase.com" OR sourcentdomain CONTAINS "147260-coinbase.com" OR sourcentdomain CONTAINS "14765-coinbase.com" OR sourcentdomain CONTAINS "14817582-coinbase.com" OR sourcentdomain CONTAINS "14871904-coinbase.com" OR sourcentdomain CONTAINS "14891902-coinbase.com" OR sourcentdomain CONTAINS "1492864-coinbase.com" OR sourcentdomain CONTAINS "158312-coinbase.com" OR sourcentdomain CONTAINS "158372-coinbase.com" OR sourcentdomain CONTAINS "158702-coinbase.com" OR sourcentdomain CONTAINS "16171675-coinbase.com" OR sourcentdomain CONTAINS "16171832-coinbase.com" OR sourcentdomain CONTAINS "16178234-coinbase.com" OR sourcentdomain CONTAINS "16178237-coinbase.com" OR sourcentdomain CONTAINS "16178434-coinbase.com" OR sourcentdomain CONTAINS "162178-coinbase.com" OR sourcentdomain CONTAINS "162478-coinbase.com" OR sourcentdomain CONTAINS "162782-coinbase.com" OR sourcentdomain CONTAINS "162812-coinbase.com" OR sourcentdomain CONTAINS "162814-coinbase.com" OR sourcentdomain CONTAINS "16442580-coinbase.com" OR sourcentdomain CONTAINS "16450107-coinbase.com")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "official-server.com" OR sourcehostname CONTAINS "server694590423.tech" OR sourcehostname CONTAINS "island-placid-bromine.glitch.me" OR sourcehostname CONTAINS "circular-noon-farmhouse.glitch.me" OR sourcehostname CONTAINS "talented-friendly-price.glitch.me" OR sourcehostname CONTAINS "dflfmgsdokasdcpl.com" OR sourcehostname CONTAINS "original-backend.com" OR sourcehostname CONTAINS "07159889-coinbase.com" OR sourcehostname CONTAINS "10195-coinbase.com" OR sourcehostname CONTAINS "11246-coinbase.com" OR sourcehostname CONTAINS "11247-coinbase.com" OR sourcehostname CONTAINS "11248-coinbase.com" OR sourcehostname CONTAINS "11258-coinbase.com" OR sourcehostname CONTAINS "11259-coinbase.com" OR sourcehostname CONTAINS "113912-coinbase.com" OR sourcehostname CONTAINS "11472-coinbase.com" OR sourcehostname CONTAINS "11923-coinbase.com" OR sourcehostname CONTAINS "11957-coinbase.com" OR sourcehostname CONTAINS "128147-coinbase.com" OR sourcehostname CONTAINS "12958-coinbase.com" OR sourcehostname CONTAINS "12984-okta.com" OR sourcehostname CONTAINS "12985-coinbase.com" OR sourcehostname CONTAINS "13130-coinbase.com" OR sourcehostname CONTAINS "13247-coinbase.com" OR sourcehostname CONTAINS "13247-icloud.com" OR sourcehostname CONTAINS "13267-coinbase.com" OR sourcehostname CONTAINS "146271510-coinbase.com" OR sourcehostname CONTAINS "146282-coinbase.com" OR sourcehostname CONTAINS "146284-coinbase.com" OR sourcehostname CONTAINS "147260-coinbase.com" OR sourcehostname CONTAINS "14765-coinbase.com" OR sourcehostname CONTAINS "14817582-coinbase.com" OR sourcehostname CONTAINS "14871904-coinbase.com" OR sourcehostname CONTAINS "14891902-coinbase.com" OR sourcehostname CONTAINS "1492864-coinbase.com" OR sourcehostname CONTAINS "158312-coinbase.com" OR sourcehostname CONTAINS "158372-coinbase.com" OR sourcehostname CONTAINS "158702-coinbase.com" OR sourcehostname CONTAINS "16171675-coinbase.com" OR sourcehostname CONTAINS "16171832-coinbase.com" OR sourcehostname CONTAINS "16178234-coinbase.com" OR sourcehostname CONTAINS "16178237-coinbase.com" OR sourcehostname CONTAINS "16178434-coinbase.com" OR sourcehostname CONTAINS "162178-coinbase.com" OR sourcehostname CONTAINS "162478-coinbase.com" OR sourcehostname CONTAINS "162782-coinbase.com" OR sourcehostname CONTAINS "162812-coinbase.com" OR sourcehostname CONTAINS "162814-coinbase.com" OR sourcehostname CONTAINS "16442580-coinbase.com" OR sourcehostname CONTAINS "16450107-coinbase.com")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "official-server.com" OR destinationntdomain CONTAINS "server694590423.tech" OR destinationntdomain CONTAINS "island-placid-bromine.glitch.me" OR destinationntdomain CONTAINS "circular-noon-farmhouse.glitch.me" OR destinationntdomain CONTAINS "talented-friendly-price.glitch.me" OR destinationntdomain CONTAINS "dflfmgsdokasdcpl.com" OR destinationntdomain CONTAINS "original-backend.com" OR destinationntdomain CONTAINS "07159889-coinbase.com" OR destinationntdomain CONTAINS "10195-coinbase.com" OR destinationntdomain CONTAINS "11246-coinbase.com" OR destinationntdomain CONTAINS "11247-coinbase.com" OR destinationntdomain CONTAINS "11248-coinbase.com" OR destinationntdomain CONTAINS "11258-coinbase.com" OR destinationntdomain CONTAINS "11259-coinbase.com" OR destinationntdomain CONTAINS "113912-coinbase.com" OR destinationntdomain CONTAINS "11472-coinbase.com" OR destinationntdomain CONTAINS "11923-coinbase.com" OR destinationntdomain CONTAINS "11957-coinbase.com" OR destinationntdomain CONTAINS "128147-coinbase.com" OR destinationntdomain CONTAINS "12958-coinbase.com" OR destinationntdomain CONTAINS "12984-okta.com" OR destinationntdomain CONTAINS "12985-coinbase.com" OR destinationntdomain CONTAINS "13130-coinbase.com" OR destinationntdomain CONTAINS "13247-coinbase.com" OR destinationntdomain CONTAINS "13247-icloud.com" OR destinationntdomain CONTAINS "13267-coinbase.com" OR destinationntdomain CONTAINS "146271510-coinbase.com" OR destinationntdomain CONTAINS "146282-coinbase.com" OR destinationntdomain CONTAINS "146284-coinbase.com" OR destinationntdomain CONTAINS "147260-coinbase.com" OR destinationntdomain CONTAINS "14765-coinbase.com" OR destinationntdomain CONTAINS "14817582-coinbase.com" OR destinationntdomain CONTAINS "14871904-coinbase.com" OR destinationntdomain CONTAINS "14891902-coinbase.com" OR destinationntdomain CONTAINS "1492864-coinbase.com" OR destinationntdomain CONTAINS "158312-coinbase.com" OR destinationntdomain CONTAINS "158372-coinbase.com" OR destinationntdomain CONTAINS "158702-coinbase.com" OR destinationntdomain CONTAINS "16171675-coinbase.com" OR destinationntdomain CONTAINS "16171832-coinbase.com" OR destinationntdomain CONTAINS "16178234-coinbase.com" OR destinationntdomain CONTAINS "16178237-coinbase.com" OR destinationntdomain CONTAINS "16178434-coinbase.com" OR destinationntdomain CONTAINS "162178-coinbase.com" OR destinationntdomain CONTAINS "162478-coinbase.com" OR destinationntdomain CONTAINS "162782-coinbase.com" OR destinationntdomain CONTAINS "162812-coinbase.com" OR destinationntdomain CONTAINS "162814-coinbase.com" OR destinationntdomain CONTAINS "16442580-coinbase.com" OR destinationntdomain CONTAINS "16450107-coinbase.com")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND requesturl NOT NULL AND (requesturl CONTAINS "official-server.com" OR requesturl CONTAINS "server694590423.tech" OR requesturl CONTAINS "island-placid-bromine.glitch.me" OR requesturl CONTAINS "circular-noon-farmhouse.glitch.me" OR requesturl CONTAINS "talented-friendly-price.glitch.me" OR requesturl CONTAINS "dflfmgsdokasdcpl.com" OR requesturl CONTAINS "original-backend.com" OR requesturl CONTAINS "07159889-coinbase.com" OR requesturl CONTAINS "10195-coinbase.com" OR requesturl CONTAINS "11246-coinbase.com" OR requesturl CONTAINS "11247-coinbase.com" OR requesturl CONTAINS "11248-coinbase.com" OR requesturl CONTAINS "11258-coinbase.com" OR requesturl CONTAINS "11259-coinbase.com" OR requesturl CONTAINS "113912-coinbase.com" OR requesturl CONTAINS "11472-coinbase.com" OR requesturl CONTAINS "11923-coinbase.com" OR requesturl CONTAINS "11957-coinbase.com" OR requesturl CONTAINS "128147-coinbase.com" OR requesturl CONTAINS "12958-coinbase.com" OR requesturl CONTAINS "12984-okta.com" OR requesturl CONTAINS "12985-coinbase.com" OR requesturl CONTAINS "13130-coinbase.com" OR requesturl CONTAINS "13247-coinbase.com" OR requesturl CONTAINS "13247-icloud.com" OR requesturl CONTAINS "13267-coinbase.com" OR requesturl CONTAINS "146271510-coinbase.com" OR requesturl CONTAINS "146282-coinbase.com" OR requesturl CONTAINS "146284-coinbase.com" OR requesturl CONTAINS "147260-coinbase.com" OR requesturl CONTAINS "14765-coinbase.com" OR requesturl CONTAINS "14817582-coinbase.com" OR requesturl CONTAINS "14871904-coinbase.com" OR requesturl CONTAINS "14891902-coinbase.com" OR requesturl CONTAINS "1492864-coinbase.com" OR requesturl CONTAINS "158312-coinbase.com" OR requesturl CONTAINS "158372-coinbase.com" OR requesturl CONTAINS "158702-coinbase.com" OR requesturl CONTAINS "16171675-coinbase.com" OR requesturl CONTAINS "16171832-coinbase.com" OR requesturl CONTAINS "16178234-coinbase.com" OR requesturl CONTAINS "16178237-coinbase.com" OR requesturl CONTAINS "16178434-coinbase.com" OR requesturl CONTAINS "162178-coinbase.com" OR requesturl CONTAINS "162478-coinbase.com" OR requesturl CONTAINS "162782-coinbase.com" OR requesturl CONTAINS "162812-coinbase.com" OR requesturl CONTAINS "162814-coinbase.com" OR requesturl CONTAINS "16442580-coinbase.com" OR requesturl CONTAINS "16450107-coinbase.com")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "16450207-coinbase.com" OR destinationhostname CONTAINS "16458207-coinbase.com" OR destinationhostname CONTAINS "16478202-coinbase.com" OR destinationhostname CONTAINS "164872942-coinbase.com" OR destinationhostname CONTAINS "16590-coinbase.com" OR destinationhostname CONTAINS "16594373-coinbase.com" OR destinationhostname CONTAINS "16624831-coinbase.com" OR destinationhostname CONTAINS "16642124-coinbase.com" OR destinationhostname CONTAINS "16642172-coinbase.com" OR destinationhostname CONTAINS "16642580-coinbase.com" OR destinationhostname CONTAINS "16642721-coinbase.com" OR destinationhostname CONTAINS "16642724-coinbase.com" OR destinationhostname CONTAINS "16642871-coinbase.com" OR destinationhostname CONTAINS "16642872-coinbase.com" OR destinationhostname CONTAINS "16712942-coinbase.com" OR destinationhostname CONTAINS "16718672-coinbase.com" OR destinationhostname CONTAINS "16728342-coinbase.com" OR destinationhostname CONTAINS "16728348-coinbase.com" OR destinationhostname CONTAINS "16728442-coinbase.com" OR destinationhostname CONTAINS "16728472-coinbase.com" OR destinationhostname CONTAINS "167285-coinbase.com" OR destinationhostname CONTAINS "16729042-coinbase.com" OR destinationhostname CONTAINS "16748272-coinbase.com" OR destinationhostname CONTAINS "16782942-coinbase.com" OR destinationhostname CONTAINS "16827420-coinbase.com" OR destinationhostname CONTAINS "16827423-coinbase.com" OR destinationhostname CONTAINS "16847145-coinbase.com" OR destinationhostname CONTAINS "16893924-coinbase.com" OR destinationhostname CONTAINS "17182-coinbase.com" OR destinationhostname CONTAINS "17255030-coinbase.com" OR destinationhostname CONTAINS "17259-kraken.com" OR destinationhostname CONTAINS "172486-coinbase.com" OR destinationhostname CONTAINS "17284652-coinbase.com" OR destinationhostname CONTAINS "17286-coinbase.com" OR destinationhostname CONTAINS "17334522-coinbase.com" OR destinationhostname CONTAINS "17334522-kraken.com" OR destinationhostname CONTAINS "17384522-coinbase.com" OR destinationhostname CONTAINS "173912-coinbase.com" OR destinationhostname CONTAINS "17494976-coinbase.com" OR destinationhostname CONTAINS "17512854-coinbase.com" OR destinationhostname CONTAINS "17512857-coinbase.com" OR destinationhostname CONTAINS "1751954-coinbase.com" OR destinationhostname CONTAINS "17525030-coinbase.com" OR destinationhostname CONTAINS "17529580-coinbase.com" OR destinationhostname CONTAINS "17614-coinbase.com" OR destinationhostname CONTAINS "17618412-coinbase.com" OR destinationhostname CONTAINS "17619-coinbase.com" OR destinationhostname CONTAINS "176284-coinbase.com" OR destinationhostname CONTAINS "17823920-coinbase.com" OR destinationhostname CONTAINS "178253-coinbase.com")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "16450207-coinbase.com" OR sourcentdomain CONTAINS "16458207-coinbase.com" OR sourcentdomain CONTAINS "16478202-coinbase.com" OR sourcentdomain CONTAINS "164872942-coinbase.com" OR sourcentdomain CONTAINS "16590-coinbase.com" OR sourcentdomain CONTAINS "16594373-coinbase.com" OR sourcentdomain CONTAINS "16624831-coinbase.com" OR sourcentdomain CONTAINS "16642124-coinbase.com" OR sourcentdomain CONTAINS "16642172-coinbase.com" OR sourcentdomain CONTAINS "16642580-coinbase.com" OR sourcentdomain CONTAINS "16642721-coinbase.com" OR sourcentdomain CONTAINS "16642724-coinbase.com" OR sourcentdomain CONTAINS "16642871-coinbase.com" OR sourcentdomain CONTAINS "16642872-coinbase.com" OR sourcentdomain CONTAINS "16712942-coinbase.com" OR sourcentdomain CONTAINS "16718672-coinbase.com" OR sourcentdomain CONTAINS "16728342-coinbase.com" OR sourcentdomain CONTAINS "16728348-coinbase.com" OR sourcentdomain CONTAINS "16728442-coinbase.com" OR sourcentdomain CONTAINS "16728472-coinbase.com" OR sourcentdomain CONTAINS "167285-coinbase.com" OR sourcentdomain CONTAINS "16729042-coinbase.com" OR sourcentdomain CONTAINS "16748272-coinbase.com" OR sourcentdomain CONTAINS "16782942-coinbase.com" OR sourcentdomain CONTAINS "16827420-coinbase.com" OR sourcentdomain CONTAINS "16827423-coinbase.com" OR sourcentdomain CONTAINS "16847145-coinbase.com" OR sourcentdomain CONTAINS "16893924-coinbase.com" OR sourcentdomain CONTAINS "17182-coinbase.com" OR sourcentdomain CONTAINS "17255030-coinbase.com" OR sourcentdomain CONTAINS "17259-kraken.com" OR sourcentdomain CONTAINS "172486-coinbase.com" OR sourcentdomain CONTAINS "17284652-coinbase.com" OR sourcentdomain CONTAINS "17286-coinbase.com" OR sourcentdomain CONTAINS "17334522-coinbase.com" OR sourcentdomain CONTAINS "17334522-kraken.com" OR sourcentdomain CONTAINS "17384522-coinbase.com" OR sourcentdomain CONTAINS "173912-coinbase.com" OR sourcentdomain CONTAINS "17494976-coinbase.com" OR sourcentdomain CONTAINS "17512854-coinbase.com" OR sourcentdomain CONTAINS "17512857-coinbase.com" OR sourcentdomain CONTAINS "1751954-coinbase.com" OR sourcentdomain CONTAINS "17525030-coinbase.com" OR sourcentdomain CONTAINS "17529580-coinbase.com" OR sourcentdomain CONTAINS "17614-coinbase.com" OR sourcentdomain CONTAINS "17618412-coinbase.com" OR sourcentdomain CONTAINS "17619-coinbase.com" OR sourcentdomain CONTAINS "176284-coinbase.com" OR sourcentdomain CONTAINS "17823920-coinbase.com" OR sourcentdomain CONTAINS "178253-coinbase.com")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "16450207-coinbase.com" OR sourcehostname CONTAINS "16458207-coinbase.com" OR sourcehostname CONTAINS "16478202-coinbase.com" OR sourcehostname CONTAINS "164872942-coinbase.com" OR sourcehostname CONTAINS "16590-coinbase.com" OR sourcehostname CONTAINS "16594373-coinbase.com" OR sourcehostname CONTAINS "16624831-coinbase.com" OR sourcehostname CONTAINS "16642124-coinbase.com" OR sourcehostname CONTAINS "16642172-coinbase.com" OR sourcehostname CONTAINS "16642580-coinbase.com" OR sourcehostname CONTAINS "16642721-coinbase.com" OR sourcehostname CONTAINS "16642724-coinbase.com" OR sourcehostname CONTAINS "16642871-coinbase.com" OR sourcehostname CONTAINS "16642872-coinbase.com" OR sourcehostname CONTAINS "16712942-coinbase.com" OR sourcehostname CONTAINS "16718672-coinbase.com" OR sourcehostname CONTAINS "16728342-coinbase.com" OR sourcehostname CONTAINS "16728348-coinbase.com" OR sourcehostname CONTAINS "16728442-coinbase.com" OR sourcehostname CONTAINS "16728472-coinbase.com" OR sourcehostname CONTAINS "167285-coinbase.com" OR sourcehostname CONTAINS "16729042-coinbase.com" OR sourcehostname CONTAINS "16748272-coinbase.com" OR sourcehostname CONTAINS "16782942-coinbase.com" OR sourcehostname CONTAINS "16827420-coinbase.com" OR sourcehostname CONTAINS "16827423-coinbase.com" OR sourcehostname CONTAINS "16847145-coinbase.com" OR sourcehostname CONTAINS "16893924-coinbase.com" OR sourcehostname CONTAINS "17182-coinbase.com" OR sourcehostname CONTAINS "17255030-coinbase.com" OR sourcehostname CONTAINS "17259-kraken.com" OR sourcehostname CONTAINS "172486-coinbase.com" OR sourcehostname CONTAINS "17284652-coinbase.com" OR sourcehostname CONTAINS "17286-coinbase.com" OR sourcehostname CONTAINS "17334522-coinbase.com" OR sourcehostname CONTAINS "17334522-kraken.com" OR sourcehostname CONTAINS "17384522-coinbase.com" OR sourcehostname CONTAINS "173912-coinbase.com" OR sourcehostname CONTAINS "17494976-coinbase.com" OR sourcehostname CONTAINS "17512854-coinbase.com" OR sourcehostname CONTAINS "17512857-coinbase.com" OR sourcehostname CONTAINS "1751954-coinbase.com" OR sourcehostname CONTAINS "17525030-coinbase.com" OR sourcehostname CONTAINS "17529580-coinbase.com" OR sourcehostname CONTAINS "17614-coinbase.com" OR sourcehostname CONTAINS "17618412-coinbase.com" OR sourcehostname CONTAINS "17619-coinbase.com" OR sourcehostname CONTAINS "176284-coinbase.com" OR sourcehostname CONTAINS "17823920-coinbase.com" OR sourcehostname CONTAINS "178253-coinbase.com")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "16450207-coinbase.com" OR destinationntdomain CONTAINS "16458207-coinbase.com" OR destinationntdomain CONTAINS "16478202-coinbase.com" OR destinationntdomain CONTAINS "164872942-coinbase.com" OR destinationntdomain CONTAINS "16590-coinbase.com" OR destinationntdomain CONTAINS "16594373-coinbase.com" OR destinationntdomain CONTAINS "16624831-coinbase.com" OR destinationntdomain CONTAINS "16642124-coinbase.com" OR destinationntdomain CONTAINS "16642172-coinbase.com" OR destinationntdomain CONTAINS "16642580-coinbase.com" OR destinationntdomain CONTAINS "16642721-coinbase.com" OR destinationntdomain CONTAINS "16642724-coinbase.com" OR destinationntdomain CONTAINS "16642871-coinbase.com" OR destinationntdomain CONTAINS "16642872-coinbase.com" OR destinationntdomain CONTAINS "16712942-coinbase.com" OR destinationntdomain CONTAINS "16718672-coinbase.com" OR destinationntdomain CONTAINS "16728342-coinbase.com" OR destinationntdomain CONTAINS "16728348-coinbase.com" OR destinationntdomain CONTAINS "16728442-coinbase.com" OR destinationntdomain CONTAINS "16728472-coinbase.com" OR destinationntdomain CONTAINS "167285-coinbase.com" OR destinationntdomain CONTAINS "16729042-coinbase.com" OR destinationntdomain CONTAINS "16748272-coinbase.com" OR destinationntdomain CONTAINS "16782942-coinbase.com" OR destinationntdomain CONTAINS "16827420-coinbase.com" OR destinationntdomain CONTAINS "16827423-coinbase.com" OR destinationntdomain CONTAINS "16847145-coinbase.com" OR destinationntdomain CONTAINS "16893924-coinbase.com" OR destinationntdomain CONTAINS "17182-coinbase.com" OR destinationntdomain CONTAINS "17255030-coinbase.com" OR destinationntdomain CONTAINS "17259-kraken.com" OR destinationntdomain CONTAINS "172486-coinbase.com" OR destinationntdomain CONTAINS "17284652-coinbase.com" OR destinationntdomain CONTAINS "17286-coinbase.com" OR destinationntdomain CONTAINS "17334522-coinbase.com" OR destinationntdomain CONTAINS "17334522-kraken.com" OR destinationntdomain CONTAINS "17384522-coinbase.com" OR destinationntdomain CONTAINS "173912-coinbase.com" OR destinationntdomain CONTAINS "17494976-coinbase.com" OR destinationntdomain CONTAINS "17512854-coinbase.com" OR destinationntdomain CONTAINS "17512857-coinbase.com" OR destinationntdomain CONTAINS "1751954-coinbase.com" OR destinationntdomain CONTAINS "17525030-coinbase.com" OR destinationntdomain CONTAINS "17529580-coinbase.com" OR destinationntdomain CONTAINS "17614-coinbase.com" OR destinationntdomain CONTAINS "17618412-coinbase.com" OR destinationntdomain CONTAINS "17619-coinbase.com" OR destinationntdomain CONTAINS "176284-coinbase.com" OR destinationntdomain CONTAINS "17823920-coinbase.com" OR destinationntdomain CONTAINS "178253-coinbase.com")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND requesturl NOT NULL AND (requesturl CONTAINS "16450207-coinbase.com" OR requesturl CONTAINS "16458207-coinbase.com" OR requesturl CONTAINS "16478202-coinbase.com" OR requesturl CONTAINS "164872942-coinbase.com" OR requesturl CONTAINS "16590-coinbase.com" OR requesturl CONTAINS "16594373-coinbase.com" OR requesturl CONTAINS "16624831-coinbase.com" OR requesturl CONTAINS "16642124-coinbase.com" OR requesturl CONTAINS "16642172-coinbase.com" OR requesturl CONTAINS "16642580-coinbase.com" OR requesturl CONTAINS "16642721-coinbase.com" OR requesturl CONTAINS "16642724-coinbase.com" OR requesturl CONTAINS "16642871-coinbase.com" OR requesturl CONTAINS "16642872-coinbase.com" OR requesturl CONTAINS "16712942-coinbase.com" OR requesturl CONTAINS "16718672-coinbase.com" OR requesturl CONTAINS "16728342-coinbase.com" OR requesturl CONTAINS "16728348-coinbase.com" OR requesturl CONTAINS "16728442-coinbase.com" OR requesturl CONTAINS "16728472-coinbase.com" OR requesturl CONTAINS "167285-coinbase.com" OR requesturl CONTAINS "16729042-coinbase.com" OR requesturl CONTAINS "16748272-coinbase.com" OR requesturl CONTAINS "16782942-coinbase.com" OR requesturl CONTAINS "16827420-coinbase.com" OR requesturl CONTAINS "16827423-coinbase.com" OR requesturl CONTAINS "16847145-coinbase.com" OR requesturl CONTAINS "16893924-coinbase.com" OR requesturl CONTAINS "17182-coinbase.com" OR requesturl CONTAINS "17255030-coinbase.com" OR requesturl CONTAINS "17259-kraken.com" OR requesturl CONTAINS "172486-coinbase.com" OR requesturl CONTAINS "17284652-coinbase.com" OR requesturl CONTAINS "17286-coinbase.com" OR requesturl CONTAINS "17334522-coinbase.com" OR requesturl CONTAINS "17334522-kraken.com" OR requesturl CONTAINS "17384522-coinbase.com" OR requesturl CONTAINS "173912-coinbase.com" OR requesturl CONTAINS "17494976-coinbase.com" OR requesturl CONTAINS "17512854-coinbase.com" OR requesturl CONTAINS "17512857-coinbase.com" OR requesturl CONTAINS "1751954-coinbase.com" OR requesturl CONTAINS "17525030-coinbase.com" OR requesturl CONTAINS "17529580-coinbase.com" OR requesturl CONTAINS "17614-coinbase.com" OR requesturl CONTAINS "17618412-coinbase.com" OR requesturl CONTAINS "17619-coinbase.com" OR requesturl CONTAINS "176284-coinbase.com" OR requesturl CONTAINS "17823920-coinbase.com" OR requesturl CONTAINS "178253-coinbase.com")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "178294-coinbase.com" OR destinationhostname CONTAINS "17912-coinbase.com" OR destinationhostname CONTAINS "17914-coinbase.com" OR destinationhostname CONTAINS "17917-coinbase.com" OR destinationhostname CONTAINS "17954-coinbase.com" OR destinationhostname CONTAINS "17958-coinbase.com" OR destinationhostname CONTAINS "182043-coinbase.com" OR destinationhostname CONTAINS "18275-gemini.com" OR destinationhostname CONTAINS "18276-coinbase.com" OR destinationhostname CONTAINS "18290185-coinbase.com" OR destinationhostname CONTAINS "182967-coinbase.com" OR destinationhostname CONTAINS "18560-coinbase.com" OR destinationhostname CONTAINS "18571-coinbase.com" OR destinationhostname CONTAINS "185912-coinbase.com" OR destinationhostname CONTAINS "185914-coinbase.com" OR destinationhostname CONTAINS "18592176-coinbase.com" OR destinationhostname CONTAINS "18594162-coinbase.com" OR destinationhostname CONTAINS "18594962-coinbase.com" OR destinationhostname CONTAINS "18597162-coinbase.com" OR destinationhostname CONTAINS "18719562-coinbase.com" OR destinationhostname CONTAINS "1875290-coinbase.com" OR destinationhostname CONTAINS "1882730-coinbase.com" OR destinationhostname CONTAINS "18902-coinbase.com" OR destinationhostname CONTAINS "18903-coinbase.com" OR destinationhostname CONTAINS "189126-coinbase.com" OR destinationhostname CONTAINS "18952-coinbase.com" OR destinationhostname CONTAINS "192854-coinbase.com" OR destinationhostname CONTAINS "192856-coinbase.com" OR destinationhostname CONTAINS "19287-binance.com" OR destinationhostname CONTAINS "19572-coinbase.com" OR destinationhostname CONTAINS "195812-coinbase.com" OR destinationhostname CONTAINS "195826-coinbase.com" OR destinationhostname CONTAINS "1958262-coinbase.com" OR destinationhostname CONTAINS "195827-binance.com" OR destinationhostname CONTAINS "1958297-coinbase.com" OR destinationhostname CONTAINS "19582970-coinbase.com" OR destinationhostname CONTAINS "19582971-coinbase.com" OR destinationhostname CONTAINS "19583-coinbase.com" OR destinationhostname CONTAINS "19592653-coinbase.com" OR destinationhostname CONTAINS "197304-coinbase.com" OR destinationhostname CONTAINS "19730492-coinbase.com" OR destinationhostname CONTAINS "19764162-coinbase.com" OR destinationhostname CONTAINS "19803-coinbase.com" OR destinationhostname CONTAINS "201784289-coinbase.com" OR destinationhostname CONTAINS "210823644-coinbase.com" OR destinationhostname CONTAINS "21158-coinbase.com" OR destinationhostname CONTAINS "21509-coinbase.com" OR destinationhostname CONTAINS "25985-coinbase.com" OR destinationhostname CONTAINS "27699-coinbase.com" OR destinationhostname CONTAINS "28367-coinbase.com")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "178294-coinbase.com" OR sourcentdomain CONTAINS "17912-coinbase.com" OR sourcentdomain CONTAINS "17914-coinbase.com" OR sourcentdomain CONTAINS "17917-coinbase.com" OR sourcentdomain CONTAINS "17954-coinbase.com" OR sourcentdomain CONTAINS "17958-coinbase.com" OR sourcentdomain CONTAINS "182043-coinbase.com" OR sourcentdomain CONTAINS "18275-gemini.com" OR sourcentdomain CONTAINS "18276-coinbase.com" OR sourcentdomain CONTAINS "18290185-coinbase.com" OR sourcentdomain CONTAINS "182967-coinbase.com" OR sourcentdomain CONTAINS "18560-coinbase.com" OR sourcentdomain CONTAINS "18571-coinbase.com" OR sourcentdomain CONTAINS "185912-coinbase.com" OR sourcentdomain CONTAINS "185914-coinbase.com" OR sourcentdomain CONTAINS "18592176-coinbase.com" OR sourcentdomain CONTAINS "18594162-coinbase.com" OR sourcentdomain CONTAINS "18594962-coinbase.com" OR sourcentdomain CONTAINS "18597162-coinbase.com" OR sourcentdomain CONTAINS "18719562-coinbase.com" OR sourcentdomain CONTAINS "1875290-coinbase.com" OR sourcentdomain CONTAINS "1882730-coinbase.com" OR sourcentdomain CONTAINS "18902-coinbase.com" OR sourcentdomain CONTAINS "18903-coinbase.com" OR sourcentdomain CONTAINS "189126-coinbase.com" OR sourcentdomain CONTAINS "18952-coinbase.com" OR sourcentdomain CONTAINS "192854-coinbase.com" OR sourcentdomain CONTAINS "192856-coinbase.com" OR sourcentdomain CONTAINS "19287-binance.com" OR sourcentdomain CONTAINS "19572-coinbase.com" OR sourcentdomain CONTAINS "195812-coinbase.com" OR sourcentdomain CONTAINS "195826-coinbase.com" OR sourcentdomain CONTAINS "1958262-coinbase.com" OR sourcentdomain CONTAINS "195827-binance.com" OR sourcentdomain CONTAINS "1958297-coinbase.com" OR sourcentdomain CONTAINS "19582970-coinbase.com" OR sourcentdomain CONTAINS "19582971-coinbase.com" OR sourcentdomain CONTAINS "19583-coinbase.com" OR sourcentdomain CONTAINS "19592653-coinbase.com" OR sourcentdomain CONTAINS "197304-coinbase.com" OR sourcentdomain CONTAINS "19730492-coinbase.com" OR sourcentdomain CONTAINS "19764162-coinbase.com" OR sourcentdomain CONTAINS "19803-coinbase.com" OR sourcentdomain CONTAINS "201784289-coinbase.com" OR sourcentdomain CONTAINS "210823644-coinbase.com" OR sourcentdomain CONTAINS "21158-coinbase.com" OR sourcentdomain CONTAINS "21509-coinbase.com" OR sourcentdomain CONTAINS "25985-coinbase.com" OR sourcentdomain CONTAINS "27699-coinbase.com" OR sourcentdomain CONTAINS "28367-coinbase.com")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "178294-coinbase.com" OR sourcehostname CONTAINS "17912-coinbase.com" OR sourcehostname CONTAINS "17914-coinbase.com" OR sourcehostname CONTAINS "17917-coinbase.com" OR sourcehostname CONTAINS "17954-coinbase.com" OR sourcehostname CONTAINS "17958-coinbase.com" OR sourcehostname CONTAINS "182043-coinbase.com" OR sourcehostname CONTAINS "18275-gemini.com" OR sourcehostname CONTAINS "18276-coinbase.com" OR sourcehostname CONTAINS "18290185-coinbase.com" OR sourcehostname CONTAINS "182967-coinbase.com" OR sourcehostname CONTAINS "18560-coinbase.com" OR sourcehostname CONTAINS "18571-coinbase.com" OR sourcehostname CONTAINS "185912-coinbase.com" OR sourcehostname CONTAINS "185914-coinbase.com" OR sourcehostname CONTAINS "18592176-coinbase.com" OR sourcehostname CONTAINS "18594162-coinbase.com" OR sourcehostname CONTAINS "18594962-coinbase.com" OR sourcehostname CONTAINS "18597162-coinbase.com" OR sourcehostname CONTAINS "18719562-coinbase.com" OR sourcehostname CONTAINS "1875290-coinbase.com" OR sourcehostname CONTAINS "1882730-coinbase.com" OR sourcehostname CONTAINS "18902-coinbase.com" OR sourcehostname CONTAINS "18903-coinbase.com" OR sourcehostname CONTAINS "189126-coinbase.com" OR sourcehostname CONTAINS "18952-coinbase.com" OR sourcehostname CONTAINS "192854-coinbase.com" OR sourcehostname CONTAINS "192856-coinbase.com" OR sourcehostname CONTAINS "19287-binance.com" OR sourcehostname CONTAINS "19572-coinbase.com" OR sourcehostname CONTAINS "195812-coinbase.com" OR sourcehostname CONTAINS "195826-coinbase.com" OR sourcehostname CONTAINS "1958262-coinbase.com" OR sourcehostname CONTAINS "195827-binance.com" OR sourcehostname CONTAINS "1958297-coinbase.com" OR sourcehostname CONTAINS "19582970-coinbase.com" OR sourcehostname CONTAINS "19582971-coinbase.com" OR sourcehostname CONTAINS "19583-coinbase.com" OR sourcehostname CONTAINS "19592653-coinbase.com" OR sourcehostname CONTAINS "197304-coinbase.com" OR sourcehostname CONTAINS "19730492-coinbase.com" OR sourcehostname CONTAINS "19764162-coinbase.com" OR sourcehostname CONTAINS "19803-coinbase.com" OR sourcehostname CONTAINS "201784289-coinbase.com" OR sourcehostname CONTAINS "210823644-coinbase.com" OR sourcehostname CONTAINS "21158-coinbase.com" OR sourcehostname CONTAINS "21509-coinbase.com" OR sourcehostname CONTAINS "25985-coinbase.com" OR sourcehostname CONTAINS "27699-coinbase.com" OR sourcehostname CONTAINS "28367-coinbase.com")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "178294-coinbase.com" OR destinationntdomain CONTAINS "17912-coinbase.com" OR destinationntdomain CONTAINS "17914-coinbase.com" OR destinationntdomain CONTAINS "17917-coinbase.com" OR destinationntdomain CONTAINS "17954-coinbase.com" OR destinationntdomain CONTAINS "17958-coinbase.com" OR destinationntdomain CONTAINS "182043-coinbase.com" OR destinationntdomain CONTAINS "18275-gemini.com" OR destinationntdomain CONTAINS "18276-coinbase.com" OR destinationntdomain CONTAINS "18290185-coinbase.com" OR destinationntdomain CONTAINS "182967-coinbase.com" OR destinationntdomain CONTAINS "18560-coinbase.com" OR destinationntdomain CONTAINS "18571-coinbase.com" OR destinationntdomain CONTAINS "185912-coinbase.com" OR destinationntdomain CONTAINS "185914-coinbase.com" OR destinationntdomain CONTAINS "18592176-coinbase.com" OR destinationntdomain CONTAINS "18594162-coinbase.com" OR destinationntdomain CONTAINS "18594962-coinbase.com" OR destinationntdomain CONTAINS "18597162-coinbase.com" OR destinationntdomain CONTAINS "18719562-coinbase.com" OR destinationntdomain CONTAINS "1875290-coinbase.com" OR destinationntdomain CONTAINS "1882730-coinbase.com" OR destinationntdomain CONTAINS "18902-coinbase.com" OR destinationntdomain CONTAINS "18903-coinbase.com" OR destinationntdomain CONTAINS "189126-coinbase.com" OR destinationntdomain CONTAINS "18952-coinbase.com" OR destinationntdomain CONTAINS "192854-coinbase.com" OR destinationntdomain CONTAINS "192856-coinbase.com" OR destinationntdomain CONTAINS "19287-binance.com" OR destinationntdomain CONTAINS "19572-coinbase.com" OR destinationntdomain CONTAINS "195812-coinbase.com" OR destinationntdomain CONTAINS "195826-coinbase.com" OR destinationntdomain CONTAINS "1958262-coinbase.com" OR destinationntdomain CONTAINS "195827-binance.com" OR destinationntdomain CONTAINS "1958297-coinbase.com" OR destinationntdomain CONTAINS "19582970-coinbase.com" OR destinationntdomain CONTAINS "19582971-coinbase.com" OR destinationntdomain CONTAINS "19583-coinbase.com" OR destinationntdomain CONTAINS "19592653-coinbase.com" OR destinationntdomain CONTAINS "197304-coinbase.com" OR destinationntdomain CONTAINS "19730492-coinbase.com" OR destinationntdomain CONTAINS "19764162-coinbase.com" OR destinationntdomain CONTAINS "19803-coinbase.com" OR destinationntdomain CONTAINS "201784289-coinbase.com" OR destinationntdomain CONTAINS "210823644-coinbase.com" OR destinationntdomain CONTAINS "21158-coinbase.com" OR destinationntdomain CONTAINS "21509-coinbase.com" OR destinationntdomain CONTAINS "25985-coinbase.com" OR destinationntdomain CONTAINS "27699-coinbase.com" OR destinationntdomain CONTAINS "28367-coinbase.com")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND requesturl NOT NULL AND (requesturl CONTAINS "178294-coinbase.com" OR requesturl CONTAINS "17912-coinbase.com" OR requesturl CONTAINS "17914-coinbase.com" OR requesturl CONTAINS "17917-coinbase.com" OR requesturl CONTAINS "17954-coinbase.com" OR requesturl CONTAINS "17958-coinbase.com" OR requesturl CONTAINS "182043-coinbase.com" OR requesturl CONTAINS "18275-gemini.com" OR requesturl CONTAINS "18276-coinbase.com" OR requesturl CONTAINS "18290185-coinbase.com" OR requesturl CONTAINS "182967-coinbase.com" OR requesturl CONTAINS "18560-coinbase.com" OR requesturl CONTAINS "18571-coinbase.com" OR requesturl CONTAINS "185912-coinbase.com" OR requesturl CONTAINS "185914-coinbase.com" OR requesturl CONTAINS "18592176-coinbase.com" OR requesturl CONTAINS "18594162-coinbase.com" OR requesturl CONTAINS "18594962-coinbase.com" OR requesturl CONTAINS "18597162-coinbase.com" OR requesturl CONTAINS "18719562-coinbase.com" OR requesturl CONTAINS "1875290-coinbase.com" OR requesturl CONTAINS "1882730-coinbase.com" OR requesturl CONTAINS "18902-coinbase.com" OR requesturl CONTAINS "18903-coinbase.com" OR requesturl CONTAINS "189126-coinbase.com" OR requesturl CONTAINS "18952-coinbase.com" OR requesturl CONTAINS "192854-coinbase.com" OR requesturl CONTAINS "192856-coinbase.com" OR requesturl CONTAINS "19287-binance.com" OR requesturl CONTAINS "19572-coinbase.com" OR requesturl CONTAINS "195812-coinbase.com" OR requesturl CONTAINS "195826-coinbase.com" OR requesturl CONTAINS "1958262-coinbase.com" OR requesturl CONTAINS "195827-binance.com" OR requesturl CONTAINS "1958297-coinbase.com" OR requesturl CONTAINS "19582970-coinbase.com" OR requesturl CONTAINS "19582971-coinbase.com" OR requesturl CONTAINS "19583-coinbase.com" OR requesturl CONTAINS "19592653-coinbase.com" OR requesturl CONTAINS "197304-coinbase.com" OR requesturl CONTAINS "19730492-coinbase.com" OR requesturl CONTAINS "19764162-coinbase.com" OR requesturl CONTAINS "19803-coinbase.com" OR requesturl CONTAINS "201784289-coinbase.com" OR requesturl CONTAINS "210823644-coinbase.com" OR requesturl CONTAINS "21158-coinbase.com" OR requesturl CONTAINS "21509-coinbase.com" OR requesturl CONTAINS "25985-coinbase.com" OR requesturl CONTAINS "27699-coinbase.com" OR requesturl CONTAINS "28367-coinbase.com")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "28676-coinbase.com" OR destinationhostname CONTAINS "29185-coinbase.com" OR destinationhostname CONTAINS "29195-coinbase.com" OR destinationhostname CONTAINS "2a-coinbase.com" OR destinationhostname CONTAINS "2b-coinbase.com" OR destinationhostname CONTAINS "2c-coinbase.com" OR destinationhostname CONTAINS "2f-coinbase.com" OR destinationhostname CONTAINS "2fas-coinbase.com" OR destinationhostname CONTAINS "2o-coinbase.com" OR destinationhostname CONTAINS "2r-coinbase.com" OR destinationhostname CONTAINS "2s-coinbase.com" OR destinationhostname CONTAINS "2sv-coinbase.com" OR destinationhostname CONTAINS "352134951-coinbase.com" OR destinationhostname CONTAINS "38468-coinbase.com" OR destinationhostname CONTAINS "39590-coinbase.com" OR destinationhostname CONTAINS "41260-coinbase.com" OR destinationhostname CONTAINS "427883-coinbase.com" OR destinationhostname CONTAINS "43017-coinbase.com" OR destinationhostname CONTAINS "47562-coinbase.com" OR destinationhostname CONTAINS "50195-coinbase.com" OR destinationhostname CONTAINS "5247-coinbase.com" OR destinationhostname CONTAINS "54765-coinbase.com" OR destinationhostname CONTAINS "57197-coinbase.com" OR destinationhostname CONTAINS "58176-coinbase.com" OR destinationhostname CONTAINS "58297-coinbase.com" OR destinationhostname CONTAINS "61250-coinbase.com" OR destinationhostname CONTAINS "61835-coinbase.com" OR destinationhostname CONTAINS "61851-coinbase.com" OR destinationhostname CONTAINS "61937-coinbase.com" OR destinationhostname CONTAINS "71925-coinbase.com" OR destinationhostname CONTAINS "72957-coinbase.com" OR destinationhostname CONTAINS "72985-coinbase.com" OR destinationhostname CONTAINS "74651-coinbase.com" OR destinationhostname CONTAINS "754668948-coinbase.com" OR destinationhostname CONTAINS "76159869-coinbase.com" OR destinationhostname CONTAINS "76153-coinbase.com" OR destinationhostname CONTAINS "81758-coinbase.com" OR destinationhostname CONTAINS "81920-coinbase.com" OR destinationhostname CONTAINS "81926-coinbase.com" OR destinationhostname CONTAINS "81958-coinbase.com" OR destinationhostname CONTAINS "826298-coinbase.com" OR destinationhostname CONTAINS "83216-coinbase.com" OR destinationhostname CONTAINS "837613-coinbase.com" OR destinationhostname CONTAINS "83956-coinbase.com" OR destinationhostname CONTAINS "87157-coinbase.com" OR destinationhostname CONTAINS "87312-coinbase.com" OR destinationhostname CONTAINS "89304-coinbase.com" OR destinationhostname CONTAINS "89375-coinbase.com" OR destinationhostname CONTAINS "91723-gemini.com" OR destinationhostname CONTAINS "91752-coinbase.com")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "28676-coinbase.com" OR sourcentdomain CONTAINS "29185-coinbase.com" OR sourcentdomain CONTAINS "29195-coinbase.com" OR sourcentdomain CONTAINS "2a-coinbase.com" OR sourcentdomain CONTAINS "2b-coinbase.com" OR sourcentdomain CONTAINS "2c-coinbase.com" OR sourcentdomain CONTAINS "2f-coinbase.com" OR sourcentdomain CONTAINS "2fas-coinbase.com" OR sourcentdomain CONTAINS "2o-coinbase.com" OR sourcentdomain CONTAINS "2r-coinbase.com" OR sourcentdomain CONTAINS "2s-coinbase.com" OR sourcentdomain CONTAINS "2sv-coinbase.com" OR sourcentdomain CONTAINS "352134951-coinbase.com" OR sourcentdomain CONTAINS "38468-coinbase.com" OR sourcentdomain CONTAINS "39590-coinbase.com" OR sourcentdomain CONTAINS "41260-coinbase.com" OR sourcentdomain CONTAINS "427883-coinbase.com" OR sourcentdomain CONTAINS "43017-coinbase.com" OR sourcentdomain CONTAINS "47562-coinbase.com" OR sourcentdomain CONTAINS "50195-coinbase.com" OR sourcentdomain CONTAINS "5247-coinbase.com" OR sourcentdomain CONTAINS "54765-coinbase.com" OR sourcentdomain CONTAINS "57197-coinbase.com" OR sourcentdomain CONTAINS "58176-coinbase.com" OR sourcentdomain CONTAINS "58297-coinbase.com" OR sourcentdomain CONTAINS "61250-coinbase.com" OR sourcentdomain CONTAINS "61835-coinbase.com" OR sourcentdomain CONTAINS "61851-coinbase.com" OR sourcentdomain CONTAINS "61937-coinbase.com" OR sourcentdomain CONTAINS "71925-coinbase.com" OR sourcentdomain CONTAINS "72957-coinbase.com" OR sourcentdomain CONTAINS "72985-coinbase.com" OR sourcentdomain CONTAINS "74651-coinbase.com" OR sourcentdomain CONTAINS "754668948-coinbase.com" OR sourcentdomain CONTAINS "76159869-coinbase.com" OR sourcentdomain CONTAINS "76153-coinbase.com" OR sourcentdomain CONTAINS "81758-coinbase.com" OR sourcentdomain CONTAINS "81920-coinbase.com" OR sourcentdomain CONTAINS "81926-coinbase.com" OR sourcentdomain CONTAINS "81958-coinbase.com" OR sourcentdomain CONTAINS "826298-coinbase.com" OR sourcentdomain CONTAINS "83216-coinbase.com" OR sourcentdomain CONTAINS "837613-coinbase.com" OR sourcentdomain CONTAINS "83956-coinbase.com" OR sourcentdomain CONTAINS "87157-coinbase.com" OR sourcentdomain CONTAINS "87312-coinbase.com" OR sourcentdomain CONTAINS "89304-coinbase.com" OR sourcentdomain CONTAINS "89375-coinbase.com" OR sourcentdomain CONTAINS "91723-gemini.com" OR sourcentdomain CONTAINS "91752-coinbase.com")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "28676-coinbase.com" OR sourcehostname CONTAINS "29185-coinbase.com" OR sourcehostname CONTAINS "29195-coinbase.com" OR sourcehostname CONTAINS "2a-coinbase.com" OR sourcehostname CONTAINS "2b-coinbase.com" OR sourcehostname CONTAINS "2c-coinbase.com" OR sourcehostname CONTAINS "2f-coinbase.com" OR sourcehostname CONTAINS "2fas-coinbase.com" OR sourcehostname CONTAINS "2o-coinbase.com" OR sourcehostname CONTAINS "2r-coinbase.com" OR sourcehostname CONTAINS "2s-coinbase.com" OR sourcehostname CONTAINS "2sv-coinbase.com" OR sourcehostname CONTAINS "352134951-coinbase.com" OR sourcehostname CONTAINS "38468-coinbase.com" OR sourcehostname CONTAINS "39590-coinbase.com" OR sourcehostname CONTAINS "41260-coinbase.com" OR sourcehostname CONTAINS "427883-coinbase.com" OR sourcehostname CONTAINS "43017-coinbase.com" OR sourcehostname CONTAINS "47562-coinbase.com" OR sourcehostname CONTAINS "50195-coinbase.com" OR sourcehostname CONTAINS "5247-coinbase.com" OR sourcehostname CONTAINS "54765-coinbase.com" OR sourcehostname CONTAINS "57197-coinbase.com" OR sourcehostname CONTAINS "58176-coinbase.com" OR sourcehostname CONTAINS "58297-coinbase.com" OR sourcehostname CONTAINS "61250-coinbase.com" OR sourcehostname CONTAINS "61835-coinbase.com" OR sourcehostname CONTAINS "61851-coinbase.com" OR sourcehostname CONTAINS "61937-coinbase.com" OR sourcehostname CONTAINS "71925-coinbase.com" OR sourcehostname CONTAINS "72957-coinbase.com" OR sourcehostname CONTAINS "72985-coinbase.com" OR sourcehostname CONTAINS "74651-coinbase.com" OR sourcehostname CONTAINS "754668948-coinbase.com" OR sourcehostname CONTAINS "76159869-coinbase.com" OR sourcehostname CONTAINS "76153-coinbase.com" OR sourcehostname CONTAINS "81758-coinbase.com" OR sourcehostname CONTAINS "81920-coinbase.com" OR sourcehostname CONTAINS "81926-coinbase.com" OR sourcehostname CONTAINS "81958-coinbase.com" OR sourcehostname CONTAINS "826298-coinbase.com" OR sourcehostname CONTAINS "83216-coinbase.com" OR sourcehostname CONTAINS "837613-coinbase.com" OR sourcehostname CONTAINS "83956-coinbase.com" OR sourcehostname CONTAINS "87157-coinbase.com" OR sourcehostname CONTAINS "87312-coinbase.com" OR sourcehostname CONTAINS "89304-coinbase.com" OR sourcehostname CONTAINS "89375-coinbase.com" OR sourcehostname CONTAINS "91723-gemini.com" OR sourcehostname CONTAINS "91752-coinbase.com")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "28676-coinbase.com" OR destinationntdomain CONTAINS "29185-coinbase.com" OR destinationntdomain CONTAINS "29195-coinbase.com" OR destinationntdomain CONTAINS "2a-coinbase.com" OR destinationntdomain CONTAINS "2b-coinbase.com" OR destinationntdomain CONTAINS "2c-coinbase.com" OR destinationntdomain CONTAINS "2f-coinbase.com" OR destinationntdomain CONTAINS "2fas-coinbase.com" OR destinationntdomain CONTAINS "2o-coinbase.com" OR destinationntdomain CONTAINS "2r-coinbase.com" OR destinationntdomain CONTAINS "2s-coinbase.com" OR destinationntdomain CONTAINS "2sv-coinbase.com" OR destinationntdomain CONTAINS "352134951-coinbase.com" OR destinationntdomain CONTAINS "38468-coinbase.com" OR destinationntdomain CONTAINS "39590-coinbase.com" OR destinationntdomain CONTAINS "41260-coinbase.com" OR destinationntdomain CONTAINS "427883-coinbase.com" OR destinationntdomain CONTAINS "43017-coinbase.com" OR destinationntdomain CONTAINS "47562-coinbase.com" OR destinationntdomain CONTAINS "50195-coinbase.com" OR destinationntdomain CONTAINS "5247-coinbase.com" OR destinationntdomain CONTAINS "54765-coinbase.com" OR destinationntdomain CONTAINS "57197-coinbase.com" OR destinationntdomain CONTAINS "58176-coinbase.com" OR destinationntdomain CONTAINS "58297-coinbase.com" OR destinationntdomain CONTAINS "61250-coinbase.com" OR destinationntdomain CONTAINS "61835-coinbase.com" OR destinationntdomain CONTAINS "61851-coinbase.com" OR destinationntdomain CONTAINS "61937-coinbase.com" OR destinationntdomain CONTAINS "71925-coinbase.com" OR destinationntdomain CONTAINS "72957-coinbase.com" OR destinationntdomain CONTAINS "72985-coinbase.com" OR destinationntdomain CONTAINS "74651-coinbase.com" OR destinationntdomain CONTAINS "754668948-coinbase.com" OR destinationntdomain CONTAINS "76159869-coinbase.com" OR destinationntdomain CONTAINS "76153-coinbase.com" OR destinationntdomain CONTAINS "81758-coinbase.com" OR destinationntdomain CONTAINS "81920-coinbase.com" OR destinationntdomain CONTAINS "81926-coinbase.com" OR destinationntdomain CONTAINS "81958-coinbase.com" OR destinationntdomain CONTAINS "826298-coinbase.com" OR destinationntdomain CONTAINS "83216-coinbase.com" OR destinationntdomain CONTAINS "837613-coinbase.com" OR destinationntdomain CONTAINS "83956-coinbase.com" OR destinationntdomain CONTAINS "87157-coinbase.com" OR destinationntdomain CONTAINS "87312-coinbase.com" OR destinationntdomain CONTAINS "89304-coinbase.com" OR destinationntdomain CONTAINS "89375-coinbase.com" OR destinationntdomain CONTAINS "91723-gemini.com" OR destinationntdomain CONTAINS "91752-coinbase.com")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND requesturl NOT NULL AND (requesturl CONTAINS "28676-coinbase.com" OR requesturl CONTAINS "29185-coinbase.com" OR requesturl CONTAINS "29195-coinbase.com" OR requesturl CONTAINS "2a-coinbase.com" OR requesturl CONTAINS "2b-coinbase.com" OR requesturl CONTAINS "2c-coinbase.com" OR requesturl CONTAINS "2f-coinbase.com" OR requesturl CONTAINS "2fas-coinbase.com" OR requesturl CONTAINS "2o-coinbase.com" OR requesturl CONTAINS "2r-coinbase.com" OR requesturl CONTAINS "2s-coinbase.com" OR requesturl CONTAINS "2sv-coinbase.com" OR requesturl CONTAINS "352134951-coinbase.com" OR requesturl CONTAINS "38468-coinbase.com" OR requesturl CONTAINS "39590-coinbase.com" OR requesturl CONTAINS "41260-coinbase.com" OR requesturl CONTAINS "427883-coinbase.com" OR requesturl CONTAINS "43017-coinbase.com" OR requesturl CONTAINS "47562-coinbase.com" OR requesturl CONTAINS "50195-coinbase.com" OR requesturl CONTAINS "5247-coinbase.com" OR requesturl CONTAINS "54765-coinbase.com" OR requesturl CONTAINS "57197-coinbase.com" OR requesturl CONTAINS "58176-coinbase.com" OR requesturl CONTAINS "58297-coinbase.com" OR requesturl CONTAINS "61250-coinbase.com" OR requesturl CONTAINS "61835-coinbase.com" OR requesturl CONTAINS "61851-coinbase.com" OR requesturl CONTAINS "61937-coinbase.com" OR requesturl CONTAINS "71925-coinbase.com" OR requesturl CONTAINS "72957-coinbase.com" OR requesturl CONTAINS "72985-coinbase.com" OR requesturl CONTAINS "74651-coinbase.com" OR requesturl CONTAINS "754668948-coinbase.com" OR requesturl CONTAINS "76159869-coinbase.com" OR requesturl CONTAINS "76153-coinbase.com" OR requesturl CONTAINS "81758-coinbase.com" OR requesturl CONTAINS "81920-coinbase.com" OR requesturl CONTAINS "81926-coinbase.com" OR requesturl CONTAINS "81958-coinbase.com" OR requesturl CONTAINS "826298-coinbase.com" OR requesturl CONTAINS "83216-coinbase.com" OR requesturl CONTAINS "837613-coinbase.com" OR requesturl CONTAINS "83956-coinbase.com" OR requesturl CONTAINS "87157-coinbase.com" OR requesturl CONTAINS "87312-coinbase.com" OR requesturl CONTAINS "89304-coinbase.com" OR requesturl CONTAINS "89375-coinbase.com" OR requesturl CONTAINS "91723-gemini.com" OR requesturl CONTAINS "91752-coinbase.com")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "91756-coinbase.com" OR destinationhostname CONTAINS "91782-coinbase.com" OR destinationhostname CONTAINS "91835-coinbase.com" OR destinationhostname CONTAINS "91845-coinbase.com" OR destinationhostname CONTAINS "91923-coinbase.com" OR destinationhostname CONTAINS "92758-coinbase.com" OR destinationhostname CONTAINS "948122061-coinbase.com" OR destinationhostname CONTAINS "978941-coinbase.com" OR destinationhostname CONTAINS "accountrecovery-coinbase.com" OR destinationhostname CONTAINS "action-shakepay.com" OR destinationhostname CONTAINS "adjust-coinbase.com" OR destinationhostname CONTAINS "admin-kraken.com" OR destinationhostname CONTAINS "applechargebacks.com" OR destinationhostname CONTAINS "authenticate-gemini.com" OR destinationhostname CONTAINS "authorize-gmail.com" OR destinationhostname CONTAINS "binance-okta.com" OR destinationhostname CONTAINS "captcha-coinbase.com" OR destinationhostname CONTAINS "cd-coinbase.com" OR destinationhostname CONTAINS "coinbase-heip.com" OR destinationhostname CONTAINS "coinbase-live.support" OR destinationhostname CONTAINS "coinbase-reject.com" OR destinationhostname CONTAINS "coinbase-ticket.com" OR destinationhostname CONTAINS "coinbaseheip.com" OR destinationhostname CONTAINS "com-2fa.help" OR destinationhostname CONTAINS "com-2fa.support" OR destinationhostname CONTAINS "com-3845.support" OR destinationhostname CONTAINS "com-connect.help" OR destinationhostname CONTAINS "com-fraud.support" OR destinationhostname CONTAINS "com-help.support" OR destinationhostname CONTAINS "com-reset.help" OR destinationhostname CONTAINS "com-reset.net" OR destinationhostname CONTAINS "com-ticket.live" OR destinationhostname CONTAINS "com-ticket.support" OR destinationhostname CONTAINS "contact-nexo.com" OR destinationhostname CONTAINS "convert-coinbase.com" OR destinationhostname CONTAINS "customerservice-coinbase.com" OR destinationhostname CONTAINS "default-coinbase.com" OR destinationhostname CONTAINS "defend-coinbase.com" OR destinationhostname CONTAINS "deny-coinbase.com" OR destinationhostname CONTAINS "disconnect-coinbase.com" OR destinationhostname CONTAINS "escalate-coinbase.com" OR destinationhostname CONTAINS "establish-coinbase.com" OR destinationhostname CONTAINS "fcc-okta.com" OR destinationhostname CONTAINS "fraudulent-coinbase.com" OR destinationhostname CONTAINS "guard-apple.com" OR destinationhostname CONTAINS "guard-icloud.com" OR destinationhostname CONTAINS "guardian-coinbase.com" OR destinationhostname CONTAINS "guide-gemini.com" OR destinationhostname CONTAINS "help-bitfinex.com" OR destinationhostname CONTAINS "help-shakepay.com")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "91756-coinbase.com" OR sourcentdomain CONTAINS "91782-coinbase.com" OR sourcentdomain CONTAINS "91835-coinbase.com" OR sourcentdomain CONTAINS "91845-coinbase.com" OR sourcentdomain CONTAINS "91923-coinbase.com" OR sourcentdomain CONTAINS "92758-coinbase.com" OR sourcentdomain CONTAINS "948122061-coinbase.com" OR sourcentdomain CONTAINS "978941-coinbase.com" OR sourcentdomain CONTAINS "accountrecovery-coinbase.com" OR sourcentdomain CONTAINS "action-shakepay.com" OR sourcentdomain CONTAINS "adjust-coinbase.com" OR sourcentdomain CONTAINS "admin-kraken.com" OR sourcentdomain CONTAINS "applechargebacks.com" OR sourcentdomain CONTAINS "authenticate-gemini.com" OR sourcentdomain CONTAINS "authorize-gmail.com" OR sourcentdomain CONTAINS "binance-okta.com" OR sourcentdomain CONTAINS "captcha-coinbase.com" OR sourcentdomain CONTAINS "cd-coinbase.com" OR sourcentdomain CONTAINS "coinbase-heip.com" OR sourcentdomain CONTAINS "coinbase-live.support" OR sourcentdomain CONTAINS "coinbase-reject.com" OR sourcentdomain CONTAINS "coinbase-ticket.com" OR sourcentdomain CONTAINS "coinbaseheip.com" OR sourcentdomain CONTAINS "com-2fa.help" OR sourcentdomain CONTAINS "com-2fa.support" OR sourcentdomain CONTAINS "com-3845.support" OR sourcentdomain CONTAINS "com-connect.help" OR sourcentdomain CONTAINS "com-fraud.support" OR sourcentdomain CONTAINS "com-help.support" OR sourcentdomain CONTAINS "com-reset.help" OR sourcentdomain CONTAINS "com-reset.net" OR sourcentdomain CONTAINS "com-ticket.live" OR sourcentdomain CONTAINS "com-ticket.support" OR sourcentdomain CONTAINS "contact-nexo.com" OR sourcentdomain CONTAINS "convert-coinbase.com" OR sourcentdomain CONTAINS "customerservice-coinbase.com" OR sourcentdomain CONTAINS "default-coinbase.com" OR sourcentdomain CONTAINS "defend-coinbase.com" OR sourcentdomain CONTAINS "deny-coinbase.com" OR sourcentdomain CONTAINS "disconnect-coinbase.com" OR sourcentdomain CONTAINS "escalate-coinbase.com" OR sourcentdomain CONTAINS "establish-coinbase.com" OR sourcentdomain CONTAINS "fcc-okta.com" OR sourcentdomain CONTAINS "fraudulent-coinbase.com" OR sourcentdomain CONTAINS "guard-apple.com" OR sourcentdomain CONTAINS "guard-icloud.com" OR sourcentdomain CONTAINS "guardian-coinbase.com" OR sourcentdomain CONTAINS "guide-gemini.com" OR sourcentdomain CONTAINS "help-bitfinex.com" OR sourcentdomain CONTAINS "help-shakepay.com")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "91756-coinbase.com" OR sourcehostname CONTAINS "91782-coinbase.com" OR sourcehostname CONTAINS "91835-coinbase.com" OR sourcehostname CONTAINS "91845-coinbase.com" OR sourcehostname CONTAINS "91923-coinbase.com" OR sourcehostname CONTAINS "92758-coinbase.com" OR sourcehostname CONTAINS "948122061-coinbase.com" OR sourcehostname CONTAINS "978941-coinbase.com" OR sourcehostname CONTAINS "accountrecovery-coinbase.com" OR sourcehostname CONTAINS "action-shakepay.com" OR sourcehostname CONTAINS "adjust-coinbase.com" OR sourcehostname CONTAINS "admin-kraken.com" OR sourcehostname CONTAINS "applechargebacks.com" OR sourcehostname CONTAINS "authenticate-gemini.com" OR sourcehostname CONTAINS "authorize-gmail.com" OR sourcehostname CONTAINS "binance-okta.com" OR sourcehostname CONTAINS "captcha-coinbase.com" OR sourcehostname CONTAINS "cd-coinbase.com" OR sourcehostname CONTAINS "coinbase-heip.com" OR sourcehostname CONTAINS "coinbase-live.support" OR sourcehostname CONTAINS "coinbase-reject.com" OR sourcehostname CONTAINS "coinbase-ticket.com" OR sourcehostname CONTAINS "coinbaseheip.com" OR sourcehostname CONTAINS "com-2fa.help" OR sourcehostname CONTAINS "com-2fa.support" OR sourcehostname CONTAINS "com-3845.support" OR sourcehostname CONTAINS "com-connect.help" OR sourcehostname CONTAINS "com-fraud.support" OR sourcehostname CONTAINS "com-help.support" OR sourcehostname CONTAINS "com-reset.help" OR sourcehostname CONTAINS "com-reset.net" OR sourcehostname CONTAINS "com-ticket.live" OR sourcehostname CONTAINS "com-ticket.support" OR sourcehostname CONTAINS "contact-nexo.com" OR sourcehostname CONTAINS "convert-coinbase.com" OR sourcehostname CONTAINS "customerservice-coinbase.com" OR sourcehostname CONTAINS "default-coinbase.com" OR sourcehostname CONTAINS "defend-coinbase.com" OR sourcehostname CONTAINS "deny-coinbase.com" OR sourcehostname CONTAINS "disconnect-coinbase.com" OR sourcehostname CONTAINS "escalate-coinbase.com" OR sourcehostname CONTAINS "establish-coinbase.com" OR sourcehostname CONTAINS "fcc-okta.com" OR sourcehostname CONTAINS "fraudulent-coinbase.com" OR sourcehostname CONTAINS "guard-apple.com" OR sourcehostname CONTAINS "guard-icloud.com" OR sourcehostname CONTAINS "guardian-coinbase.com" OR sourcehostname CONTAINS "guide-gemini.com" OR sourcehostname CONTAINS "help-bitfinex.com" OR sourcehostname CONTAINS "help-shakepay.com")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "91756-coinbase.com" OR destinationntdomain CONTAINS "91782-coinbase.com" OR destinationntdomain CONTAINS "91835-coinbase.com" OR destinationntdomain CONTAINS "91845-coinbase.com" OR destinationntdomain CONTAINS "91923-coinbase.com" OR destinationntdomain CONTAINS "92758-coinbase.com" OR destinationntdomain CONTAINS "948122061-coinbase.com" OR destinationntdomain CONTAINS "978941-coinbase.com" OR destinationntdomain CONTAINS "accountrecovery-coinbase.com" OR destinationntdomain CONTAINS "action-shakepay.com" OR destinationntdomain CONTAINS "adjust-coinbase.com" OR destinationntdomain CONTAINS "admin-kraken.com" OR destinationntdomain CONTAINS "applechargebacks.com" OR destinationntdomain CONTAINS "authenticate-gemini.com" OR destinationntdomain CONTAINS "authorize-gmail.com" OR destinationntdomain CONTAINS "binance-okta.com" OR destinationntdomain CONTAINS "captcha-coinbase.com" OR destinationntdomain CONTAINS "cd-coinbase.com" OR destinationntdomain CONTAINS "coinbase-heip.com" OR destinationntdomain CONTAINS "coinbase-live.support" OR destinationntdomain CONTAINS "coinbase-reject.com" OR destinationntdomain CONTAINS "coinbase-ticket.com" OR destinationntdomain CONTAINS "coinbaseheip.com" OR destinationntdomain CONTAINS "com-2fa.help" OR destinationntdomain CONTAINS "com-2fa.support" OR destinationntdomain CONTAINS "com-3845.support" OR destinationntdomain CONTAINS "com-connect.help" OR destinationntdomain CONTAINS "com-fraud.support" OR destinationntdomain CONTAINS "com-help.support" OR destinationntdomain CONTAINS "com-reset.help" OR destinationntdomain CONTAINS "com-reset.net" OR destinationntdomain CONTAINS "com-ticket.live" OR destinationntdomain CONTAINS "com-ticket.support" OR destinationntdomain CONTAINS "contact-nexo.com" OR destinationntdomain CONTAINS "convert-coinbase.com" OR destinationntdomain CONTAINS "customerservice-coinbase.com" OR destinationntdomain CONTAINS "default-coinbase.com" OR destinationntdomain CONTAINS "defend-coinbase.com" OR destinationntdomain CONTAINS "deny-coinbase.com" OR destinationntdomain CONTAINS "disconnect-coinbase.com" OR destinationntdomain CONTAINS "escalate-coinbase.com" OR destinationntdomain CONTAINS "establish-coinbase.com" OR destinationntdomain CONTAINS "fcc-okta.com" OR destinationntdomain CONTAINS "fraudulent-coinbase.com" OR destinationntdomain CONTAINS "guard-apple.com" OR destinationntdomain CONTAINS "guard-icloud.com" OR destinationntdomain CONTAINS "guardian-coinbase.com" OR destinationntdomain CONTAINS "guide-gemini.com" OR destinationntdomain CONTAINS "help-bitfinex.com" OR destinationntdomain CONTAINS "help-shakepay.com")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND requesturl NOT NULL AND (requesturl CONTAINS "91756-coinbase.com" OR requesturl CONTAINS "91782-coinbase.com" OR requesturl CONTAINS "91835-coinbase.com" OR requesturl CONTAINS "91845-coinbase.com" OR requesturl CONTAINS "91923-coinbase.com" OR requesturl CONTAINS "92758-coinbase.com" OR requesturl CONTAINS "948122061-coinbase.com" OR requesturl CONTAINS "978941-coinbase.com" OR requesturl CONTAINS "accountrecovery-coinbase.com" OR requesturl CONTAINS "action-shakepay.com" OR requesturl CONTAINS "adjust-coinbase.com" OR requesturl CONTAINS "admin-kraken.com" OR requesturl CONTAINS "applechargebacks.com" OR requesturl CONTAINS "authenticate-gemini.com" OR requesturl CONTAINS "authorize-gmail.com" OR requesturl CONTAINS "binance-okta.com" OR requesturl CONTAINS "captcha-coinbase.com" OR requesturl CONTAINS "cd-coinbase.com" OR requesturl CONTAINS "coinbase-heip.com" OR requesturl CONTAINS "coinbase-live.support" OR requesturl CONTAINS "coinbase-reject.com" OR requesturl CONTAINS "coinbase-ticket.com" OR requesturl CONTAINS "coinbaseheip.com" OR requesturl CONTAINS "com-2fa.help" OR requesturl CONTAINS "com-2fa.support" OR requesturl CONTAINS "com-3845.support" OR requesturl CONTAINS "com-connect.help" OR requesturl CONTAINS "com-fraud.support" OR requesturl CONTAINS "com-help.support" OR requesturl CONTAINS "com-reset.help" OR requesturl CONTAINS "com-reset.net" OR requesturl CONTAINS "com-ticket.live" OR requesturl CONTAINS "com-ticket.support" OR requesturl CONTAINS "contact-nexo.com" OR requesturl CONTAINS "convert-coinbase.com" OR requesturl CONTAINS "customerservice-coinbase.com" OR requesturl CONTAINS "default-coinbase.com" OR requesturl CONTAINS "defend-coinbase.com" OR requesturl CONTAINS "deny-coinbase.com" OR requesturl CONTAINS "disconnect-coinbase.com" OR requesturl CONTAINS "escalate-coinbase.com" OR requesturl CONTAINS "establish-coinbase.com" OR requesturl CONTAINS "fcc-okta.com" OR requesturl CONTAINS "fraudulent-coinbase.com" OR requesturl CONTAINS "guard-apple.com" OR requesturl CONTAINS "guard-icloud.com" OR requesturl CONTAINS "guardian-coinbase.com" OR requesturl CONTAINS "guide-gemini.com" OR requesturl CONTAINS "help-bitfinex.com" OR requesturl CONTAINS "help-shakepay.com")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "helpdesk-apple.com" OR destinationhostname CONTAINS "helpdesk-gemini.com" OR destinationhostname CONTAINS "helpdesk-icloud.com" OR destinationhostname CONTAINS "identification-coinbase.com" OR destinationhostname CONTAINS "lockdown-coinbase.com" OR destinationhostname CONTAINS "login-nexo.com" OR destinationhostname CONTAINS "keys-coinbase.com" OR destinationhostname CONTAINS "messages-coinbase.com" OR destinationhostname CONTAINS "newpassword-coinbase.com" OR destinationhostname CONTAINS "prompt-coinbase.com" OR destinationhostname CONTAINS "protect-apple.com" OR destinationhostname CONTAINS "protect-coinbase.com" OR destinationhostname CONTAINS "protect-gmail.com" OR destinationhostname CONTAINS "protect-kraken.com" OR destinationhostname CONTAINS "recoverme-coinbase.com" OR destinationhostname CONTAINS "recoveryportal-coinbase.com" OR destinationhostname CONTAINS "refunds-coinbase.com" OR destinationhostname CONTAINS "reset-okta.com" OR destinationhostname CONTAINS "restore-coinbase.com" OR destinationhostname CONTAINS "return-coinbase.com" OR destinationhostname CONTAINS "reverts-coinbase.com" OR destinationhostname CONTAINS "secure-binance.us" OR destinationhostname CONTAINS "secure-icloud.com" OR destinationhostname CONTAINS "secure-nexo.com" OR destinationhostname CONTAINS "secure-shakepay.com" OR destinationhostname CONTAINS "security-umusic.com" OR destinationhostname CONTAINS "server694590423.tech" OR destinationhostname CONTAINS "session-coinbase.com" OR destinationhostname CONTAINS "startrecovery-coinbase.com" OR destinationhostname CONTAINS "signin-kraken.com" OR destinationhostname CONTAINS "suite-trezor.io" OR destinationhostname CONTAINS "supportportal-coinbase.com" OR destinationhostname CONTAINS "tech-icloud.com" OR destinationhostname CONTAINS "threat-coinbase.com" OR destinationhostname CONTAINS "ticket-apple.com" OR destinationhostname CONTAINS "ticket-coinbase.com" OR destinationhostname CONTAINS "tickets-apple.com" OR destinationhostname CONTAINS "tokens-coinbase.com" OR destinationhostname CONTAINS "unblock-coinbase.com" OR destinationhostname CONTAINS "unlink-coinbase.com" OR destinationhostname CONTAINS "your-coinbase.com" OR destinationhostname CONTAINS "welcome-coinbase.com" OR destinationhostname CONTAINS "www-coinbasewallet.com" OR destinationhostname CONTAINS "www-help-coinbase.com" OR destinationhostname CONTAINS "www-help-gemini.com")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "helpdesk-apple.com" OR sourcentdomain CONTAINS "helpdesk-gemini.com" OR sourcentdomain CONTAINS "helpdesk-icloud.com" OR sourcentdomain CONTAINS "identification-coinbase.com" OR sourcentdomain CONTAINS "lockdown-coinbase.com" OR sourcentdomain CONTAINS "login-nexo.com" OR sourcentdomain CONTAINS "keys-coinbase.com" OR sourcentdomain CONTAINS "messages-coinbase.com" OR sourcentdomain CONTAINS "newpassword-coinbase.com" OR sourcentdomain CONTAINS "prompt-coinbase.com" OR sourcentdomain CONTAINS "protect-apple.com" OR sourcentdomain CONTAINS "protect-coinbase.com" OR sourcentdomain CONTAINS "protect-gmail.com" OR sourcentdomain CONTAINS "protect-kraken.com" OR sourcentdomain CONTAINS "recoverme-coinbase.com" OR sourcentdomain CONTAINS "recoveryportal-coinbase.com" OR sourcentdomain CONTAINS "refunds-coinbase.com" OR sourcentdomain CONTAINS "reset-okta.com" OR sourcentdomain CONTAINS "restore-coinbase.com" OR sourcentdomain CONTAINS "return-coinbase.com" OR sourcentdomain CONTAINS "reverts-coinbase.com" OR sourcentdomain CONTAINS "secure-binance.us" OR sourcentdomain CONTAINS "secure-icloud.com" OR sourcentdomain CONTAINS "secure-nexo.com" OR sourcentdomain CONTAINS "secure-shakepay.com" OR sourcentdomain CONTAINS "security-umusic.com" OR sourcentdomain CONTAINS "server694590423.tech" OR sourcentdomain CONTAINS "session-coinbase.com" OR sourcentdomain CONTAINS "startrecovery-coinbase.com" OR sourcentdomain CONTAINS "signin-kraken.com" OR sourcentdomain CONTAINS "suite-trezor.io" OR sourcentdomain CONTAINS "supportportal-coinbase.com" OR sourcentdomain CONTAINS "tech-icloud.com" OR sourcentdomain CONTAINS "threat-coinbase.com" OR sourcentdomain CONTAINS "ticket-apple.com" OR sourcentdomain CONTAINS "ticket-coinbase.com" OR sourcentdomain CONTAINS "tickets-apple.com" OR sourcentdomain CONTAINS "tokens-coinbase.com" OR sourcentdomain CONTAINS "unblock-coinbase.com" OR sourcentdomain CONTAINS "unlink-coinbase.com" OR sourcentdomain CONTAINS "your-coinbase.com" OR sourcentdomain CONTAINS "welcome-coinbase.com" OR sourcentdomain CONTAINS "www-coinbasewallet.com" OR sourcentdomain CONTAINS "www-help-coinbase.com" OR sourcentdomain CONTAINS "www-help-gemini.com")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "helpdesk-apple.com" OR sourcehostname CONTAINS "helpdesk-gemini.com" OR sourcehostname CONTAINS "helpdesk-icloud.com" OR sourcehostname CONTAINS "identification-coinbase.com" OR sourcehostname CONTAINS "lockdown-coinbase.com" OR sourcehostname CONTAINS "login-nexo.com" OR sourcehostname CONTAINS "keys-coinbase.com" OR sourcehostname CONTAINS "messages-coinbase.com" OR sourcehostname CONTAINS "newpassword-coinbase.com" OR sourcehostname CONTAINS "prompt-coinbase.com" OR sourcehostname CONTAINS "protect-apple.com" OR sourcehostname CONTAINS "protect-coinbase.com" OR sourcehostname CONTAINS "protect-gmail.com" OR sourcehostname CONTAINS "protect-kraken.com" OR sourcehostname CONTAINS "recoverme-coinbase.com" OR sourcehostname CONTAINS "recoveryportal-coinbase.com" OR sourcehostname CONTAINS "refunds-coinbase.com" OR sourcehostname CONTAINS "reset-okta.com" OR sourcehostname CONTAINS "restore-coinbase.com" OR sourcehostname CONTAINS "return-coinbase.com" OR sourcehostname CONTAINS "reverts-coinbase.com" OR sourcehostname CONTAINS "secure-binance.us" OR sourcehostname CONTAINS "secure-icloud.com" OR sourcehostname CONTAINS "secure-nexo.com" OR sourcehostname CONTAINS "secure-shakepay.com" OR sourcehostname CONTAINS "security-umusic.com" OR sourcehostname CONTAINS "server694590423.tech" OR sourcehostname CONTAINS "session-coinbase.com" OR sourcehostname CONTAINS "startrecovery-coinbase.com" OR sourcehostname CONTAINS "signin-kraken.com" OR sourcehostname CONTAINS "suite-trezor.io" OR sourcehostname CONTAINS "supportportal-coinbase.com" OR sourcehostname CONTAINS "tech-icloud.com" OR sourcehostname CONTAINS "threat-coinbase.com" OR sourcehostname CONTAINS "ticket-apple.com" OR sourcehostname CONTAINS "ticket-coinbase.com" OR sourcehostname CONTAINS "tickets-apple.com" OR sourcehostname CONTAINS "tokens-coinbase.com" OR sourcehostname CONTAINS "unblock-coinbase.com" OR sourcehostname CONTAINS "unlink-coinbase.com" OR sourcehostname CONTAINS "your-coinbase.com" OR sourcehostname CONTAINS "welcome-coinbase.com" OR sourcehostname CONTAINS "www-coinbasewallet.com" OR sourcehostname CONTAINS "www-help-coinbase.com" OR sourcehostname CONTAINS "www-help-gemini.com")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "helpdesk-apple.com" OR destinationntdomain CONTAINS "helpdesk-gemini.com" OR destinationntdomain CONTAINS "helpdesk-icloud.com" OR destinationntdomain CONTAINS "identification-coinbase.com" OR destinationntdomain CONTAINS "lockdown-coinbase.com" OR destinationntdomain CONTAINS "login-nexo.com" OR destinationntdomain CONTAINS "keys-coinbase.com" OR destinationntdomain CONTAINS "messages-coinbase.com" OR destinationntdomain CONTAINS "newpassword-coinbase.com" OR destinationntdomain CONTAINS "prompt-coinbase.com" OR destinationntdomain CONTAINS "protect-apple.com" OR destinationntdomain CONTAINS "protect-coinbase.com" OR destinationntdomain CONTAINS "protect-gmail.com" OR destinationntdomain CONTAINS "protect-kraken.com" OR destinationntdomain CONTAINS "recoverme-coinbase.com" OR destinationntdomain CONTAINS "recoveryportal-coinbase.com" OR destinationntdomain CONTAINS "refunds-coinbase.com" OR destinationntdomain CONTAINS "reset-okta.com" OR destinationntdomain CONTAINS "restore-coinbase.com" OR destinationntdomain CONTAINS "return-coinbase.com" OR destinationntdomain CONTAINS "reverts-coinbase.com" OR destinationntdomain CONTAINS "secure-binance.us" OR destinationntdomain CONTAINS "secure-icloud.com" OR destinationntdomain CONTAINS "secure-nexo.com" OR destinationntdomain CONTAINS "secure-shakepay.com" OR destinationntdomain CONTAINS "security-umusic.com" OR destinationntdomain CONTAINS "server694590423.tech" OR destinationntdomain CONTAINS "session-coinbase.com" OR destinationntdomain CONTAINS "startrecovery-coinbase.com" OR destinationntdomain CONTAINS "signin-kraken.com" OR destinationntdomain CONTAINS "suite-trezor.io" OR destinationntdomain CONTAINS "supportportal-coinbase.com" OR destinationntdomain CONTAINS "tech-icloud.com" OR destinationntdomain CONTAINS "threat-coinbase.com" OR destinationntdomain CONTAINS "ticket-apple.com" OR destinationntdomain CONTAINS "ticket-coinbase.com" OR destinationntdomain CONTAINS "tickets-apple.com" OR destinationntdomain CONTAINS "tokens-coinbase.com" OR destinationntdomain CONTAINS "unblock-coinbase.com" OR destinationntdomain CONTAINS "unlink-coinbase.com" OR destinationntdomain CONTAINS "your-coinbase.com" OR destinationntdomain CONTAINS "welcome-coinbase.com" OR destinationntdomain CONTAINS "www-coinbasewallet.com" OR destinationntdomain CONTAINS "www-help-coinbase.com" OR destinationntdomain CONTAINS "www-help-gemini.com")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND requesturl NOT NULL AND (requesturl CONTAINS "helpdesk-apple.com" OR requesturl CONTAINS "helpdesk-gemini.com" OR requesturl CONTAINS "helpdesk-icloud.com" OR requesturl CONTAINS "identification-coinbase.com" OR requesturl CONTAINS "lockdown-coinbase.com" OR requesturl CONTAINS "login-nexo.com" OR requesturl CONTAINS "keys-coinbase.com" OR requesturl CONTAINS "messages-coinbase.com" OR requesturl CONTAINS "newpassword-coinbase.com" OR requesturl CONTAINS "prompt-coinbase.com" OR requesturl CONTAINS "protect-apple.com" OR requesturl CONTAINS "protect-coinbase.com" OR requesturl CONTAINS "protect-gmail.com" OR requesturl CONTAINS "protect-kraken.com" OR requesturl CONTAINS "recoverme-coinbase.com" OR requesturl CONTAINS "recoveryportal-coinbase.com" OR requesturl CONTAINS "refunds-coinbase.com" OR requesturl CONTAINS "reset-okta.com" OR requesturl CONTAINS "restore-coinbase.com" OR requesturl CONTAINS "return-coinbase.com" OR requesturl CONTAINS "reverts-coinbase.com" OR requesturl CONTAINS "secure-binance.us" OR requesturl CONTAINS "secure-icloud.com" OR requesturl CONTAINS "secure-nexo.com" OR requesturl CONTAINS "secure-shakepay.com" OR requesturl CONTAINS "security-umusic.com" OR requesturl CONTAINS "server694590423.tech" OR requesturl CONTAINS "session-coinbase.com" OR requesturl CONTAINS "startrecovery-coinbase.com" OR requesturl CONTAINS "signin-kraken.com" OR requesturl CONTAINS "suite-trezor.io" OR requesturl CONTAINS "supportportal-coinbase.com" OR requesturl CONTAINS "tech-icloud.com" OR requesturl CONTAINS "threat-coinbase.com" OR requesturl CONTAINS "ticket-apple.com" OR requesturl CONTAINS "ticket-coinbase.com" OR requesturl CONTAINS "tickets-apple.com" OR requesturl CONTAINS "tokens-coinbase.com" OR requesturl CONTAINS "unblock-coinbase.com" OR requesturl CONTAINS "unlink-coinbase.com" OR requesturl CONTAINS "your-coinbase.com" OR requesturl CONTAINS "welcome-coinbase.com" OR requesturl CONTAINS "www-coinbasewallet.com" OR requesturl CONTAINS "www-help-coinbase.com" OR requesturl CONTAINS "www-help-gemini.com")
index=activity AND rg_functionality="Cloud Application Audit" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "official-server.com" OR destinationhostname CONTAINS "server694590423.tech" OR destinationhostname CONTAINS "island-placid-bromine.glitch.me" OR destinationhostname CONTAINS "circular-noon-farmhouse.glitch.me" OR destinationhostname CONTAINS "talented-friendly-price.glitch.me" OR destinationhostname CONTAINS "dflfmgsdokasdcpl.com" OR destinationhostname CONTAINS "original-backend.com" OR destinationhostname CONTAINS "07159889-coinbase.com" OR destinationhostname CONTAINS "10195-coinbase.com" OR destinationhostname CONTAINS "11246-coinbase.com" OR destinationhostname CONTAINS "11247-coinbase.com" OR destinationhostname CONTAINS "11248-coinbase.com" OR destinationhostname CONTAINS "11258-coinbase.com" OR destinationhostname CONTAINS "11259-coinbase.com" OR destinationhostname CONTAINS "113912-coinbase.com" OR destinationhostname CONTAINS "11472-coinbase.com" OR destinationhostname CONTAINS "11923-coinbase.com" OR destinationhostname CONTAINS "11957-coinbase.com" OR destinationhostname CONTAINS "128147-coinbase.com" OR destinationhostname CONTAINS "12958-coinbase.com" OR destinationhostname CONTAINS "12984-okta.com" OR destinationhostname CONTAINS "12985-coinbase.com" OR destinationhostname CONTAINS "13130-coinbase.com" OR destinationhostname CONTAINS "13247-coinbase.com" OR destinationhostname CONTAINS "13247-icloud.com" OR destinationhostname CONTAINS "13267-coinbase.com" OR destinationhostname CONTAINS "146271510-coinbase.com" OR destinationhostname CONTAINS "146282-coinbase.com" OR destinationhostname CONTAINS "146284-coinbase.com" OR destinationhostname CONTAINS "147260-coinbase.com" OR destinationhostname CONTAINS "14765-coinbase.com" OR destinationhostname CONTAINS "14817582-coinbase.com" OR destinationhostname CONTAINS "14871904-coinbase.com" OR destinationhostname CONTAINS "14891902-coinbase.com" OR destinationhostname CONTAINS "1492864-coinbase.com" OR destinationhostname CONTAINS "158312-coinbase.com" OR destinationhostname CONTAINS "158372-coinbase.com" OR destinationhostname CONTAINS "158702-coinbase.com" OR destinationhostname CONTAINS "16171675-coinbase.com" OR destinationhostname CONTAINS "16171832-coinbase.com" OR destinationhostname CONTAINS "16178234-coinbase.com" OR destinationhostname CONTAINS "16178237-coinbase.com" OR destinationhostname CONTAINS "16178434-coinbase.com" OR destinationhostname CONTAINS "162178-coinbase.com" OR destinationhostname CONTAINS "162478-coinbase.com" OR destinationhostname CONTAINS "162782-coinbase.com" OR destinationhostname CONTAINS "162812-coinbase.com" OR destinationhostname CONTAINS "162814-coinbase.com" OR destinationhostname CONTAINS "16442580-coinbase.com" OR destinationhostname CONTAINS "16450107-coinbase.com")
index=activity AND rg_functionality="Cloud Application Audit" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "official-server.com" OR sourcentdomain CONTAINS "server694590423.tech" OR sourcentdomain CONTAINS "island-placid-bromine.glitch.me" OR sourcentdomain CONTAINS "circular-noon-farmhouse.glitch.me" OR sourcentdomain CONTAINS "talented-friendly-price.glitch.me" OR sourcentdomain CONTAINS "dflfmgsdokasdcpl.com" OR sourcentdomain CONTAINS "original-backend.com" OR sourcentdomain CONTAINS "07159889-coinbase.com" OR sourcentdomain CONTAINS "10195-coinbase.com" OR sourcentdomain CONTAINS "11246-coinbase.com" OR sourcentdomain CONTAINS "11247-coinbase.com" OR sourcentdomain CONTAINS "11248-coinbase.com" OR sourcentdomain CONTAINS "11258-coinbase.com" OR sourcentdomain CONTAINS "11259-coinbase.com" OR sourcentdomain CONTAINS "113912-coinbase.com" OR sourcentdomain CONTAINS "11472-coinbase.com" OR sourcentdomain CONTAINS "11923-coinbase.com" OR sourcentdomain CONTAINS "11957-coinbase.com" OR sourcentdomain CONTAINS "128147-coinbase.com" OR sourcentdomain CONTAINS "12958-coinbase.com" OR sourcentdomain CONTAINS "12984-okta.com" OR sourcentdomain CONTAINS "12985-coinbase.com" OR sourcentdomain CONTAINS "13130-coinbase.com" OR sourcentdomain CONTAINS "13247-coinbase.com" OR sourcentdomain CONTAINS "13247-icloud.com" OR sourcentdomain CONTAINS "13267-coinbase.com" OR sourcentdomain CONTAINS "146271510-coinbase.com" OR sourcentdomain CONTAINS "146282-coinbase.com" OR sourcentdomain CONTAINS "146284-coinbase.com" OR sourcentdomain CONTAINS "147260-coinbase.com" OR sourcentdomain CONTAINS "14765-coinbase.com" OR sourcentdomain CONTAINS "14817582-coinbase.com" OR sourcentdomain CONTAINS "14871904-coinbase.com" OR sourcentdomain CONTAINS "14891902-coinbase.com" OR sourcentdomain CONTAINS "1492864-coinbase.com" OR sourcentdomain CONTAINS "158312-coinbase.com" OR sourcentdomain CONTAINS "158372-coinbase.com" OR sourcentdomain CONTAINS "158702-coinbase.com" OR sourcentdomain CONTAINS "16171675-coinbase.com" OR sourcentdomain CONTAINS "16171832-coinbase.com" OR sourcentdomain CONTAINS "16178234-coinbase.com" OR sourcentdomain CONTAINS "16178237-coinbase.com" OR sourcentdomain CONTAINS "16178434-coinbase.com" OR sourcentdomain CONTAINS "162178-coinbase.com" OR sourcentdomain CONTAINS "162478-coinbase.com" OR sourcentdomain CONTAINS "162782-coinbase.com" OR sourcentdomain CONTAINS "162812-coinbase.com" OR sourcentdomain CONTAINS "162814-coinbase.com" OR sourcentdomain CONTAINS "16442580-coinbase.com" OR sourcentdomain CONTAINS "16450107-coinbase.com")
index=activity AND rg_functionality="Cloud Application Audit" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "official-server.com" OR sourcehostname CONTAINS "server694590423.tech" OR sourcehostname CONTAINS "island-placid-bromine.glitch.me" OR sourcehostname CONTAINS "circular-noon-farmhouse.glitch.me" OR sourcehostname CONTAINS "talented-friendly-price.glitch.me" OR sourcehostname CONTAINS "dflfmgsdokasdcpl.com" OR sourcehostname CONTAINS "original-backend.com" OR sourcehostname CONTAINS "07159889-coinbase.com" OR sourcehostname CONTAINS "10195-coinbase.com" OR sourcehostname CONTAINS "11246-coinbase.com" OR sourcehostname CONTAINS "11247-coinbase.com" OR sourcehostname CONTAINS "11248-coinbase.com" OR sourcehostname CONTAINS "11258-coinbase.com" OR sourcehostname CONTAINS "11259-coinbase.com" OR sourcehostname CONTAINS "113912-coinbase.com" OR sourcehostname CONTAINS "11472-coinbase.com" OR sourcehostname CONTAINS "11923-coinbase.com" OR sourcehostname CONTAINS "11957-coinbase.com" OR sourcehostname CONTAINS "128147-coinbase.com" OR sourcehostname CONTAINS "12958-coinbase.com" OR sourcehostname CONTAINS "12984-okta.com" OR sourcehostname CONTAINS "12985-coinbase.com" OR sourcehostname CONTAINS "13130-coinbase.com" OR sourcehostname CONTAINS "13247-coinbase.com" OR sourcehostname CONTAINS "13247-icloud.com" OR sourcehostname CONTAINS "13267-coinbase.com" OR sourcehostname CONTAINS "146271510-coinbase.com" OR sourcehostname CONTAINS "146282-coinbase.com" OR sourcehostname CONTAINS "146284-coinbase.com" OR sourcehostname CONTAINS "147260-coinbase.com" OR sourcehostname CONTAINS "14765-coinbase.com" OR sourcehostname CONTAINS "14817582-coinbase.com" OR sourcehostname CONTAINS "14871904-coinbase.com" OR sourcehostname CONTAINS "14891902-coinbase.com" OR sourcehostname CONTAINS "1492864-coinbase.com" OR sourcehostname CONTAINS "158312-coinbase.com" OR sourcehostname CONTAINS "158372-coinbase.com" OR sourcehostname CONTAINS "158702-coinbase.com" OR sourcehostname CONTAINS "16171675-coinbase.com" OR sourcehostname CONTAINS "16171832-coinbase.com" OR sourcehostname CONTAINS "16178234-coinbase.com" OR sourcehostname CONTAINS "16178237-coinbase.com" OR sourcehostname CONTAINS "16178434-coinbase.com" OR sourcehostname CONTAINS "162178-coinbase.com" OR sourcehostname CONTAINS "162478-coinbase.com" OR sourcehostname CONTAINS "162782-coinbase.com" OR sourcehostname CONTAINS "162812-coinbase.com" OR sourcehostname CONTAINS "162814-coinbase.com" OR sourcehostname CONTAINS "16442580-coinbase.com" OR sourcehostname CONTAINS "16450107-coinbase.com")
index=activity AND rg_functionality="Cloud Application Audit" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "official-server.com" OR destinationntdomain CONTAINS "server694590423.tech" OR destinationntdomain CONTAINS "island-placid-bromine.glitch.me" OR destinationntdomain CONTAINS "circular-noon-farmhouse.glitch.me" OR destinationntdomain CONTAINS "talented-friendly-price.glitch.me" OR destinationntdomain CONTAINS "dflfmgsdokasdcpl.com" OR destinationntdomain CONTAINS "original-backend.com" OR destinationntdomain CONTAINS "07159889-coinbase.com" OR destinationntdomain CONTAINS "10195-coinbase.com" OR destinationntdomain CONTAINS "11246-coinbase.com" OR destinationntdomain CONTAINS "11247-coinbase.com" OR destinationntdomain CONTAINS "11248-coinbase.com" OR destinationntdomain CONTAINS "11258-coinbase.com" OR destinationntdomain CONTAINS "11259-coinbase.com" OR destinationntdomain CONTAINS "113912-coinbase.com" OR destinationntdomain CONTAINS "11472-coinbase.com" OR destinationntdomain CONTAINS "11923-coinbase.com" OR destinationntdomain CONTAINS "11957-coinbase.com" OR destinationntdomain CONTAINS "128147-coinbase.com" OR destinationntdomain CONTAINS "12958-coinbase.com" OR destinationntdomain CONTAINS "12984-okta.com" OR destinationntdomain CONTAINS "12985-coinbase.com" OR destinationntdomain CONTAINS "13130-coinbase.com" OR destinationntdomain CONTAINS "13247-coinbase.com" OR destinationntdomain CONTAINS "13247-icloud.com" OR destinationntdomain CONTAINS "13267-coinbase.com" OR destinationntdomain CONTAINS "146271510-coinbase.com" OR destinationntdomain CONTAINS "146282-coinbase.com" OR destinationntdomain CONTAINS "146284-coinbase.com" OR destinationntdomain CONTAINS "147260-coinbase.com" OR destinationntdomain CONTAINS "14765-coinbase.com" OR destinationntdomain CONTAINS "14817582-coinbase.com" OR destinationntdomain CONTAINS "14871904-coinbase.com" OR destinationntdomain CONTAINS "14891902-coinbase.com" OR destinationntdomain CONTAINS "1492864-coinbase.com" OR destinationntdomain CONTAINS "158312-coinbase.com" OR destinationntdomain CONTAINS "158372-coinbase.com" OR destinationntdomain CONTAINS "158702-coinbase.com" OR destinationntdomain CONTAINS "16171675-coinbase.com" OR destinationntdomain CONTAINS "16171832-coinbase.com" OR destinationntdomain CONTAINS "16178234-coinbase.com" OR destinationntdomain CONTAINS "16178237-coinbase.com" OR destinationntdomain CONTAINS "16178434-coinbase.com" OR destinationntdomain CONTAINS "162178-coinbase.com" OR destinationntdomain CONTAINS "162478-coinbase.com" OR destinationntdomain CONTAINS "162782-coinbase.com" OR destinationntdomain CONTAINS "162812-coinbase.com" OR destinationntdomain CONTAINS "162814-coinbase.com" OR destinationntdomain CONTAINS "16442580-coinbase.com" OR destinationntdomain CONTAINS "16450107-coinbase.com")
index=activity AND rg_functionality="Cloud Application Audit" AND requesturl NOT NULL AND (requesturl CONTAINS "official-server.com" OR requesturl CONTAINS "server694590423.tech" OR requesturl CONTAINS "island-placid-bromine.glitch.me" OR requesturl CONTAINS "circular-noon-farmhouse.glitch.me" OR requesturl CONTAINS "talented-friendly-price.glitch.me" OR requesturl CONTAINS "dflfmgsdokasdcpl.com" OR requesturl CONTAINS "original-backend.com" OR requesturl CONTAINS "07159889-coinbase.com" OR requesturl CONTAINS "10195-coinbase.com" OR requesturl CONTAINS "11246-coinbase.com" OR requesturl CONTAINS "11247-coinbase.com" OR requesturl CONTAINS "11248-coinbase.com" OR requesturl CONTAINS "11258-coinbase.com" OR requesturl CONTAINS "11259-coinbase.com" OR requesturl CONTAINS "113912-coinbase.com" OR requesturl CONTAINS "11472-coinbase.com" OR requesturl CONTAINS "11923-coinbase.com" OR requesturl CONTAINS "11957-coinbase.com" OR requesturl CONTAINS "128147-coinbase.com" OR requesturl CONTAINS "12958-coinbase.com" OR requesturl CONTAINS "12984-okta.com" OR requesturl CONTAINS "12985-coinbase.com" OR requesturl CONTAINS "13130-coinbase.com" OR requesturl CONTAINS "13247-coinbase.com" OR requesturl CONTAINS "13247-icloud.com" OR requesturl CONTAINS "13267-coinbase.com" OR requesturl CONTAINS "146271510-coinbase.com" OR requesturl CONTAINS "146282-coinbase.com" OR requesturl CONTAINS "146284-coinbase.com" OR requesturl CONTAINS "147260-coinbase.com" OR requesturl CONTAINS "14765-coinbase.com" OR requesturl CONTAINS "14817582-coinbase.com" OR requesturl CONTAINS "14871904-coinbase.com" OR requesturl CONTAINS "14891902-coinbase.com" OR requesturl CONTAINS "1492864-coinbase.com" OR requesturl CONTAINS "158312-coinbase.com" OR requesturl CONTAINS "158372-coinbase.com" OR requesturl CONTAINS "158702-coinbase.com" OR requesturl CONTAINS "16171675-coinbase.com" OR requesturl CONTAINS "16171832-coinbase.com" OR requesturl CONTAINS "16178234-coinbase.com" OR requesturl CONTAINS "16178237-coinbase.com" OR requesturl CONTAINS "16178434-coinbase.com" OR requesturl CONTAINS "162178-coinbase.com" OR requesturl CONTAINS "162478-coinbase.com" OR requesturl CONTAINS "162782-coinbase.com" OR requesturl CONTAINS "162812-coinbase.com" OR requesturl CONTAINS "162814-coinbase.com" OR requesturl CONTAINS "16442580-coinbase.com" OR requesturl CONTAINS "16450107-coinbase.com")
index=activity AND rg_functionality="Cloud Application Audit" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "16450207-coinbase.com" OR destinationhostname CONTAINS "16458207-coinbase.com" OR destinationhostname CONTAINS "16478202-coinbase.com" OR destinationhostname CONTAINS "164872942-coinbase.com" OR destinationhostname CONTAINS "16590-coinbase.com" OR destinationhostname CONTAINS "16594373-coinbase.com" OR destinationhostname CONTAINS "16624831-coinbase.com" OR destinationhostname CONTAINS "16642124-coinbase.com" OR destinationhostname CONTAINS "16642172-coinbase.com" OR destinationhostname CONTAINS "16642580-coinbase.com" OR destinationhostname CONTAINS "16642721-coinbase.com" OR destinationhostname CONTAINS "16642724-coinbase.com" OR destinationhostname CONTAINS "16642871-coinbase.com" OR destinationhostname CONTAINS "16642872-coinbase.com" OR destinationhostname CONTAINS "16712942-coinbase.com" OR destinationhostname CONTAINS "16718672-coinbase.com" OR destinationhostname CONTAINS "16728342-coinbase.com" OR destinationhostname CONTAINS "16728348-coinbase.com" OR destinationhostname CONTAINS "16728442-coinbase.com" OR destinationhostname CONTAINS "16728472-coinbase.com" OR destinationhostname CONTAINS "167285-coinbase.com" OR destinationhostname CONTAINS "16729042-coinbase.com" OR destinationhostname CONTAINS "16748272-coinbase.com" OR destinationhostname CONTAINS "16782942-coinbase.com" OR destinationhostname CONTAINS "16827420-coinbase.com" OR destinationhostname CONTAINS "16827423-coinbase.com" OR destinationhostname CONTAINS "16847145-coinbase.com" OR destinationhostname CONTAINS "16893924-coinbase.com" OR destinationhostname CONTAINS "17182-coinbase.com" OR destinationhostname CONTAINS "17255030-coinbase.com" OR destinationhostname CONTAINS "17259-kraken.com" OR destinationhostname CONTAINS "172486-coinbase.com" OR destinationhostname CONTAINS "17284652-coinbase.com" OR destinationhostname CONTAINS "17286-coinbase.com" OR destinationhostname CONTAINS "17334522-coinbase.com" OR destinationhostname CONTAINS "17334522-kraken.com" OR destinationhostname CONTAINS "17384522-coinbase.com" OR destinationhostname CONTAINS "173912-coinbase.com" OR destinationhostname CONTAINS "17494976-coinbase.com" OR destinationhostname CONTAINS "17512854-coinbase.com" OR destinationhostname CONTAINS "17512857-coinbase.com" OR destinationhostname CONTAINS "1751954-coinbase.com" OR destinationhostname CONTAINS "17525030-coinbase.com" OR destinationhostname CONTAINS "17529580-coinbase.com" OR destinationhostname CONTAINS "17614-coinbase.com" OR destinationhostname CONTAINS "17618412-coinbase.com" OR destinationhostname CONTAINS "17619-coinbase.com" OR destinationhostname CONTAINS "176284-coinbase.com" OR destinationhostname CONTAINS "17823920-coinbase.com" OR destinationhostname CONTAINS "178253-coinbase.com")
index=activity AND rg_functionality="Cloud Application Audit" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "16450207-coinbase.com" OR sourcentdomain CONTAINS "16458207-coinbase.com" OR sourcentdomain CONTAINS "16478202-coinbase.com" OR sourcentdomain CONTAINS "164872942-coinbase.com" OR sourcentdomain CONTAINS "16590-coinbase.com" OR sourcentdomain CONTAINS "16594373-coinbase.com" OR sourcentdomain CONTAINS "16624831-coinbase.com" OR sourcentdomain CONTAINS "16642124-coinbase.com" OR sourcentdomain CONTAINS "16642172-coinbase.com" OR sourcentdomain CONTAINS "16642580-coinbase.com" OR sourcentdomain CONTAINS "16642721-coinbase.com" OR sourcentdomain CONTAINS "16642724-coinbase.com" OR sourcentdomain CONTAINS "16642871-coinbase.com" OR sourcentdomain CONTAINS "16642872-coinbase.com" OR sourcentdomain CONTAINS "16712942-coinbase.com" OR sourcentdomain CONTAINS "16718672-coinbase.com" OR sourcentdomain CONTAINS "16728342-coinbase.com" OR sourcentdomain CONTAINS "16728348-coinbase.com" OR sourcentdomain CONTAINS "16728442-coinbase.com" OR sourcentdomain CONTAINS "16728472-coinbase.com" OR sourcentdomain CONTAINS "167285-coinbase.com" OR sourcentdomain CONTAINS "16729042-coinbase.com" OR sourcentdomain CONTAINS "16748272-coinbase.com" OR sourcentdomain CONTAINS "16782942-coinbase.com" OR sourcentdomain CONTAINS "16827420-coinbase.com" OR sourcentdomain CONTAINS "16827423-coinbase.com" OR sourcentdomain CONTAINS "16847145-coinbase.com" OR sourcentdomain CONTAINS "16893924-coinbase.com" OR sourcentdomain CONTAINS "17182-coinbase.com" OR sourcentdomain CONTAINS "17255030-coinbase.com" OR sourcentdomain CONTAINS "17259-kraken.com" OR sourcentdomain CONTAINS "172486-coinbase.com" OR sourcentdomain CONTAINS "17284652-coinbase.com" OR sourcentdomain CONTAINS "17286-coinbase.com" OR sourcentdomain CONTAINS "17334522-coinbase.com" OR sourcentdomain CONTAINS "17334522-kraken.com" OR sourcentdomain CONTAINS "17384522-coinbase.com" OR sourcentdomain CONTAINS "173912-coinbase.com" OR sourcentdomain CONTAINS "17494976-coinbase.com" OR sourcentdomain CONTAINS "17512854-coinbase.com" OR sourcentdomain CONTAINS "17512857-coinbase.com" OR sourcentdomain CONTAINS "1751954-coinbase.com" OR sourcentdomain CONTAINS "17525030-coinbase.com" OR sourcentdomain CONTAINS "17529580-coinbase.com" OR sourcentdomain CONTAINS "17614-coinbase.com" OR sourcentdomain CONTAINS "17618412-coinbase.com" OR sourcentdomain CONTAINS "17619-coinbase.com" OR sourcentdomain CONTAINS "176284-coinbase.com" OR sourcentdomain CONTAINS "17823920-coinbase.com" OR sourcentdomain CONTAINS "178253-coinbase.com")
index=activity AND rg_functionality="Cloud Application Audit" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "16450207-coinbase.com" OR sourcehostname CONTAINS "16458207-coinbase.com" OR sourcehostname CONTAINS "16478202-coinbase.com" OR sourcehostname CONTAINS "164872942-coinbase.com" OR sourcehostname CONTAINS "16590-coinbase.com" OR sourcehostname CONTAINS "16594373-coinbase.com" OR sourcehostname CONTAINS "16624831-coinbase.com" OR sourcehostname CONTAINS "16642124-coinbase.com" OR sourcehostname CONTAINS "16642172-coinbase.com" OR sourcehostname CONTAINS "16642580-coinbase.com" OR sourcehostname CONTAINS "16642721-coinbase.com" OR sourcehostname CONTAINS "16642724-coinbase.com" OR sourcehostname CONTAINS "16642871-coinbase.com" OR sourcehostname CONTAINS "16642872-coinbase.com" OR sourcehostname CONTAINS "16712942-coinbase.com" OR sourcehostname CONTAINS "16718672-coinbase.com" OR sourcehostname CONTAINS "16728342-coinbase.com" OR sourcehostname CONTAINS "16728348-coinbase.com" OR sourcehostname CONTAINS "16728442-coinbase.com" OR sourcehostname CONTAINS "16728472-coinbase.com" OR sourcehostname CONTAINS "167285-coinbase.com" OR sourcehostname CONTAINS "16729042-coinbase.com" OR sourcehostname CONTAINS "16748272-coinbase.com" OR sourcehostname CONTAINS "16782942-coinbase.com" OR sourcehostname CONTAINS "16827420-coinbase.com" OR sourcehostname CONTAINS "16827423-coinbase.com" OR sourcehostname CONTAINS "16847145-coinbase.com" OR sourcehostname CONTAINS "16893924-coinbase.com" OR sourcehostname CONTAINS "17182-coinbase.com" OR sourcehostname CONTAINS "17255030-coinbase.com" OR sourcehostname CONTAINS "17259-kraken.com" OR sourcehostname CONTAINS "172486-coinbase.com" OR sourcehostname CONTAINS "17284652-coinbase.com" OR sourcehostname CONTAINS "17286-coinbase.com" OR sourcehostname CONTAINS "17334522-coinbase.com" OR sourcehostname CONTAINS "17334522-kraken.com" OR sourcehostname CONTAINS "17384522-coinbase.com" OR sourcehostname CONTAINS "173912-coinbase.com" OR sourcehostname CONTAINS "17494976-coinbase.com" OR sourcehostname CONTAINS "17512854-coinbase.com" OR sourcehostname CONTAINS "17512857-coinbase.com" OR sourcehostname CONTAINS "1751954-coinbase.com" OR sourcehostname CONTAINS "17525030-coinbase.com" OR sourcehostname CONTAINS "17529580-coinbase.com" OR sourcehostname CONTAINS "17614-coinbase.com" OR sourcehostname CONTAINS "17618412-coinbase.com" OR sourcehostname CONTAINS "17619-coinbase.com" OR sourcehostname CONTAINS "176284-coinbase.com" OR sourcehostname CONTAINS "17823920-coinbase.com" OR sourcehostname CONTAINS "178253-coinbase.com")
index=activity AND rg_functionality="Cloud Application Audit" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "16450207-coinbase.com" OR destinationntdomain CONTAINS "16458207-coinbase.com" OR destinationntdomain CONTAINS "16478202-coinbase.com" OR destinationntdomain CONTAINS "164872942-coinbase.com" OR destinationntdomain CONTAINS "16590-coinbase.com" OR destinationntdomain CONTAINS "16594373-coinbase.com" OR destinationntdomain CONTAINS "16624831-coinbase.com" OR destinationntdomain CONTAINS "16642124-coinbase.com" OR destinationntdomain CONTAINS "16642172-coinbase.com" OR destinationntdomain CONTAINS "16642580-coinbase.com" OR destinationntdomain CONTAINS "16642721-coinbase.com" OR destinationntdomain CONTAINS "16642724-coinbase.com" OR destinationntdomain CONTAINS "16642871-coinbase.com" OR destinationntdomain CONTAINS "16642872-coinbase.com" OR destinationntdomain CONTAINS "16712942-coinbase.com" OR destinationntdomain CONTAINS "16718672-coinbase.com" OR destinationntdomain CONTAINS "16728342-coinbase.com" OR destinationntdomain CONTAINS "16728348-coinbase.com" OR destinationntdomain CONTAINS "16728442-coinbase.com" OR destinationntdomain CONTAINS "16728472-coinbase.com" OR destinationntdomain CONTAINS "167285-coinbase.com" OR destinationntdomain CONTAINS "16729042-coinbase.com" OR destinationntdomain CONTAINS "16748272-coinbase.com" OR destinationntdomain CONTAINS "16782942-coinbase.com" OR destinationntdomain CONTAINS "16827420-coinbase.com" OR destinationntdomain CONTAINS "16827423-coinbase.com" OR destinationntdomain CONTAINS "16847145-coinbase.com" OR destinationntdomain CONTAINS "16893924-coinbase.com" OR destinationntdomain CONTAINS "17182-coinbase.com" OR destinationntdomain CONTAINS "17255030-coinbase.com" OR destinationntdomain CONTAINS "17259-kraken.com" OR destinationntdomain CONTAINS "172486-coinbase.com" OR destinationntdomain CONTAINS "17284652-coinbase.com" OR destinationntdomain CONTAINS "17286-coinbase.com" OR destinationntdomain CONTAINS "17334522-coinbase.com" OR destinationntdomain CONTAINS "17334522-kraken.com" OR destinationntdomain CONTAINS "17384522-coinbase.com" OR destinationntdomain CONTAINS "173912-coinbase.com" OR destinationntdomain CONTAINS "17494976-coinbase.com" OR destinationntdomain CONTAINS "17512854-coinbase.com" OR destinationntdomain CONTAINS "17512857-coinbase.com" OR destinationntdomain CONTAINS "1751954-coinbase.com" OR destinationntdomain CONTAINS "17525030-coinbase.com" OR destinationntdomain CONTAINS "17529580-coinbase.com" OR destinationntdomain CONTAINS "17614-coinbase.com" OR destinationntdomain CONTAINS "17618412-coinbase.com" OR destinationntdomain CONTAINS "17619-coinbase.com" OR destinationntdomain CONTAINS "176284-coinbase.com" OR destinationntdomain CONTAINS "17823920-coinbase.com" OR destinationntdomain CONTAINS "178253-coinbase.com")
index=activity AND rg_functionality="Cloud Application Audit" AND requesturl NOT NULL AND (requesturl CONTAINS "16450207-coinbase.com" OR requesturl CONTAINS "16458207-coinbase.com" OR requesturl CONTAINS "16478202-coinbase.com" OR requesturl CONTAINS "164872942-coinbase.com" OR requesturl CONTAINS "16590-coinbase.com" OR requesturl CONTAINS "16594373-coinbase.com" OR requesturl CONTAINS "16624831-coinbase.com" OR requesturl CONTAINS "16642124-coinbase.com" OR requesturl CONTAINS "16642172-coinbase.com" OR requesturl CONTAINS "16642580-coinbase.com" OR requesturl CONTAINS "16642721-coinbase.com" OR requesturl CONTAINS "16642724-coinbase.com" OR requesturl CONTAINS "16642871-coinbase.com" OR requesturl CONTAINS "16642872-coinbase.com" OR requesturl CONTAINS "16712942-coinbase.com" OR requesturl CONTAINS "16718672-coinbase.com" OR requesturl CONTAINS "16728342-coinbase.com" OR requesturl CONTAINS "16728348-coinbase.com" OR requesturl CONTAINS "16728442-coinbase.com" OR requesturl CONTAINS "16728472-coinbase.com" OR requesturl CONTAINS "167285-coinbase.com" OR requesturl CONTAINS "16729042-coinbase.com" OR requesturl CONTAINS "16748272-coinbase.com" OR requesturl CONTAINS "16782942-coinbase.com" OR requesturl CONTAINS "16827420-coinbase.com" OR requesturl CONTAINS "16827423-coinbase.com" OR requesturl CONTAINS "16847145-coinbase.com" OR requesturl CONTAINS "16893924-coinbase.com" OR requesturl CONTAINS "17182-coinbase.com" OR requesturl CONTAINS "17255030-coinbase.com" OR requesturl CONTAINS "17259-kraken.com" OR requesturl CONTAINS "172486-coinbase.com" OR requesturl CONTAINS "17284652-coinbase.com" OR requesturl CONTAINS "17286-coinbase.com" OR requesturl CONTAINS "17334522-coinbase.com" OR requesturl CONTAINS "17334522-kraken.com" OR requesturl CONTAINS "17384522-coinbase.com" OR requesturl CONTAINS "173912-coinbase.com" OR requesturl CONTAINS "17494976-coinbase.com" OR requesturl CONTAINS "17512854-coinbase.com" OR requesturl CONTAINS "17512857-coinbase.com" OR requesturl CONTAINS "1751954-coinbase.com" OR requesturl CONTAINS "17525030-coinbase.com" OR requesturl CONTAINS "17529580-coinbase.com" OR requesturl CONTAINS "17614-coinbase.com" OR requesturl CONTAINS "17618412-coinbase.com" OR requesturl CONTAINS "17619-coinbase.com" OR requesturl CONTAINS "176284-coinbase.com" OR requesturl CONTAINS "17823920-coinbase.com" OR requesturl CONTAINS "178253-coinbase.com")
index=activity AND rg_functionality="Cloud Application Audit" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "178294-coinbase.com" OR destinationhostname CONTAINS "17912-coinbase.com" OR destinationhostname CONTAINS "17914-coinbase.com" OR destinationhostname CONTAINS "17917-coinbase.com" OR destinationhostname CONTAINS "17954-coinbase.com" OR destinationhostname CONTAINS "17958-coinbase.com" OR destinationhostname CONTAINS "182043-coinbase.com" OR destinationhostname CONTAINS "18275-gemini.com" OR destinationhostname CONTAINS "18276-coinbase.com" OR destinationhostname CONTAINS "18290185-coinbase.com" OR destinationhostname CONTAINS "182967-coinbase.com" OR destinationhostname CONTAINS "18560-coinbase.com" OR destinationhostname CONTAINS "18571-coinbase.com" OR destinationhostname CONTAINS "185912-coinbase.com" OR destinationhostname CONTAINS "185914-coinbase.com" OR destinationhostname CONTAINS "18592176-coinbase.com" OR destinationhostname CONTAINS "18594162-coinbase.com" OR destinationhostname CONTAINS "18594962-coinbase.com" OR destinationhostname CONTAINS "18597162-coinbase.com" OR destinationhostname CONTAINS "18719562-coinbase.com" OR destinationhostname CONTAINS "1875290-coinbase.com" OR destinationhostname CONTAINS "1882730-coinbase.com" OR destinationhostname CONTAINS "18902-coinbase.com" OR destinationhostname CONTAINS "18903-coinbase.com" OR destinationhostname CONTAINS "189126-coinbase.com" OR destinationhostname CONTAINS "18952-coinbase.com" OR destinationhostname CONTAINS "192854-coinbase.com" OR destinationhostname CONTAINS "192856-coinbase.com" OR destinationhostname CONTAINS "19287-binance.com" OR destinationhostname CONTAINS "19572-coinbase.com" OR destinationhostname CONTAINS "195812-coinbase.com" OR destinationhostname CONTAINS "195826-coinbase.com" OR destinationhostname CONTAINS "1958262-coinbase.com" OR destinationhostname CONTAINS "195827-binance.com" OR destinationhostname CONTAINS "1958297-coinbase.com" OR destinationhostname CONTAINS "19582970-coinbase.com" OR destinationhostname CONTAINS "19582971-coinbase.com" OR destinationhostname CONTAINS "19583-coinbase.com" OR destinationhostname CONTAINS "19592653-coinbase.com" OR destinationhostname CONTAINS "197304-coinbase.com" OR destinationhostname CONTAINS "19730492-coinbase.com" OR destinationhostname CONTAINS "19764162-coinbase.com" OR destinationhostname CONTAINS "19803-coinbase.com" OR destinationhostname CONTAINS "201784289-coinbase.com" OR destinationhostname CONTAINS "210823644-coinbase.com" OR destinationhostname CONTAINS "21158-coinbase.com" OR destinationhostname CONTAINS "21509-coinbase.com" OR destinationhostname CONTAINS "25985-coinbase.com" OR destinationhostname CONTAINS "27699-coinbase.com" OR destinationhostname CONTAINS "28367-coinbase.com")
index=activity AND rg_functionality="Cloud Application Audit" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "178294-coinbase.com" OR sourcentdomain CONTAINS "17912-coinbase.com" OR sourcentdomain CONTAINS "17914-coinbase.com" OR sourcentdomain CONTAINS "17917-coinbase.com" OR sourcentdomain CONTAINS "17954-coinbase.com" OR sourcentdomain CONTAINS "17958-coinbase.com" OR sourcentdomain CONTAINS "182043-coinbase.com" OR sourcentdomain CONTAINS "18275-gemini.com" OR sourcentdomain CONTAINS "18276-coinbase.com" OR sourcentdomain CONTAINS "18290185-coinbase.com" OR sourcentdomain CONTAINS "182967-coinbase.com" OR sourcentdomain CONTAINS "18560-coinbase.com" OR sourcentdomain CONTAINS "18571-coinbase.com" OR sourcentdomain CONTAINS "185912-coinbase.com" OR sourcentdomain CONTAINS "185914-coinbase.com" OR sourcentdomain CONTAINS "18592176-coinbase.com" OR sourcentdomain CONTAINS "18594162-coinbase.com" OR sourcentdomain CONTAINS "18594962-coinbase.com" OR sourcentdomain CONTAINS "18597162-coinbase.com" OR sourcentdomain CONTAINS "18719562-coinbase.com" OR sourcentdomain CONTAINS "1875290-coinbase.com" OR sourcentdomain CONTAINS "1882730-coinbase.com" OR sourcentdomain CONTAINS "18902-coinbase.com" OR sourcentdomain CONTAINS "18903-coinbase.com" OR sourcentdomain CONTAINS "189126-coinbase.com" OR sourcentdomain CONTAINS "18952-coinbase.com" OR sourcentdomain CONTAINS "192854-coinbase.com" OR sourcentdomain CONTAINS "192856-coinbase.com" OR sourcentdomain CONTAINS "19287-binance.com" OR sourcentdomain CONTAINS "19572-coinbase.com" OR sourcentdomain CONTAINS "195812-coinbase.com" OR sourcentdomain CONTAINS "195826-coinbase.com" OR sourcentdomain CONTAINS "1958262-coinbase.com" OR sourcentdomain CONTAINS "195827-binance.com" OR sourcentdomain CONTAINS "1958297-coinbase.com" OR sourcentdomain CONTAINS "19582970-coinbase.com" OR sourcentdomain CONTAINS "19582971-coinbase.com" OR sourcentdomain CONTAINS "19583-coinbase.com" OR sourcentdomain CONTAINS "19592653-coinbase.com" OR sourcentdomain CONTAINS "197304-coinbase.com" OR sourcentdomain CONTAINS "19730492-coinbase.com" OR sourcentdomain CONTAINS "19764162-coinbase.com" OR sourcentdomain CONTAINS "19803-coinbase.com" OR sourcentdomain CONTAINS "201784289-coinbase.com" OR sourcentdomain CONTAINS "210823644-coinbase.com" OR sourcentdomain CONTAINS "21158-coinbase.com" OR sourcentdomain CONTAINS "21509-coinbase.com" OR sourcentdomain CONTAINS "25985-coinbase.com" OR sourcentdomain CONTAINS "27699-coinbase.com" OR sourcentdomain CONTAINS "28367-coinbase.com")
index=activity AND rg_functionality="Cloud Application Audit" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "178294-coinbase.com" OR sourcehostname CONTAINS "17912-coinbase.com" OR sourcehostname CONTAINS "17914-coinbase.com" OR sourcehostname CONTAINS "17917-coinbase.com" OR sourcehostname CONTAINS "17954-coinbase.com" OR sourcehostname CONTAINS "17958-coinbase.com" OR sourcehostname CONTAINS "182043-coinbase.com" OR sourcehostname CONTAINS "18275-gemini.com" OR sourcehostname CONTAINS "18276-coinbase.com" OR sourcehostname CONTAINS "18290185-coinbase.com" OR sourcehostname CONTAINS "182967-coinbase.com" OR sourcehostname CONTAINS "18560-coinbase.com" OR sourcehostname CONTAINS "18571-coinbase.com" OR sourcehostname CONTAINS "185912-coinbase.com" OR sourcehostname CONTAINS "185914-coinbase.com" OR sourcehostname CONTAINS "18592176-coinbase.com" OR sourcehostname CONTAINS "18594162-coinbase.com" OR sourcehostname CONTAINS "18594962-coinbase.com" OR sourcehostname CONTAINS "18597162-coinbase.com" OR sourcehostname CONTAINS "18719562-coinbase.com" OR sourcehostname CONTAINS "1875290-coinbase.com" OR sourcehostname CONTAINS "1882730-coinbase.com" OR sourcehostname CONTAINS "18902-coinbase.com" OR sourcehostname CONTAINS "18903-coinbase.com" OR sourcehostname CONTAINS "189126-coinbase.com" OR sourcehostname CONTAINS "18952-coinbase.com" OR sourcehostname CONTAINS "192854-coinbase.com" OR sourcehostname CONTAINS "192856-coinbase.com" OR sourcehostname CONTAINS "19287-binance.com" OR sourcehostname CONTAINS "19572-coinbase.com" OR sourcehostname CONTAINS "195812-coinbase.com" OR sourcehostname CONTAINS "195826-coinbase.com" OR sourcehostname CONTAINS "1958262-coinbase.com" OR sourcehostname CONTAINS "195827-binance.com" OR sourcehostname CONTAINS "1958297-coinbase.com" OR sourcehostname CONTAINS "19582970-coinbase.com" OR sourcehostname CONTAINS "19582971-coinbase.com" OR sourcehostname CONTAINS "19583-coinbase.com" OR sourcehostname CONTAINS "19592653-coinbase.com" OR sourcehostname CONTAINS "197304-coinbase.com" OR sourcehostname CONTAINS "19730492-coinbase.com" OR sourcehostname CONTAINS "19764162-coinbase.com" OR sourcehostname CONTAINS "19803-coinbase.com" OR sourcehostname CONTAINS "201784289-coinbase.com" OR sourcehostname CONTAINS "210823644-coinbase.com" OR sourcehostname CONTAINS "21158-coinbase.com" OR sourcehostname CONTAINS "21509-coinbase.com" OR sourcehostname CONTAINS "25985-coinbase.com" OR sourcehostname CONTAINS "27699-coinbase.com" OR sourcehostname CONTAINS "28367-coinbase.com")
index=activity AND rg_functionality="Cloud Application Audit" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "178294-coinbase.com" OR destinationntdomain CONTAINS "17912-coinbase.com" OR destinationntdomain CONTAINS "17914-coinbase.com" OR destinationntdomain CONTAINS "17917-coinbase.com" OR destinationntdomain CONTAINS "17954-coinbase.com" OR destinationntdomain CONTAINS "17958-coinbase.com" OR destinationntdomain CONTAINS "182043-coinbase.com" OR destinationntdomain CONTAINS "18275-gemini.com" OR destinationntdomain CONTAINS "18276-coinbase.com" OR destinationntdomain CONTAINS "18290185-coinbase.com" OR destinationntdomain CONTAINS "182967-coinbase.com" OR destinationntdomain CONTAINS "18560-coinbase.com" OR destinationntdomain CONTAINS "18571-coinbase.com" OR destinationntdomain CONTAINS "185912-coinbase.com" OR destinationntdomain CONTAINS "185914-coinbase.com" OR destinationntdomain CONTAINS "18592176-coinbase.com" OR destinationntdomain CONTAINS "18594162-coinbase.com" OR destinationntdomain CONTAINS "18594962-coinbase.com" OR destinationntdomain CONTAINS "18597162-coinbase.com" OR destinationntdomain CONTAINS "18719562-coinbase.com" OR destinationntdomain CONTAINS "1875290-coinbase.com" OR destinationntdomain CONTAINS "1882730-coinbase.com" OR destinationntdomain CONTAINS "18902-coinbase.com" OR destinationntdomain CONTAINS "18903-coinbase.com" OR destinationntdomain CONTAINS "189126-coinbase.com" OR destinationntdomain CONTAINS "18952-coinbase.com" OR destinationntdomain CONTAINS "192854-coinbase.com" OR destinationntdomain CONTAINS "192856-coinbase.com" OR destinationntdomain CONTAINS "19287-binance.com" OR destinationntdomain CONTAINS "19572-coinbase.com" OR destinationntdomain CONTAINS "195812-coinbase.com" OR destinationntdomain CONTAINS "195826-coinbase.com" OR destinationntdomain CONTAINS "1958262-coinbase.com" OR destinationntdomain CONTAINS "195827-binance.com" OR destinationntdomain CONTAINS "1958297-coinbase.com" OR destinationntdomain CONTAINS "19582970-coinbase.com" OR destinationntdomain CONTAINS "19582971-coinbase.com" OR destinationntdomain CONTAINS "19583-coinbase.com" OR destinationntdomain CONTAINS "19592653-coinbase.com" OR destinationntdomain CONTAINS "197304-coinbase.com" OR destinationntdomain CONTAINS "19730492-coinbase.com" OR destinationntdomain CONTAINS "19764162-coinbase.com" OR destinationntdomain CONTAINS "19803-coinbase.com" OR destinationntdomain CONTAINS "201784289-coinbase.com" OR destinationntdomain CONTAINS "210823644-coinbase.com" OR destinationntdomain CONTAINS "21158-coinbase.com" OR destinationntdomain CONTAINS "21509-coinbase.com" OR destinationntdomain CONTAINS "25985-coinbase.com" OR destinationntdomain CONTAINS "27699-coinbase.com" OR destinationntdomain CONTAINS "28367-coinbase.com")
index=activity AND rg_functionality="Cloud Application Audit" AND requesturl NOT NULL AND (requesturl CONTAINS "178294-coinbase.com" OR requesturl CONTAINS "17912-coinbase.com" OR requesturl CONTAINS "17914-coinbase.com" OR requesturl CONTAINS "17917-coinbase.com" OR requesturl CONTAINS "17954-coinbase.com" OR requesturl CONTAINS "17958-coinbase.com" OR requesturl CONTAINS "182043-coinbase.com" OR requesturl CONTAINS "18275-gemini.com" OR requesturl CONTAINS "18276-coinbase.com" OR requesturl CONTAINS "18290185-coinbase.com" OR requesturl CONTAINS "182967-coinbase.com" OR requesturl CONTAINS "18560-coinbase.com" OR requesturl CONTAINS "18571-coinbase.com" OR requesturl CONTAINS "185912-coinbase.com" OR requesturl CONTAINS "185914-coinbase.com" OR requesturl CONTAINS "18592176-coinbase.com" OR requesturl CONTAINS "18594162-coinbase.com" OR requesturl CONTAINS "18594962-coinbase.com" OR requesturl CONTAINS "18597162-coinbase.com" OR requesturl CONTAINS "18719562-coinbase.com" OR requesturl CONTAINS "1875290-coinbase.com" OR requesturl CONTAINS "1882730-coinbase.com" OR requesturl CONTAINS "18902-coinbase.com" OR requesturl CONTAINS "18903-coinbase.com" OR requesturl CONTAINS "189126-coinbase.com" OR requesturl CONTAINS "18952-coinbase.com" OR requesturl CONTAINS "192854-coinbase.com" OR requesturl CONTAINS "192856-coinbase.com" OR requesturl CONTAINS "19287-binance.com" OR requesturl CONTAINS "19572-coinbase.com" OR requesturl CONTAINS "195812-coinbase.com" OR requesturl CONTAINS "195826-coinbase.com" OR requesturl CONTAINS "1958262-coinbase.com" OR requesturl CONTAINS "195827-binance.com" OR requesturl CONTAINS "1958297-coinbase.com" OR requesturl CONTAINS "19582970-coinbase.com" OR requesturl CONTAINS "19582971-coinbase.com" OR requesturl CONTAINS "19583-coinbase.com" OR requesturl CONTAINS "19592653-coinbase.com" OR requesturl CONTAINS "197304-coinbase.com" OR requesturl CONTAINS "19730492-coinbase.com" OR requesturl CONTAINS "19764162-coinbase.com" OR requesturl CONTAINS "19803-coinbase.com" OR requesturl CONTAINS "201784289-coinbase.com" OR requesturl CONTAINS "210823644-coinbase.com" OR requesturl CONTAINS "21158-coinbase.com" OR requesturl CONTAINS "21509-coinbase.com" OR requesturl CONTAINS "25985-coinbase.com" OR requesturl CONTAINS "27699-coinbase.com" OR requesturl CONTAINS "28367-coinbase.com")
index=activity AND rg_functionality="Cloud Application Audit" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "28676-coinbase.com" OR destinationhostname CONTAINS "29185-coinbase.com" OR destinationhostname CONTAINS "29195-coinbase.com" OR destinationhostname CONTAINS "2a-coinbase.com" OR destinationhostname CONTAINS "2b-coinbase.com" OR destinationhostname CONTAINS "2c-coinbase.com" OR destinationhostname CONTAINS "2f-coinbase.com" OR destinationhostname CONTAINS "2fas-coinbase.com" OR destinationhostname CONTAINS "2o-coinbase.com" OR destinationhostname CONTAINS "2r-coinbase.com" OR destinationhostname CONTAINS "2s-coinbase.com" OR destinationhostname CONTAINS "2sv-coinbase.com" OR destinationhostname CONTAINS "352134951-coinbase.com" OR destinationhostname CONTAINS "38468-coinbase.com" OR destinationhostname CONTAINS "39590-coinbase.com" OR destinationhostname CONTAINS "41260-coinbase.com" OR destinationhostname CONTAINS "427883-coinbase.com" OR destinationhostname CONTAINS "43017-coinbase.com" OR destinationhostname CONTAINS "47562-coinbase.com" OR destinationhostname CONTAINS "50195-coinbase.com" OR destinationhostname CONTAINS "5247-coinbase.com" OR destinationhostname CONTAINS "54765-coinbase.com" OR destinationhostname CONTAINS "57197-coinbase.com" OR destinationhostname CONTAINS "58176-coinbase.com" OR destinationhostname CONTAINS "58297-coinbase.com" OR destinationhostname CONTAINS "61250-coinbase.com" OR destinationhostname CONTAINS "61835-coinbase.com" OR destinationhostname CONTAINS "61851-coinbase.com" OR destinationhostname CONTAINS "61937-coinbase.com" OR destinationhostname CONTAINS "71925-coinbase.com" OR destinationhostname CONTAINS "72957-coinbase.com" OR destinationhostname CONTAINS "72985-coinbase.com" OR destinationhostname CONTAINS "74651-coinbase.com" OR destinationhostname CONTAINS "754668948-coinbase.com" OR destinationhostname CONTAINS "76159869-coinbase.com" OR destinationhostname CONTAINS "76153-coinbase.com" OR destinationhostname CONTAINS "81758-coinbase.com" OR destinationhostname CONTAINS "81920-coinbase.com" OR destinationhostname CONTAINS "81926-coinbase.com" OR destinationhostname CONTAINS "81958-coinbase.com" OR destinationhostname CONTAINS "826298-coinbase.com" OR destinationhostname CONTAINS "83216-coinbase.com" OR destinationhostname CONTAINS "837613-coinbase.com" OR destinationhostname CONTAINS "83956-coinbase.com" OR destinationhostname CONTAINS "87157-coinbase.com" OR destinationhostname CONTAINS "87312-coinbase.com" OR destinationhostname CONTAINS "89304-coinbase.com" OR destinationhostname CONTAINS "89375-coinbase.com" OR destinationhostname CONTAINS "91723-gemini.com" OR destinationhostname CONTAINS "91752-coinbase.com")
index=activity AND rg_functionality="Cloud Application Audit" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "28676-coinbase.com" OR sourcentdomain CONTAINS "29185-coinbase.com" OR sourcentdomain CONTAINS "29195-coinbase.com" OR sourcentdomain CONTAINS "2a-coinbase.com" OR sourcentdomain CONTAINS "2b-coinbase.com" OR sourcentdomain CONTAINS "2c-coinbase.com" OR sourcentdomain CONTAINS "2f-coinbase.com" OR sourcentdomain CONTAINS "2fas-coinbase.com" OR sourcentdomain CONTAINS "2o-coinbase.com" OR sourcentdomain CONTAINS "2r-coinbase.com" OR sourcentdomain CONTAINS "2s-coinbase.com" OR sourcentdomain CONTAINS "2sv-coinbase.com" OR sourcentdomain CONTAINS "352134951-coinbase.com" OR sourcentdomain CONTAINS "38468-coinbase.com" OR sourcentdomain CONTAINS "39590-coinbase.com" OR sourcentdomain CONTAINS "41260-coinbase.com" OR sourcentdomain CONTAINS "427883-coinbase.com" OR sourcentdomain CONTAINS "43017-coinbase.com" OR sourcentdomain CONTAINS "47562-coinbase.com" OR sourcentdomain CONTAINS "50195-coinbase.com" OR sourcentdomain CONTAINS "5247-coinbase.com" OR sourcentdomain CONTAINS "54765-coinbase.com" OR sourcentdomain CONTAINS "57197-coinbase.com" OR sourcentdomain CONTAINS "58176-coinbase.com" OR sourcentdomain CONTAINS "58297-coinbase.com" OR sourcentdomain CONTAINS "61250-coinbase.com" OR sourcentdomain CONTAINS "61835-coinbase.com" OR sourcentdomain CONTAINS "61851-coinbase.com" OR sourcentdomain CONTAINS "61937-coinbase.com" OR sourcentdomain CONTAINS "71925-coinbase.com" OR sourcentdomain CONTAINS "72957-coinbase.com" OR sourcentdomain CONTAINS "72985-coinbase.com" OR sourcentdomain CONTAINS "74651-coinbase.com" OR sourcentdomain CONTAINS "754668948-coinbase.com" OR sourcentdomain CONTAINS "76159869-coinbase.com" OR sourcentdomain CONTAINS "76153-coinbase.com" OR sourcentdomain CONTAINS "81758-coinbase.com" OR sourcentdomain CONTAINS "81920-coinbase.com" OR sourcentdomain CONTAINS "81926-coinbase.com" OR sourcentdomain CONTAINS "81958-coinbase.com" OR sourcentdomain CONTAINS "826298-coinbase.com" OR sourcentdomain CONTAINS "83216-coinbase.com" OR sourcentdomain CONTAINS "837613-coinbase.com" OR sourcentdomain CONTAINS "83956-coinbase.com" OR sourcentdomain CONTAINS "87157-coinbase.com" OR sourcentdomain CONTAINS "87312-coinbase.com" OR sourcentdomain CONTAINS "89304-coinbase.com" OR sourcentdomain CONTAINS "89375-coinbase.com" OR sourcentdomain CONTAINS "91723-gemini.com" OR sourcentdomain CONTAINS "91752-coinbase.com")
index=activity AND rg_functionality="Cloud Application Audit" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "28676-coinbase.com" OR sourcehostname CONTAINS "29185-coinbase.com" OR sourcehostname CONTAINS "29195-coinbase.com" OR sourcehostname CONTAINS "2a-coinbase.com" OR sourcehostname CONTAINS "2b-coinbase.com" OR sourcehostname CONTAINS "2c-coinbase.com" OR sourcehostname CONTAINS "2f-coinbase.com" OR sourcehostname CONTAINS "2fas-coinbase.com" OR sourcehostname CONTAINS "2o-coinbase.com" OR sourcehostname CONTAINS "2r-coinbase.com" OR sourcehostname CONTAINS "2s-coinbase.com" OR sourcehostname CONTAINS "2sv-coinbase.com" OR sourcehostname CONTAINS "352134951-coinbase.com" OR sourcehostname CONTAINS "38468-coinbase.com" OR sourcehostname CONTAINS "39590-coinbase.com" OR sourcehostname CONTAINS "41260-coinbase.com" OR sourcehostname CONTAINS "427883-coinbase.com" OR sourcehostname CONTAINS "43017-coinbase.com" OR sourcehostname CONTAINS "47562-coinbase.com" OR sourcehostname CONTAINS "50195-coinbase.com" OR sourcehostname CONTAINS "5247-coinbase.com" OR sourcehostname CONTAINS "54765-coinbase.com" OR sourcehostname CONTAINS "57197-coinbase.com" OR sourcehostname CONTAINS "58176-coinbase.com" OR sourcehostname CONTAINS "58297-coinbase.com" OR sourcehostname CONTAINS "61250-coinbase.com" OR sourcehostname CONTAINS "61835-coinbase.com" OR sourcehostname CONTAINS "61851-coinbase.com" OR sourcehostname CONTAINS "61937-coinbase.com" OR sourcehostname CONTAINS "71925-coinbase.com" OR sourcehostname CONTAINS "72957-coinbase.com" OR sourcehostname CONTAINS "72985-coinbase.com" OR sourcehostname CONTAINS "74651-coinbase.com" OR sourcehostname CONTAINS "754668948-coinbase.com" OR sourcehostname CONTAINS "76159869-coinbase.com" OR sourcehostname CONTAINS "76153-coinbase.com" OR sourcehostname CONTAINS "81758-coinbase.com" OR sourcehostname CONTAINS "81920-coinbase.com" OR sourcehostname CONTAINS "81926-coinbase.com" OR sourcehostname CONTAINS "81958-coinbase.com" OR sourcehostname CONTAINS "826298-coinbase.com" OR sourcehostname CONTAINS "83216-coinbase.com" OR sourcehostname CONTAINS "837613-coinbase.com" OR sourcehostname CONTAINS "83956-coinbase.com" OR sourcehostname CONTAINS "87157-coinbase.com" OR sourcehostname CONTAINS "87312-coinbase.com" OR sourcehostname CONTAINS "89304-coinbase.com" OR sourcehostname CONTAINS "89375-coinbase.com" OR sourcehostname CONTAINS "91723-gemini.com" OR sourcehostname CONTAINS "91752-coinbase.com")
index=activity AND rg_functionality="Cloud Application Audit" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "28676-coinbase.com" OR destinationntdomain CONTAINS "29185-coinbase.com" OR destinationntdomain CONTAINS "29195-coinbase.com" OR destinationntdomain CONTAINS "2a-coinbase.com" OR destinationntdomain CONTAINS "2b-coinbase.com" OR destinationntdomain CONTAINS "2c-coinbase.com" OR destinationntdomain CONTAINS "2f-coinbase.com" OR destinationntdomain CONTAINS "2fas-coinbase.com" OR destinationntdomain CONTAINS "2o-coinbase.com" OR destinationntdomain CONTAINS "2r-coinbase.com" OR destinationntdomain CONTAINS "2s-coinbase.com" OR destinationntdomain CONTAINS "2sv-coinbase.com" OR destinationntdomain CONTAINS "352134951-coinbase.com" OR destinationntdomain CONTAINS "38468-coinbase.com" OR destinationntdomain CONTAINS "39590-coinbase.com" OR destinationntdomain CONTAINS "41260-coinbase.com" OR destinationntdomain CONTAINS "427883-coinbase.com" OR destinationntdomain CONTAINS "43017-coinbase.com" OR destinationntdomain CONTAINS "47562-coinbase.com" OR destinationntdomain CONTAINS "50195-coinbase.com" OR destinationntdomain CONTAINS "5247-coinbase.com" OR destinationntdomain CONTAINS "54765-coinbase.com" OR destinationntdomain CONTAINS "57197-coinbase.com" OR destinationntdomain CONTAINS "58176-coinbase.com" OR destinationntdomain CONTAINS "58297-coinbase.com" OR destinationntdomain CONTAINS "61250-coinbase.com" OR destinationntdomain CONTAINS "61835-coinbase.com" OR destinationntdomain CONTAINS "61851-coinbase.com" OR destinationntdomain CONTAINS "61937-coinbase.com" OR destinationntdomain CONTAINS "71925-coinbase.com" OR destinationntdomain CONTAINS "72957-coinbase.com" OR destinationntdomain CONTAINS "72985-coinbase.com" OR destinationntdomain CONTAINS "74651-coinbase.com" OR destinationntdomain CONTAINS "754668948-coinbase.com" OR destinationntdomain CONTAINS "76159869-coinbase.com" OR destinationntdomain CONTAINS "76153-coinbase.com" OR destinationntdomain CONTAINS "81758-coinbase.com" OR destinationntdomain CONTAINS "81920-coinbase.com" OR destinationntdomain CONTAINS "81926-coinbase.com" OR destinationntdomain CONTAINS "81958-coinbase.com" OR destinationntdomain CONTAINS "826298-coinbase.com" OR destinationntdomain CONTAINS "83216-coinbase.com" OR destinationntdomain CONTAINS "837613-coinbase.com" OR destinationntdomain CONTAINS "83956-coinbase.com" OR destinationntdomain CONTAINS "87157-coinbase.com" OR destinationntdomain CONTAINS "87312-coinbase.com" OR destinationntdomain CONTAINS "89304-coinbase.com" OR destinationntdomain CONTAINS "89375-coinbase.com" OR destinationntdomain CONTAINS "91723-gemini.com" OR destinationntdomain CONTAINS "91752-coinbase.com")
index=activity AND rg_functionality="Cloud Application Audit" AND requesturl NOT NULL AND (requesturl CONTAINS "28676-coinbase.com" OR requesturl CONTAINS "29185-coinbase.com" OR requesturl CONTAINS "29195-coinbase.com" OR requesturl CONTAINS "2a-coinbase.com" OR requesturl CONTAINS "2b-coinbase.com" OR requesturl CONTAINS "2c-coinbase.com" OR requesturl CONTAINS "2f-coinbase.com" OR requesturl CONTAINS "2fas-coinbase.com" OR requesturl CONTAINS "2o-coinbase.com" OR requesturl CONTAINS "2r-coinbase.com" OR requesturl CONTAINS "2s-coinbase.com" OR requesturl CONTAINS "2sv-coinbase.com" OR requesturl CONTAINS "352134951-coinbase.com" OR requesturl CONTAINS "38468-coinbase.com" OR requesturl CONTAINS "39590-coinbase.com" OR requesturl CONTAINS "41260-coinbase.com" OR requesturl CONTAINS "427883-coinbase.com" OR requesturl CONTAINS "43017-coinbase.com" OR requesturl CONTAINS "47562-coinbase.com" OR requesturl CONTAINS "50195-coinbase.com" OR requesturl CONTAINS "5247-coinbase.com" OR requesturl CONTAINS "54765-coinbase.com" OR requesturl CONTAINS "57197-coinbase.com" OR requesturl CONTAINS "58176-coinbase.com" OR requesturl CONTAINS "58297-coinbase.com" OR requesturl CONTAINS "61250-coinbase.com" OR requesturl CONTAINS "61835-coinbase.com" OR requesturl CONTAINS "61851-coinbase.com" OR requesturl CONTAINS "61937-coinbase.com" OR requesturl CONTAINS "71925-coinbase.com" OR requesturl CONTAINS "72957-coinbase.com" OR requesturl CONTAINS "72985-coinbase.com" OR requesturl CONTAINS "74651-coinbase.com" OR requesturl CONTAINS "754668948-coinbase.com" OR requesturl CONTAINS "76159869-coinbase.com" OR requesturl CONTAINS "76153-coinbase.com" OR requesturl CONTAINS "81758-coinbase.com" OR requesturl CONTAINS "81920-coinbase.com" OR requesturl CONTAINS "81926-coinbase.com" OR requesturl CONTAINS "81958-coinbase.com" OR requesturl CONTAINS "826298-coinbase.com" OR requesturl CONTAINS "83216-coinbase.com" OR requesturl CONTAINS "837613-coinbase.com" OR requesturl CONTAINS "83956-coinbase.com" OR requesturl CONTAINS "87157-coinbase.com" OR requesturl CONTAINS "87312-coinbase.com" OR requesturl CONTAINS "89304-coinbase.com" OR requesturl CONTAINS "89375-coinbase.com" OR requesturl CONTAINS "91723-gemini.com" OR requesturl CONTAINS "91752-coinbase.com")
index=activity AND rg_functionality="Cloud Application Audit" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "91756-coinbase.com" OR destinationhostname CONTAINS "91782-coinbase.com" OR destinationhostname CONTAINS "91835-coinbase.com" OR destinationhostname CONTAINS "91845-coinbase.com" OR destinationhostname CONTAINS "91923-coinbase.com" OR destinationhostname CONTAINS "92758-coinbase.com" OR destinationhostname CONTAINS "948122061-coinbase.com" OR destinationhostname CONTAINS "978941-coinbase.com" OR destinationhostname CONTAINS "accountrecovery-coinbase.com" OR destinationhostname CONTAINS "action-shakepay.com" OR destinationhostname CONTAINS "adjust-coinbase.com" OR destinationhostname CONTAINS "admin-kraken.com" OR destinationhostname CONTAINS "applechargebacks.com" OR destinationhostname CONTAINS "authenticate-gemini.com" OR destinationhostname CONTAINS "authorize-gmail.com" OR destinationhostname CONTAINS "binance-okta.com" OR destinationhostname CONTAINS "captcha-coinbase.com" OR destinationhostname CONTAINS "cd-coinbase.com" OR destinationhostname CONTAINS "coinbase-heip.com" OR destinationhostname CONTAINS "coinbase-live.support" OR destinationhostname CONTAINS "coinbase-reject.com" OR destinationhostname CONTAINS "coinbase-ticket.com" OR destinationhostname CONTAINS "coinbaseheip.com" OR destinationhostname CONTAINS "com-2fa.help" OR destinationhostname CONTAINS "com-2fa.support" OR destinationhostname CONTAINS "com-3845.support" OR destinationhostname CONTAINS "com-connect.help" OR destinationhostname CONTAINS "com-fraud.support" OR destinationhostname CONTAINS "com-help.support" OR destinationhostname CONTAINS "com-reset.help" OR destinationhostname CONTAINS "com-reset.net" OR destinationhostname CONTAINS "com-ticket.live" OR destinationhostname CONTAINS "com-ticket.support" OR destinationhostname CONTAINS "contact-nexo.com" OR destinationhostname CONTAINS "convert-coinbase.com" OR destinationhostname CONTAINS "customerservice-coinbase.com" OR destinationhostname CONTAINS "default-coinbase.com" OR destinationhostname CONTAINS "defend-coinbase.com" OR destinationhostname CONTAINS "deny-coinbase.com" OR destinationhostname CONTAINS "disconnect-coinbase.com" OR destinationhostname CONTAINS "escalate-coinbase.com" OR destinationhostname CONTAINS "establish-coinbase.com" OR destinationhostname CONTAINS "fcc-okta.com" OR destinationhostname CONTAINS "fraudulent-coinbase.com" OR destinationhostname CONTAINS "guard-apple.com" OR destinationhostname CONTAINS "guard-icloud.com" OR destinationhostname CONTAINS "guardian-coinbase.com" OR destinationhostname CONTAINS "guide-gemini.com" OR destinationhostname CONTAINS "help-bitfinex.com" OR destinationhostname CONTAINS "help-shakepay.com")
index=activity AND rg_functionality="Cloud Application Audit" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "91756-coinbase.com" OR sourcentdomain CONTAINS "91782-coinbase.com" OR sourcentdomain CONTAINS "91835-coinbase.com" OR sourcentdomain CONTAINS "91845-coinbase.com" OR sourcentdomain CONTAINS "91923-coinbase.com" OR sourcentdomain CONTAINS "92758-coinbase.com" OR sourcentdomain CONTAINS "948122061-coinbase.com" OR sourcentdomain CONTAINS "978941-coinbase.com" OR sourcentdomain CONTAINS "accountrecovery-coinbase.com" OR sourcentdomain CONTAINS "action-shakepay.com" OR sourcentdomain CONTAINS "adjust-coinbase.com" OR sourcentdomain CONTAINS "admin-kraken.com" OR sourcentdomain CONTAINS "applechargebacks.com" OR sourcentdomain CONTAINS "authenticate-gemini.com" OR sourcentdomain CONTAINS "authorize-gmail.com" OR sourcentdomain CONTAINS "binance-okta.com" OR sourcentdomain CONTAINS "captcha-coinbase.com" OR sourcentdomain CONTAINS "cd-coinbase.com" OR sourcentdomain CONTAINS "coinbase-heip.com" OR sourcentdomain CONTAINS "coinbase-live.support" OR sourcentdomain CONTAINS "coinbase-reject.com" OR sourcentdomain CONTAINS "coinbase-ticket.com" OR sourcentdomain CONTAINS "coinbaseheip.com" OR sourcentdomain CONTAINS "com-2fa.help" OR sourcentdomain CONTAINS "com-2fa.support" OR sourcentdomain CONTAINS "com-3845.support" OR sourcentdomain CONTAINS "com-connect.help" OR sourcentdomain CONTAINS "com-fraud.support" OR sourcentdomain CONTAINS "com-help.support" OR sourcentdomain CONTAINS "com-reset.help" OR sourcentdomain CONTAINS "com-reset.net" OR sourcentdomain CONTAINS "com-ticket.live" OR sourcentdomain CONTAINS "com-ticket.support" OR sourcentdomain CONTAINS "contact-nexo.com" OR sourcentdomain CONTAINS "convert-coinbase.com" OR sourcentdomain CONTAINS "customerservice-coinbase.com" OR sourcentdomain CONTAINS "default-coinbase.com" OR sourcentdomain CONTAINS "defend-coinbase.com" OR sourcentdomain CONTAINS "deny-coinbase.com" OR sourcentdomain CONTAINS "disconnect-coinbase.com" OR sourcentdomain CONTAINS "escalate-coinbase.com" OR sourcentdomain CONTAINS "establish-coinbase.com" OR sourcentdomain CONTAINS "fcc-okta.com" OR sourcentdomain CONTAINS "fraudulent-coinbase.com" OR sourcentdomain CONTAINS "guard-apple.com" OR sourcentdomain CONTAINS "guard-icloud.com" OR sourcentdomain CONTAINS "guardian-coinbase.com" OR sourcentdomain CONTAINS "guide-gemini.com" OR sourcentdomain CONTAINS "help-bitfinex.com" OR sourcentdomain CONTAINS "help-shakepay.com")
index=activity AND rg_functionality="Cloud Application Audit" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "91756-coinbase.com" OR sourcehostname CONTAINS "91782-coinbase.com" OR sourcehostname CONTAINS "91835-coinbase.com" OR sourcehostname CONTAINS "91845-coinbase.com" OR sourcehostname CONTAINS "91923-coinbase.com" OR sourcehostname CONTAINS "92758-coinbase.com" OR sourcehostname CONTAINS "948122061-coinbase.com" OR sourcehostname CONTAINS "978941-coinbase.com" OR sourcehostname CONTAINS "accountrecovery-coinbase.com" OR sourcehostname CONTAINS "action-shakepay.com" OR sourcehostname CONTAINS "adjust-coinbase.com" OR sourcehostname CONTAINS "admin-kraken.com" OR sourcehostname CONTAINS "applechargebacks.com" OR sourcehostname CONTAINS "authenticate-gemini.com" OR sourcehostname CONTAINS "authorize-gmail.com" OR sourcehostname CONTAINS "binance-okta.com" OR sourcehostname CONTAINS "captcha-coinbase.com" OR sourcehostname CONTAINS "cd-coinbase.com" OR sourcehostname CONTAINS "coinbase-heip.com" OR sourcehostname CONTAINS "coinbase-live.support" OR sourcehostname CONTAINS "coinbase-reject.com" OR sourcehostname CONTAINS "coinbase-ticket.com" OR sourcehostname CONTAINS "coinbaseheip.com" OR sourcehostname CONTAINS "com-2fa.help" OR sourcehostname CONTAINS "com-2fa.support" OR sourcehostname CONTAINS "com-3845.support" OR sourcehostname CONTAINS "com-connect.help" OR sourcehostname CONTAINS "com-fraud.support" OR sourcehostname CONTAINS "com-help.support" OR sourcehostname CONTAINS "com-reset.help" OR sourcehostname CONTAINS "com-reset.net" OR sourcehostname CONTAINS "com-ticket.live" OR sourcehostname CONTAINS "com-ticket.support" OR sourcehostname CONTAINS "contact-nexo.com" OR sourcehostname CONTAINS "convert-coinbase.com" OR sourcehostname CONTAINS "customerservice-coinbase.com" OR sourcehostname CONTAINS "default-coinbase.com" OR sourcehostname CONTAINS "defend-coinbase.com" OR sourcehostname CONTAINS "deny-coinbase.com" OR sourcehostname CONTAINS "disconnect-coinbase.com" OR sourcehostname CONTAINS "escalate-coinbase.com" OR sourcehostname CONTAINS "establish-coinbase.com" OR sourcehostname CONTAINS "fcc-okta.com" OR sourcehostname CONTAINS "fraudulent-coinbase.com" OR sourcehostname CONTAINS "guard-apple.com" OR sourcehostname CONTAINS "guard-icloud.com" OR sourcehostname CONTAINS "guardian-coinbase.com" OR sourcehostname CONTAINS "guide-gemini.com" OR sourcehostname CONTAINS "help-bitfinex.com" OR sourcehostname CONTAINS "help-shakepay.com")
index=activity AND rg_functionality="Cloud Application Audit" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "91756-coinbase.com" OR destinationntdomain CONTAINS "91782-coinbase.com" OR destinationntdomain CONTAINS "91835-coinbase.com" OR destinationntdomain CONTAINS "91845-coinbase.com" OR destinationntdomain CONTAINS "91923-coinbase.com" OR destinationntdomain CONTAINS "92758-coinbase.com" OR destinationntdomain CONTAINS "948122061-coinbase.com" OR destinationntdomain CONTAINS "978941-coinbase.com" OR destinationntdomain CONTAINS "accountrecovery-coinbase.com" OR destinationntdomain CONTAINS "action-shakepay.com" OR destinationntdomain CONTAINS "adjust-coinbase.com" OR destinationntdomain CONTAINS "admin-kraken.com" OR destinationntdomain CONTAINS "applechargebacks.com" OR destinationntdomain CONTAINS "authenticate-gemini.com" OR destinationntdomain CONTAINS "authorize-gmail.com" OR destinationntdomain CONTAINS "binance-okta.com" OR destinationntdomain CONTAINS "captcha-coinbase.com" OR destinationntdomain CONTAINS "cd-coinbase.com" OR destinationntdomain CONTAINS "coinbase-heip.com" OR destinationntdomain CONTAINS "coinbase-live.support" OR destinationntdomain CONTAINS "coinbase-reject.com" OR destinationntdomain CONTAINS "coinbase-ticket.com" OR destinationntdomain CONTAINS "coinbaseheip.com" OR destinationntdomain CONTAINS "com-2fa.help" OR destinationntdomain CONTAINS "com-2fa.support" OR destinationntdomain CONTAINS "com-3845.support" OR destinationntdomain CONTAINS "com-connect.help" OR destinationntdomain CONTAINS "com-fraud.support" OR destinationntdomain CONTAINS "com-help.support" OR destinationntdomain CONTAINS "com-reset.help" OR destinationntdomain CONTAINS "com-reset.net" OR destinationntdomain CONTAINS "com-ticket.live" OR destinationntdomain CONTAINS "com-ticket.support" OR destinationntdomain CONTAINS "contact-nexo.com" OR destinationntdomain CONTAINS "convert-coinbase.com" OR destinationntdomain CONTAINS "customerservice-coinbase.com" OR destinationntdomain CONTAINS "default-coinbase.com" OR destinationntdomain CONTAINS "defend-coinbase.com" OR destinationntdomain CONTAINS "deny-coinbase.com" OR destinationntdomain CONTAINS "disconnect-coinbase.com" OR destinationntdomain CONTAINS "escalate-coinbase.com" OR destinationntdomain CONTAINS "establish-coinbase.com" OR destinationntdomain CONTAINS "fcc-okta.com" OR destinationntdomain CONTAINS "fraudulent-coinbase.com" OR destinationntdomain CONTAINS "guard-apple.com" OR destinationntdomain CONTAINS "guard-icloud.com" OR destinationntdomain CONTAINS "guardian-coinbase.com" OR destinationntdomain CONTAINS "guide-gemini.com" OR destinationntdomain CONTAINS "help-bitfinex.com" OR destinationntdomain CONTAINS "help-shakepay.com")
index=activity AND rg_functionality="Cloud Application Audit" AND requesturl NOT NULL AND (requesturl CONTAINS "91756-coinbase.com" OR requesturl CONTAINS "91782-coinbase.com" OR requesturl CONTAINS "91835-coinbase.com" OR requesturl CONTAINS "91845-coinbase.com" OR requesturl CONTAINS "91923-coinbase.com" OR requesturl CONTAINS "92758-coinbase.com" OR requesturl CONTAINS "948122061-coinbase.com" OR requesturl CONTAINS "978941-coinbase.com" OR requesturl CONTAINS "accountrecovery-coinbase.com" OR requesturl CONTAINS "action-shakepay.com" OR requesturl CONTAINS "adjust-coinbase.com" OR requesturl CONTAINS "admin-kraken.com" OR requesturl CONTAINS "applechargebacks.com" OR requesturl CONTAINS "authenticate-gemini.com" OR requesturl CONTAINS "authorize-gmail.com" OR requesturl CONTAINS "binance-okta.com" OR requesturl CONTAINS "captcha-coinbase.com" OR requesturl CONTAINS "cd-coinbase.com" OR requesturl CONTAINS "coinbase-heip.com" OR requesturl CONTAINS "coinbase-live.support" OR requesturl CONTAINS "coinbase-reject.com" OR requesturl CONTAINS "coinbase-ticket.com" OR requesturl CONTAINS "coinbaseheip.com" OR requesturl CONTAINS "com-2fa.help" OR requesturl CONTAINS "com-2fa.support" OR requesturl CONTAINS "com-3845.support" OR requesturl CONTAINS "com-connect.help" OR requesturl CONTAINS "com-fraud.support" OR requesturl CONTAINS "com-help.support" OR requesturl CONTAINS "com-reset.help" OR requesturl CONTAINS "com-reset.net" OR requesturl CONTAINS "com-ticket.live" OR requesturl CONTAINS "com-ticket.support" OR requesturl CONTAINS "contact-nexo.com" OR requesturl CONTAINS "convert-coinbase.com" OR requesturl CONTAINS "customerservice-coinbase.com" OR requesturl CONTAINS "default-coinbase.com" OR requesturl CONTAINS "defend-coinbase.com" OR requesturl CONTAINS "deny-coinbase.com" OR requesturl CONTAINS "disconnect-coinbase.com" OR requesturl CONTAINS "escalate-coinbase.com" OR requesturl CONTAINS "establish-coinbase.com" OR requesturl CONTAINS "fcc-okta.com" OR requesturl CONTAINS "fraudulent-coinbase.com" OR requesturl CONTAINS "guard-apple.com" OR requesturl CONTAINS "guard-icloud.com" OR requesturl CONTAINS "guardian-coinbase.com" OR requesturl CONTAINS "guide-gemini.com" OR requesturl CONTAINS "help-bitfinex.com" OR requesturl CONTAINS "help-shakepay.com")
index=activity AND rg_functionality="Cloud Application Audit" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "helpdesk-apple.com" OR destinationhostname CONTAINS "helpdesk-gemini.com" OR destinationhostname CONTAINS "helpdesk-icloud.com" OR destinationhostname CONTAINS "identification-coinbase.com" OR destinationhostname CONTAINS "lockdown-coinbase.com" OR destinationhostname CONTAINS "login-nexo.com" OR destinationhostname CONTAINS "keys-coinbase.com" OR destinationhostname CONTAINS "messages-coinbase.com" OR destinationhostname CONTAINS "newpassword-coinbase.com" OR destinationhostname CONTAINS "prompt-coinbase.com" OR destinationhostname CONTAINS "protect-apple.com" OR destinationhostname CONTAINS "protect-coinbase.com" OR destinationhostname CONTAINS "protect-gmail.com" OR destinationhostname CONTAINS "protect-kraken.com" OR destinationhostname CONTAINS "recoverme-coinbase.com" OR destinationhostname CONTAINS "recoveryportal-coinbase.com" OR destinationhostname CONTAINS "refunds-coinbase.com" OR destinationhostname CONTAINS "reset-okta.com" OR destinationhostname CONTAINS "restore-coinbase.com" OR destinationhostname CONTAINS "return-coinbase.com" OR destinationhostname CONTAINS "reverts-coinbase.com" OR destinationhostname CONTAINS "secure-binance.us" OR destinationhostname CONTAINS "secure-icloud.com" OR destinationhostname CONTAINS "secure-nexo.com" OR destinationhostname CONTAINS "secure-shakepay.com" OR destinationhostname CONTAINS "security-umusic.com" OR destinationhostname CONTAINS "server694590423.tech" OR destinationhostname CONTAINS "session-coinbase.com" OR destinationhostname CONTAINS "startrecovery-coinbase.com" OR destinationhostname CONTAINS "signin-kraken.com" OR destinationhostname CONTAINS "suite-trezor.io" OR destinationhostname CONTAINS "supportportal-coinbase.com" OR destinationhostname CONTAINS "tech-icloud.com" OR destinationhostname CONTAINS "threat-coinbase.com" OR destinationhostname CONTAINS "ticket-apple.com" OR destinationhostname CONTAINS "ticket-coinbase.com" OR destinationhostname CONTAINS "tickets-apple.com" OR destinationhostname CONTAINS "tokens-coinbase.com" OR destinationhostname CONTAINS "unblock-coinbase.com" OR destinationhostname CONTAINS "unlink-coinbase.com" OR destinationhostname CONTAINS "your-coinbase.com" OR destinationhostname CONTAINS "welcome-coinbase.com" OR destinationhostname CONTAINS "www-coinbasewallet.com" OR destinationhostname CONTAINS "www-help-coinbase.com" OR destinationhostname CONTAINS "www-help-gemini.com")
index=activity AND rg_functionality="Cloud Application Audit" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "helpdesk-apple.com" OR sourcentdomain CONTAINS "helpdesk-gemini.com" OR sourcentdomain CONTAINS "helpdesk-icloud.com" OR sourcentdomain CONTAINS "identification-coinbase.com" OR sourcentdomain CONTAINS "lockdown-coinbase.com" OR sourcentdomain CONTAINS "login-nexo.com" OR sourcentdomain CONTAINS "keys-coinbase.com" OR sourcentdomain CONTAINS "messages-coinbase.com" OR sourcentdomain CONTAINS "newpassword-coinbase.com" OR sourcentdomain CONTAINS "prompt-coinbase.com" OR sourcentdomain CONTAINS "protect-apple.com" OR sourcentdomain CONTAINS "protect-coinbase.com" OR sourcentdomain CONTAINS "protect-gmail.com" OR sourcentdomain CONTAINS "protect-kraken.com" OR sourcentdomain CONTAINS "recoverme-coinbase.com" OR sourcentdomain CONTAINS "recoveryportal-coinbase.com" OR sourcentdomain CONTAINS "refunds-coinbase.com" OR sourcentdomain CONTAINS "reset-okta.com" OR sourcentdomain CONTAINS "restore-coinbase.com" OR sourcentdomain CONTAINS "return-coinbase.com" OR sourcentdomain CONTAINS "reverts-coinbase.com" OR sourcentdomain CONTAINS "secure-binance.us" OR sourcentdomain CONTAINS "secure-icloud.com" OR sourcentdomain CONTAINS "secure-nexo.com" OR sourcentdomain CONTAINS "secure-shakepay.com" OR sourcentdomain CONTAINS "security-umusic.com" OR sourcentdomain CONTAINS "server694590423.tech" OR sourcentdomain CONTAINS "session-coinbase.com" OR sourcentdomain CONTAINS "startrecovery-coinbase.com" OR sourcentdomain CONTAINS "signin-kraken.com" OR sourcentdomain CONTAINS "suite-trezor.io" OR sourcentdomain CONTAINS "supportportal-coinbase.com" OR sourcentdomain CONTAINS "tech-icloud.com" OR sourcentdomain CONTAINS "threat-coinbase.com" OR sourcentdomain CONTAINS "ticket-apple.com" OR sourcentdomain CONTAINS "ticket-coinbase.com" OR sourcentdomain CONTAINS "tickets-apple.com" OR sourcentdomain CONTAINS "tokens-coinbase.com" OR sourcentdomain CONTAINS "unblock-coinbase.com" OR sourcentdomain CONTAINS "unlink-coinbase.com" OR sourcentdomain CONTAINS "your-coinbase.com" OR sourcentdomain CONTAINS "welcome-coinbase.com" OR sourcentdomain CONTAINS "www-coinbasewallet.com" OR sourcentdomain CONTAINS "www-help-coinbase.com" OR sourcentdomain CONTAINS "www-help-gemini.com")
index=activity AND rg_functionality="Cloud Application Audit" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "helpdesk-apple.com" OR sourcehostname CONTAINS "helpdesk-gemini.com" OR sourcehostname CONTAINS "helpdesk-icloud.com" OR sourcehostname CONTAINS "identification-coinbase.com" OR sourcehostname CONTAINS "lockdown-coinbase.com" OR sourcehostname CONTAINS "login-nexo.com" OR sourcehostname CONTAINS "keys-coinbase.com" OR sourcehostname CONTAINS "messages-coinbase.com" OR sourcehostname CONTAINS "newpassword-coinbase.com" OR sourcehostname CONTAINS "prompt-coinbase.com" OR sourcehostname CONTAINS "protect-apple.com" OR sourcehostname CONTAINS "protect-coinbase.com" OR sourcehostname CONTAINS "protect-gmail.com" OR sourcehostname CONTAINS "protect-kraken.com" OR sourcehostname CONTAINS "recoverme-coinbase.com" OR sourcehostname CONTAINS "recoveryportal-coinbase.com" OR sourcehostname CONTAINS "refunds-coinbase.com" OR sourcehostname CONTAINS "reset-okta.com" OR sourcehostname CONTAINS "restore-coinbase.com" OR sourcehostname CONTAINS "return-coinbase.com" OR sourcehostname CONTAINS "reverts-coinbase.com" OR sourcehostname CONTAINS "secure-binance.us" OR sourcehostname CONTAINS "secure-icloud.com" OR sourcehostname CONTAINS "secure-nexo.com" OR sourcehostname CONTAINS "secure-shakepay.com" OR sourcehostname CONTAINS "security-umusic.com" OR sourcehostname CONTAINS "server694590423.tech" OR sourcehostname CONTAINS "session-coinbase.com" OR sourcehostname CONTAINS "startrecovery-coinbase.com" OR sourcehostname CONTAINS "signin-kraken.com" OR sourcehostname CONTAINS "suite-trezor.io" OR sourcehostname CONTAINS "supportportal-coinbase.com" OR sourcehostname CONTAINS "tech-icloud.com" OR sourcehostname CONTAINS "threat-coinbase.com" OR sourcehostname CONTAINS "ticket-apple.com" OR sourcehostname CONTAINS "ticket-coinbase.com" OR sourcehostname CONTAINS "tickets-apple.com" OR sourcehostname CONTAINS "tokens-coinbase.com" OR sourcehostname CONTAINS "unblock-coinbase.com" OR sourcehostname CONTAINS "unlink-coinbase.com" OR sourcehostname CONTAINS "your-coinbase.com" OR sourcehostname CONTAINS "welcome-coinbase.com" OR sourcehostname CONTAINS "www-coinbasewallet.com" OR sourcehostname CONTAINS "www-help-coinbase.com" OR sourcehostname CONTAINS "www-help-gemini.com")
index=activity AND rg_functionality="Cloud Application Audit" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "helpdesk-apple.com" OR destinationntdomain CONTAINS "helpdesk-gemini.com" OR destinationntdomain CONTAINS "helpdesk-icloud.com" OR destinationntdomain CONTAINS "identification-coinbase.com" OR destinationntdomain CONTAINS "lockdown-coinbase.com" OR destinationntdomain CONTAINS "login-nexo.com" OR destinationntdomain CONTAINS "keys-coinbase.com" OR destinationntdomain CONTAINS "messages-coinbase.com" OR destinationntdomain CONTAINS "newpassword-coinbase.com" OR destinationntdomain CONTAINS "prompt-coinbase.com" OR destinationntdomain CONTAINS "protect-apple.com" OR destinationntdomain CONTAINS "protect-coinbase.com" OR destinationntdomain CONTAINS "protect-gmail.com" OR destinationntdomain CONTAINS "protect-kraken.com" OR destinationntdomain CONTAINS "recoverme-coinbase.com" OR destinationntdomain CONTAINS "recoveryportal-coinbase.com" OR destinationntdomain CONTAINS "refunds-coinbase.com" OR destinationntdomain CONTAINS "reset-okta.com" OR destinationntdomain CONTAINS "restore-coinbase.com" OR destinationntdomain CONTAINS "return-coinbase.com" OR destinationntdomain CONTAINS "reverts-coinbase.com" OR destinationntdomain CONTAINS "secure-binance.us" OR destinationntdomain CONTAINS "secure-icloud.com" OR destinationntdomain CONTAINS "secure-nexo.com" OR destinationntdomain CONTAINS "secure-shakepay.com" OR destinationntdomain CONTAINS "security-umusic.com" OR destinationntdomain CONTAINS "server694590423.tech" OR destinationntdomain CONTAINS "session-coinbase.com" OR destinationntdomain CONTAINS "startrecovery-coinbase.com" OR destinationntdomain CONTAINS "signin-kraken.com" OR destinationntdomain CONTAINS "suite-trezor.io" OR destinationntdomain CONTAINS "supportportal-coinbase.com" OR destinationntdomain CONTAINS "tech-icloud.com" OR destinationntdomain CONTAINS "threat-coinbase.com" OR destinationntdomain CONTAINS "ticket-apple.com" OR destinationntdomain CONTAINS "ticket-coinbase.com" OR destinationntdomain CONTAINS "tickets-apple.com" OR destinationntdomain CONTAINS "tokens-coinbase.com" OR destinationntdomain CONTAINS "unblock-coinbase.com" OR destinationntdomain CONTAINS "unlink-coinbase.com" OR destinationntdomain CONTAINS "your-coinbase.com" OR destinationntdomain CONTAINS "welcome-coinbase.com" OR destinationntdomain CONTAINS "www-coinbasewallet.com" OR destinationntdomain CONTAINS "www-help-coinbase.com" OR destinationntdomain CONTAINS "www-help-gemini.com")
index=activity AND rg_functionality="Cloud Application Audit" AND requesturl NOT NULL AND (requesturl CONTAINS "helpdesk-apple.com" OR requesturl CONTAINS "helpdesk-gemini.com" OR requesturl CONTAINS "helpdesk-icloud.com" OR requesturl CONTAINS "identification-coinbase.com" OR requesturl CONTAINS "lockdown-coinbase.com" OR requesturl CONTAINS "login-nexo.com" OR requesturl CONTAINS "keys-coinbase.com" OR requesturl CONTAINS "messages-coinbase.com" OR requesturl CONTAINS "newpassword-coinbase.com" OR requesturl CONTAINS "prompt-coinbase.com" OR requesturl CONTAINS "protect-apple.com" OR requesturl CONTAINS "protect-coinbase.com" OR requesturl CONTAINS "protect-gmail.com" OR requesturl CONTAINS "protect-kraken.com" OR requesturl CONTAINS "recoverme-coinbase.com" OR requesturl CONTAINS "recoveryportal-coinbase.com" OR requesturl CONTAINS "refunds-coinbase.com" OR requesturl CONTAINS "reset-okta.com" OR requesturl CONTAINS "restore-coinbase.com" OR requesturl CONTAINS "return-coinbase.com" OR requesturl CONTAINS "reverts-coinbase.com" OR requesturl CONTAINS "secure-binance.us" OR requesturl CONTAINS "secure-icloud.com" OR requesturl CONTAINS "secure-nexo.com" OR requesturl CONTAINS "secure-shakepay.com" OR requesturl CONTAINS "security-umusic.com" OR requesturl CONTAINS "server694590423.tech" OR requesturl CONTAINS "session-coinbase.com" OR requesturl CONTAINS "startrecovery-coinbase.com" OR requesturl CONTAINS "signin-kraken.com" OR requesturl CONTAINS "suite-trezor.io" OR requesturl CONTAINS "supportportal-coinbase.com" OR requesturl CONTAINS "tech-icloud.com" OR requesturl CONTAINS "threat-coinbase.com" OR requesturl CONTAINS "ticket-apple.com" OR requesturl CONTAINS "ticket-coinbase.com" OR requesturl CONTAINS "tickets-apple.com" OR requesturl CONTAINS "tokens-coinbase.com" OR requesturl CONTAINS "unblock-coinbase.com" OR requesturl CONTAINS "unlink-coinbase.com" OR requesturl CONTAINS "your-coinbase.com" OR requesturl CONTAINS "welcome-coinbase.com" OR requesturl CONTAINS "www-coinbasewallet.com" OR requesturl CONTAINS "www-help-coinbase.com" OR requesturl CONTAINS "www-help-gemini.com")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "official-server.com" OR destinationhostname CONTAINS "server694590423.tech" OR destinationhostname CONTAINS "island-placid-bromine.glitch.me" OR destinationhostname CONTAINS "circular-noon-farmhouse.glitch.me" OR destinationhostname CONTAINS "talented-friendly-price.glitch.me" OR destinationhostname CONTAINS "dflfmgsdokasdcpl.com" OR destinationhostname CONTAINS "original-backend.com" OR destinationhostname CONTAINS "07159889-coinbase.com" OR destinationhostname CONTAINS "10195-coinbase.com" OR destinationhostname CONTAINS "11246-coinbase.com" OR destinationhostname CONTAINS "11247-coinbase.com" OR destinationhostname CONTAINS "11248-coinbase.com" OR destinationhostname CONTAINS "11258-coinbase.com" OR destinationhostname CONTAINS "11259-coinbase.com" OR destinationhostname CONTAINS "113912-coinbase.com" OR destinationhostname CONTAINS "11472-coinbase.com" OR destinationhostname CONTAINS "11923-coinbase.com" OR destinationhostname CONTAINS "11957-coinbase.com" OR destinationhostname CONTAINS "128147-coinbase.com" OR destinationhostname CONTAINS "12958-coinbase.com" OR destinationhostname CONTAINS "12984-okta.com" OR destinationhostname CONTAINS "12985-coinbase.com" OR destinationhostname CONTAINS "13130-coinbase.com" OR destinationhostname CONTAINS "13247-coinbase.com" OR destinationhostname CONTAINS "13247-icloud.com" OR destinationhostname CONTAINS "13267-coinbase.com" OR destinationhostname CONTAINS "146271510-coinbase.com" OR destinationhostname CONTAINS "146282-coinbase.com" OR destinationhostname CONTAINS "146284-coinbase.com" OR destinationhostname CONTAINS "147260-coinbase.com" OR destinationhostname CONTAINS "14765-coinbase.com" OR destinationhostname CONTAINS "14817582-coinbase.com" OR destinationhostname CONTAINS "14871904-coinbase.com" OR destinationhostname CONTAINS "14891902-coinbase.com" OR destinationhostname CONTAINS "1492864-coinbase.com" OR destinationhostname CONTAINS "158312-coinbase.com" OR destinationhostname CONTAINS "158372-coinbase.com" OR destinationhostname CONTAINS "158702-coinbase.com" OR destinationhostname CONTAINS "16171675-coinbase.com" OR destinationhostname CONTAINS "16171832-coinbase.com" OR destinationhostname CONTAINS "16178234-coinbase.com" OR destinationhostname CONTAINS "16178237-coinbase.com" OR destinationhostname CONTAINS "16178434-coinbase.com" OR destinationhostname CONTAINS "162178-coinbase.com" OR destinationhostname CONTAINS "162478-coinbase.com" OR destinationhostname CONTAINS "162782-coinbase.com" OR destinationhostname CONTAINS "162812-coinbase.com" OR destinationhostname CONTAINS "162814-coinbase.com" OR destinationhostname CONTAINS "16442580-coinbase.com" OR destinationhostname CONTAINS "16450107-coinbase.com")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "official-server.com" OR sourcentdomain CONTAINS "server694590423.tech" OR sourcentdomain CONTAINS "island-placid-bromine.glitch.me" OR sourcentdomain CONTAINS "circular-noon-farmhouse.glitch.me" OR sourcentdomain CONTAINS "talented-friendly-price.glitch.me" OR sourcentdomain CONTAINS "dflfmgsdokasdcpl.com" OR sourcentdomain CONTAINS "original-backend.com" OR sourcentdomain CONTAINS "07159889-coinbase.com" OR sourcentdomain CONTAINS "10195-coinbase.com" OR sourcentdomain CONTAINS "11246-coinbase.com" OR sourcentdomain CONTAINS "11247-coinbase.com" OR sourcentdomain CONTAINS "11248-coinbase.com" OR sourcentdomain CONTAINS "11258-coinbase.com" OR sourcentdomain CONTAINS "11259-coinbase.com" OR sourcentdomain CONTAINS "113912-coinbase.com" OR sourcentdomain CONTAINS "11472-coinbase.com" OR sourcentdomain CONTAINS "11923-coinbase.com" OR sourcentdomain CONTAINS "11957-coinbase.com" OR sourcentdomain CONTAINS "128147-coinbase.com" OR sourcentdomain CONTAINS "12958-coinbase.com" OR sourcentdomain CONTAINS "12984-okta.com" OR sourcentdomain CONTAINS "12985-coinbase.com" OR sourcentdomain CONTAINS "13130-coinbase.com" OR sourcentdomain CONTAINS "13247-coinbase.com" OR sourcentdomain CONTAINS "13247-icloud.com" OR sourcentdomain CONTAINS "13267-coinbase.com" OR sourcentdomain CONTAINS "146271510-coinbase.com" OR sourcentdomain CONTAINS "146282-coinbase.com" OR sourcentdomain CONTAINS "146284-coinbase.com" OR sourcentdomain CONTAINS "147260-coinbase.com" OR sourcentdomain CONTAINS "14765-coinbase.com" OR sourcentdomain CONTAINS "14817582-coinbase.com" OR sourcentdomain CONTAINS "14871904-coinbase.com" OR sourcentdomain CONTAINS "14891902-coinbase.com" OR sourcentdomain CONTAINS "1492864-coinbase.com" OR sourcentdomain CONTAINS "158312-coinbase.com" OR sourcentdomain CONTAINS "158372-coinbase.com" OR sourcentdomain CONTAINS "158702-coinbase.com" OR sourcentdomain CONTAINS "16171675-coinbase.com" OR sourcentdomain CONTAINS "16171832-coinbase.com" OR sourcentdomain CONTAINS "16178234-coinbase.com" OR sourcentdomain CONTAINS "16178237-coinbase.com" OR sourcentdomain CONTAINS "16178434-coinbase.com" OR sourcentdomain CONTAINS "162178-coinbase.com" OR sourcentdomain CONTAINS "162478-coinbase.com" OR sourcentdomain CONTAINS "162782-coinbase.com" OR sourcentdomain CONTAINS "162812-coinbase.com" OR sourcentdomain CONTAINS "162814-coinbase.com" OR sourcentdomain CONTAINS "16442580-coinbase.com" OR sourcentdomain CONTAINS "16450107-coinbase.com")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "official-server.com" OR sourcehostname CONTAINS "server694590423.tech" OR sourcehostname CONTAINS "island-placid-bromine.glitch.me" OR sourcehostname CONTAINS "circular-noon-farmhouse.glitch.me" OR sourcehostname CONTAINS "talented-friendly-price.glitch.me" OR sourcehostname CONTAINS "dflfmgsdokasdcpl.com" OR sourcehostname CONTAINS "original-backend.com" OR sourcehostname CONTAINS "07159889-coinbase.com" OR sourcehostname CONTAINS "10195-coinbase.com" OR sourcehostname CONTAINS "11246-coinbase.com" OR sourcehostname CONTAINS "11247-coinbase.com" OR sourcehostname CONTAINS "11248-coinbase.com" OR sourcehostname CONTAINS "11258-coinbase.com" OR sourcehostname CONTAINS "11259-coinbase.com" OR sourcehostname CONTAINS "113912-coinbase.com" OR sourcehostname CONTAINS "11472-coinbase.com" OR sourcehostname CONTAINS "11923-coinbase.com" OR sourcehostname CONTAINS "11957-coinbase.com" OR sourcehostname CONTAINS "128147-coinbase.com" OR sourcehostname CONTAINS "12958-coinbase.com" OR sourcehostname CONTAINS "12984-okta.com" OR sourcehostname CONTAINS "12985-coinbase.com" OR sourcehostname CONTAINS "13130-coinbase.com" OR sourcehostname CONTAINS "13247-coinbase.com" OR sourcehostname CONTAINS "13247-icloud.com" OR sourcehostname CONTAINS "13267-coinbase.com" OR sourcehostname CONTAINS "146271510-coinbase.com" OR sourcehostname CONTAINS "146282-coinbase.com" OR sourcehostname CONTAINS "146284-coinbase.com" OR sourcehostname CONTAINS "147260-coinbase.com" OR sourcehostname CONTAINS "14765-coinbase.com" OR sourcehostname CONTAINS "14817582-coinbase.com" OR sourcehostname CONTAINS "14871904-coinbase.com" OR sourcehostname CONTAINS "14891902-coinbase.com" OR sourcehostname CONTAINS "1492864-coinbase.com" OR sourcehostname CONTAINS "158312-coinbase.com" OR sourcehostname CONTAINS "158372-coinbase.com" OR sourcehostname CONTAINS "158702-coinbase.com" OR sourcehostname CONTAINS "16171675-coinbase.com" OR sourcehostname CONTAINS "16171832-coinbase.com" OR sourcehostname CONTAINS "16178234-coinbase.com" OR sourcehostname CONTAINS "16178237-coinbase.com" OR sourcehostname CONTAINS "16178434-coinbase.com" OR sourcehostname CONTAINS "162178-coinbase.com" OR sourcehostname CONTAINS "162478-coinbase.com" OR sourcehostname CONTAINS "162782-coinbase.com" OR sourcehostname CONTAINS "162812-coinbase.com" OR sourcehostname CONTAINS "162814-coinbase.com" OR sourcehostname CONTAINS "16442580-coinbase.com" OR sourcehostname CONTAINS "16450107-coinbase.com")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "official-server.com" OR destinationntdomain CONTAINS "server694590423.tech" OR destinationntdomain CONTAINS "island-placid-bromine.glitch.me" OR destinationntdomain CONTAINS "circular-noon-farmhouse.glitch.me" OR destinationntdomain CONTAINS "talented-friendly-price.glitch.me" OR destinationntdomain CONTAINS "dflfmgsdokasdcpl.com" OR destinationntdomain CONTAINS "original-backend.com" OR destinationntdomain CONTAINS "07159889-coinbase.com" OR destinationntdomain CONTAINS "10195-coinbase.com" OR destinationntdomain CONTAINS "11246-coinbase.com" OR destinationntdomain CONTAINS "11247-coinbase.com" OR destinationntdomain CONTAINS "11248-coinbase.com" OR destinationntdomain CONTAINS "11258-coinbase.com" OR destinationntdomain CONTAINS "11259-coinbase.com" OR destinationntdomain CONTAINS "113912-coinbase.com" OR destinationntdomain CONTAINS "11472-coinbase.com" OR destinationntdomain CONTAINS "11923-coinbase.com" OR destinationntdomain CONTAINS "11957-coinbase.com" OR destinationntdomain CONTAINS "128147-coinbase.com" OR destinationntdomain CONTAINS "12958-coinbase.com" OR destinationntdomain CONTAINS "12984-okta.com" OR destinationntdomain CONTAINS "12985-coinbase.com" OR destinationntdomain CONTAINS "13130-coinbase.com" OR destinationntdomain CONTAINS "13247-coinbase.com" OR destinationntdomain CONTAINS "13247-icloud.com" OR destinationntdomain CONTAINS "13267-coinbase.com" OR destinationntdomain CONTAINS "146271510-coinbase.com" OR destinationntdomain CONTAINS "146282-coinbase.com" OR destinationntdomain CONTAINS "146284-coinbase.com" OR destinationntdomain CONTAINS "147260-coinbase.com" OR destinationntdomain CONTAINS "14765-coinbase.com" OR destinationntdomain CONTAINS "14817582-coinbase.com" OR destinationntdomain CONTAINS "14871904-coinbase.com" OR destinationntdomain CONTAINS "14891902-coinbase.com" OR destinationntdomain CONTAINS "1492864-coinbase.com" OR destinationntdomain CONTAINS "158312-coinbase.com" OR destinationntdomain CONTAINS "158372-coinbase.com" OR destinationntdomain CONTAINS "158702-coinbase.com" OR destinationntdomain CONTAINS "16171675-coinbase.com" OR destinationntdomain CONTAINS "16171832-coinbase.com" OR destinationntdomain CONTAINS "16178234-coinbase.com" OR destinationntdomain CONTAINS "16178237-coinbase.com" OR destinationntdomain CONTAINS "16178434-coinbase.com" OR destinationntdomain CONTAINS "162178-coinbase.com" OR destinationntdomain CONTAINS "162478-coinbase.com" OR destinationntdomain CONTAINS "162782-coinbase.com" OR destinationntdomain CONTAINS "162812-coinbase.com" OR destinationntdomain CONTAINS "162814-coinbase.com" OR destinationntdomain CONTAINS "16442580-coinbase.com" OR destinationntdomain CONTAINS "16450107-coinbase.com")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND requesturl NOT NULL AND (requesturl CONTAINS "official-server.com" OR requesturl CONTAINS "server694590423.tech" OR requesturl CONTAINS "island-placid-bromine.glitch.me" OR requesturl CONTAINS "circular-noon-farmhouse.glitch.me" OR requesturl CONTAINS "talented-friendly-price.glitch.me" OR requesturl CONTAINS "dflfmgsdokasdcpl.com" OR requesturl CONTAINS "original-backend.com" OR requesturl CONTAINS "07159889-coinbase.com" OR requesturl CONTAINS "10195-coinbase.com" OR requesturl CONTAINS "11246-coinbase.com" OR requesturl CONTAINS "11247-coinbase.com" OR requesturl CONTAINS "11248-coinbase.com" OR requesturl CONTAINS "11258-coinbase.com" OR requesturl CONTAINS "11259-coinbase.com" OR requesturl CONTAINS "113912-coinbase.com" OR requesturl CONTAINS "11472-coinbase.com" OR requesturl CONTAINS "11923-coinbase.com" OR requesturl CONTAINS "11957-coinbase.com" OR requesturl CONTAINS "128147-coinbase.com" OR requesturl CONTAINS "12958-coinbase.com" OR requesturl CONTAINS "12984-okta.com" OR requesturl CONTAINS "12985-coinbase.com" OR requesturl CONTAINS "13130-coinbase.com" OR requesturl CONTAINS "13247-coinbase.com" OR requesturl CONTAINS "13247-icloud.com" OR requesturl CONTAINS "13267-coinbase.com" OR requesturl CONTAINS "146271510-coinbase.com" OR requesturl CONTAINS "146282-coinbase.com" OR requesturl CONTAINS "146284-coinbase.com" OR requesturl CONTAINS "147260-coinbase.com" OR requesturl CONTAINS "14765-coinbase.com" OR requesturl CONTAINS "14817582-coinbase.com" OR requesturl CONTAINS "14871904-coinbase.com" OR requesturl CONTAINS "14891902-coinbase.com" OR requesturl CONTAINS "1492864-coinbase.com" OR requesturl CONTAINS "158312-coinbase.com" OR requesturl CONTAINS "158372-coinbase.com" OR requesturl CONTAINS "158702-coinbase.com" OR requesturl CONTAINS "16171675-coinbase.com" OR requesturl CONTAINS "16171832-coinbase.com" OR requesturl CONTAINS "16178234-coinbase.com" OR requesturl CONTAINS "16178237-coinbase.com" OR requesturl CONTAINS "16178434-coinbase.com" OR requesturl CONTAINS "162178-coinbase.com" OR requesturl CONTAINS "162478-coinbase.com" OR requesturl CONTAINS "162782-coinbase.com" OR requesturl CONTAINS "162812-coinbase.com" OR requesturl CONTAINS "162814-coinbase.com" OR requesturl CONTAINS "16442580-coinbase.com" OR requesturl CONTAINS "16450107-coinbase.com")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "16450207-coinbase.com" OR destinationhostname CONTAINS "16458207-coinbase.com" OR destinationhostname CONTAINS "16478202-coinbase.com" OR destinationhostname CONTAINS "164872942-coinbase.com" OR destinationhostname CONTAINS "16590-coinbase.com" OR destinationhostname CONTAINS "16594373-coinbase.com" OR destinationhostname CONTAINS "16624831-coinbase.com" OR destinationhostname CONTAINS "16642124-coinbase.com" OR destinationhostname CONTAINS "16642172-coinbase.com" OR destinationhostname CONTAINS "16642580-coinbase.com" OR destinationhostname CONTAINS "16642721-coinbase.com" OR destinationhostname CONTAINS "16642724-coinbase.com" OR destinationhostname CONTAINS "16642871-coinbase.com" OR destinationhostname CONTAINS "16642872-coinbase.com" OR destinationhostname CONTAINS "16712942-coinbase.com" OR destinationhostname CONTAINS "16718672-coinbase.com" OR destinationhostname CONTAINS "16728342-coinbase.com" OR destinationhostname CONTAINS "16728348-coinbase.com" OR destinationhostname CONTAINS "16728442-coinbase.com" OR destinationhostname CONTAINS "16728472-coinbase.com" OR destinationhostname CONTAINS "167285-coinbase.com" OR destinationhostname CONTAINS "16729042-coinbase.com" OR destinationhostname CONTAINS "16748272-coinbase.com" OR destinationhostname CONTAINS "16782942-coinbase.com" OR destinationhostname CONTAINS "16827420-coinbase.com" OR destinationhostname CONTAINS "16827423-coinbase.com" OR destinationhostname CONTAINS "16847145-coinbase.com" OR destinationhostname CONTAINS "16893924-coinbase.com" OR destinationhostname CONTAINS "17182-coinbase.com" OR destinationhostname CONTAINS "17255030-coinbase.com" OR destinationhostname CONTAINS "17259-kraken.com" OR destinationhostname CONTAINS "172486-coinbase.com" OR destinationhostname CONTAINS "17284652-coinbase.com" OR destinationhostname CONTAINS "17286-coinbase.com" OR destinationhostname CONTAINS "17334522-coinbase.com" OR destinationhostname CONTAINS "17334522-kraken.com" OR destinationhostname CONTAINS "17384522-coinbase.com" OR destinationhostname CONTAINS "173912-coinbase.com" OR destinationhostname CONTAINS "17494976-coinbase.com" OR destinationhostname CONTAINS "17512854-coinbase.com" OR destinationhostname CONTAINS "17512857-coinbase.com" OR destinationhostname CONTAINS "1751954-coinbase.com" OR destinationhostname CONTAINS "17525030-coinbase.com" OR destinationhostname CONTAINS "17529580-coinbase.com" OR destinationhostname CONTAINS "17614-coinbase.com" OR destinationhostname CONTAINS "17618412-coinbase.com" OR destinationhostname CONTAINS "17619-coinbase.com" OR destinationhostname CONTAINS "176284-coinbase.com" OR destinationhostname CONTAINS "17823920-coinbase.com" OR destinationhostname CONTAINS "178253-coinbase.com")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "16450207-coinbase.com" OR sourcentdomain CONTAINS "16458207-coinbase.com" OR sourcentdomain CONTAINS "16478202-coinbase.com" OR sourcentdomain CONTAINS "164872942-coinbase.com" OR sourcentdomain CONTAINS "16590-coinbase.com" OR sourcentdomain CONTAINS "16594373-coinbase.com" OR sourcentdomain CONTAINS "16624831-coinbase.com" OR sourcentdomain CONTAINS "16642124-coinbase.com" OR sourcentdomain CONTAINS "16642172-coinbase.com" OR sourcentdomain CONTAINS "16642580-coinbase.com" OR sourcentdomain CONTAINS "16642721-coinbase.com" OR sourcentdomain CONTAINS "16642724-coinbase.com" OR sourcentdomain CONTAINS "16642871-coinbase.com" OR sourcentdomain CONTAINS "16642872-coinbase.com" OR sourcentdomain CONTAINS "16712942-coinbase.com" OR sourcentdomain CONTAINS "16718672-coinbase.com" OR sourcentdomain CONTAINS "16728342-coinbase.com" OR sourcentdomain CONTAINS "16728348-coinbase.com" OR sourcentdomain CONTAINS "16728442-coinbase.com" OR sourcentdomain CONTAINS "16728472-coinbase.com" OR sourcentdomain CONTAINS "167285-coinbase.com" OR sourcentdomain CONTAINS "16729042-coinbase.com" OR sourcentdomain CONTAINS "16748272-coinbase.com" OR sourcentdomain CONTAINS "16782942-coinbase.com" OR sourcentdomain CONTAINS "16827420-coinbase.com" OR sourcentdomain CONTAINS "16827423-coinbase.com" OR sourcentdomain CONTAINS "16847145-coinbase.com" OR sourcentdomain CONTAINS "16893924-coinbase.com" OR sourcentdomain CONTAINS "17182-coinbase.com" OR sourcentdomain CONTAINS "17255030-coinbase.com" OR sourcentdomain CONTAINS "17259-kraken.com" OR sourcentdomain CONTAINS "172486-coinbase.com" OR sourcentdomain CONTAINS "17284652-coinbase.com" OR sourcentdomain CONTAINS "17286-coinbase.com" OR sourcentdomain CONTAINS "17334522-coinbase.com" OR sourcentdomain CONTAINS "17334522-kraken.com" OR sourcentdomain CONTAINS "17384522-coinbase.com" OR sourcentdomain CONTAINS "173912-coinbase.com" OR sourcentdomain CONTAINS "17494976-coinbase.com" OR sourcentdomain CONTAINS "17512854-coinbase.com" OR sourcentdomain CONTAINS "17512857-coinbase.com" OR sourcentdomain CONTAINS "1751954-coinbase.com" OR sourcentdomain CONTAINS "17525030-coinbase.com" OR sourcentdomain CONTAINS "17529580-coinbase.com" OR sourcentdomain CONTAINS "17614-coinbase.com" OR sourcentdomain CONTAINS "17618412-coinbase.com" OR sourcentdomain CONTAINS "17619-coinbase.com" OR sourcentdomain CONTAINS "176284-coinbase.com" OR sourcentdomain CONTAINS "17823920-coinbase.com" OR sourcentdomain CONTAINS "178253-coinbase.com")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "16450207-coinbase.com" OR sourcehostname CONTAINS "16458207-coinbase.com" OR sourcehostname CONTAINS "16478202-coinbase.com" OR sourcehostname CONTAINS "164872942-coinbase.com" OR sourcehostname CONTAINS "16590-coinbase.com" OR sourcehostname CONTAINS "16594373-coinbase.com" OR sourcehostname CONTAINS "16624831-coinbase.com" OR sourcehostname CONTAINS "16642124-coinbase.com" OR sourcehostname CONTAINS "16642172-coinbase.com" OR sourcehostname CONTAINS "16642580-coinbase.com" OR sourcehostname CONTAINS "16642721-coinbase.com" OR sourcehostname CONTAINS "16642724-coinbase.com" OR sourcehostname CONTAINS "16642871-coinbase.com" OR sourcehostname CONTAINS "16642872-coinbase.com" OR sourcehostname CONTAINS "16712942-coinbase.com" OR sourcehostname CONTAINS "16718672-coinbase.com" OR sourcehostname CONTAINS "16728342-coinbase.com" OR sourcehostname CONTAINS "16728348-coinbase.com" OR sourcehostname CONTAINS "16728442-coinbase.com" OR sourcehostname CONTAINS "16728472-coinbase.com" OR sourcehostname CONTAINS "167285-coinbase.com" OR sourcehostname CONTAINS "16729042-coinbase.com" OR sourcehostname CONTAINS "16748272-coinbase.com" OR sourcehostname CONTAINS "16782942-coinbase.com" OR sourcehostname CONTAINS "16827420-coinbase.com" OR sourcehostname CONTAINS "16827423-coinbase.com" OR sourcehostname CONTAINS "16847145-coinbase.com" OR sourcehostname CONTAINS "16893924-coinbase.com" OR sourcehostname CONTAINS "17182-coinbase.com" OR sourcehostname CONTAINS "17255030-coinbase.com" OR sourcehostname CONTAINS "17259-kraken.com" OR sourcehostname CONTAINS "172486-coinbase.com" OR sourcehostname CONTAINS "17284652-coinbase.com" OR sourcehostname CONTAINS "17286-coinbase.com" OR sourcehostname CONTAINS "17334522-coinbase.com" OR sourcehostname CONTAINS "17334522-kraken.com" OR sourcehostname CONTAINS "17384522-coinbase.com" OR sourcehostname CONTAINS "173912-coinbase.com" OR sourcehostname CONTAINS "17494976-coinbase.com" OR sourcehostname CONTAINS "17512854-coinbase.com" OR sourcehostname CONTAINS "17512857-coinbase.com" OR sourcehostname CONTAINS "1751954-coinbase.com" OR sourcehostname CONTAINS "17525030-coinbase.com" OR sourcehostname CONTAINS "17529580-coinbase.com" OR sourcehostname CONTAINS "17614-coinbase.com" OR sourcehostname CONTAINS "17618412-coinbase.com" OR sourcehostname CONTAINS "17619-coinbase.com" OR sourcehostname CONTAINS "176284-coinbase.com" OR sourcehostname CONTAINS "17823920-coinbase.com" OR sourcehostname CONTAINS "178253-coinbase.com")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "16450207-coinbase.com" OR destinationntdomain CONTAINS "16458207-coinbase.com" OR destinationntdomain CONTAINS "16478202-coinbase.com" OR destinationntdomain CONTAINS "164872942-coinbase.com" OR destinationntdomain CONTAINS "16590-coinbase.com" OR destinationntdomain CONTAINS "16594373-coinbase.com" OR destinationntdomain CONTAINS "16624831-coinbase.com" OR destinationntdomain CONTAINS "16642124-coinbase.com" OR destinationntdomain CONTAINS "16642172-coinbase.com" OR destinationntdomain CONTAINS "16642580-coinbase.com" OR destinationntdomain CONTAINS "16642721-coinbase.com" OR destinationntdomain CONTAINS "16642724-coinbase.com" OR destinationntdomain CONTAINS "16642871-coinbase.com" OR destinationntdomain CONTAINS "16642872-coinbase.com" OR destinationntdomain CONTAINS "16712942-coinbase.com" OR destinationntdomain CONTAINS "16718672-coinbase.com" OR destinationntdomain CONTAINS "16728342-coinbase.com" OR destinationntdomain CONTAINS "16728348-coinbase.com" OR destinationntdomain CONTAINS "16728442-coinbase.com" OR destinationntdomain CONTAINS "16728472-coinbase.com" OR destinationntdomain CONTAINS "167285-coinbase.com" OR destinationntdomain CONTAINS "16729042-coinbase.com" OR destinationntdomain CONTAINS "16748272-coinbase.com" OR destinationntdomain CONTAINS "16782942-coinbase.com" OR destinationntdomain CONTAINS "16827420-coinbase.com" OR destinationntdomain CONTAINS "16827423-coinbase.com" OR destinationntdomain CONTAINS "16847145-coinbase.com" OR destinationntdomain CONTAINS "16893924-coinbase.com" OR destinationntdomain CONTAINS "17182-coinbase.com" OR destinationntdomain CONTAINS "17255030-coinbase.com" OR destinationntdomain CONTAINS "17259-kraken.com" OR destinationntdomain CONTAINS "172486-coinbase.com" OR destinationntdomain CONTAINS "17284652-coinbase.com" OR destinationntdomain CONTAINS "17286-coinbase.com" OR destinationntdomain CONTAINS "17334522-coinbase.com" OR destinationntdomain CONTAINS "17334522-kraken.com" OR destinationntdomain CONTAINS "17384522-coinbase.com" OR destinationntdomain CONTAINS "173912-coinbase.com" OR destinationntdomain CONTAINS "17494976-coinbase.com" OR destinationntdomain CONTAINS "17512854-coinbase.com" OR destinationntdomain CONTAINS "17512857-coinbase.com" OR destinationntdomain CONTAINS "1751954-coinbase.com" OR destinationntdomain CONTAINS "17525030-coinbase.com" OR destinationntdomain CONTAINS "17529580-coinbase.com" OR destinationntdomain CONTAINS "17614-coinbase.com" OR destinationntdomain CONTAINS "17618412-coinbase.com" OR destinationntdomain CONTAINS "17619-coinbase.com" OR destinationntdomain CONTAINS "176284-coinbase.com" OR destinationntdomain CONTAINS "17823920-coinbase.com" OR destinationntdomain CONTAINS "178253-coinbase.com")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND requesturl NOT NULL AND (requesturl CONTAINS "16450207-coinbase.com" OR requesturl CONTAINS "16458207-coinbase.com" OR requesturl CONTAINS "16478202-coinbase.com" OR requesturl CONTAINS "164872942-coinbase.com" OR requesturl CONTAINS "16590-coinbase.com" OR requesturl CONTAINS "16594373-coinbase.com" OR requesturl CONTAINS "16624831-coinbase.com" OR requesturl CONTAINS "16642124-coinbase.com" OR requesturl CONTAINS "16642172-coinbase.com" OR requesturl CONTAINS "16642580-coinbase.com" OR requesturl CONTAINS "16642721-coinbase.com" OR requesturl CONTAINS "16642724-coinbase.com" OR requesturl CONTAINS "16642871-coinbase.com" OR requesturl CONTAINS "16642872-coinbase.com" OR requesturl CONTAINS "16712942-coinbase.com" OR requesturl CONTAINS "16718672-coinbase.com" OR requesturl CONTAINS "16728342-coinbase.com" OR requesturl CONTAINS "16728348-coinbase.com" OR requesturl CONTAINS "16728442-coinbase.com" OR requesturl CONTAINS "16728472-coinbase.com" OR requesturl CONTAINS "167285-coinbase.com" OR requesturl CONTAINS "16729042-coinbase.com" OR requesturl CONTAINS "16748272-coinbase.com" OR requesturl CONTAINS "16782942-coinbase.com" OR requesturl CONTAINS "16827420-coinbase.com" OR requesturl CONTAINS "16827423-coinbase.com" OR requesturl CONTAINS "16847145-coinbase.com" OR requesturl CONTAINS "16893924-coinbase.com" OR requesturl CONTAINS "17182-coinbase.com" OR requesturl CONTAINS "17255030-coinbase.com" OR requesturl CONTAINS "17259-kraken.com" OR requesturl CONTAINS "172486-coinbase.com" OR requesturl CONTAINS "17284652-coinbase.com" OR requesturl CONTAINS "17286-coinbase.com" OR requesturl CONTAINS "17334522-coinbase.com" OR requesturl CONTAINS "17334522-kraken.com" OR requesturl CONTAINS "17384522-coinbase.com" OR requesturl CONTAINS "173912-coinbase.com" OR requesturl CONTAINS "17494976-coinbase.com" OR requesturl CONTAINS "17512854-coinbase.com" OR requesturl CONTAINS "17512857-coinbase.com" OR requesturl CONTAINS "1751954-coinbase.com" OR requesturl CONTAINS "17525030-coinbase.com" OR requesturl CONTAINS "17529580-coinbase.com" OR requesturl CONTAINS "17614-coinbase.com" OR requesturl CONTAINS "17618412-coinbase.com" OR requesturl CONTAINS "17619-coinbase.com" OR requesturl CONTAINS "176284-coinbase.com" OR requesturl CONTAINS "17823920-coinbase.com" OR requesturl CONTAINS "178253-coinbase.com")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "178294-coinbase.com" OR destinationhostname CONTAINS "17912-coinbase.com" OR destinationhostname CONTAINS "17914-coinbase.com" OR destinationhostname CONTAINS "17917-coinbase.com" OR destinationhostname CONTAINS "17954-coinbase.com" OR destinationhostname CONTAINS "17958-coinbase.com" OR destinationhostname CONTAINS "182043-coinbase.com" OR destinationhostname CONTAINS "18275-gemini.com" OR destinationhostname CONTAINS "18276-coinbase.com" OR destinationhostname CONTAINS "18290185-coinbase.com" OR destinationhostname CONTAINS "182967-coinbase.com" OR destinationhostname CONTAINS "18560-coinbase.com" OR destinationhostname CONTAINS "18571-coinbase.com" OR destinationhostname CONTAINS "185912-coinbase.com" OR destinationhostname CONTAINS "185914-coinbase.com" OR destinationhostname CONTAINS "18592176-coinbase.com" OR destinationhostname CONTAINS "18594162-coinbase.com" OR destinationhostname CONTAINS "18594962-coinbase.com" OR destinationhostname CONTAINS "18597162-coinbase.com" OR destinationhostname CONTAINS "18719562-coinbase.com" OR destinationhostname CONTAINS "1875290-coinbase.com" OR destinationhostname CONTAINS "1882730-coinbase.com" OR destinationhostname CONTAINS "18902-coinbase.com" OR destinationhostname CONTAINS "18903-coinbase.com" OR destinationhostname CONTAINS "189126-coinbase.com" OR destinationhostname CONTAINS "18952-coinbase.com" OR destinationhostname CONTAINS "192854-coinbase.com" OR destinationhostname CONTAINS "192856-coinbase.com" OR destinationhostname CONTAINS "19287-binance.com" OR destinationhostname CONTAINS "19572-coinbase.com" OR destinationhostname CONTAINS "195812-coinbase.com" OR destinationhostname CONTAINS "195826-coinbase.com" OR destinationhostname CONTAINS "1958262-coinbase.com" OR destinationhostname CONTAINS "195827-binance.com" OR destinationhostname CONTAINS "1958297-coinbase.com" OR destinationhostname CONTAINS "19582970-coinbase.com" OR destinationhostname CONTAINS "19582971-coinbase.com" OR destinationhostname CONTAINS "19583-coinbase.com" OR destinationhostname CONTAINS "19592653-coinbase.com" OR destinationhostname CONTAINS "197304-coinbase.com" OR destinationhostname CONTAINS "19730492-coinbase.com" OR destinationhostname CONTAINS "19764162-coinbase.com" OR destinationhostname CONTAINS "19803-coinbase.com" OR destinationhostname CONTAINS "201784289-coinbase.com" OR destinationhostname CONTAINS "210823644-coinbase.com" OR destinationhostname CONTAINS "21158-coinbase.com" OR destinationhostname CONTAINS "21509-coinbase.com" OR destinationhostname CONTAINS "25985-coinbase.com" OR destinationhostname CONTAINS "27699-coinbase.com" OR destinationhostname CONTAINS "28367-coinbase.com")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "178294-coinbase.com" OR sourcentdomain CONTAINS "17912-coinbase.com" OR sourcentdomain CONTAINS "17914-coinbase.com" OR sourcentdomain CONTAINS "17917-coinbase.com" OR sourcentdomain CONTAINS "17954-coinbase.com" OR sourcentdomain CONTAINS "17958-coinbase.com" OR sourcentdomain CONTAINS "182043-coinbase.com" OR sourcentdomain CONTAINS "18275-gemini.com" OR sourcentdomain CONTAINS "18276-coinbase.com" OR sourcentdomain CONTAINS "18290185-coinbase.com" OR sourcentdomain CONTAINS "182967-coinbase.com" OR sourcentdomain CONTAINS "18560-coinbase.com" OR sourcentdomain CONTAINS "18571-coinbase.com" OR sourcentdomain CONTAINS "185912-coinbase.com" OR sourcentdomain CONTAINS "185914-coinbase.com" OR sourcentdomain CONTAINS "18592176-coinbase.com" OR sourcentdomain CONTAINS "18594162-coinbase.com" OR sourcentdomain CONTAINS "18594962-coinbase.com" OR sourcentdomain CONTAINS "18597162-coinbase.com" OR sourcentdomain CONTAINS "18719562-coinbase.com" OR sourcentdomain CONTAINS "1875290-coinbase.com" OR sourcentdomain CONTAINS "1882730-coinbase.com" OR sourcentdomain CONTAINS "18902-coinbase.com" OR sourcentdomain CONTAINS "18903-coinbase.com" OR sourcentdomain CONTAINS "189126-coinbase.com" OR sourcentdomain CONTAINS "18952-coinbase.com" OR sourcentdomain CONTAINS "192854-coinbase.com" OR sourcentdomain CONTAINS "192856-coinbase.com" OR sourcentdomain CONTAINS "19287-binance.com" OR sourcentdomain CONTAINS "19572-coinbase.com" OR sourcentdomain CONTAINS "195812-coinbase.com" OR sourcentdomain CONTAINS "195826-coinbase.com" OR sourcentdomain CONTAINS "1958262-coinbase.com" OR sourcentdomain CONTAINS "195827-binance.com" OR sourcentdomain CONTAINS "1958297-coinbase.com" OR sourcentdomain CONTAINS "19582970-coinbase.com" OR sourcentdomain CONTAINS "19582971-coinbase.com" OR sourcentdomain CONTAINS "19583-coinbase.com" OR sourcentdomain CONTAINS "19592653-coinbase.com" OR sourcentdomain CONTAINS "197304-coinbase.com" OR sourcentdomain CONTAINS "19730492-coinbase.com" OR sourcentdomain CONTAINS "19764162-coinbase.com" OR sourcentdomain CONTAINS "19803-coinbase.com" OR sourcentdomain CONTAINS "201784289-coinbase.com" OR sourcentdomain CONTAINS "210823644-coinbase.com" OR sourcentdomain CONTAINS "21158-coinbase.com" OR sourcentdomain CONTAINS "21509-coinbase.com" OR sourcentdomain CONTAINS "25985-coinbase.com" OR sourcentdomain CONTAINS "27699-coinbase.com" OR sourcentdomain CONTAINS "28367-coinbase.com")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "178294-coinbase.com" OR sourcehostname CONTAINS "17912-coinbase.com" OR sourcehostname CONTAINS "17914-coinbase.com" OR sourcehostname CONTAINS "17917-coinbase.com" OR sourcehostname CONTAINS "17954-coinbase.com" OR sourcehostname CONTAINS "17958-coinbase.com" OR sourcehostname CONTAINS "182043-coinbase.com" OR sourcehostname CONTAINS "18275-gemini.com" OR sourcehostname CONTAINS "18276-coinbase.com" OR sourcehostname CONTAINS "18290185-coinbase.com" OR sourcehostname CONTAINS "182967-coinbase.com" OR sourcehostname CONTAINS "18560-coinbase.com" OR sourcehostname CONTAINS "18571-coinbase.com" OR sourcehostname CONTAINS "185912-coinbase.com" OR sourcehostname CONTAINS "185914-coinbase.com" OR sourcehostname CONTAINS "18592176-coinbase.com" OR sourcehostname CONTAINS "18594162-coinbase.com" OR sourcehostname CONTAINS "18594962-coinbase.com" OR sourcehostname CONTAINS "18597162-coinbase.com" OR sourcehostname CONTAINS "18719562-coinbase.com" OR sourcehostname CONTAINS "1875290-coinbase.com" OR sourcehostname CONTAINS "1882730-coinbase.com" OR sourcehostname CONTAINS "18902-coinbase.com" OR sourcehostname CONTAINS "18903-coinbase.com" OR sourcehostname CONTAINS "189126-coinbase.com" OR sourcehostname CONTAINS "18952-coinbase.com" OR sourcehostname CONTAINS "192854-coinbase.com" OR sourcehostname CONTAINS "192856-coinbase.com" OR sourcehostname CONTAINS "19287-binance.com" OR sourcehostname CONTAINS "19572-coinbase.com" OR sourcehostname CONTAINS "195812-coinbase.com" OR sourcehostname CONTAINS "195826-coinbase.com" OR sourcehostname CONTAINS "1958262-coinbase.com" OR sourcehostname CONTAINS "195827-binance.com" OR sourcehostname CONTAINS "1958297-coinbase.com" OR sourcehostname CONTAINS "19582970-coinbase.com" OR sourcehostname CONTAINS "19582971-coinbase.com" OR sourcehostname CONTAINS "19583-coinbase.com" OR sourcehostname CONTAINS "19592653-coinbase.com" OR sourcehostname CONTAINS "197304-coinbase.com" OR sourcehostname CONTAINS "19730492-coinbase.com" OR sourcehostname CONTAINS "19764162-coinbase.com" OR sourcehostname CONTAINS "19803-coinbase.com" OR sourcehostname CONTAINS "201784289-coinbase.com" OR sourcehostname CONTAINS "210823644-coinbase.com" OR sourcehostname CONTAINS "21158-coinbase.com" OR sourcehostname CONTAINS "21509-coinbase.com" OR sourcehostname CONTAINS "25985-coinbase.com" OR sourcehostname CONTAINS "27699-coinbase.com" OR sourcehostname CONTAINS "28367-coinbase.com")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "178294-coinbase.com" OR destinationntdomain CONTAINS "17912-coinbase.com" OR destinationntdomain CONTAINS "17914-coinbase.com" OR destinationntdomain CONTAINS "17917-coinbase.com" OR destinationntdomain CONTAINS "17954-coinbase.com" OR destinationntdomain CONTAINS "17958-coinbase.com" OR destinationntdomain CONTAINS "182043-coinbase.com" OR destinationntdomain CONTAINS "18275-gemini.com" OR destinationntdomain CONTAINS "18276-coinbase.com" OR destinationntdomain CONTAINS "18290185-coinbase.com" OR destinationntdomain CONTAINS "182967-coinbase.com" OR destinationntdomain CONTAINS "18560-coinbase.com" OR destinationntdomain CONTAINS "18571-coinbase.com" OR destinationntdomain CONTAINS "185912-coinbase.com" OR destinationntdomain CONTAINS "185914-coinbase.com" OR destinationntdomain CONTAINS "18592176-coinbase.com" OR destinationntdomain CONTAINS "18594162-coinbase.com" OR destinationntdomain CONTAINS "18594962-coinbase.com" OR destinationntdomain CONTAINS "18597162-coinbase.com" OR destinationntdomain CONTAINS "18719562-coinbase.com" OR destinationntdomain CONTAINS "1875290-coinbase.com" OR destinationntdomain CONTAINS "1882730-coinbase.com" OR destinationntdomain CONTAINS "18902-coinbase.com" OR destinationntdomain CONTAINS "18903-coinbase.com" OR destinationntdomain CONTAINS "189126-coinbase.com" OR destinationntdomain CONTAINS "18952-coinbase.com" OR destinationntdomain CONTAINS "192854-coinbase.com" OR destinationntdomain CONTAINS "192856-coinbase.com" OR destinationntdomain CONTAINS "19287-binance.com" OR destinationntdomain CONTAINS "19572-coinbase.com" OR destinationntdomain CONTAINS "195812-coinbase.com" OR destinationntdomain CONTAINS "195826-coinbase.com" OR destinationntdomain CONTAINS "1958262-coinbase.com" OR destinationntdomain CONTAINS "195827-binance.com" OR destinationntdomain CONTAINS "1958297-coinbase.com" OR destinationntdomain CONTAINS "19582970-coinbase.com" OR destinationntdomain CONTAINS "19582971-coinbase.com" OR destinationntdomain CONTAINS "19583-coinbase.com" OR destinationntdomain CONTAINS "19592653-coinbase.com" OR destinationntdomain CONTAINS "197304-coinbase.com" OR destinationntdomain CONTAINS "19730492-coinbase.com" OR destinationntdomain CONTAINS "19764162-coinbase.com" OR destinationntdomain CONTAINS "19803-coinbase.com" OR destinationntdomain CONTAINS "201784289-coinbase.com" OR destinationntdomain CONTAINS "210823644-coinbase.com" OR destinationntdomain CONTAINS "21158-coinbase.com" OR destinationntdomain CONTAINS "21509-coinbase.com" OR destinationntdomain CONTAINS "25985-coinbase.com" OR destinationntdomain CONTAINS "27699-coinbase.com" OR destinationntdomain CONTAINS "28367-coinbase.com")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND requesturl NOT NULL AND (requesturl CONTAINS "178294-coinbase.com" OR requesturl CONTAINS "17912-coinbase.com" OR requesturl CONTAINS "17914-coinbase.com" OR requesturl CONTAINS "17917-coinbase.com" OR requesturl CONTAINS "17954-coinbase.com" OR requesturl CONTAINS "17958-coinbase.com" OR requesturl CONTAINS "182043-coinbase.com" OR requesturl CONTAINS "18275-gemini.com" OR requesturl CONTAINS "18276-coinbase.com" OR requesturl CONTAINS "18290185-coinbase.com" OR requesturl CONTAINS "182967-coinbase.com" OR requesturl CONTAINS "18560-coinbase.com" OR requesturl CONTAINS "18571-coinbase.com" OR requesturl CONTAINS "185912-coinbase.com" OR requesturl CONTAINS "185914-coinbase.com" OR requesturl CONTAINS "18592176-coinbase.com" OR requesturl CONTAINS "18594162-coinbase.com" OR requesturl CONTAINS "18594962-coinbase.com" OR requesturl CONTAINS "18597162-coinbase.com" OR requesturl CONTAINS "18719562-coinbase.com" OR requesturl CONTAINS "1875290-coinbase.com" OR requesturl CONTAINS "1882730-coinbase.com" OR requesturl CONTAINS "18902-coinbase.com" OR requesturl CONTAINS "18903-coinbase.com" OR requesturl CONTAINS "189126-coinbase.com" OR requesturl CONTAINS "18952-coinbase.com" OR requesturl CONTAINS "192854-coinbase.com" OR requesturl CONTAINS "192856-coinbase.com" OR requesturl CONTAINS "19287-binance.com" OR requesturl CONTAINS "19572-coinbase.com" OR requesturl CONTAINS "195812-coinbase.com" OR requesturl CONTAINS "195826-coinbase.com" OR requesturl CONTAINS "1958262-coinbase.com" OR requesturl CONTAINS "195827-binance.com" OR requesturl CONTAINS "1958297-coinbase.com" OR requesturl CONTAINS "19582970-coinbase.com" OR requesturl CONTAINS "19582971-coinbase.com" OR requesturl CONTAINS "19583-coinbase.com" OR requesturl CONTAINS "19592653-coinbase.com" OR requesturl CONTAINS "197304-coinbase.com" OR requesturl CONTAINS "19730492-coinbase.com" OR requesturl CONTAINS "19764162-coinbase.com" OR requesturl CONTAINS "19803-coinbase.com" OR requesturl CONTAINS "201784289-coinbase.com" OR requesturl CONTAINS "210823644-coinbase.com" OR requesturl CONTAINS "21158-coinbase.com" OR requesturl CONTAINS "21509-coinbase.com" OR requesturl CONTAINS "25985-coinbase.com" OR requesturl CONTAINS "27699-coinbase.com" OR requesturl CONTAINS "28367-coinbase.com")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "28676-coinbase.com" OR destinationhostname CONTAINS "29185-coinbase.com" OR destinationhostname CONTAINS "29195-coinbase.com" OR destinationhostname CONTAINS "2a-coinbase.com" OR destinationhostname CONTAINS "2b-coinbase.com" OR destinationhostname CONTAINS "2c-coinbase.com" OR destinationhostname CONTAINS "2f-coinbase.com" OR destinationhostname CONTAINS "2fas-coinbase.com" OR destinationhostname CONTAINS "2o-coinbase.com" OR destinationhostname CONTAINS "2r-coinbase.com" OR destinationhostname CONTAINS "2s-coinbase.com" OR destinationhostname CONTAINS "2sv-coinbase.com" OR destinationhostname CONTAINS "352134951-coinbase.com" OR destinationhostname CONTAINS "38468-coinbase.com" OR destinationhostname CONTAINS "39590-coinbase.com" OR destinationhostname CONTAINS "41260-coinbase.com" OR destinationhostname CONTAINS "427883-coinbase.com" OR destinationhostname CONTAINS "43017-coinbase.com" OR destinationhostname CONTAINS "47562-coinbase.com" OR destinationhostname CONTAINS "50195-coinbase.com" OR destinationhostname CONTAINS "5247-coinbase.com" OR destinationhostname CONTAINS "54765-coinbase.com" OR destinationhostname CONTAINS "57197-coinbase.com" OR destinationhostname CONTAINS "58176-coinbase.com" OR destinationhostname CONTAINS "58297-coinbase.com" OR destinationhostname CONTAINS "61250-coinbase.com" OR destinationhostname CONTAINS "61835-coinbase.com" OR destinationhostname CONTAINS "61851-coinbase.com" OR destinationhostname CONTAINS "61937-coinbase.com" OR destinationhostname CONTAINS "71925-coinbase.com" OR destinationhostname CONTAINS "72957-coinbase.com" OR destinationhostname CONTAINS "72985-coinbase.com" OR destinationhostname CONTAINS "74651-coinbase.com" OR destinationhostname CONTAINS "754668948-coinbase.com" OR destinationhostname CONTAINS "76159869-coinbase.com" OR destinationhostname CONTAINS "76153-coinbase.com" OR destinationhostname CONTAINS "81758-coinbase.com" OR destinationhostname CONTAINS "81920-coinbase.com" OR destinationhostname CONTAINS "81926-coinbase.com" OR destinationhostname CONTAINS "81958-coinbase.com" OR destinationhostname CONTAINS "826298-coinbase.com" OR destinationhostname CONTAINS "83216-coinbase.com" OR destinationhostname CONTAINS "837613-coinbase.com" OR destinationhostname CONTAINS "83956-coinbase.com" OR destinationhostname CONTAINS "87157-coinbase.com" OR destinationhostname CONTAINS "87312-coinbase.com" OR destinationhostname CONTAINS "89304-coinbase.com" OR destinationhostname CONTAINS "89375-coinbase.com" OR destinationhostname CONTAINS "91723-gemini.com" OR destinationhostname CONTAINS "91752-coinbase.com")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "28676-coinbase.com" OR sourcentdomain CONTAINS "29185-coinbase.com" OR sourcentdomain CONTAINS "29195-coinbase.com" OR sourcentdomain CONTAINS "2a-coinbase.com" OR sourcentdomain CONTAINS "2b-coinbase.com" OR sourcentdomain CONTAINS "2c-coinbase.com" OR sourcentdomain CONTAINS "2f-coinbase.com" OR sourcentdomain CONTAINS "2fas-coinbase.com" OR sourcentdomain CONTAINS "2o-coinbase.com" OR sourcentdomain CONTAINS "2r-coinbase.com" OR sourcentdomain CONTAINS "2s-coinbase.com" OR sourcentdomain CONTAINS "2sv-coinbase.com" OR sourcentdomain CONTAINS "352134951-coinbase.com" OR sourcentdomain CONTAINS "38468-coinbase.com" OR sourcentdomain CONTAINS "39590-coinbase.com" OR sourcentdomain CONTAINS "41260-coinbase.com" OR sourcentdomain CONTAINS "427883-coinbase.com" OR sourcentdomain CONTAINS "43017-coinbase.com" OR sourcentdomain CONTAINS "47562-coinbase.com" OR sourcentdomain CONTAINS "50195-coinbase.com" OR sourcentdomain CONTAINS "5247-coinbase.com" OR sourcentdomain CONTAINS "54765-coinbase.com" OR sourcentdomain CONTAINS "57197-coinbase.com" OR sourcentdomain CONTAINS "58176-coinbase.com" OR sourcentdomain CONTAINS "58297-coinbase.com" OR sourcentdomain CONTAINS "61250-coinbase.com" OR sourcentdomain CONTAINS "61835-coinbase.com" OR sourcentdomain CONTAINS "61851-coinbase.com" OR sourcentdomain CONTAINS "61937-coinbase.com" OR sourcentdomain CONTAINS "71925-coinbase.com" OR sourcentdomain CONTAINS "72957-coinbase.com" OR sourcentdomain CONTAINS "72985-coinbase.com" OR sourcentdomain CONTAINS "74651-coinbase.com" OR sourcentdomain CONTAINS "754668948-coinbase.com" OR sourcentdomain CONTAINS "76159869-coinbase.com" OR sourcentdomain CONTAINS "76153-coinbase.com" OR sourcentdomain CONTAINS "81758-coinbase.com" OR sourcentdomain CONTAINS "81920-coinbase.com" OR sourcentdomain CONTAINS "81926-coinbase.com" OR sourcentdomain CONTAINS "81958-coinbase.com" OR sourcentdomain CONTAINS "826298-coinbase.com" OR sourcentdomain CONTAINS "83216-coinbase.com" OR sourcentdomain CONTAINS "837613-coinbase.com" OR sourcentdomain CONTAINS "83956-coinbase.com" OR sourcentdomain CONTAINS "87157-coinbase.com" OR sourcentdomain CONTAINS "87312-coinbase.com" OR sourcentdomain CONTAINS "89304-coinbase.com" OR sourcentdomain CONTAINS "89375-coinbase.com" OR sourcentdomain CONTAINS "91723-gemini.com" OR sourcentdomain CONTAINS "91752-coinbase.com")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "28676-coinbase.com" OR sourcehostname CONTAINS "29185-coinbase.com" OR sourcehostname CONTAINS "29195-coinbase.com" OR sourcehostname CONTAINS "2a-coinbase.com" OR sourcehostname CONTAINS "2b-coinbase.com" OR sourcehostname CONTAINS "2c-coinbase.com" OR sourcehostname CONTAINS "2f-coinbase.com" OR sourcehostname CONTAINS "2fas-coinbase.com" OR sourcehostname CONTAINS "2o-coinbase.com" OR sourcehostname CONTAINS "2r-coinbase.com" OR sourcehostname CONTAINS "2s-coinbase.com" OR sourcehostname CONTAINS "2sv-coinbase.com" OR sourcehostname CONTAINS "352134951-coinbase.com" OR sourcehostname CONTAINS "38468-coinbase.com" OR sourcehostname CONTAINS "39590-coinbase.com" OR sourcehostname CONTAINS "41260-coinbase.com" OR sourcehostname CONTAINS "427883-coinbase.com" OR sourcehostname CONTAINS "43017-coinbase.com" OR sourcehostname CONTAINS "47562-coinbase.com" OR sourcehostname CONTAINS "50195-coinbase.com" OR sourcehostname CONTAINS "5247-coinbase.com" OR sourcehostname CONTAINS "54765-coinbase.com" OR sourcehostname CONTAINS "57197-coinbase.com" OR sourcehostname CONTAINS "58176-coinbase.com" OR sourcehostname CONTAINS "58297-coinbase.com" OR sourcehostname CONTAINS "61250-coinbase.com" OR sourcehostname CONTAINS "61835-coinbase.com" OR sourcehostname CONTAINS "61851-coinbase.com" OR sourcehostname CONTAINS "61937-coinbase.com" OR sourcehostname CONTAINS "71925-coinbase.com" OR sourcehostname CONTAINS "72957-coinbase.com" OR sourcehostname CONTAINS "72985-coinbase.com" OR sourcehostname CONTAINS "74651-coinbase.com" OR sourcehostname CONTAINS "754668948-coinbase.com" OR sourcehostname CONTAINS "76159869-coinbase.com" OR sourcehostname CONTAINS "76153-coinbase.com" OR sourcehostname CONTAINS "81758-coinbase.com" OR sourcehostname CONTAINS "81920-coinbase.com" OR sourcehostname CONTAINS "81926-coinbase.com" OR sourcehostname CONTAINS "81958-coinbase.com" OR sourcehostname CONTAINS "826298-coinbase.com" OR sourcehostname CONTAINS "83216-coinbase.com" OR sourcehostname CONTAINS "837613-coinbase.com" OR sourcehostname CONTAINS "83956-coinbase.com" OR sourcehostname CONTAINS "87157-coinbase.com" OR sourcehostname CONTAINS "87312-coinbase.com" OR sourcehostname CONTAINS "89304-coinbase.com" OR sourcehostname CONTAINS "89375-coinbase.com" OR sourcehostname CONTAINS "91723-gemini.com" OR sourcehostname CONTAINS "91752-coinbase.com")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "28676-coinbase.com" OR destinationntdomain CONTAINS "29185-coinbase.com" OR destinationntdomain CONTAINS "29195-coinbase.com" OR destinationntdomain CONTAINS "2a-coinbase.com" OR destinationntdomain CONTAINS "2b-coinbase.com" OR destinationntdomain CONTAINS "2c-coinbase.com" OR destinationntdomain CONTAINS "2f-coinbase.com" OR destinationntdomain CONTAINS "2fas-coinbase.com" OR destinationntdomain CONTAINS "2o-coinbase.com" OR destinationntdomain CONTAINS "2r-coinbase.com" OR destinationntdomain CONTAINS "2s-coinbase.com" OR destinationntdomain CONTAINS "2sv-coinbase.com" OR destinationntdomain CONTAINS "352134951-coinbase.com" OR destinationntdomain CONTAINS "38468-coinbase.com" OR destinationntdomain CONTAINS "39590-coinbase.com" OR destinationntdomain CONTAINS "41260-coinbase.com" OR destinationntdomain CONTAINS "427883-coinbase.com" OR destinationntdomain CONTAINS "43017-coinbase.com" OR destinationntdomain CONTAINS "47562-coinbase.com" OR destinationntdomain CONTAINS "50195-coinbase.com" OR destinationntdomain CONTAINS "5247-coinbase.com" OR destinationntdomain CONTAINS "54765-coinbase.com" OR destinationntdomain CONTAINS "57197-coinbase.com" OR destinationntdomain CONTAINS "58176-coinbase.com" OR destinationntdomain CONTAINS "58297-coinbase.com" OR destinationntdomain CONTAINS "61250-coinbase.com" OR destinationntdomain CONTAINS "61835-coinbase.com" OR destinationntdomain CONTAINS "61851-coinbase.com" OR destinationntdomain CONTAINS "61937-coinbase.com" OR destinationntdomain CONTAINS "71925-coinbase.com" OR destinationntdomain CONTAINS "72957-coinbase.com" OR destinationntdomain CONTAINS "72985-coinbase.com" OR destinationntdomain CONTAINS "74651-coinbase.com" OR destinationntdomain CONTAINS "754668948-coinbase.com" OR destinationntdomain CONTAINS "76159869-coinbase.com" OR destinationntdomain CONTAINS "76153-coinbase.com" OR destinationntdomain CONTAINS "81758-coinbase.com" OR destinationntdomain CONTAINS "81920-coinbase.com" OR destinationntdomain CONTAINS "81926-coinbase.com" OR destinationntdomain CONTAINS "81958-coinbase.com" OR destinationntdomain CONTAINS "826298-coinbase.com" OR destinationntdomain CONTAINS "83216-coinbase.com" OR destinationntdomain CONTAINS "837613-coinbase.com" OR destinationntdomain CONTAINS "83956-coinbase.com" OR destinationntdomain CONTAINS "87157-coinbase.com" OR destinationntdomain CONTAINS "87312-coinbase.com" OR destinationntdomain CONTAINS "89304-coinbase.com" OR destinationntdomain CONTAINS "89375-coinbase.com" OR destinationntdomain CONTAINS "91723-gemini.com" OR destinationntdomain CONTAINS "91752-coinbase.com")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND requesturl NOT NULL AND (requesturl CONTAINS "28676-coinbase.com" OR requesturl CONTAINS "29185-coinbase.com" OR requesturl CONTAINS "29195-coinbase.com" OR requesturl CONTAINS "2a-coinbase.com" OR requesturl CONTAINS "2b-coinbase.com" OR requesturl CONTAINS "2c-coinbase.com" OR requesturl CONTAINS "2f-coinbase.com" OR requesturl CONTAINS "2fas-coinbase.com" OR requesturl CONTAINS "2o-coinbase.com" OR requesturl CONTAINS "2r-coinbase.com" OR requesturl CONTAINS "2s-coinbase.com" OR requesturl CONTAINS "2sv-coinbase.com" OR requesturl CONTAINS "352134951-coinbase.com" OR requesturl CONTAINS "38468-coinbase.com" OR requesturl CONTAINS "39590-coinbase.com" OR requesturl CONTAINS "41260-coinbase.com" OR requesturl CONTAINS "427883-coinbase.com" OR requesturl CONTAINS "43017-coinbase.com" OR requesturl CONTAINS "47562-coinbase.com" OR requesturl CONTAINS "50195-coinbase.com" OR requesturl CONTAINS "5247-coinbase.com" OR requesturl CONTAINS "54765-coinbase.com" OR requesturl CONTAINS "57197-coinbase.com" OR requesturl CONTAINS "58176-coinbase.com" OR requesturl CONTAINS "58297-coinbase.com" OR requesturl CONTAINS "61250-coinbase.com" OR requesturl CONTAINS "61835-coinbase.com" OR requesturl CONTAINS "61851-coinbase.com" OR requesturl CONTAINS "61937-coinbase.com" OR requesturl CONTAINS "71925-coinbase.com" OR requesturl CONTAINS "72957-coinbase.com" OR requesturl CONTAINS "72985-coinbase.com" OR requesturl CONTAINS "74651-coinbase.com" OR requesturl CONTAINS "754668948-coinbase.com" OR requesturl CONTAINS "76159869-coinbase.com" OR requesturl CONTAINS "76153-coinbase.com" OR requesturl CONTAINS "81758-coinbase.com" OR requesturl CONTAINS "81920-coinbase.com" OR requesturl CONTAINS "81926-coinbase.com" OR requesturl CONTAINS "81958-coinbase.com" OR requesturl CONTAINS "826298-coinbase.com" OR requesturl CONTAINS "83216-coinbase.com" OR requesturl CONTAINS "837613-coinbase.com" OR requesturl CONTAINS "83956-coinbase.com" OR requesturl CONTAINS "87157-coinbase.com" OR requesturl CONTAINS "87312-coinbase.com" OR requesturl CONTAINS "89304-coinbase.com" OR requesturl CONTAINS "89375-coinbase.com" OR requesturl CONTAINS "91723-gemini.com" OR requesturl CONTAINS "91752-coinbase.com")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "91756-coinbase.com" OR destinationhostname CONTAINS "91782-coinbase.com" OR destinationhostname CONTAINS "91835-coinbase.com" OR destinationhostname CONTAINS "91845-coinbase.com" OR destinationhostname CONTAINS "91923-coinbase.com" OR destinationhostname CONTAINS "92758-coinbase.com" OR destinationhostname CONTAINS "948122061-coinbase.com" OR destinationhostname CONTAINS "978941-coinbase.com" OR destinationhostname CONTAINS "accountrecovery-coinbase.com" OR destinationhostname CONTAINS "action-shakepay.com" OR destinationhostname CONTAINS "adjust-coinbase.com" OR destinationhostname CONTAINS "admin-kraken.com" OR destinationhostname CONTAINS "applechargebacks.com" OR destinationhostname CONTAINS "authenticate-gemini.com" OR destinationhostname CONTAINS "authorize-gmail.com" OR destinationhostname CONTAINS "binance-okta.com" OR destinationhostname CONTAINS "captcha-coinbase.com" OR destinationhostname CONTAINS "cd-coinbase.com" OR destinationhostname CONTAINS "coinbase-heip.com" OR destinationhostname CONTAINS "coinbase-live.support" OR destinationhostname CONTAINS "coinbase-reject.com" OR destinationhostname CONTAINS "coinbase-ticket.com" OR destinationhostname CONTAINS "coinbaseheip.com" OR destinationhostname CONTAINS "com-2fa.help" OR destinationhostname CONTAINS "com-2fa.support" OR destinationhostname CONTAINS "com-3845.support" OR destinationhostname CONTAINS "com-connect.help" OR destinationhostname CONTAINS "com-fraud.support" OR destinationhostname CONTAINS "com-help.support" OR destinationhostname CONTAINS "com-reset.help" OR destinationhostname CONTAINS "com-reset.net" OR destinationhostname CONTAINS "com-ticket.live" OR destinationhostname CONTAINS "com-ticket.support" OR destinationhostname CONTAINS "contact-nexo.com" OR destinationhostname CONTAINS "convert-coinbase.com" OR destinationhostname CONTAINS "customerservice-coinbase.com" OR destinationhostname CONTAINS "default-coinbase.com" OR destinationhostname CONTAINS "defend-coinbase.com" OR destinationhostname CONTAINS "deny-coinbase.com" OR destinationhostname CONTAINS "disconnect-coinbase.com" OR destinationhostname CONTAINS "escalate-coinbase.com" OR destinationhostname CONTAINS "establish-coinbase.com" OR destinationhostname CONTAINS "fcc-okta.com" OR destinationhostname CONTAINS "fraudulent-coinbase.com" OR destinationhostname CONTAINS "guard-apple.com" OR destinationhostname CONTAINS "guard-icloud.com" OR destinationhostname CONTAINS "guardian-coinbase.com" OR destinationhostname CONTAINS "guide-gemini.com" OR destinationhostname CONTAINS "help-bitfinex.com" OR destinationhostname CONTAINS "help-shakepay.com")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "91756-coinbase.com" OR sourcentdomain CONTAINS "91782-coinbase.com" OR sourcentdomain CONTAINS "91835-coinbase.com" OR sourcentdomain CONTAINS "91845-coinbase.com" OR sourcentdomain CONTAINS "91923-coinbase.com" OR sourcentdomain CONTAINS "92758-coinbase.com" OR sourcentdomain CONTAINS "948122061-coinbase.com" OR sourcentdomain CONTAINS "978941-coinbase.com" OR sourcentdomain CONTAINS "accountrecovery-coinbase.com" OR sourcentdomain CONTAINS "action-shakepay.com" OR sourcentdomain CONTAINS "adjust-coinbase.com" OR sourcentdomain CONTAINS "admin-kraken.com" OR sourcentdomain CONTAINS "applechargebacks.com" OR sourcentdomain CONTAINS "authenticate-gemini.com" OR sourcentdomain CONTAINS "authorize-gmail.com" OR sourcentdomain CONTAINS "binance-okta.com" OR sourcentdomain CONTAINS "captcha-coinbase.com" OR sourcentdomain CONTAINS "cd-coinbase.com" OR sourcentdomain CONTAINS "coinbase-heip.com" OR sourcentdomain CONTAINS "coinbase-live.support" OR sourcentdomain CONTAINS "coinbase-reject.com" OR sourcentdomain CONTAINS "coinbase-ticket.com" OR sourcentdomain CONTAINS "coinbaseheip.com" OR sourcentdomain CONTAINS "com-2fa.help" OR sourcentdomain CONTAINS "com-2fa.support" OR sourcentdomain CONTAINS "com-3845.support" OR sourcentdomain CONTAINS "com-connect.help" OR sourcentdomain CONTAINS "com-fraud.support" OR sourcentdomain CONTAINS "com-help.support" OR sourcentdomain CONTAINS "com-reset.help" OR sourcentdomain CONTAINS "com-reset.net" OR sourcentdomain CONTAINS "com-ticket.live" OR sourcentdomain CONTAINS "com-ticket.support" OR sourcentdomain CONTAINS "contact-nexo.com" OR sourcentdomain CONTAINS "convert-coinbase.com" OR sourcentdomain CONTAINS "customerservice-coinbase.com" OR sourcentdomain CONTAINS "default-coinbase.com" OR sourcentdomain CONTAINS "defend-coinbase.com" OR sourcentdomain CONTAINS "deny-coinbase.com" OR sourcentdomain CONTAINS "disconnect-coinbase.com" OR sourcentdomain CONTAINS "escalate-coinbase.com" OR sourcentdomain CONTAINS "establish-coinbase.com" OR sourcentdomain CONTAINS "fcc-okta.com" OR sourcentdomain CONTAINS "fraudulent-coinbase.com" OR sourcentdomain CONTAINS "guard-apple.com" OR sourcentdomain CONTAINS "guard-icloud.com" OR sourcentdomain CONTAINS "guardian-coinbase.com" OR sourcentdomain CONTAINS "guide-gemini.com" OR sourcentdomain CONTAINS "help-bitfinex.com" OR sourcentdomain CONTAINS "help-shakepay.com")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "91756-coinbase.com" OR sourcehostname CONTAINS "91782-coinbase.com" OR sourcehostname CONTAINS "91835-coinbase.com" OR sourcehostname CONTAINS "91845-coinbase.com" OR sourcehostname CONTAINS "91923-coinbase.com" OR sourcehostname CONTAINS "92758-coinbase.com" OR sourcehostname CONTAINS "948122061-coinbase.com" OR sourcehostname CONTAINS "978941-coinbase.com" OR sourcehostname CONTAINS "accountrecovery-coinbase.com" OR sourcehostname CONTAINS "action-shakepay.com" OR sourcehostname CONTAINS "adjust-coinbase.com" OR sourcehostname CONTAINS "admin-kraken.com" OR sourcehostname CONTAINS "applechargebacks.com" OR sourcehostname CONTAINS "authenticate-gemini.com" OR sourcehostname CONTAINS "authorize-gmail.com" OR sourcehostname CONTAINS "binance-okta.com" OR sourcehostname CONTAINS "captcha-coinbase.com" OR sourcehostname CONTAINS "cd-coinbase.com" OR sourcehostname CONTAINS "coinbase-heip.com" OR sourcehostname CONTAINS "coinbase-live.support" OR sourcehostname CONTAINS "coinbase-reject.com" OR sourcehostname CONTAINS "coinbase-ticket.com" OR sourcehostname CONTAINS "coinbaseheip.com" OR sourcehostname CONTAINS "com-2fa.help" OR sourcehostname CONTAINS "com-2fa.support" OR sourcehostname CONTAINS "com-3845.support" OR sourcehostname CONTAINS "com-connect.help" OR sourcehostname CONTAINS "com-fraud.support" OR sourcehostname CONTAINS "com-help.support" OR sourcehostname CONTAINS "com-reset.help" OR sourcehostname CONTAINS "com-reset.net" OR sourcehostname CONTAINS "com-ticket.live" OR sourcehostname CONTAINS "com-ticket.support" OR sourcehostname CONTAINS "contact-nexo.com" OR sourcehostname CONTAINS "convert-coinbase.com" OR sourcehostname CONTAINS "customerservice-coinbase.com" OR sourcehostname CONTAINS "default-coinbase.com" OR sourcehostname CONTAINS "defend-coinbase.com" OR sourcehostname CONTAINS "deny-coinbase.com" OR sourcehostname CONTAINS "disconnect-coinbase.com" OR sourcehostname CONTAINS "escalate-coinbase.com" OR sourcehostname CONTAINS "establish-coinbase.com" OR sourcehostname CONTAINS "fcc-okta.com" OR sourcehostname CONTAINS "fraudulent-coinbase.com" OR sourcehostname CONTAINS "guard-apple.com" OR sourcehostname CONTAINS "guard-icloud.com" OR sourcehostname CONTAINS "guardian-coinbase.com" OR sourcehostname CONTAINS "guide-gemini.com" OR sourcehostname CONTAINS "help-bitfinex.com" OR sourcehostname CONTAINS "help-shakepay.com")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "91756-coinbase.com" OR destinationntdomain CONTAINS "91782-coinbase.com" OR destinationntdomain CONTAINS "91835-coinbase.com" OR destinationntdomain CONTAINS "91845-coinbase.com" OR destinationntdomain CONTAINS "91923-coinbase.com" OR destinationntdomain CONTAINS "92758-coinbase.com" OR destinationntdomain CONTAINS "948122061-coinbase.com" OR destinationntdomain CONTAINS "978941-coinbase.com" OR destinationntdomain CONTAINS "accountrecovery-coinbase.com" OR destinationntdomain CONTAINS "action-shakepay.com" OR destinationntdomain CONTAINS "adjust-coinbase.com" OR destinationntdomain CONTAINS "admin-kraken.com" OR destinationntdomain CONTAINS "applechargebacks.com" OR destinationntdomain CONTAINS "authenticate-gemini.com" OR destinationntdomain CONTAINS "authorize-gmail.com" OR destinationntdomain CONTAINS "binance-okta.com" OR destinationntdomain CONTAINS "captcha-coinbase.com" OR destinationntdomain CONTAINS "cd-coinbase.com" OR destinationntdomain CONTAINS "coinbase-heip.com" OR destinationntdomain CONTAINS "coinbase-live.support" OR destinationntdomain CONTAINS "coinbase-reject.com" OR destinationntdomain CONTAINS "coinbase-ticket.com" OR destinationntdomain CONTAINS "coinbaseheip.com" OR destinationntdomain CONTAINS "com-2fa.help" OR destinationntdomain CONTAINS "com-2fa.support" OR destinationntdomain CONTAINS "com-3845.support" OR destinationntdomain CONTAINS "com-connect.help" OR destinationntdomain CONTAINS "com-fraud.support" OR destinationntdomain CONTAINS "com-help.support" OR destinationntdomain CONTAINS "com-reset.help" OR destinationntdomain CONTAINS "com-reset.net" OR destinationntdomain CONTAINS "com-ticket.live" OR destinationntdomain CONTAINS "com-ticket.support" OR destinationntdomain CONTAINS "contact-nexo.com" OR destinationntdomain CONTAINS "convert-coinbase.com" OR destinationntdomain CONTAINS "customerservice-coinbase.com" OR destinationntdomain CONTAINS "default-coinbase.com" OR destinationntdomain CONTAINS "defend-coinbase.com" OR destinationntdomain CONTAINS "deny-coinbase.com" OR destinationntdomain CONTAINS "disconnect-coinbase.com" OR destinationntdomain CONTAINS "escalate-coinbase.com" OR destinationntdomain CONTAINS "establish-coinbase.com" OR destinationntdomain CONTAINS "fcc-okta.com" OR destinationntdomain CONTAINS "fraudulent-coinbase.com" OR destinationntdomain CONTAINS "guard-apple.com" OR destinationntdomain CONTAINS "guard-icloud.com" OR destinationntdomain CONTAINS "guardian-coinbase.com" OR destinationntdomain CONTAINS "guide-gemini.com" OR destinationntdomain CONTAINS "help-bitfinex.com" OR destinationntdomain CONTAINS "help-shakepay.com")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND requesturl NOT NULL AND (requesturl CONTAINS "91756-coinbase.com" OR requesturl CONTAINS "91782-coinbase.com" OR requesturl CONTAINS "91835-coinbase.com" OR requesturl CONTAINS "91845-coinbase.com" OR requesturl CONTAINS "91923-coinbase.com" OR requesturl CONTAINS "92758-coinbase.com" OR requesturl CONTAINS "948122061-coinbase.com" OR requesturl CONTAINS "978941-coinbase.com" OR requesturl CONTAINS "accountrecovery-coinbase.com" OR requesturl CONTAINS "action-shakepay.com" OR requesturl CONTAINS "adjust-coinbase.com" OR requesturl CONTAINS "admin-kraken.com" OR requesturl CONTAINS "applechargebacks.com" OR requesturl CONTAINS "authenticate-gemini.com" OR requesturl CONTAINS "authorize-gmail.com" OR requesturl CONTAINS "binance-okta.com" OR requesturl CONTAINS "captcha-coinbase.com" OR requesturl CONTAINS "cd-coinbase.com" OR requesturl CONTAINS "coinbase-heip.com" OR requesturl CONTAINS "coinbase-live.support" OR requesturl CONTAINS "coinbase-reject.com" OR requesturl CONTAINS "coinbase-ticket.com" OR requesturl CONTAINS "coinbaseheip.com" OR requesturl CONTAINS "com-2fa.help" OR requesturl CONTAINS "com-2fa.support" OR requesturl CONTAINS "com-3845.support" OR requesturl CONTAINS "com-connect.help" OR requesturl CONTAINS "com-fraud.support" OR requesturl CONTAINS "com-help.support" OR requesturl CONTAINS "com-reset.help" OR requesturl CONTAINS "com-reset.net" OR requesturl CONTAINS "com-ticket.live" OR requesturl CONTAINS "com-ticket.support" OR requesturl CONTAINS "contact-nexo.com" OR requesturl CONTAINS "convert-coinbase.com" OR requesturl CONTAINS "customerservice-coinbase.com" OR requesturl CONTAINS "default-coinbase.com" OR requesturl CONTAINS "defend-coinbase.com" OR requesturl CONTAINS "deny-coinbase.com" OR requesturl CONTAINS "disconnect-coinbase.com" OR requesturl CONTAINS "escalate-coinbase.com" OR requesturl CONTAINS "establish-coinbase.com" OR requesturl CONTAINS "fcc-okta.com" OR requesturl CONTAINS "fraudulent-coinbase.com" OR requesturl CONTAINS "guard-apple.com" OR requesturl CONTAINS "guard-icloud.com" OR requesturl CONTAINS "guardian-coinbase.com" OR requesturl CONTAINS "guide-gemini.com" OR requesturl CONTAINS "help-bitfinex.com" OR requesturl CONTAINS "help-shakepay.com")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "helpdesk-apple.com" OR destinationhostname CONTAINS "helpdesk-gemini.com" OR destinationhostname CONTAINS "helpdesk-icloud.com" OR destinationhostname CONTAINS "identification-coinbase.com" OR destinationhostname CONTAINS "lockdown-coinbase.com" OR destinationhostname CONTAINS "login-nexo.com" OR destinationhostname CONTAINS "keys-coinbase.com" OR destinationhostname CONTAINS "messages-coinbase.com" OR destinationhostname CONTAINS "newpassword-coinbase.com" OR destinationhostname CONTAINS "prompt-coinbase.com" OR destinationhostname CONTAINS "protect-apple.com" OR destinationhostname CONTAINS "protect-coinbase.com" OR destinationhostname CONTAINS "protect-gmail.com" OR destinationhostname CONTAINS "protect-kraken.com" OR destinationhostname CONTAINS "recoverme-coinbase.com" OR destinationhostname CONTAINS "recoveryportal-coinbase.com" OR destinationhostname CONTAINS "refunds-coinbase.com" OR destinationhostname CONTAINS "reset-okta.com" OR destinationhostname CONTAINS "restore-coinbase.com" OR destinationhostname CONTAINS "return-coinbase.com" OR destinationhostname CONTAINS "reverts-coinbase.com" OR destinationhostname CONTAINS "secure-binance.us" OR destinationhostname CONTAINS "secure-icloud.com" OR destinationhostname CONTAINS "secure-nexo.com" OR destinationhostname CONTAINS "secure-shakepay.com" OR destinationhostname CONTAINS "security-umusic.com" OR destinationhostname CONTAINS "server694590423.tech" OR destinationhostname CONTAINS "session-coinbase.com" OR destinationhostname CONTAINS "startrecovery-coinbase.com" OR destinationhostname CONTAINS "signin-kraken.com" OR destinationhostname CONTAINS "suite-trezor.io" OR destinationhostname CONTAINS "supportportal-coinbase.com" OR destinationhostname CONTAINS "tech-icloud.com" OR destinationhostname CONTAINS "threat-coinbase.com" OR destinationhostname CONTAINS "ticket-apple.com" OR destinationhostname CONTAINS "ticket-coinbase.com" OR destinationhostname CONTAINS "tickets-apple.com" OR destinationhostname CONTAINS "tokens-coinbase.com" OR destinationhostname CONTAINS "unblock-coinbase.com" OR destinationhostname CONTAINS "unlink-coinbase.com" OR destinationhostname CONTAINS "your-coinbase.com" OR destinationhostname CONTAINS "welcome-coinbase.com" OR destinationhostname CONTAINS "www-coinbasewallet.com" OR destinationhostname CONTAINS "www-help-coinbase.com" OR destinationhostname CONTAINS "www-help-gemini.com")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "helpdesk-apple.com" OR sourcentdomain CONTAINS "helpdesk-gemini.com" OR sourcentdomain CONTAINS "helpdesk-icloud.com" OR sourcentdomain CONTAINS "identification-coinbase.com" OR sourcentdomain CONTAINS "lockdown-coinbase.com" OR sourcentdomain CONTAINS "login-nexo.com" OR sourcentdomain CONTAINS "keys-coinbase.com" OR sourcentdomain CONTAINS "messages-coinbase.com" OR sourcentdomain CONTAINS "newpassword-coinbase.com" OR sourcentdomain CONTAINS "prompt-coinbase.com" OR sourcentdomain CONTAINS "protect-apple.com" OR sourcentdomain CONTAINS "protect-coinbase.com" OR sourcentdomain CONTAINS "protect-gmail.com" OR sourcentdomain CONTAINS "protect-kraken.com" OR sourcentdomain CONTAINS "recoverme-coinbase.com" OR sourcentdomain CONTAINS "recoveryportal-coinbase.com" OR sourcentdomain CONTAINS "refunds-coinbase.com" OR sourcentdomain CONTAINS "reset-okta.com" OR sourcentdomain CONTAINS "restore-coinbase.com" OR sourcentdomain CONTAINS "return-coinbase.com" OR sourcentdomain CONTAINS "reverts-coinbase.com" OR sourcentdomain CONTAINS "secure-binance.us" OR sourcentdomain CONTAINS "secure-icloud.com" OR sourcentdomain CONTAINS "secure-nexo.com" OR sourcentdomain CONTAINS "secure-shakepay.com" OR sourcentdomain CONTAINS "security-umusic.com" OR sourcentdomain CONTAINS "server694590423.tech" OR sourcentdomain CONTAINS "session-coinbase.com" OR sourcentdomain CONTAINS "startrecovery-coinbase.com" OR sourcentdomain CONTAINS "signin-kraken.com" OR sourcentdomain CONTAINS "suite-trezor.io" OR sourcentdomain CONTAINS "supportportal-coinbase.com" OR sourcentdomain CONTAINS "tech-icloud.com" OR sourcentdomain CONTAINS "threat-coinbase.com" OR sourcentdomain CONTAINS "ticket-apple.com" OR sourcentdomain CONTAINS "ticket-coinbase.com" OR sourcentdomain CONTAINS "tickets-apple.com" OR sourcentdomain CONTAINS "tokens-coinbase.com" OR sourcentdomain CONTAINS "unblock-coinbase.com" OR sourcentdomain CONTAINS "unlink-coinbase.com" OR sourcentdomain CONTAINS "your-coinbase.com" OR sourcentdomain CONTAINS "welcome-coinbase.com" OR sourcentdomain CONTAINS "www-coinbasewallet.com" OR sourcentdomain CONTAINS "www-help-coinbase.com" OR sourcentdomain CONTAINS "www-help-gemini.com")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "helpdesk-apple.com" OR sourcehostname CONTAINS "helpdesk-gemini.com" OR sourcehostname CONTAINS "helpdesk-icloud.com" OR sourcehostname CONTAINS "identification-coinbase.com" OR sourcehostname CONTAINS "lockdown-coinbase.com" OR sourcehostname CONTAINS "login-nexo.com" OR sourcehostname CONTAINS "keys-coinbase.com" OR sourcehostname CONTAINS "messages-coinbase.com" OR sourcehostname CONTAINS "newpassword-coinbase.com" OR sourcehostname CONTAINS "prompt-coinbase.com" OR sourcehostname CONTAINS "protect-apple.com" OR sourcehostname CONTAINS "protect-coinbase.com" OR sourcehostname CONTAINS "protect-gmail.com" OR sourcehostname CONTAINS "protect-kraken.com" OR sourcehostname CONTAINS "recoverme-coinbase.com" OR sourcehostname CONTAINS "recoveryportal-coinbase.com" OR sourcehostname CONTAINS "refunds-coinbase.com" OR sourcehostname CONTAINS "reset-okta.com" OR sourcehostname CONTAINS "restore-coinbase.com" OR sourcehostname CONTAINS "return-coinbase.com" OR sourcehostname CONTAINS "reverts-coinbase.com" OR sourcehostname CONTAINS "secure-binance.us" OR sourcehostname CONTAINS "secure-icloud.com" OR sourcehostname CONTAINS "secure-nexo.com" OR sourcehostname CONTAINS "secure-shakepay.com" OR sourcehostname CONTAINS "security-umusic.com" OR sourcehostname CONTAINS "server694590423.tech" OR sourcehostname CONTAINS "session-coinbase.com" OR sourcehostname CONTAINS "startrecovery-coinbase.com" OR sourcehostname CONTAINS "signin-kraken.com" OR sourcehostname CONTAINS "suite-trezor.io" OR sourcehostname CONTAINS "supportportal-coinbase.com" OR sourcehostname CONTAINS "tech-icloud.com" OR sourcehostname CONTAINS "threat-coinbase.com" OR sourcehostname CONTAINS "ticket-apple.com" OR sourcehostname CONTAINS "ticket-coinbase.com" OR sourcehostname CONTAINS "tickets-apple.com" OR sourcehostname CONTAINS "tokens-coinbase.com" OR sourcehostname CONTAINS "unblock-coinbase.com" OR sourcehostname CONTAINS "unlink-coinbase.com" OR sourcehostname CONTAINS "your-coinbase.com" OR sourcehostname CONTAINS "welcome-coinbase.com" OR sourcehostname CONTAINS "www-coinbasewallet.com" OR sourcehostname CONTAINS "www-help-coinbase.com" OR sourcehostname CONTAINS "www-help-gemini.com")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "helpdesk-apple.com" OR destinationntdomain CONTAINS "helpdesk-gemini.com" OR destinationntdomain CONTAINS "helpdesk-icloud.com" OR destinationntdomain CONTAINS "identification-coinbase.com" OR destinationntdomain CONTAINS "lockdown-coinbase.com" OR destinationntdomain CONTAINS "login-nexo.com" OR destinationntdomain CONTAINS "keys-coinbase.com" OR destinationntdomain CONTAINS "messages-coinbase.com" OR destinationntdomain CONTAINS "newpassword-coinbase.com" OR destinationntdomain CONTAINS "prompt-coinbase.com" OR destinationntdomain CONTAINS "protect-apple.com" OR destinationntdomain CONTAINS "protect-coinbase.com" OR destinationntdomain CONTAINS "protect-gmail.com" OR destinationntdomain CONTAINS "protect-kraken.com" OR destinationntdomain CONTAINS "recoverme-coinbase.com" OR destinationntdomain CONTAINS "recoveryportal-coinbase.com" OR destinationntdomain CONTAINS "refunds-coinbase.com" OR destinationntdomain CONTAINS "reset-okta.com" OR destinationntdomain CONTAINS "restore-coinbase.com" OR destinationntdomain CONTAINS "return-coinbase.com" OR destinationntdomain CONTAINS "reverts-coinbase.com" OR destinationntdomain CONTAINS "secure-binance.us" OR destinationntdomain CONTAINS "secure-icloud.com" OR destinationntdomain CONTAINS "secure-nexo.com" OR destinationntdomain CONTAINS "secure-shakepay.com" OR destinationntdomain CONTAINS "security-umusic.com" OR destinationntdomain CONTAINS "server694590423.tech" OR destinationntdomain CONTAINS "session-coinbase.com" OR destinationntdomain CONTAINS "startrecovery-coinbase.com" OR destinationntdomain CONTAINS "signin-kraken.com" OR destinationntdomain CONTAINS "suite-trezor.io" OR destinationntdomain CONTAINS "supportportal-coinbase.com" OR destinationntdomain CONTAINS "tech-icloud.com" OR destinationntdomain CONTAINS "threat-coinbase.com" OR destinationntdomain CONTAINS "ticket-apple.com" OR destinationntdomain CONTAINS "ticket-coinbase.com" OR destinationntdomain CONTAINS "tickets-apple.com" OR destinationntdomain CONTAINS "tokens-coinbase.com" OR destinationntdomain CONTAINS "unblock-coinbase.com" OR destinationntdomain CONTAINS "unlink-coinbase.com" OR destinationntdomain CONTAINS "your-coinbase.com" OR destinationntdomain CONTAINS "welcome-coinbase.com" OR destinationntdomain CONTAINS "www-coinbasewallet.com" OR destinationntdomain CONTAINS "www-help-coinbase.com" OR destinationntdomain CONTAINS "www-help-gemini.com")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND requesturl NOT NULL AND (requesturl CONTAINS "helpdesk-apple.com" OR requesturl CONTAINS "helpdesk-gemini.com" OR requesturl CONTAINS "helpdesk-icloud.com" OR requesturl CONTAINS "identification-coinbase.com" OR requesturl CONTAINS "lockdown-coinbase.com" OR requesturl CONTAINS "login-nexo.com" OR requesturl CONTAINS "keys-coinbase.com" OR requesturl CONTAINS "messages-coinbase.com" OR requesturl CONTAINS "newpassword-coinbase.com" OR requesturl CONTAINS "prompt-coinbase.com" OR requesturl CONTAINS "protect-apple.com" OR requesturl CONTAINS "protect-coinbase.com" OR requesturl CONTAINS "protect-gmail.com" OR requesturl CONTAINS "protect-kraken.com" OR requesturl CONTAINS "recoverme-coinbase.com" OR requesturl CONTAINS "recoveryportal-coinbase.com" OR requesturl CONTAINS "refunds-coinbase.com" OR requesturl CONTAINS "reset-okta.com" OR requesturl CONTAINS "restore-coinbase.com" OR requesturl CONTAINS "return-coinbase.com" OR requesturl CONTAINS "reverts-coinbase.com" OR requesturl CONTAINS "secure-binance.us" OR requesturl CONTAINS "secure-icloud.com" OR requesturl CONTAINS "secure-nexo.com" OR requesturl CONTAINS "secure-shakepay.com" OR requesturl CONTAINS "security-umusic.com" OR requesturl CONTAINS "server694590423.tech" OR requesturl CONTAINS "session-coinbase.com" OR requesturl CONTAINS "startrecovery-coinbase.com" OR requesturl CONTAINS "signin-kraken.com" OR requesturl CONTAINS "suite-trezor.io" OR requesturl CONTAINS "supportportal-coinbase.com" OR requesturl CONTAINS "tech-icloud.com" OR requesturl CONTAINS "threat-coinbase.com" OR requesturl CONTAINS "ticket-apple.com" OR requesturl CONTAINS "ticket-coinbase.com" OR requesturl CONTAINS "tickets-apple.com" OR requesturl CONTAINS "tokens-coinbase.com" OR requesturl CONTAINS "unblock-coinbase.com" OR requesturl CONTAINS "unlink-coinbase.com" OR requesturl CONTAINS "your-coinbase.com" OR requesturl CONTAINS "welcome-coinbase.com" OR requesturl CONTAINS "www-coinbasewallet.com" OR requesturl CONTAINS "www-help-coinbase.com" OR requesturl CONTAINS "www-help-gemini.com")
index=activity AND rg_functionality="Unix / Linux / AIX" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "official-server.com" OR destinationhostname CONTAINS "server694590423.tech" OR destinationhostname CONTAINS "island-placid-bromine.glitch.me" OR destinationhostname CONTAINS "circular-noon-farmhouse.glitch.me" OR destinationhostname CONTAINS "talented-friendly-price.glitch.me" OR destinationhostname CONTAINS "dflfmgsdokasdcpl.com" OR destinationhostname CONTAINS "original-backend.com" OR destinationhostname CONTAINS "07159889-coinbase.com" OR destinationhostname CONTAINS "10195-coinbase.com" OR destinationhostname CONTAINS "11246-coinbase.com" OR destinationhostname CONTAINS "11247-coinbase.com" OR destinationhostname CONTAINS "11248-coinbase.com" OR destinationhostname CONTAINS "11258-coinbase.com" OR destinationhostname CONTAINS "11259-coinbase.com" OR destinationhostname CONTAINS "113912-coinbase.com" OR destinationhostname CONTAINS "11472-coinbase.com" OR destinationhostname CONTAINS "11923-coinbase.com" OR destinationhostname CONTAINS "11957-coinbase.com" OR destinationhostname CONTAINS "128147-coinbase.com" OR destinationhostname CONTAINS "12958-coinbase.com" OR destinationhostname CONTAINS "12984-okta.com" OR destinationhostname CONTAINS "12985-coinbase.com" OR destinationhostname CONTAINS "13130-coinbase.com" OR destinationhostname CONTAINS "13247-coinbase.com" OR destinationhostname CONTAINS "13247-icloud.com" OR destinationhostname CONTAINS "13267-coinbase.com" OR destinationhostname CONTAINS "146271510-coinbase.com" OR destinationhostname CONTAINS "146282-coinbase.com" OR destinationhostname CONTAINS "146284-coinbase.com" OR destinationhostname CONTAINS "147260-coinbase.com" OR destinationhostname CONTAINS "14765-coinbase.com" OR destinationhostname CONTAINS "14817582-coinbase.com" OR destinationhostname CONTAINS "14871904-coinbase.com" OR destinationhostname CONTAINS "14891902-coinbase.com" OR destinationhostname CONTAINS "1492864-coinbase.com" OR destinationhostname CONTAINS "158312-coinbase.com" OR destinationhostname CONTAINS "158372-coinbase.com" OR destinationhostname CONTAINS "158702-coinbase.com" OR destinationhostname CONTAINS "16171675-coinbase.com" OR destinationhostname CONTAINS "16171832-coinbase.com" OR destinationhostname CONTAINS "16178234-coinbase.com" OR destinationhostname CONTAINS "16178237-coinbase.com" OR destinationhostname CONTAINS "16178434-coinbase.com" OR destinationhostname CONTAINS "162178-coinbase.com" OR destinationhostname CONTAINS "162478-coinbase.com" OR destinationhostname CONTAINS "162782-coinbase.com" OR destinationhostname CONTAINS "162812-coinbase.com" OR destinationhostname CONTAINS "162814-coinbase.com" OR destinationhostname CONTAINS "16442580-coinbase.com" OR destinationhostname CONTAINS "16450107-coinbase.com")
index=activity AND rg_functionality="Unix / Linux / AIX" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "official-server.com" OR sourcentdomain CONTAINS "server694590423.tech" OR sourcentdomain CONTAINS "island-placid-bromine.glitch.me" OR sourcentdomain CONTAINS "circular-noon-farmhouse.glitch.me" OR sourcentdomain CONTAINS "talented-friendly-price.glitch.me" OR sourcentdomain CONTAINS "dflfmgsdokasdcpl.com" OR sourcentdomain CONTAINS "original-backend.com" OR sourcentdomain CONTAINS "07159889-coinbase.com" OR sourcentdomain CONTAINS "10195-coinbase.com" OR sourcentdomain CONTAINS "11246-coinbase.com" OR sourcentdomain CONTAINS "11247-coinbase.com" OR sourcentdomain CONTAINS "11248-coinbase.com" OR sourcentdomain CONTAINS "11258-coinbase.com" OR sourcentdomain CONTAINS "11259-coinbase.com" OR sourcentdomain CONTAINS "113912-coinbase.com" OR sourcentdomain CONTAINS "11472-coinbase.com" OR sourcentdomain CONTAINS "11923-coinbase.com" OR sourcentdomain CONTAINS "11957-coinbase.com" OR sourcentdomain CONTAINS "128147-coinbase.com" OR sourcentdomain CONTAINS "12958-coinbase.com" OR sourcentdomain CONTAINS "12984-okta.com" OR sourcentdomain CONTAINS "12985-coinbase.com" OR sourcentdomain CONTAINS "13130-coinbase.com" OR sourcentdomain CONTAINS "13247-coinbase.com" OR sourcentdomain CONTAINS "13247-icloud.com" OR sourcentdomain CONTAINS "13267-coinbase.com" OR sourcentdomain CONTAINS "146271510-coinbase.com" OR sourcentdomain CONTAINS "146282-coinbase.com" OR sourcentdomain CONTAINS "146284-coinbase.com" OR sourcentdomain CONTAINS "147260-coinbase.com" OR sourcentdomain CONTAINS "14765-coinbase.com" OR sourcentdomain CONTAINS "14817582-coinbase.com" OR sourcentdomain CONTAINS "14871904-coinbase.com" OR sourcentdomain CONTAINS "14891902-coinbase.com" OR sourcentdomain CONTAINS "1492864-coinbase.com" OR sourcentdomain CONTAINS "158312-coinbase.com" OR sourcentdomain CONTAINS "158372-coinbase.com" OR sourcentdomain CONTAINS "158702-coinbase.com" OR sourcentdomain CONTAINS "16171675-coinbase.com" OR sourcentdomain CONTAINS "16171832-coinbase.com" OR sourcentdomain CONTAINS "16178234-coinbase.com" OR sourcentdomain CONTAINS "16178237-coinbase.com" OR sourcentdomain CONTAINS "16178434-coinbase.com" OR sourcentdomain CONTAINS "162178-coinbase.com" OR sourcentdomain CONTAINS "162478-coinbase.com" OR sourcentdomain CONTAINS "162782-coinbase.com" OR sourcentdomain CONTAINS "162812-coinbase.com" OR sourcentdomain CONTAINS "162814-coinbase.com" OR sourcentdomain CONTAINS "16442580-coinbase.com" OR sourcentdomain CONTAINS "16450107-coinbase.com")
index=activity AND rg_functionality="Unix / Linux / AIX" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "official-server.com" OR sourcehostname CONTAINS "server694590423.tech" OR sourcehostname CONTAINS "island-placid-bromine.glitch.me" OR sourcehostname CONTAINS "circular-noon-farmhouse.glitch.me" OR sourcehostname CONTAINS "talented-friendly-price.glitch.me" OR sourcehostname CONTAINS "dflfmgsdokasdcpl.com" OR sourcehostname CONTAINS "original-backend.com" OR sourcehostname CONTAINS "07159889-coinbase.com" OR sourcehostname CONTAINS "10195-coinbase.com" OR sourcehostname CONTAINS "11246-coinbase.com" OR sourcehostname CONTAINS "11247-coinbase.com" OR sourcehostname CONTAINS "11248-coinbase.com" OR sourcehostname CONTAINS "11258-coinbase.com" OR sourcehostname CONTAINS "11259-coinbase.com" OR sourcehostname CONTAINS "113912-coinbase.com" OR sourcehostname CONTAINS "11472-coinbase.com" OR sourcehostname CONTAINS "11923-coinbase.com" OR sourcehostname CONTAINS "11957-coinbase.com" OR sourcehostname CONTAINS "128147-coinbase.com" OR sourcehostname CONTAINS "12958-coinbase.com" OR sourcehostname CONTAINS "12984-okta.com" OR sourcehostname CONTAINS "12985-coinbase.com" OR sourcehostname CONTAINS "13130-coinbase.com" OR sourcehostname CONTAINS "13247-coinbase.com" OR sourcehostname CONTAINS "13247-icloud.com" OR sourcehostname CONTAINS "13267-coinbase.com" OR sourcehostname CONTAINS "146271510-coinbase.com" OR sourcehostname CONTAINS "146282-coinbase.com" OR sourcehostname CONTAINS "146284-coinbase.com" OR sourcehostname CONTAINS "147260-coinbase.com" OR sourcehostname CONTAINS "14765-coinbase.com" OR sourcehostname CONTAINS "14817582-coinbase.com" OR sourcehostname CONTAINS "14871904-coinbase.com" OR sourcehostname CONTAINS "14891902-coinbase.com" OR sourcehostname CONTAINS "1492864-coinbase.com" OR sourcehostname CONTAINS "158312-coinbase.com" OR sourcehostname CONTAINS "158372-coinbase.com" OR sourcehostname CONTAINS "158702-coinbase.com" OR sourcehostname CONTAINS "16171675-coinbase.com" OR sourcehostname CONTAINS "16171832-coinbase.com" OR sourcehostname CONTAINS "16178234-coinbase.com" OR sourcehostname CONTAINS "16178237-coinbase.com" OR sourcehostname CONTAINS "16178434-coinbase.com" OR sourcehostname CONTAINS "162178-coinbase.com" OR sourcehostname CONTAINS "162478-coinbase.com" OR sourcehostname CONTAINS "162782-coinbase.com" OR sourcehostname CONTAINS "162812-coinbase.com" OR sourcehostname CONTAINS "162814-coinbase.com" OR sourcehostname CONTAINS "16442580-coinbase.com" OR sourcehostname CONTAINS "16450107-coinbase.com")
index=activity AND rg_functionality="Unix / Linux / AIX" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "official-server.com" OR destinationntdomain CONTAINS "server694590423.tech" OR destinationntdomain CONTAINS "island-placid-bromine.glitch.me" OR destinationntdomain CONTAINS "circular-noon-farmhouse.glitch.me" OR destinationntdomain CONTAINS "talented-friendly-price.glitch.me" OR destinationntdomain CONTAINS "dflfmgsdokasdcpl.com" OR destinationntdomain CONTAINS "original-backend.com" OR destinationntdomain CONTAINS "07159889-coinbase.com" OR destinationntdomain CONTAINS "10195-coinbase.com" OR destinationntdomain CONTAINS "11246-coinbase.com" OR destinationntdomain CONTAINS "11247-coinbase.com" OR destinationntdomain CONTAINS "11248-coinbase.com" OR destinationntdomain CONTAINS "11258-coinbase.com" OR destinationntdomain CONTAINS "11259-coinbase.com" OR destinationntdomain CONTAINS "113912-coinbase.com" OR destinationntdomain CONTAINS "11472-coinbase.com" OR destinationntdomain CONTAINS "11923-coinbase.com" OR destinationntdomain CONTAINS "11957-coinbase.com" OR destinationntdomain CONTAINS "128147-coinbase.com" OR destinationntdomain CONTAINS "12958-coinbase.com" OR destinationntdomain CONTAINS "12984-okta.com" OR destinationntdomain CONTAINS "12985-coinbase.com" OR destinationntdomain CONTAINS "13130-coinbase.com" OR destinationntdomain CONTAINS "13247-coinbase.com" OR destinationntdomain CONTAINS "13247-icloud.com" OR destinationntdomain CONTAINS "13267-coinbase.com" OR destinationntdomain CONTAINS "146271510-coinbase.com" OR destinationntdomain CONTAINS "146282-coinbase.com" OR destinationntdomain CONTAINS "146284-coinbase.com" OR destinationntdomain CONTAINS "147260-coinbase.com" OR destinationntdomain CONTAINS "14765-coinbase.com" OR destinationntdomain CONTAINS "14817582-coinbase.com" OR destinationntdomain CONTAINS "14871904-coinbase.com" OR destinationntdomain CONTAINS "14891902-coinbase.com" OR destinationntdomain CONTAINS "1492864-coinbase.com" OR destinationntdomain CONTAINS "158312-coinbase.com" OR destinationntdomain CONTAINS "158372-coinbase.com" OR destinationntdomain CONTAINS "158702-coinbase.com" OR destinationntdomain CONTAINS "16171675-coinbase.com" OR destinationntdomain CONTAINS "16171832-coinbase.com" OR destinationntdomain CONTAINS "16178234-coinbase.com" OR destinationntdomain CONTAINS "16178237-coinbase.com" OR destinationntdomain CONTAINS "16178434-coinbase.com" OR destinationntdomain CONTAINS "162178-coinbase.com" OR destinationntdomain CONTAINS "162478-coinbase.com" OR destinationntdomain CONTAINS "162782-coinbase.com" OR destinationntdomain CONTAINS "162812-coinbase.com" OR destinationntdomain CONTAINS "162814-coinbase.com" OR destinationntdomain CONTAINS "16442580-coinbase.com" OR destinationntdomain CONTAINS "16450107-coinbase.com")
index=activity AND rg_functionality="Unix / Linux / AIX" AND requesturl NOT NULL AND (requesturl CONTAINS "official-server.com" OR requesturl CONTAINS "server694590423.tech" OR requesturl CONTAINS "island-placid-bromine.glitch.me" OR requesturl CONTAINS "circular-noon-farmhouse.glitch.me" OR requesturl CONTAINS "talented-friendly-price.glitch.me" OR requesturl CONTAINS "dflfmgsdokasdcpl.com" OR requesturl CONTAINS "original-backend.com" OR requesturl CONTAINS "07159889-coinbase.com" OR requesturl CONTAINS "10195-coinbase.com" OR requesturl CONTAINS "11246-coinbase.com" OR requesturl CONTAINS "11247-coinbase.com" OR requesturl CONTAINS "11248-coinbase.com" OR requesturl CONTAINS "11258-coinbase.com" OR requesturl CONTAINS "11259-coinbase.com" OR requesturl CONTAINS "113912-coinbase.com" OR requesturl CONTAINS "11472-coinbase.com" OR requesturl CONTAINS "11923-coinbase.com" OR requesturl CONTAINS "11957-coinbase.com" OR requesturl CONTAINS "128147-coinbase.com" OR requesturl CONTAINS "12958-coinbase.com" OR requesturl CONTAINS "12984-okta.com" OR requesturl CONTAINS "12985-coinbase.com" OR requesturl CONTAINS "13130-coinbase.com" OR requesturl CONTAINS "13247-coinbase.com" OR requesturl CONTAINS "13247-icloud.com" OR requesturl CONTAINS "13267-coinbase.com" OR requesturl CONTAINS "146271510-coinbase.com" OR requesturl CONTAINS "146282-coinbase.com" OR requesturl CONTAINS "146284-coinbase.com" OR requesturl CONTAINS "147260-coinbase.com" OR requesturl CONTAINS "14765-coinbase.com" OR requesturl CONTAINS "14817582-coinbase.com" OR requesturl CONTAINS "14871904-coinbase.com" OR requesturl CONTAINS "14891902-coinbase.com" OR requesturl CONTAINS "1492864-coinbase.com" OR requesturl CONTAINS "158312-coinbase.com" OR requesturl CONTAINS "158372-coinbase.com" OR requesturl CONTAINS "158702-coinbase.com" OR requesturl CONTAINS "16171675-coinbase.com" OR requesturl CONTAINS "16171832-coinbase.com" OR requesturl CONTAINS "16178234-coinbase.com" OR requesturl CONTAINS "16178237-coinbase.com" OR requesturl CONTAINS "16178434-coinbase.com" OR requesturl CONTAINS "162178-coinbase.com" OR requesturl CONTAINS "162478-coinbase.com" OR requesturl CONTAINS "162782-coinbase.com" OR requesturl CONTAINS "162812-coinbase.com" OR requesturl CONTAINS "162814-coinbase.com" OR requesturl CONTAINS "16442580-coinbase.com" OR requesturl CONTAINS "16450107-coinbase.com")
index=activity AND rg_functionality="Unix / Linux / AIX" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "16450207-coinbase.com" OR destinationhostname CONTAINS "16458207-coinbase.com" OR destinationhostname CONTAINS "16478202-coinbase.com" OR destinationhostname CONTAINS "164872942-coinbase.com" OR destinationhostname CONTAINS "16590-coinbase.com" OR destinationhostname CONTAINS "16594373-coinbase.com" OR destinationhostname CONTAINS "16624831-coinbase.com" OR destinationhostname CONTAINS "16642124-coinbase.com" OR destinationhostname CONTAINS "16642172-coinbase.com" OR destinationhostname CONTAINS "16642580-coinbase.com" OR destinationhostname CONTAINS "16642721-coinbase.com" OR destinationhostname CONTAINS "16642724-coinbase.com" OR destinationhostname CONTAINS "16642871-coinbase.com" OR destinationhostname CONTAINS "16642872-coinbase.com" OR destinationhostname CONTAINS "16712942-coinbase.com" OR destinationhostname CONTAINS "16718672-coinbase.com" OR destinationhostname CONTAINS "16728342-coinbase.com" OR destinationhostname CONTAINS "16728348-coinbase.com" OR destinationhostname CONTAINS "16728442-coinbase.com" OR destinationhostname CONTAINS "16728472-coinbase.com" OR destinationhostname CONTAINS "167285-coinbase.com" OR destinationhostname CONTAINS "16729042-coinbase.com" OR destinationhostname CONTAINS "16748272-coinbase.com" OR destinationhostname CONTAINS "16782942-coinbase.com" OR destinationhostname CONTAINS "16827420-coinbase.com" OR destinationhostname CONTAINS "16827423-coinbase.com" OR destinationhostname CONTAINS "16847145-coinbase.com" OR destinationhostname CONTAINS "16893924-coinbase.com" OR destinationhostname CONTAINS "17182-coinbase.com" OR destinationhostname CONTAINS "17255030-coinbase.com" OR destinationhostname CONTAINS "17259-kraken.com" OR destinationhostname CONTAINS "172486-coinbase.com" OR destinationhostname CONTAINS "17284652-coinbase.com" OR destinationhostname CONTAINS "17286-coinbase.com" OR destinationhostname CONTAINS "17334522-coinbase.com" OR destinationhostname CONTAINS "17334522-kraken.com" OR destinationhostname CONTAINS "17384522-coinbase.com" OR destinationhostname CONTAINS "173912-coinbase.com" OR destinationhostname CONTAINS "17494976-coinbase.com" OR destinationhostname CONTAINS "17512854-coinbase.com" OR destinationhostname CONTAINS "17512857-coinbase.com" OR destinationhostname CONTAINS "1751954-coinbase.com" OR destinationhostname CONTAINS "17525030-coinbase.com" OR destinationhostname CONTAINS "17529580-coinbase.com" OR destinationhostname CONTAINS "17614-coinbase.com" OR destinationhostname CONTAINS "17618412-coinbase.com" OR destinationhostname CONTAINS "17619-coinbase.com" OR destinationhostname CONTAINS "176284-coinbase.com" OR destinationhostname CONTAINS "17823920-coinbase.com" OR destinationhostname CONTAINS "178253-coinbase.com")
index=activity AND rg_functionality="Unix / Linux / AIX" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "16450207-coinbase.com" OR sourcentdomain CONTAINS "16458207-coinbase.com" OR sourcentdomain CONTAINS "16478202-coinbase.com" OR sourcentdomain CONTAINS "164872942-coinbase.com" OR sourcentdomain CONTAINS "16590-coinbase.com" OR sourcentdomain CONTAINS "16594373-coinbase.com" OR sourcentdomain CONTAINS "16624831-coinbase.com" OR sourcentdomain CONTAINS "16642124-coinbase.com" OR sourcentdomain CONTAINS "16642172-coinbase.com" OR sourcentdomain CONTAINS "16642580-coinbase.com" OR sourcentdomain CONTAINS "16642721-coinbase.com" OR sourcentdomain CONTAINS "16642724-coinbase.com" OR sourcentdomain CONTAINS "16642871-coinbase.com" OR sourcentdomain CONTAINS "16642872-coinbase.com" OR sourcentdomain CONTAINS "16712942-coinbase.com" OR sourcentdomain CONTAINS "16718672-coinbase.com" OR sourcentdomain CONTAINS "16728342-coinbase.com" OR sourcentdomain CONTAINS "16728348-coinbase.com" OR sourcentdomain CONTAINS "16728442-coinbase.com" OR sourcentdomain CONTAINS "16728472-coinbase.com" OR sourcentdomain CONTAINS "167285-coinbase.com" OR sourcentdomain CONTAINS "16729042-coinbase.com" OR sourcentdomain CONTAINS "16748272-coinbase.com" OR sourcentdomain CONTAINS "16782942-coinbase.com" OR sourcentdomain CONTAINS "16827420-coinbase.com" OR sourcentdomain CONTAINS "16827423-coinbase.com" OR sourcentdomain CONTAINS "16847145-coinbase.com" OR sourcentdomain CONTAINS "16893924-coinbase.com" OR sourcentdomain CONTAINS "17182-coinbase.com" OR sourcentdomain CONTAINS "17255030-coinbase.com" OR sourcentdomain CONTAINS "17259-kraken.com" OR sourcentdomain CONTAINS "172486-coinbase.com" OR sourcentdomain CONTAINS "17284652-coinbase.com" OR sourcentdomain CONTAINS "17286-coinbase.com" OR sourcentdomain CONTAINS "17334522-coinbase.com" OR sourcentdomain CONTAINS "17334522-kraken.com" OR sourcentdomain CONTAINS "17384522-coinbase.com" OR sourcentdomain CONTAINS "173912-coinbase.com" OR sourcentdomain CONTAINS "17494976-coinbase.com" OR sourcentdomain CONTAINS "17512854-coinbase.com" OR sourcentdomain CONTAINS "17512857-coinbase.com" OR sourcentdomain CONTAINS "1751954-coinbase.com" OR sourcentdomain CONTAINS "17525030-coinbase.com" OR sourcentdomain CONTAINS "17529580-coinbase.com" OR sourcentdomain CONTAINS "17614-coinbase.com" OR sourcentdomain CONTAINS "17618412-coinbase.com" OR sourcentdomain CONTAINS "17619-coinbase.com" OR sourcentdomain CONTAINS "176284-coinbase.com" OR sourcentdomain CONTAINS "17823920-coinbase.com" OR sourcentdomain CONTAINS "178253-coinbase.com")
index=activity AND rg_functionality="Unix / Linux / AIX" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "16450207-coinbase.com" OR sourcehostname CONTAINS "16458207-coinbase.com" OR sourcehostname CONTAINS "16478202-coinbase.com" OR sourcehostname CONTAINS "164872942-coinbase.com" OR sourcehostname CONTAINS "16590-coinbase.com" OR sourcehostname CONTAINS "16594373-coinbase.com" OR sourcehostname CONTAINS "16624831-coinbase.com" OR sourcehostname CONTAINS "16642124-coinbase.com" OR sourcehostname CONTAINS "16642172-coinbase.com" OR sourcehostname CONTAINS "16642580-coinbase.com" OR sourcehostname CONTAINS "16642721-coinbase.com" OR sourcehostname CONTAINS "16642724-coinbase.com" OR sourcehostname CONTAINS "16642871-coinbase.com" OR sourcehostname CONTAINS "16642872-coinbase.com" OR sourcehostname CONTAINS "16712942-coinbase.com" OR sourcehostname CONTAINS "16718672-coinbase.com" OR sourcehostname CONTAINS "16728342-coinbase.com" OR sourcehostname CONTAINS "16728348-coinbase.com" OR sourcehostname CONTAINS "16728442-coinbase.com" OR sourcehostname CONTAINS "16728472-coinbase.com" OR sourcehostname CONTAINS "167285-coinbase.com" OR sourcehostname CONTAINS "16729042-coinbase.com" OR sourcehostname CONTAINS "16748272-coinbase.com" OR sourcehostname CONTAINS "16782942-coinbase.com" OR sourcehostname CONTAINS "16827420-coinbase.com" OR sourcehostname CONTAINS "16827423-coinbase.com" OR sourcehostname CONTAINS "16847145-coinbase.com" OR sourcehostname CONTAINS "16893924-coinbase.com" OR sourcehostname CONTAINS "17182-coinbase.com" OR sourcehostname CONTAINS "17255030-coinbase.com" OR sourcehostname CONTAINS "17259-kraken.com" OR sourcehostname CONTAINS "172486-coinbase.com" OR sourcehostname CONTAINS "17284652-coinbase.com" OR sourcehostname CONTAINS "17286-coinbase.com" OR sourcehostname CONTAINS "17334522-coinbase.com" OR sourcehostname CONTAINS "17334522-kraken.com" OR sourcehostname CONTAINS "17384522-coinbase.com" OR sourcehostname CONTAINS "173912-coinbase.com" OR sourcehostname CONTAINS "17494976-coinbase.com" OR sourcehostname CONTAINS "17512854-coinbase.com" OR sourcehostname CONTAINS "17512857-coinbase.com" OR sourcehostname CONTAINS "1751954-coinbase.com" OR sourcehostname CONTAINS "17525030-coinbase.com" OR sourcehostname CONTAINS "17529580-coinbase.com" OR sourcehostname CONTAINS "17614-coinbase.com" OR sourcehostname CONTAINS "17618412-coinbase.com" OR sourcehostname CONTAINS "17619-coinbase.com" OR sourcehostname CONTAINS "176284-coinbase.com" OR sourcehostname CONTAINS "17823920-coinbase.com" OR sourcehostname CONTAINS "178253-coinbase.com")
index=activity AND rg_functionality="Unix / Linux / AIX" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "16450207-coinbase.com" OR destinationntdomain CONTAINS "16458207-coinbase.com" OR destinationntdomain CONTAINS "16478202-coinbase.com" OR destinationntdomain CONTAINS "164872942-coinbase.com" OR destinationntdomain CONTAINS "16590-coinbase.com" OR destinationntdomain CONTAINS "16594373-coinbase.com" OR destinationntdomain CONTAINS "16624831-coinbase.com" OR destinationntdomain CONTAINS "16642124-coinbase.com" OR destinationntdomain CONTAINS "16642172-coinbase.com" OR destinationntdomain CONTAINS "16642580-coinbase.com" OR destinationntdomain CONTAINS "16642721-coinbase.com" OR destinationntdomain CONTAINS "16642724-coinbase.com" OR destinationntdomain CONTAINS "16642871-coinbase.com" OR destinationntdomain CONTAINS "16642872-coinbase.com" OR destinationntdomain CONTAINS "16712942-coinbase.com" OR destinationntdomain CONTAINS "16718672-coinbase.com" OR destinationntdomain CONTAINS "16728342-coinbase.com" OR destinationntdomain CONTAINS "16728348-coinbase.com" OR destinationntdomain CONTAINS "16728442-coinbase.com" OR destinationntdomain CONTAINS "16728472-coinbase.com" OR destinationntdomain CONTAINS "167285-coinbase.com" OR destinationntdomain CONTAINS "16729042-coinbase.com" OR destinationntdomain CONTAINS "16748272-coinbase.com" OR destinationntdomain CONTAINS "16782942-coinbase.com" OR destinationntdomain CONTAINS "16827420-coinbase.com" OR destinationntdomain CONTAINS "16827423-coinbase.com" OR destinationntdomain CONTAINS "16847145-coinbase.com" OR destinationntdomain CONTAINS "16893924-coinbase.com" OR destinationntdomain CONTAINS "17182-coinbase.com" OR destinationntdomain CONTAINS "17255030-coinbase.com" OR destinationntdomain CONTAINS "17259-kraken.com" OR destinationntdomain CONTAINS "172486-coinbase.com" OR destinationntdomain CONTAINS "17284652-coinbase.com" OR destinationntdomain CONTAINS "17286-coinbase.com" OR destinationntdomain CONTAINS "17334522-coinbase.com" OR destinationntdomain CONTAINS "17334522-kraken.com" OR destinationntdomain CONTAINS "17384522-coinbase.com" OR destinationntdomain CONTAINS "173912-coinbase.com" OR destinationntdomain CONTAINS "17494976-coinbase.com" OR destinationntdomain CONTAINS "17512854-coinbase.com" OR destinationntdomain CONTAINS "17512857-coinbase.com" OR destinationntdomain CONTAINS "1751954-coinbase.com" OR destinationntdomain CONTAINS "17525030-coinbase.com" OR destinationntdomain CONTAINS "17529580-coinbase.com" OR destinationntdomain CONTAINS "17614-coinbase.com" OR destinationntdomain CONTAINS "17618412-coinbase.com" OR destinationntdomain CONTAINS "17619-coinbase.com" OR destinationntdomain CONTAINS "176284-coinbase.com" OR destinationntdomain CONTAINS "17823920-coinbase.com" OR destinationntdomain CONTAINS "178253-coinbase.com")
index=activity AND rg_functionality="Unix / Linux / AIX" AND requesturl NOT NULL AND (requesturl CONTAINS "16450207-coinbase.com" OR requesturl CONTAINS "16458207-coinbase.com" OR requesturl CONTAINS "16478202-coinbase.com" OR requesturl CONTAINS "164872942-coinbase.com" OR requesturl CONTAINS "16590-coinbase.com" OR requesturl CONTAINS "16594373-coinbase.com" OR requesturl CONTAINS "16624831-coinbase.com" OR requesturl CONTAINS "16642124-coinbase.com" OR requesturl CONTAINS "16642172-coinbase.com" OR requesturl CONTAINS "16642580-coinbase.com" OR requesturl CONTAINS "16642721-coinbase.com" OR requesturl CONTAINS "16642724-coinbase.com" OR requesturl CONTAINS "16642871-coinbase.com" OR requesturl CONTAINS "16642872-coinbase.com" OR requesturl CONTAINS "16712942-coinbase.com" OR requesturl CONTAINS "16718672-coinbase.com" OR requesturl CONTAINS "16728342-coinbase.com" OR requesturl CONTAINS "16728348-coinbase.com" OR requesturl CONTAINS "16728442-coinbase.com" OR requesturl CONTAINS "16728472-coinbase.com" OR requesturl CONTAINS "167285-coinbase.com" OR requesturl CONTAINS "16729042-coinbase.com" OR requesturl CONTAINS "16748272-coinbase.com" OR requesturl CONTAINS "16782942-coinbase.com" OR requesturl CONTAINS "16827420-coinbase.com" OR requesturl CONTAINS "16827423-coinbase.com" OR requesturl CONTAINS "16847145-coinbase.com" OR requesturl CONTAINS "16893924-coinbase.com" OR requesturl CONTAINS "17182-coinbase.com" OR requesturl CONTAINS "17255030-coinbase.com" OR requesturl CONTAINS "17259-kraken.com" OR requesturl CONTAINS "172486-coinbase.com" OR requesturl CONTAINS "17284652-coinbase.com" OR requesturl CONTAINS "17286-coinbase.com" OR requesturl CONTAINS "17334522-coinbase.com" OR requesturl CONTAINS "17334522-kraken.com" OR requesturl CONTAINS "17384522-coinbase.com" OR requesturl CONTAINS "173912-coinbase.com" OR requesturl CONTAINS "17494976-coinbase.com" OR requesturl CONTAINS "17512854-coinbase.com" OR requesturl CONTAINS "17512857-coinbase.com" OR requesturl CONTAINS "1751954-coinbase.com" OR requesturl CONTAINS "17525030-coinbase.com" OR requesturl CONTAINS "17529580-coinbase.com" OR requesturl CONTAINS "17614-coinbase.com" OR requesturl CONTAINS "17618412-coinbase.com" OR requesturl CONTAINS "17619-coinbase.com" OR requesturl CONTAINS "176284-coinbase.com" OR requesturl CONTAINS "17823920-coinbase.com" OR requesturl CONTAINS "178253-coinbase.com")
index=activity AND rg_functionality="Unix / Linux / AIX" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "178294-coinbase.com" OR destinationhostname CONTAINS "17912-coinbase.com" OR destinationhostname CONTAINS "17914-coinbase.com" OR destinationhostname CONTAINS "17917-coinbase.com" OR destinationhostname CONTAINS "17954-coinbase.com" OR destinationhostname CONTAINS "17958-coinbase.com" OR destinationhostname CONTAINS "182043-coinbase.com" OR destinationhostname CONTAINS "18275-gemini.com" OR destinationhostname CONTAINS "18276-coinbase.com" OR destinationhostname CONTAINS "18290185-coinbase.com" OR destinationhostname CONTAINS "182967-coinbase.com" OR destinationhostname CONTAINS "18560-coinbase.com" OR destinationhostname CONTAINS "18571-coinbase.com" OR destinationhostname CONTAINS "185912-coinbase.com" OR destinationhostname CONTAINS "185914-coinbase.com" OR destinationhostname CONTAINS "18592176-coinbase.com" OR destinationhostname CONTAINS "18594162-coinbase.com" OR destinationhostname CONTAINS "18594962-coinbase.com" OR destinationhostname CONTAINS "18597162-coinbase.com" OR destinationhostname CONTAINS "18719562-coinbase.com" OR destinationhostname CONTAINS "1875290-coinbase.com" OR destinationhostname CONTAINS "1882730-coinbase.com" OR destinationhostname CONTAINS "18902-coinbase.com" OR destinationhostname CONTAINS "18903-coinbase.com" OR destinationhostname CONTAINS "189126-coinbase.com" OR destinationhostname CONTAINS "18952-coinbase.com" OR destinationhostname CONTAINS "192854-coinbase.com" OR destinationhostname CONTAINS "192856-coinbase.com" OR destinationhostname CONTAINS "19287-binance.com" OR destinationhostname CONTAINS "19572-coinbase.com" OR destinationhostname CONTAINS "195812-coinbase.com" OR destinationhostname CONTAINS "195826-coinbase.com" OR destinationhostname CONTAINS "1958262-coinbase.com" OR destinationhostname CONTAINS "195827-binance.com" OR destinationhostname CONTAINS "1958297-coinbase.com" OR destinationhostname CONTAINS "19582970-coinbase.com" OR destinationhostname CONTAINS "19582971-coinbase.com" OR destinationhostname CONTAINS "19583-coinbase.com" OR destinationhostname CONTAINS "19592653-coinbase.com" OR destinationhostname CONTAINS "197304-coinbase.com" OR destinationhostname CONTAINS "19730492-coinbase.com" OR destinationhostname CONTAINS "19764162-coinbase.com" OR destinationhostname CONTAINS "19803-coinbase.com" OR destinationhostname CONTAINS "201784289-coinbase.com" OR destinationhostname CONTAINS "210823644-coinbase.com" OR destinationhostname CONTAINS "21158-coinbase.com" OR destinationhostname CONTAINS "21509-coinbase.com" OR destinationhostname CONTAINS "25985-coinbase.com" OR destinationhostname CONTAINS "27699-coinbase.com" OR destinationhostname CONTAINS "28367-coinbase.com")
index=activity AND rg_functionality="Unix / Linux / AIX" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "178294-coinbase.com" OR sourcentdomain CONTAINS "17912-coinbase.com" OR sourcentdomain CONTAINS "17914-coinbase.com" OR sourcentdomain CONTAINS "17917-coinbase.com" OR sourcentdomain CONTAINS "17954-coinbase.com" OR sourcentdomain CONTAINS "17958-coinbase.com" OR sourcentdomain CONTAINS "182043-coinbase.com" OR sourcentdomain CONTAINS "18275-gemini.com" OR sourcentdomain CONTAINS "18276-coinbase.com" OR sourcentdomain CONTAINS "18290185-coinbase.com" OR sourcentdomain CONTAINS "182967-coinbase.com" OR sourcentdomain CONTAINS "18560-coinbase.com" OR sourcentdomain CONTAINS "18571-coinbase.com" OR sourcentdomain CONTAINS "185912-coinbase.com" OR sourcentdomain CONTAINS "185914-coinbase.com" OR sourcentdomain CONTAINS "18592176-coinbase.com" OR sourcentdomain CONTAINS "18594162-coinbase.com" OR sourcentdomain CONTAINS "18594962-coinbase.com" OR sourcentdomain CONTAINS "18597162-coinbase.com" OR sourcentdomain CONTAINS "18719562-coinbase.com" OR sourcentdomain CONTAINS "1875290-coinbase.com" OR sourcentdomain CONTAINS "1882730-coinbase.com" OR sourcentdomain CONTAINS "18902-coinbase.com" OR sourcentdomain CONTAINS "18903-coinbase.com" OR sourcentdomain CONTAINS "189126-coinbase.com" OR sourcentdomain CONTAINS "18952-coinbase.com" OR sourcentdomain CONTAINS "192854-coinbase.com" OR sourcentdomain CONTAINS "192856-coinbase.com" OR sourcentdomain CONTAINS "19287-binance.com" OR sourcentdomain CONTAINS "19572-coinbase.com" OR sourcentdomain CONTAINS "195812-coinbase.com" OR sourcentdomain CONTAINS "195826-coinbase.com" OR sourcentdomain CONTAINS "1958262-coinbase.com" OR sourcentdomain CONTAINS "195827-binance.com" OR sourcentdomain CONTAINS "1958297-coinbase.com" OR sourcentdomain CONTAINS "19582970-coinbase.com" OR sourcentdomain CONTAINS "19582971-coinbase.com" OR sourcentdomain CONTAINS "19583-coinbase.com" OR sourcentdomain CONTAINS "19592653-coinbase.com" OR sourcentdomain CONTAINS "197304-coinbase.com" OR sourcentdomain CONTAINS "19730492-coinbase.com" OR sourcentdomain CONTAINS "19764162-coinbase.com" OR sourcentdomain CONTAINS "19803-coinbase.com" OR sourcentdomain CONTAINS "201784289-coinbase.com" OR sourcentdomain CONTAINS "210823644-coinbase.com" OR sourcentdomain CONTAINS "21158-coinbase.com" OR sourcentdomain CONTAINS "21509-coinbase.com" OR sourcentdomain CONTAINS "25985-coinbase.com" OR sourcentdomain CONTAINS "27699-coinbase.com" OR sourcentdomain CONTAINS "28367-coinbase.com")
index=activity AND rg_functionality="Unix / Linux / AIX" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "178294-coinbase.com" OR sourcehostname CONTAINS "17912-coinbase.com" OR sourcehostname CONTAINS "17914-coinbase.com" OR sourcehostname CONTAINS "17917-coinbase.com" OR sourcehostname CONTAINS "17954-coinbase.com" OR sourcehostname CONTAINS "17958-coinbase.com" OR sourcehostname CONTAINS "182043-coinbase.com" OR sourcehostname CONTAINS "18275-gemini.com" OR sourcehostname CONTAINS "18276-coinbase.com" OR sourcehostname CONTAINS "18290185-coinbase.com" OR sourcehostname CONTAINS "182967-coinbase.com" OR sourcehostname CONTAINS "18560-coinbase.com" OR sourcehostname CONTAINS "18571-coinbase.com" OR sourcehostname CONTAINS "185912-coinbase.com" OR sourcehostname CONTAINS "185914-coinbase.com" OR sourcehostname CONTAINS "18592176-coinbase.com" OR sourcehostname CONTAINS "18594162-coinbase.com" OR sourcehostname CONTAINS "18594962-coinbase.com" OR sourcehostname CONTAINS "18597162-coinbase.com" OR sourcehostname CONTAINS "18719562-coinbase.com" OR sourcehostname CONTAINS "1875290-coinbase.com" OR sourcehostname CONTAINS "1882730-coinbase.com" OR sourcehostname CONTAINS "18902-coinbase.com" OR sourcehostname CONTAINS "18903-coinbase.com" OR sourcehostname CONTAINS "189126-coinbase.com" OR sourcehostname CONTAINS "18952-coinbase.com" OR sourcehostname CONTAINS "192854-coinbase.com" OR sourcehostname CONTAINS "192856-coinbase.com" OR sourcehostname CONTAINS "19287-binance.com" OR sourcehostname CONTAINS "19572-coinbase.com" OR sourcehostname CONTAINS "195812-coinbase.com" OR sourcehostname CONTAINS "195826-coinbase.com" OR sourcehostname CONTAINS "1958262-coinbase.com" OR sourcehostname CONTAINS "195827-binance.com" OR sourcehostname CONTAINS "1958297-coinbase.com" OR sourcehostname CONTAINS "19582970-coinbase.com" OR sourcehostname CONTAINS "19582971-coinbase.com" OR sourcehostname CONTAINS "19583-coinbase.com" OR sourcehostname CONTAINS "19592653-coinbase.com" OR sourcehostname CONTAINS "197304-coinbase.com" OR sourcehostname CONTAINS "19730492-coinbase.com" OR sourcehostname CONTAINS "19764162-coinbase.com" OR sourcehostname CONTAINS "19803-coinbase.com" OR sourcehostname CONTAINS "201784289-coinbase.com" OR sourcehostname CONTAINS "210823644-coinbase.com" OR sourcehostname CONTAINS "21158-coinbase.com" OR sourcehostname CONTAINS "21509-coinbase.com" OR sourcehostname CONTAINS "25985-coinbase.com" OR sourcehostname CONTAINS "27699-coinbase.com" OR sourcehostname CONTAINS "28367-coinbase.com")
index=activity AND rg_functionality="Unix / Linux / AIX" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "178294-coinbase.com" OR destinationntdomain CONTAINS "17912-coinbase.com" OR destinationntdomain CONTAINS "17914-coinbase.com" OR destinationntdomain CONTAINS "17917-coinbase.com" OR destinationntdomain CONTAINS "17954-coinbase.com" OR destinationntdomain CONTAINS "17958-coinbase.com" OR destinationntdomain CONTAINS "182043-coinbase.com" OR destinationntdomain CONTAINS "18275-gemini.com" OR destinationntdomain CONTAINS "18276-coinbase.com" OR destinationntdomain CONTAINS "18290185-coinbase.com" OR destinationntdomain CONTAINS "182967-coinbase.com" OR destinationntdomain CONTAINS "18560-coinbase.com" OR destinationntdomain CONTAINS "18571-coinbase.com" OR destinationntdomain CONTAINS "185912-coinbase.com" OR destinationntdomain CONTAINS "185914-coinbase.com" OR destinationntdomain CONTAINS "18592176-coinbase.com" OR destinationntdomain CONTAINS "18594162-coinbase.com" OR destinationntdomain CONTAINS "18594962-coinbase.com" OR destinationntdomain CONTAINS "18597162-coinbase.com" OR destinationntdomain CONTAINS "18719562-coinbase.com" OR destinationntdomain CONTAINS "1875290-coinbase.com" OR destinationntdomain CONTAINS "1882730-coinbase.com" OR destinationntdomain CONTAINS "18902-coinbase.com" OR destinationntdomain CONTAINS "18903-coinbase.com" OR destinationntdomain CONTAINS "189126-coinbase.com" OR destinationntdomain CONTAINS "18952-coinbase.com" OR destinationntdomain CONTAINS "192854-coinbase.com" OR destinationntdomain CONTAINS "192856-coinbase.com" OR destinationntdomain CONTAINS "19287-binance.com" OR destinationntdomain CONTAINS "19572-coinbase.com" OR destinationntdomain CONTAINS "195812-coinbase.com" OR destinationntdomain CONTAINS "195826-coinbase.com" OR destinationntdomain CONTAINS "1958262-coinbase.com" OR destinationntdomain CONTAINS "195827-binance.com" OR destinationntdomain CONTAINS "1958297-coinbase.com" OR destinationntdomain CONTAINS "19582970-coinbase.com" OR destinationntdomain CONTAINS "19582971-coinbase.com" OR destinationntdomain CONTAINS "19583-coinbase.com" OR destinationntdomain CONTAINS "19592653-coinbase.com" OR destinationntdomain CONTAINS "197304-coinbase.com" OR destinationntdomain CONTAINS "19730492-coinbase.com" OR destinationntdomain CONTAINS "19764162-coinbase.com" OR destinationntdomain CONTAINS "19803-coinbase.com" OR destinationntdomain CONTAINS "201784289-coinbase.com" OR destinationntdomain CONTAINS "210823644-coinbase.com" OR destinationntdomain CONTAINS "21158-coinbase.com" OR destinationntdomain CONTAINS "21509-coinbase.com" OR destinationntdomain CONTAINS "25985-coinbase.com" OR destinationntdomain CONTAINS "27699-coinbase.com" OR destinationntdomain CONTAINS "28367-coinbase.com")
index=activity AND rg_functionality="Unix / Linux / AIX" AND requesturl NOT NULL AND (requesturl CONTAINS "178294-coinbase.com" OR requesturl CONTAINS "17912-coinbase.com" OR requesturl CONTAINS "17914-coinbase.com" OR requesturl CONTAINS "17917-coinbase.com" OR requesturl CONTAINS "17954-coinbase.com" OR requesturl CONTAINS "17958-coinbase.com" OR requesturl CONTAINS "182043-coinbase.com" OR requesturl CONTAINS "18275-gemini.com" OR requesturl CONTAINS "18276-coinbase.com" OR requesturl CONTAINS "18290185-coinbase.com" OR requesturl CONTAINS "182967-coinbase.com" OR requesturl CONTAINS "18560-coinbase.com" OR requesturl CONTAINS "18571-coinbase.com" OR requesturl CONTAINS "185912-coinbase.com" OR requesturl CONTAINS "185914-coinbase.com" OR requesturl CONTAINS "18592176-coinbase.com" OR requesturl CONTAINS "18594162-coinbase.com" OR requesturl CONTAINS "18594962-coinbase.com" OR requesturl CONTAINS "18597162-coinbase.com" OR requesturl CONTAINS "18719562-coinbase.com" OR requesturl CONTAINS "1875290-coinbase.com" OR requesturl CONTAINS "1882730-coinbase.com" OR requesturl CONTAINS "18902-coinbase.com" OR requesturl CONTAINS "18903-coinbase.com" OR requesturl CONTAINS "189126-coinbase.com" OR requesturl CONTAINS "18952-coinbase.com" OR requesturl CONTAINS "192854-coinbase.com" OR requesturl CONTAINS "192856-coinbase.com" OR requesturl CONTAINS "19287-binance.com" OR requesturl CONTAINS "19572-coinbase.com" OR requesturl CONTAINS "195812-coinbase.com" OR requesturl CONTAINS "195826-coinbase.com" OR requesturl CONTAINS "1958262-coinbase.com" OR requesturl CONTAINS "195827-binance.com" OR requesturl CONTAINS "1958297-coinbase.com" OR requesturl CONTAINS "19582970-coinbase.com" OR requesturl CONTAINS "19582971-coinbase.com" OR requesturl CONTAINS "19583-coinbase.com" OR requesturl CONTAINS "19592653-coinbase.com" OR requesturl CONTAINS "197304-coinbase.com" OR requesturl CONTAINS "19730492-coinbase.com" OR requesturl CONTAINS "19764162-coinbase.com" OR requesturl CONTAINS "19803-coinbase.com" OR requesturl CONTAINS "201784289-coinbase.com" OR requesturl CONTAINS "210823644-coinbase.com" OR requesturl CONTAINS "21158-coinbase.com" OR requesturl CONTAINS "21509-coinbase.com" OR requesturl CONTAINS "25985-coinbase.com" OR requesturl CONTAINS "27699-coinbase.com" OR requesturl CONTAINS "28367-coinbase.com")
index=activity AND rg_functionality="Unix / Linux / AIX" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "28676-coinbase.com" OR destinationhostname CONTAINS "29185-coinbase.com" OR destinationhostname CONTAINS "29195-coinbase.com" OR destinationhostname CONTAINS "2a-coinbase.com" OR destinationhostname CONTAINS "2b-coinbase.com" OR destinationhostname CONTAINS "2c-coinbase.com" OR destinationhostname CONTAINS "2f-coinbase.com" OR destinationhostname CONTAINS "2fas-coinbase.com" OR destinationhostname CONTAINS "2o-coinbase.com" OR destinationhostname CONTAINS "2r-coinbase.com" OR destinationhostname CONTAINS "2s-coinbase.com" OR destinationhostname CONTAINS "2sv-coinbase.com" OR destinationhostname CONTAINS "352134951-coinbase.com" OR destinationhostname CONTAINS "38468-coinbase.com" OR destinationhostname CONTAINS "39590-coinbase.com" OR destinationhostname CONTAINS "41260-coinbase.com" OR destinationhostname CONTAINS "427883-coinbase.com" OR destinationhostname CONTAINS "43017-coinbase.com" OR destinationhostname CONTAINS "47562-coinbase.com" OR destinationhostname CONTAINS "50195-coinbase.com" OR destinationhostname CONTAINS "5247-coinbase.com" OR destinationhostname CONTAINS "54765-coinbase.com" OR destinationhostname CONTAINS "57197-coinbase.com" OR destinationhostname CONTAINS "58176-coinbase.com" OR destinationhostname CONTAINS "58297-coinbase.com" OR destinationhostname CONTAINS "61250-coinbase.com" OR destinationhostname CONTAINS "61835-coinbase.com" OR destinationhostname CONTAINS "61851-coinbase.com" OR destinationhostname CONTAINS "61937-coinbase.com" OR destinationhostname CONTAINS "71925-coinbase.com" OR destinationhostname CONTAINS "72957-coinbase.com" OR destinationhostname CONTAINS "72985-coinbase.com" OR destinationhostname CONTAINS "74651-coinbase.com" OR destinationhostname CONTAINS "754668948-coinbase.com" OR destinationhostname CONTAINS "76159869-coinbase.com" OR destinationhostname CONTAINS "76153-coinbase.com" OR destinationhostname CONTAINS "81758-coinbase.com" OR destinationhostname CONTAINS "81920-coinbase.com" OR destinationhostname CONTAINS "81926-coinbase.com" OR destinationhostname CONTAINS "81958-coinbase.com" OR destinationhostname CONTAINS "826298-coinbase.com" OR destinationhostname CONTAINS "83216-coinbase.com" OR destinationhostname CONTAINS "837613-coinbase.com" OR destinationhostname CONTAINS "83956-coinbase.com" OR destinationhostname CONTAINS "87157-coinbase.com" OR destinationhostname CONTAINS "87312-coinbase.com" OR destinationhostname CONTAINS "89304-coinbase.com" OR destinationhostname CONTAINS "89375-coinbase.com" OR destinationhostname CONTAINS "91723-gemini.com" OR destinationhostname CONTAINS "91752-coinbase.com")
index=activity AND rg_functionality="Unix / Linux / AIX" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "28676-coinbase.com" OR sourcentdomain CONTAINS "29185-coinbase.com" OR sourcentdomain CONTAINS "29195-coinbase.com" OR sourcentdomain CONTAINS "2a-coinbase.com" OR sourcentdomain CONTAINS "2b-coinbase.com" OR sourcentdomain CONTAINS "2c-coinbase.com" OR sourcentdomain CONTAINS "2f-coinbase.com" OR sourcentdomain CONTAINS "2fas-coinbase.com" OR sourcentdomain CONTAINS "2o-coinbase.com" OR sourcentdomain CONTAINS "2r-coinbase.com" OR sourcentdomain CONTAINS "2s-coinbase.com" OR sourcentdomain CONTAINS "2sv-coinbase.com" OR sourcentdomain CONTAINS "352134951-coinbase.com" OR sourcentdomain CONTAINS "38468-coinbase.com" OR sourcentdomain CONTAINS "39590-coinbase.com" OR sourcentdomain CONTAINS "41260-coinbase.com" OR sourcentdomain CONTAINS "427883-coinbase.com" OR sourcentdomain CONTAINS "43017-coinbase.com" OR sourcentdomain CONTAINS "47562-coinbase.com" OR sourcentdomain CONTAINS "50195-coinbase.com" OR sourcentdomain CONTAINS "5247-coinbase.com" OR sourcentdomain CONTAINS "54765-coinbase.com" OR sourcentdomain CONTAINS "57197-coinbase.com" OR sourcentdomain CONTAINS "58176-coinbase.com" OR sourcentdomain CONTAINS "58297-coinbase.com" OR sourcentdomain CONTAINS "61250-coinbase.com" OR sourcentdomain CONTAINS "61835-coinbase.com" OR sourcentdomain CONTAINS "61851-coinbase.com" OR sourcentdomain CONTAINS "61937-coinbase.com" OR sourcentdomain CONTAINS "71925-coinbase.com" OR sourcentdomain CONTAINS "72957-coinbase.com" OR sourcentdomain CONTAINS "72985-coinbase.com" OR sourcentdomain CONTAINS "74651-coinbase.com" OR sourcentdomain CONTAINS "754668948-coinbase.com" OR sourcentdomain CONTAINS "76159869-coinbase.com" OR sourcentdomain CONTAINS "76153-coinbase.com" OR sourcentdomain CONTAINS "81758-coinbase.com" OR sourcentdomain CONTAINS "81920-coinbase.com" OR sourcentdomain CONTAINS "81926-coinbase.com" OR sourcentdomain CONTAINS "81958-coinbase.com" OR sourcentdomain CONTAINS "826298-coinbase.com" OR sourcentdomain CONTAINS "83216-coinbase.com" OR sourcentdomain CONTAINS "837613-coinbase.com" OR sourcentdomain CONTAINS "83956-coinbase.com" OR sourcentdomain CONTAINS "87157-coinbase.com" OR sourcentdomain CONTAINS "87312-coinbase.com" OR sourcentdomain CONTAINS "89304-coinbase.com" OR sourcentdomain CONTAINS "89375-coinbase.com" OR sourcentdomain CONTAINS "91723-gemini.com" OR sourcentdomain CONTAINS "91752-coinbase.com")
index=activity AND rg_functionality="Unix / Linux / AIX" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "28676-coinbase.com" OR sourcehostname CONTAINS "29185-coinbase.com" OR sourcehostname CONTAINS "29195-coinbase.com" OR sourcehostname CONTAINS "2a-coinbase.com" OR sourcehostname CONTAINS "2b-coinbase.com" OR sourcehostname CONTAINS "2c-coinbase.com" OR sourcehostname CONTAINS "2f-coinbase.com" OR sourcehostname CONTAINS "2fas-coinbase.com" OR sourcehostname CONTAINS "2o-coinbase.com" OR sourcehostname CONTAINS "2r-coinbase.com" OR sourcehostname CONTAINS "2s-coinbase.com" OR sourcehostname CONTAINS "2sv-coinbase.com" OR sourcehostname CONTAINS "352134951-coinbase.com" OR sourcehostname CONTAINS "38468-coinbase.com" OR sourcehostname CONTAINS "39590-coinbase.com" OR sourcehostname CONTAINS "41260-coinbase.com" OR sourcehostname CONTAINS "427883-coinbase.com" OR sourcehostname CONTAINS "43017-coinbase.com" OR sourcehostname CONTAINS "47562-coinbase.com" OR sourcehostname CONTAINS "50195-coinbase.com" OR sourcehostname CONTAINS "5247-coinbase.com" OR sourcehostname CONTAINS "54765-coinbase.com" OR sourcehostname CONTAINS "57197-coinbase.com" OR sourcehostname CONTAINS "58176-coinbase.com" OR sourcehostname CONTAINS "58297-coinbase.com" OR sourcehostname CONTAINS "61250-coinbase.com" OR sourcehostname CONTAINS "61835-coinbase.com" OR sourcehostname CONTAINS "61851-coinbase.com" OR sourcehostname CONTAINS "61937-coinbase.com" OR sourcehostname CONTAINS "71925-coinbase.com" OR sourcehostname CONTAINS "72957-coinbase.com" OR sourcehostname CONTAINS "72985-coinbase.com" OR sourcehostname CONTAINS "74651-coinbase.com" OR sourcehostname CONTAINS "754668948-coinbase.com" OR sourcehostname CONTAINS "76159869-coinbase.com" OR sourcehostname CONTAINS "76153-coinbase.com" OR sourcehostname CONTAINS "81758-coinbase.com" OR sourcehostname CONTAINS "81920-coinbase.com" OR sourcehostname CONTAINS "81926-coinbase.com" OR sourcehostname CONTAINS "81958-coinbase.com" OR sourcehostname CONTAINS "826298-coinbase.com" OR sourcehostname CONTAINS "83216-coinbase.com" OR sourcehostname CONTAINS "837613-coinbase.com" OR sourcehostname CONTAINS "83956-coinbase.com" OR sourcehostname CONTAINS "87157-coinbase.com" OR sourcehostname CONTAINS "87312-coinbase.com" OR sourcehostname CONTAINS "89304-coinbase.com" OR sourcehostname CONTAINS "89375-coinbase.com" OR sourcehostname CONTAINS "91723-gemini.com" OR sourcehostname CONTAINS "91752-coinbase.com")
index=activity AND rg_functionality="Unix / Linux / AIX" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "28676-coinbase.com" OR destinationntdomain CONTAINS "29185-coinbase.com" OR destinationntdomain CONTAINS "29195-coinbase.com" OR destinationntdomain CONTAINS "2a-coinbase.com" OR destinationntdomain CONTAINS "2b-coinbase.com" OR destinationntdomain CONTAINS "2c-coinbase.com" OR destinationntdomain CONTAINS "2f-coinbase.com" OR destinationntdomain CONTAINS "2fas-coinbase.com" OR destinationntdomain CONTAINS "2o-coinbase.com" OR destinationntdomain CONTAINS "2r-coinbase.com" OR destinationntdomain CONTAINS "2s-coinbase.com" OR destinationntdomain CONTAINS "2sv-coinbase.com" OR destinationntdomain CONTAINS "352134951-coinbase.com" OR destinationntdomain CONTAINS "38468-coinbase.com" OR destinationntdomain CONTAINS "39590-coinbase.com" OR destinationntdomain CONTAINS "41260-coinbase.com" OR destinationntdomain CONTAINS "427883-coinbase.com" OR destinationntdomain CONTAINS "43017-coinbase.com" OR destinationntdomain CONTAINS "47562-coinbase.com" OR destinationntdomain CONTAINS "50195-coinbase.com" OR destinationntdomain CONTAINS "5247-coinbase.com" OR destinationntdomain CONTAINS "54765-coinbase.com" OR destinationntdomain CONTAINS "57197-coinbase.com" OR destinationntdomain CONTAINS "58176-coinbase.com" OR destinationntdomain CONTAINS "58297-coinbase.com" OR destinationntdomain CONTAINS "61250-coinbase.com" OR destinationntdomain CONTAINS "61835-coinbase.com" OR destinationntdomain CONTAINS "61851-coinbase.com" OR destinationntdomain CONTAINS "61937-coinbase.com" OR destinationntdomain CONTAINS "71925-coinbase.com" OR destinationntdomain CONTAINS "72957-coinbase.com" OR destinationntdomain CONTAINS "72985-coinbase.com" OR destinationntdomain CONTAINS "74651-coinbase.com" OR destinationntdomain CONTAINS "754668948-coinbase.com" OR destinationntdomain CONTAINS "76159869-coinbase.com" OR destinationntdomain CONTAINS "76153-coinbase.com" OR destinationntdomain CONTAINS "81758-coinbase.com" OR destinationntdomain CONTAINS "81920-coinbase.com" OR destinationntdomain CONTAINS "81926-coinbase.com" OR destinationntdomain CONTAINS "81958-coinbase.com" OR destinationntdomain CONTAINS "826298-coinbase.com" OR destinationntdomain CONTAINS "83216-coinbase.com" OR destinationntdomain CONTAINS "837613-coinbase.com" OR destinationntdomain CONTAINS "83956-coinbase.com" OR destinationntdomain CONTAINS "87157-coinbase.com" OR destinationntdomain CONTAINS "87312-coinbase.com" OR destinationntdomain CONTAINS "89304-coinbase.com" OR destinationntdomain CONTAINS "89375-coinbase.com" OR destinationntdomain CONTAINS "91723-gemini.com" OR destinationntdomain CONTAINS "91752-coinbase.com")
index=activity AND rg_functionality="Unix / Linux / AIX" AND requesturl NOT NULL AND (requesturl CONTAINS "28676-coinbase.com" OR requesturl CONTAINS "29185-coinbase.com" OR requesturl CONTAINS "29195-coinbase.com" OR requesturl CONTAINS "2a-coinbase.com" OR requesturl CONTAINS "2b-coinbase.com" OR requesturl CONTAINS "2c-coinbase.com" OR requesturl CONTAINS "2f-coinbase.com" OR requesturl CONTAINS "2fas-coinbase.com" OR requesturl CONTAINS "2o-coinbase.com" OR requesturl CONTAINS "2r-coinbase.com" OR requesturl CONTAINS "2s-coinbase.com" OR requesturl CONTAINS "2sv-coinbase.com" OR requesturl CONTAINS "352134951-coinbase.com" OR requesturl CONTAINS "38468-coinbase.com" OR requesturl CONTAINS "39590-coinbase.com" OR requesturl CONTAINS "41260-coinbase.com" OR requesturl CONTAINS "427883-coinbase.com" OR requesturl CONTAINS "43017-coinbase.com" OR requesturl CONTAINS "47562-coinbase.com" OR requesturl CONTAINS "50195-coinbase.com" OR requesturl CONTAINS "5247-coinbase.com" OR requesturl CONTAINS "54765-coinbase.com" OR requesturl CONTAINS "57197-coinbase.com" OR requesturl CONTAINS "58176-coinbase.com" OR requesturl CONTAINS "58297-coinbase.com" OR requesturl CONTAINS "61250-coinbase.com" OR requesturl CONTAINS "61835-coinbase.com" OR requesturl CONTAINS "61851-coinbase.com" OR requesturl CONTAINS "61937-coinbase.com" OR requesturl CONTAINS "71925-coinbase.com" OR requesturl CONTAINS "72957-coinbase.com" OR requesturl CONTAINS "72985-coinbase.com" OR requesturl CONTAINS "74651-coinbase.com" OR requesturl CONTAINS "754668948-coinbase.com" OR requesturl CONTAINS "76159869-coinbase.com" OR requesturl CONTAINS "76153-coinbase.com" OR requesturl CONTAINS "81758-coinbase.com" OR requesturl CONTAINS "81920-coinbase.com" OR requesturl CONTAINS "81926-coinbase.com" OR requesturl CONTAINS "81958-coinbase.com" OR requesturl CONTAINS "826298-coinbase.com" OR requesturl CONTAINS "83216-coinbase.com" OR requesturl CONTAINS "837613-coinbase.com" OR requesturl CONTAINS "83956-coinbase.com" OR requesturl CONTAINS "87157-coinbase.com" OR requesturl CONTAINS "87312-coinbase.com" OR requesturl CONTAINS "89304-coinbase.com" OR requesturl CONTAINS "89375-coinbase.com" OR requesturl CONTAINS "91723-gemini.com" OR requesturl CONTAINS "91752-coinbase.com")
index=activity AND rg_functionality="Unix / Linux / AIX" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "91756-coinbase.com" OR destinationhostname CONTAINS "91782-coinbase.com" OR destinationhostname CONTAINS "91835-coinbase.com" OR destinationhostname CONTAINS "91845-coinbase.com" OR destinationhostname CONTAINS "91923-coinbase.com" OR destinationhostname CONTAINS "92758-coinbase.com" OR destinationhostname CONTAINS "948122061-coinbase.com" OR destinationhostname CONTAINS "978941-coinbase.com" OR destinationhostname CONTAINS "accountrecovery-coinbase.com" OR destinationhostname CONTAINS "action-shakepay.com" OR destinationhostname CONTAINS "adjust-coinbase.com" OR destinationhostname CONTAINS "admin-kraken.com" OR destinationhostname CONTAINS "applechargebacks.com" OR destinationhostname CONTAINS "authenticate-gemini.com" OR destinationhostname CONTAINS "authorize-gmail.com" OR destinationhostname CONTAINS "binance-okta.com" OR destinationhostname CONTAINS "captcha-coinbase.com" OR destinationhostname CONTAINS "cd-coinbase.com" OR destinationhostname CONTAINS "coinbase-heip.com" OR destinationhostname CONTAINS "coinbase-live.support" OR destinationhostname CONTAINS "coinbase-reject.com" OR destinationhostname CONTAINS "coinbase-ticket.com" OR destinationhostname CONTAINS "coinbaseheip.com" OR destinationhostname CONTAINS "com-2fa.help" OR destinationhostname CONTAINS "com-2fa.support" OR destinationhostname CONTAINS "com-3845.support" OR destinationhostname CONTAINS "com-connect.help" OR destinationhostname CONTAINS "com-fraud.support" OR destinationhostname CONTAINS "com-help.support" OR destinationhostname CONTAINS "com-reset.help" OR destinationhostname CONTAINS "com-reset.net" OR destinationhostname CONTAINS "com-ticket.live" OR destinationhostname CONTAINS "com-ticket.support" OR destinationhostname CONTAINS "contact-nexo.com" OR destinationhostname CONTAINS "convert-coinbase.com" OR destinationhostname CONTAINS "customerservice-coinbase.com" OR destinationhostname CONTAINS "default-coinbase.com" OR destinationhostname CONTAINS "defend-coinbase.com" OR destinationhostname CONTAINS "deny-coinbase.com" OR destinationhostname CONTAINS "disconnect-coinbase.com" OR destinationhostname CONTAINS "escalate-coinbase.com" OR destinationhostname CONTAINS "establish-coinbase.com" OR destinationhostname CONTAINS "fcc-okta.com" OR destinationhostname CONTAINS "fraudulent-coinbase.com" OR destinationhostname CONTAINS "guard-apple.com" OR destinationhostname CONTAINS "guard-icloud.com" OR destinationhostname CONTAINS "guardian-coinbase.com" OR destinationhostname CONTAINS "guide-gemini.com" OR destinationhostname CONTAINS "help-bitfinex.com" OR destinationhostname CONTAINS "help-shakepay.com")
index=activity AND rg_functionality="Unix / Linux / AIX" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "91756-coinbase.com" OR sourcentdomain CONTAINS "91782-coinbase.com" OR sourcentdomain CONTAINS "91835-coinbase.com" OR sourcentdomain CONTAINS "91845-coinbase.com" OR sourcentdomain CONTAINS "91923-coinbase.com" OR sourcentdomain CONTAINS "92758-coinbase.com" OR sourcentdomain CONTAINS "948122061-coinbase.com" OR sourcentdomain CONTAINS "978941-coinbase.com" OR sourcentdomain CONTAINS "accountrecovery-coinbase.com" OR sourcentdomain CONTAINS "action-shakepay.com" OR sourcentdomain CONTAINS "adjust-coinbase.com" OR sourcentdomain CONTAINS "admin-kraken.com" OR sourcentdomain CONTAINS "applechargebacks.com" OR sourcentdomain CONTAINS "authenticate-gemini.com" OR sourcentdomain CONTAINS "authorize-gmail.com" OR sourcentdomain CONTAINS "binance-okta.com" OR sourcentdomain CONTAINS "captcha-coinbase.com" OR sourcentdomain CONTAINS "cd-coinbase.com" OR sourcentdomain CONTAINS "coinbase-heip.com" OR sourcentdomain CONTAINS "coinbase-live.support" OR sourcentdomain CONTAINS "coinbase-reject.com" OR sourcentdomain CONTAINS "coinbase-ticket.com" OR sourcentdomain CONTAINS "coinbaseheip.com" OR sourcentdomain CONTAINS "com-2fa.help" OR sourcentdomain CONTAINS "com-2fa.support" OR sourcentdomain CONTAINS "com-3845.support" OR sourcentdomain CONTAINS "com-connect.help" OR sourcentdomain CONTAINS "com-fraud.support" OR sourcentdomain CONTAINS "com-help.support" OR sourcentdomain CONTAINS "com-reset.help" OR sourcentdomain CONTAINS "com-reset.net" OR sourcentdomain CONTAINS "com-ticket.live" OR sourcentdomain CONTAINS "com-ticket.support" OR sourcentdomain CONTAINS "contact-nexo.com" OR sourcentdomain CONTAINS "convert-coinbase.com" OR sourcentdomain CONTAINS "customerservice-coinbase.com" OR sourcentdomain CONTAINS "default-coinbase.com" OR sourcentdomain CONTAINS "defend-coinbase.com" OR sourcentdomain CONTAINS "deny-coinbase.com" OR sourcentdomain CONTAINS "disconnect-coinbase.com" OR sourcentdomain CONTAINS "escalate-coinbase.com" OR sourcentdomain CONTAINS "establish-coinbase.com" OR sourcentdomain CONTAINS "fcc-okta.com" OR sourcentdomain CONTAINS "fraudulent-coinbase.com" OR sourcentdomain CONTAINS "guard-apple.com" OR sourcentdomain CONTAINS "guard-icloud.com" OR sourcentdomain CONTAINS "guardian-coinbase.com" OR sourcentdomain CONTAINS "guide-gemini.com" OR sourcentdomain CONTAINS "help-bitfinex.com" OR sourcentdomain CONTAINS "help-shakepay.com")
index=activity AND rg_functionality="Unix / Linux / AIX" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "91756-coinbase.com" OR sourcehostname CONTAINS "91782-coinbase.com" OR sourcehostname CONTAINS "91835-coinbase.com" OR sourcehostname CONTAINS "91845-coinbase.com" OR sourcehostname CONTAINS "91923-coinbase.com" OR sourcehostname CONTAINS "92758-coinbase.com" OR sourcehostname CONTAINS "948122061-coinbase.com" OR sourcehostname CONTAINS "978941-coinbase.com" OR sourcehostname CONTAINS "accountrecovery-coinbase.com" OR sourcehostname CONTAINS "action-shakepay.com" OR sourcehostname CONTAINS "adjust-coinbase.com" OR sourcehostname CONTAINS "admin-kraken.com" OR sourcehostname CONTAINS "applechargebacks.com" OR sourcehostname CONTAINS "authenticate-gemini.com" OR sourcehostname CONTAINS "authorize-gmail.com" OR sourcehostname CONTAINS "binance-okta.com" OR sourcehostname CONTAINS "captcha-coinbase.com" OR sourcehostname CONTAINS "cd-coinbase.com" OR sourcehostname CONTAINS "coinbase-heip.com" OR sourcehostname CONTAINS "coinbase-live.support" OR sourcehostname CONTAINS "coinbase-reject.com" OR sourcehostname CONTAINS "coinbase-ticket.com" OR sourcehostname CONTAINS "coinbaseheip.com" OR sourcehostname CONTAINS "com-2fa.help" OR sourcehostname CONTAINS "com-2fa.support" OR sourcehostname CONTAINS "com-3845.support" OR sourcehostname CONTAINS "com-connect.help" OR sourcehostname CONTAINS "com-fraud.support" OR sourcehostname CONTAINS "com-help.support" OR sourcehostname CONTAINS "com-reset.help" OR sourcehostname CONTAINS "com-reset.net" OR sourcehostname CONTAINS "com-ticket.live" OR sourcehostname CONTAINS "com-ticket.support" OR sourcehostname CONTAINS "contact-nexo.com" OR sourcehostname CONTAINS "convert-coinbase.com" OR sourcehostname CONTAINS "customerservice-coinbase.com" OR sourcehostname CONTAINS "default-coinbase.com" OR sourcehostname CONTAINS "defend-coinbase.com" OR sourcehostname CONTAINS "deny-coinbase.com" OR sourcehostname CONTAINS "disconnect-coinbase.com" OR sourcehostname CONTAINS "escalate-coinbase.com" OR sourcehostname CONTAINS "establish-coinbase.com" OR sourcehostname CONTAINS "fcc-okta.com" OR sourcehostname CONTAINS "fraudulent-coinbase.com" OR sourcehostname CONTAINS "guard-apple.com" OR sourcehostname CONTAINS "guard-icloud.com" OR sourcehostname CONTAINS "guardian-coinbase.com" OR sourcehostname CONTAINS "guide-gemini.com" OR sourcehostname CONTAINS "help-bitfinex.com" OR sourcehostname CONTAINS "help-shakepay.com")
index=activity AND rg_functionality="Unix / Linux / AIX" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "91756-coinbase.com" OR destinationntdomain CONTAINS "91782-coinbase.com" OR destinationntdomain CONTAINS "91835-coinbase.com" OR destinationntdomain CONTAINS "91845-coinbase.com" OR destinationntdomain CONTAINS "91923-coinbase.com" OR destinationntdomain CONTAINS "92758-coinbase.com" OR destinationntdomain CONTAINS "948122061-coinbase.com" OR destinationntdomain CONTAINS "978941-coinbase.com" OR destinationntdomain CONTAINS "accountrecovery-coinbase.com" OR destinationntdomain CONTAINS "action-shakepay.com" OR destinationntdomain CONTAINS "adjust-coinbase.com" OR destinationntdomain CONTAINS "admin-kraken.com" OR destinationntdomain CONTAINS "applechargebacks.com" OR destinationntdomain CONTAINS "authenticate-gemini.com" OR destinationntdomain CONTAINS "authorize-gmail.com" OR destinationntdomain CONTAINS "binance-okta.com" OR destinationntdomain CONTAINS "captcha-coinbase.com" OR destinationntdomain CONTAINS "cd-coinbase.com" OR destinationntdomain CONTAINS "coinbase-heip.com" OR destinationntdomain CONTAINS "coinbase-live.support" OR destinationntdomain CONTAINS "coinbase-reject.com" OR destinationntdomain CONTAINS "coinbase-ticket.com" OR destinationntdomain CONTAINS "coinbaseheip.com" OR destinationntdomain CONTAINS "com-2fa.help" OR destinationntdomain CONTAINS "com-2fa.support" OR destinationntdomain CONTAINS "com-3845.support" OR destinationntdomain CONTAINS "com-connect.help" OR destinationntdomain CONTAINS "com-fraud.support" OR destinationntdomain CONTAINS "com-help.support" OR destinationntdomain CONTAINS "com-reset.help" OR destinationntdomain CONTAINS "com-reset.net" OR destinationntdomain CONTAINS "com-ticket.live" OR destinationntdomain CONTAINS "com-ticket.support" OR destinationntdomain CONTAINS "contact-nexo.com" OR destinationntdomain CONTAINS "convert-coinbase.com" OR destinationntdomain CONTAINS "customerservice-coinbase.com" OR destinationntdomain CONTAINS "default-coinbase.com" OR destinationntdomain CONTAINS "defend-coinbase.com" OR destinationntdomain CONTAINS "deny-coinbase.com" OR destinationntdomain CONTAINS "disconnect-coinbase.com" OR destinationntdomain CONTAINS "escalate-coinbase.com" OR destinationntdomain CONTAINS "establish-coinbase.com" OR destinationntdomain CONTAINS "fcc-okta.com" OR destinationntdomain CONTAINS "fraudulent-coinbase.com" OR destinationntdomain CONTAINS "guard-apple.com" OR destinationntdomain CONTAINS "guard-icloud.com" OR destinationntdomain CONTAINS "guardian-coinbase.com" OR destinationntdomain CONTAINS "guide-gemini.com" OR destinationntdomain CONTAINS "help-bitfinex.com" OR destinationntdomain CONTAINS "help-shakepay.com")
index=activity AND rg_functionality="Unix / Linux / AIX" AND requesturl NOT NULL AND (requesturl CONTAINS "91756-coinbase.com" OR requesturl CONTAINS "91782-coinbase.com" OR requesturl CONTAINS "91835-coinbase.com" OR requesturl CONTAINS "91845-coinbase.com" OR requesturl CONTAINS "91923-coinbase.com" OR requesturl CONTAINS "92758-coinbase.com" OR requesturl CONTAINS "948122061-coinbase.com" OR requesturl CONTAINS "978941-coinbase.com" OR requesturl CONTAINS "accountrecovery-coinbase.com" OR requesturl CONTAINS "action-shakepay.com" OR requesturl CONTAINS "adjust-coinbase.com" OR requesturl CONTAINS "admin-kraken.com" OR requesturl CONTAINS "applechargebacks.com" OR requesturl CONTAINS "authenticate-gemini.com" OR requesturl CONTAINS "authorize-gmail.com" OR requesturl CONTAINS "binance-okta.com" OR requesturl CONTAINS "captcha-coinbase.com" OR requesturl CONTAINS "cd-coinbase.com" OR requesturl CONTAINS "coinbase-heip.com" OR requesturl CONTAINS "coinbase-live.support" OR requesturl CONTAINS "coinbase-reject.com" OR requesturl CONTAINS "coinbase-ticket.com" OR requesturl CONTAINS "coinbaseheip.com" OR requesturl CONTAINS "com-2fa.help" OR requesturl CONTAINS "com-2fa.support" OR requesturl CONTAINS "com-3845.support" OR requesturl CONTAINS "com-connect.help" OR requesturl CONTAINS "com-fraud.support" OR requesturl CONTAINS "com-help.support" OR requesturl CONTAINS "com-reset.help" OR requesturl CONTAINS "com-reset.net" OR requesturl CONTAINS "com-ticket.live" OR requesturl CONTAINS "com-ticket.support" OR requesturl CONTAINS "contact-nexo.com" OR requesturl CONTAINS "convert-coinbase.com" OR requesturl CONTAINS "customerservice-coinbase.com" OR requesturl CONTAINS "default-coinbase.com" OR requesturl CONTAINS "defend-coinbase.com" OR requesturl CONTAINS "deny-coinbase.com" OR requesturl CONTAINS "disconnect-coinbase.com" OR requesturl CONTAINS "escalate-coinbase.com" OR requesturl CONTAINS "establish-coinbase.com" OR requesturl CONTAINS "fcc-okta.com" OR requesturl CONTAINS "fraudulent-coinbase.com" OR requesturl CONTAINS "guard-apple.com" OR requesturl CONTAINS "guard-icloud.com" OR requesturl CONTAINS "guardian-coinbase.com" OR requesturl CONTAINS "guide-gemini.com" OR requesturl CONTAINS "help-bitfinex.com" OR requesturl CONTAINS "help-shakepay.com")
index=activity AND rg_functionality="Unix / Linux / AIX" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "helpdesk-apple.com" OR destinationhostname CONTAINS "helpdesk-gemini.com" OR destinationhostname CONTAINS "helpdesk-icloud.com" OR destinationhostname CONTAINS "identification-coinbase.com" OR destinationhostname CONTAINS "lockdown-coinbase.com" OR destinationhostname CONTAINS "login-nexo.com" OR destinationhostname CONTAINS "keys-coinbase.com" OR destinationhostname CONTAINS "messages-coinbase.com" OR destinationhostname CONTAINS "newpassword-coinbase.com" OR destinationhostname CONTAINS "prompt-coinbase.com" OR destinationhostname CONTAINS "protect-apple.com" OR destinationhostname CONTAINS "protect-coinbase.com" OR destinationhostname CONTAINS "protect-gmail.com" OR destinationhostname CONTAINS "protect-kraken.com" OR destinationhostname CONTAINS "recoverme-coinbase.com" OR destinationhostname CONTAINS "recoveryportal-coinbase.com" OR destinationhostname CONTAINS "refunds-coinbase.com" OR destinationhostname CONTAINS "reset-okta.com" OR destinationhostname CONTAINS "restore-coinbase.com" OR destinationhostname CONTAINS "return-coinbase.com" OR destinationhostname CONTAINS "reverts-coinbase.com" OR destinationhostname CONTAINS "secure-binance.us" OR destinationhostname CONTAINS "secure-icloud.com" OR destinationhostname CONTAINS "secure-nexo.com" OR destinationhostname CONTAINS "secure-shakepay.com" OR destinationhostname CONTAINS "security-umusic.com" OR destinationhostname CONTAINS "server694590423.tech" OR destinationhostname CONTAINS "session-coinbase.com" OR destinationhostname CONTAINS "startrecovery-coinbase.com" OR destinationhostname CONTAINS "signin-kraken.com" OR destinationhostname CONTAINS "suite-trezor.io" OR destinationhostname CONTAINS "supportportal-coinbase.com" OR destinationhostname CONTAINS "tech-icloud.com" OR destinationhostname CONTAINS "threat-coinbase.com" OR destinationhostname CONTAINS "ticket-apple.com" OR destinationhostname CONTAINS "ticket-coinbase.com" OR destinationhostname CONTAINS "tickets-apple.com" OR destinationhostname CONTAINS "tokens-coinbase.com" OR destinationhostname CONTAINS "unblock-coinbase.com" OR destinationhostname CONTAINS "unlink-coinbase.com" OR destinationhostname CONTAINS "your-coinbase.com" OR destinationhostname CONTAINS "welcome-coinbase.com" OR destinationhostname CONTAINS "www-coinbasewallet.com" OR destinationhostname CONTAINS "www-help-coinbase.com" OR destinationhostname CONTAINS "www-help-gemini.com")
index=activity AND rg_functionality="Unix / Linux / AIX" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "helpdesk-apple.com" OR sourcentdomain CONTAINS "helpdesk-gemini.com" OR sourcentdomain CONTAINS "helpdesk-icloud.com" OR sourcentdomain CONTAINS "identification-coinbase.com" OR sourcentdomain CONTAINS "lockdown-coinbase.com" OR sourcentdomain CONTAINS "login-nexo.com" OR sourcentdomain CONTAINS "keys-coinbase.com" OR sourcentdomain CONTAINS "messages-coinbase.com" OR sourcentdomain CONTAINS "newpassword-coinbase.com" OR sourcentdomain CONTAINS "prompt-coinbase.com" OR sourcentdomain CONTAINS "protect-apple.com" OR sourcentdomain CONTAINS "protect-coinbase.com" OR sourcentdomain CONTAINS "protect-gmail.com" OR sourcentdomain CONTAINS "protect-kraken.com" OR sourcentdomain CONTAINS "recoverme-coinbase.com" OR sourcentdomain CONTAINS "recoveryportal-coinbase.com" OR sourcentdomain CONTAINS "refunds-coinbase.com" OR sourcentdomain CONTAINS "reset-okta.com" OR sourcentdomain CONTAINS "restore-coinbase.com" OR sourcentdomain CONTAINS "return-coinbase.com" OR sourcentdomain CONTAINS "reverts-coinbase.com" OR sourcentdomain CONTAINS "secure-binance.us" OR sourcentdomain CONTAINS "secure-icloud.com" OR sourcentdomain CONTAINS "secure-nexo.com" OR sourcentdomain CONTAINS "secure-shakepay.com" OR sourcentdomain CONTAINS "security-umusic.com" OR sourcentdomain CONTAINS "server694590423.tech" OR sourcentdomain CONTAINS "session-coinbase.com" OR sourcentdomain CONTAINS "startrecovery-coinbase.com" OR sourcentdomain CONTAINS "signin-kraken.com" OR sourcentdomain CONTAINS "suite-trezor.io" OR sourcentdomain CONTAINS "supportportal-coinbase.com" OR sourcentdomain CONTAINS "tech-icloud.com" OR sourcentdomain CONTAINS "threat-coinbase.com" OR sourcentdomain CONTAINS "ticket-apple.com" OR sourcentdomain CONTAINS "ticket-coinbase.com" OR sourcentdomain CONTAINS "tickets-apple.com" OR sourcentdomain CONTAINS "tokens-coinbase.com" OR sourcentdomain CONTAINS "unblock-coinbase.com" OR sourcentdomain CONTAINS "unlink-coinbase.com" OR sourcentdomain CONTAINS "your-coinbase.com" OR sourcentdomain CONTAINS "welcome-coinbase.com" OR sourcentdomain CONTAINS "www-coinbasewallet.com" OR sourcentdomain CONTAINS "www-help-coinbase.com" OR sourcentdomain CONTAINS "www-help-gemini.com")
index=activity AND rg_functionality="Unix / Linux / AIX" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "helpdesk-apple.com" OR sourcehostname CONTAINS "helpdesk-gemini.com" OR sourcehostname CONTAINS "helpdesk-icloud.com" OR sourcehostname CONTAINS "identification-coinbase.com" OR sourcehostname CONTAINS "lockdown-coinbase.com" OR sourcehostname CONTAINS "login-nexo.com" OR sourcehostname CONTAINS "keys-coinbase.com" OR sourcehostname CONTAINS "messages-coinbase.com" OR sourcehostname CONTAINS "newpassword-coinbase.com" OR sourcehostname CONTAINS "prompt-coinbase.com" OR sourcehostname CONTAINS "protect-apple.com" OR sourcehostname CONTAINS "protect-coinbase.com" OR sourcehostname CONTAINS "protect-gmail.com" OR sourcehostname CONTAINS "protect-kraken.com" OR sourcehostname CONTAINS "recoverme-coinbase.com" OR sourcehostname CONTAINS "recoveryportal-coinbase.com" OR sourcehostname CONTAINS "refunds-coinbase.com" OR sourcehostname CONTAINS "reset-okta.com" OR sourcehostname CONTAINS "restore-coinbase.com" OR sourcehostname CONTAINS "return-coinbase.com" OR sourcehostname CONTAINS "reverts-coinbase.com" OR sourcehostname CONTAINS "secure-binance.us" OR sourcehostname CONTAINS "secure-icloud.com" OR sourcehostname CONTAINS "secure-nexo.com" OR sourcehostname CONTAINS "secure-shakepay.com" OR sourcehostname CONTAINS "security-umusic.com" OR sourcehostname CONTAINS "server694590423.tech" OR sourcehostname CONTAINS "session-coinbase.com" OR sourcehostname CONTAINS "startrecovery-coinbase.com" OR sourcehostname CONTAINS "signin-kraken.com" OR sourcehostname CONTAINS "suite-trezor.io" OR sourcehostname CONTAINS "supportportal-coinbase.com" OR sourcehostname CONTAINS "tech-icloud.com" OR sourcehostname CONTAINS "threat-coinbase.com" OR sourcehostname CONTAINS "ticket-apple.com" OR sourcehostname CONTAINS "ticket-coinbase.com" OR sourcehostname CONTAINS "tickets-apple.com" OR sourcehostname CONTAINS "tokens-coinbase.com" OR sourcehostname CONTAINS "unblock-coinbase.com" OR sourcehostname CONTAINS "unlink-coinbase.com" OR sourcehostname CONTAINS "your-coinbase.com" OR sourcehostname CONTAINS "welcome-coinbase.com" OR sourcehostname CONTAINS "www-coinbasewallet.com" OR sourcehostname CONTAINS "www-help-coinbase.com" OR sourcehostname CONTAINS "www-help-gemini.com")
index=activity AND rg_functionality="Unix / Linux / AIX" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "helpdesk-apple.com" OR destinationntdomain CONTAINS "helpdesk-gemini.com" OR destinationntdomain CONTAINS "helpdesk-icloud.com" OR destinationntdomain CONTAINS "identification-coinbase.com" OR destinationntdomain CONTAINS "lockdown-coinbase.com" OR destinationntdomain CONTAINS "login-nexo.com" OR destinationntdomain CONTAINS "keys-coinbase.com" OR destinationntdomain CONTAINS "messages-coinbase.com" OR destinationntdomain CONTAINS "newpassword-coinbase.com" OR destinationntdomain CONTAINS "prompt-coinbase.com" OR destinationntdomain CONTAINS "protect-apple.com" OR destinationntdomain CONTAINS "protect-coinbase.com" OR destinationntdomain CONTAINS "protect-gmail.com" OR destinationntdomain CONTAINS "protect-kraken.com" OR destinationntdomain CONTAINS "recoverme-coinbase.com" OR destinationntdomain CONTAINS "recoveryportal-coinbase.com" OR destinationntdomain CONTAINS "refunds-coinbase.com" OR destinationntdomain CONTAINS "reset-okta.com" OR destinationntdomain CONTAINS "restore-coinbase.com" OR destinationntdomain CONTAINS "return-coinbase.com" OR destinationntdomain CONTAINS "reverts-coinbase.com" OR destinationntdomain CONTAINS "secure-binance.us" OR destinationntdomain CONTAINS "secure-icloud.com" OR destinationntdomain CONTAINS "secure-nexo.com" OR destinationntdomain CONTAINS "secure-shakepay.com" OR destinationntdomain CONTAINS "security-umusic.com" OR destinationntdomain CONTAINS "server694590423.tech" OR destinationntdomain CONTAINS "session-coinbase.com" OR destinationntdomain CONTAINS "startrecovery-coinbase.com" OR destinationntdomain CONTAINS "signin-kraken.com" OR destinationntdomain CONTAINS "suite-trezor.io" OR destinationntdomain CONTAINS "supportportal-coinbase.com" OR destinationntdomain CONTAINS "tech-icloud.com" OR destinationntdomain CONTAINS "threat-coinbase.com" OR destinationntdomain CONTAINS "ticket-apple.com" OR destinationntdomain CONTAINS "ticket-coinbase.com" OR destinationntdomain CONTAINS "tickets-apple.com" OR destinationntdomain CONTAINS "tokens-coinbase.com" OR destinationntdomain CONTAINS "unblock-coinbase.com" OR destinationntdomain CONTAINS "unlink-coinbase.com" OR destinationntdomain CONTAINS "your-coinbase.com" OR destinationntdomain CONTAINS "welcome-coinbase.com" OR destinationntdomain CONTAINS "www-coinbasewallet.com" OR destinationntdomain CONTAINS "www-help-coinbase.com" OR destinationntdomain CONTAINS "www-help-gemini.com")
index=activity AND rg_functionality="Unix / Linux / AIX" AND requesturl NOT NULL AND (requesturl CONTAINS "helpdesk-apple.com" OR requesturl CONTAINS "helpdesk-gemini.com" OR requesturl CONTAINS "helpdesk-icloud.com" OR requesturl CONTAINS "identification-coinbase.com" OR requesturl CONTAINS "lockdown-coinbase.com" OR requesturl CONTAINS "login-nexo.com" OR requesturl CONTAINS "keys-coinbase.com" OR requesturl CONTAINS "messages-coinbase.com" OR requesturl CONTAINS "newpassword-coinbase.com" OR requesturl CONTAINS "prompt-coinbase.com" OR requesturl CONTAINS "protect-apple.com" OR requesturl CONTAINS "protect-coinbase.com" OR requesturl CONTAINS "protect-gmail.com" OR requesturl CONTAINS "protect-kraken.com" OR requesturl CONTAINS "recoverme-coinbase.com" OR requesturl CONTAINS "recoveryportal-coinbase.com" OR requesturl CONTAINS "refunds-coinbase.com" OR requesturl CONTAINS "reset-okta.com" OR requesturl CONTAINS "restore-coinbase.com" OR requesturl CONTAINS "return-coinbase.com" OR requesturl CONTAINS "reverts-coinbase.com" OR requesturl CONTAINS "secure-binance.us" OR requesturl CONTAINS "secure-icloud.com" OR requesturl CONTAINS "secure-nexo.com" OR requesturl CONTAINS "secure-shakepay.com" OR requesturl CONTAINS "security-umusic.com" OR requesturl CONTAINS "server694590423.tech" OR requesturl CONTAINS "session-coinbase.com" OR requesturl CONTAINS "startrecovery-coinbase.com" OR requesturl CONTAINS "signin-kraken.com" OR requesturl CONTAINS "suite-trezor.io" OR requesturl CONTAINS "supportportal-coinbase.com" OR requesturl CONTAINS "tech-icloud.com" OR requesturl CONTAINS "threat-coinbase.com" OR requesturl CONTAINS "ticket-apple.com" OR requesturl CONTAINS "ticket-coinbase.com" OR requesturl CONTAINS "tickets-apple.com" OR requesturl CONTAINS "tokens-coinbase.com" OR requesturl CONTAINS "unblock-coinbase.com" OR requesturl CONTAINS "unlink-coinbase.com" OR requesturl CONTAINS "your-coinbase.com" OR requesturl CONTAINS "welcome-coinbase.com" OR requesturl CONTAINS "www-coinbasewallet.com" OR requesturl CONTAINS "www-help-coinbase.com" OR requesturl CONTAINS "www-help-gemini.com")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "official-server.com" OR destinationhostname CONTAINS "server694590423.tech" OR destinationhostname CONTAINS "island-placid-bromine.glitch.me" OR destinationhostname CONTAINS "circular-noon-farmhouse.glitch.me" OR destinationhostname CONTAINS "talented-friendly-price.glitch.me" OR destinationhostname CONTAINS "dflfmgsdokasdcpl.com" OR destinationhostname CONTAINS "original-backend.com" OR destinationhostname CONTAINS "07159889-coinbase.com" OR destinationhostname CONTAINS "10195-coinbase.com" OR destinationhostname CONTAINS "11246-coinbase.com" OR destinationhostname CONTAINS "11247-coinbase.com" OR destinationhostname CONTAINS "11248-coinbase.com" OR destinationhostname CONTAINS "11258-coinbase.com" OR destinationhostname CONTAINS "11259-coinbase.com" OR destinationhostname CONTAINS "113912-coinbase.com" OR destinationhostname CONTAINS "11472-coinbase.com" OR destinationhostname CONTAINS "11923-coinbase.com" OR destinationhostname CONTAINS "11957-coinbase.com" OR destinationhostname CONTAINS "128147-coinbase.com" OR destinationhostname CONTAINS "12958-coinbase.com" OR destinationhostname CONTAINS "12984-okta.com" OR destinationhostname CONTAINS "12985-coinbase.com" OR destinationhostname CONTAINS "13130-coinbase.com" OR destinationhostname CONTAINS "13247-coinbase.com" OR destinationhostname CONTAINS "13247-icloud.com" OR destinationhostname CONTAINS "13267-coinbase.com" OR destinationhostname CONTAINS "146271510-coinbase.com" OR destinationhostname CONTAINS "146282-coinbase.com" OR destinationhostname CONTAINS "146284-coinbase.com" OR destinationhostname CONTAINS "147260-coinbase.com" OR destinationhostname CONTAINS "14765-coinbase.com" OR destinationhostname CONTAINS "14817582-coinbase.com" OR destinationhostname CONTAINS "14871904-coinbase.com" OR destinationhostname CONTAINS "14891902-coinbase.com" OR destinationhostname CONTAINS "1492864-coinbase.com" OR destinationhostname CONTAINS "158312-coinbase.com" OR destinationhostname CONTAINS "158372-coinbase.com" OR destinationhostname CONTAINS "158702-coinbase.com" OR destinationhostname CONTAINS "16171675-coinbase.com" OR destinationhostname CONTAINS "16171832-coinbase.com" OR destinationhostname CONTAINS "16178234-coinbase.com" OR destinationhostname CONTAINS "16178237-coinbase.com" OR destinationhostname CONTAINS "16178434-coinbase.com" OR destinationhostname CONTAINS "162178-coinbase.com" OR destinationhostname CONTAINS "162478-coinbase.com" OR destinationhostname CONTAINS "162782-coinbase.com" OR destinationhostname CONTAINS "162812-coinbase.com" OR destinationhostname CONTAINS "162814-coinbase.com" OR destinationhostname CONTAINS "16442580-coinbase.com" OR destinationhostname CONTAINS "16450107-coinbase.com")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "official-server.com" OR sourcentdomain CONTAINS "server694590423.tech" OR sourcentdomain CONTAINS "island-placid-bromine.glitch.me" OR sourcentdomain CONTAINS "circular-noon-farmhouse.glitch.me" OR sourcentdomain CONTAINS "talented-friendly-price.glitch.me" OR sourcentdomain CONTAINS "dflfmgsdokasdcpl.com" OR sourcentdomain CONTAINS "original-backend.com" OR sourcentdomain CONTAINS "07159889-coinbase.com" OR sourcentdomain CONTAINS "10195-coinbase.com" OR sourcentdomain CONTAINS "11246-coinbase.com" OR sourcentdomain CONTAINS "11247-coinbase.com" OR sourcentdomain CONTAINS "11248-coinbase.com" OR sourcentdomain CONTAINS "11258-coinbase.com" OR sourcentdomain CONTAINS "11259-coinbase.com" OR sourcentdomain CONTAINS "113912-coinbase.com" OR sourcentdomain CONTAINS "11472-coinbase.com" OR sourcentdomain CONTAINS "11923-coinbase.com" OR sourcentdomain CONTAINS "11957-coinbase.com" OR sourcentdomain CONTAINS "128147-coinbase.com" OR sourcentdomain CONTAINS "12958-coinbase.com" OR sourcentdomain CONTAINS "12984-okta.com" OR sourcentdomain CONTAINS "12985-coinbase.com" OR sourcentdomain CONTAINS "13130-coinbase.com" OR sourcentdomain CONTAINS "13247-coinbase.com" OR sourcentdomain CONTAINS "13247-icloud.com" OR sourcentdomain CONTAINS "13267-coinbase.com" OR sourcentdomain CONTAINS "146271510-coinbase.com" OR sourcentdomain CONTAINS "146282-coinbase.com" OR sourcentdomain CONTAINS "146284-coinbase.com" OR sourcentdomain CONTAINS "147260-coinbase.com" OR sourcentdomain CONTAINS "14765-coinbase.com" OR sourcentdomain CONTAINS "14817582-coinbase.com" OR sourcentdomain CONTAINS "14871904-coinbase.com" OR sourcentdomain CONTAINS "14891902-coinbase.com" OR sourcentdomain CONTAINS "1492864-coinbase.com" OR sourcentdomain CONTAINS "158312-coinbase.com" OR sourcentdomain CONTAINS "158372-coinbase.com" OR sourcentdomain CONTAINS "158702-coinbase.com" OR sourcentdomain CONTAINS "16171675-coinbase.com" OR sourcentdomain CONTAINS "16171832-coinbase.com" OR sourcentdomain CONTAINS "16178234-coinbase.com" OR sourcentdomain CONTAINS "16178237-coinbase.com" OR sourcentdomain CONTAINS "16178434-coinbase.com" OR sourcentdomain CONTAINS "162178-coinbase.com" OR sourcentdomain CONTAINS "162478-coinbase.com" OR sourcentdomain CONTAINS "162782-coinbase.com" OR sourcentdomain CONTAINS "162812-coinbase.com" OR sourcentdomain CONTAINS "162814-coinbase.com" OR sourcentdomain CONTAINS "16442580-coinbase.com" OR sourcentdomain CONTAINS "16450107-coinbase.com")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "official-server.com" OR sourcehostname CONTAINS "server694590423.tech" OR sourcehostname CONTAINS "island-placid-bromine.glitch.me" OR sourcehostname CONTAINS "circular-noon-farmhouse.glitch.me" OR sourcehostname CONTAINS "talented-friendly-price.glitch.me" OR sourcehostname CONTAINS "dflfmgsdokasdcpl.com" OR sourcehostname CONTAINS "original-backend.com" OR sourcehostname CONTAINS "07159889-coinbase.com" OR sourcehostname CONTAINS "10195-coinbase.com" OR sourcehostname CONTAINS "11246-coinbase.com" OR sourcehostname CONTAINS "11247-coinbase.com" OR sourcehostname CONTAINS "11248-coinbase.com" OR sourcehostname CONTAINS "11258-coinbase.com" OR sourcehostname CONTAINS "11259-coinbase.com" OR sourcehostname CONTAINS "113912-coinbase.com" OR sourcehostname CONTAINS "11472-coinbase.com" OR sourcehostname CONTAINS "11923-coinbase.com" OR sourcehostname CONTAINS "11957-coinbase.com" OR sourcehostname CONTAINS "128147-coinbase.com" OR sourcehostname CONTAINS "12958-coinbase.com" OR sourcehostname CONTAINS "12984-okta.com" OR sourcehostname CONTAINS "12985-coinbase.com" OR sourcehostname CONTAINS "13130-coinbase.com" OR sourcehostname CONTAINS "13247-coinbase.com" OR sourcehostname CONTAINS "13247-icloud.com" OR sourcehostname CONTAINS "13267-coinbase.com" OR sourcehostname CONTAINS "146271510-coinbase.com" OR sourcehostname CONTAINS "146282-coinbase.com" OR sourcehostname CONTAINS "146284-coinbase.com" OR sourcehostname CONTAINS "147260-coinbase.com" OR sourcehostname CONTAINS "14765-coinbase.com" OR sourcehostname CONTAINS "14817582-coinbase.com" OR sourcehostname CONTAINS "14871904-coinbase.com" OR sourcehostname CONTAINS "14891902-coinbase.com" OR sourcehostname CONTAINS "1492864-coinbase.com" OR sourcehostname CONTAINS "158312-coinbase.com" OR sourcehostname CONTAINS "158372-coinbase.com" OR sourcehostname CONTAINS "158702-coinbase.com" OR sourcehostname CONTAINS "16171675-coinbase.com" OR sourcehostname CONTAINS "16171832-coinbase.com" OR sourcehostname CONTAINS "16178234-coinbase.com" OR sourcehostname CONTAINS "16178237-coinbase.com" OR sourcehostname CONTAINS "16178434-coinbase.com" OR sourcehostname CONTAINS "162178-coinbase.com" OR sourcehostname CONTAINS "162478-coinbase.com" OR sourcehostname CONTAINS "162782-coinbase.com" OR sourcehostname CONTAINS "162812-coinbase.com" OR sourcehostname CONTAINS "162814-coinbase.com" OR sourcehostname CONTAINS "16442580-coinbase.com" OR sourcehostname CONTAINS "16450107-coinbase.com")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "official-server.com" OR destinationntdomain CONTAINS "server694590423.tech" OR destinationntdomain CONTAINS "island-placid-bromine.glitch.me" OR destinationntdomain CONTAINS "circular-noon-farmhouse.glitch.me" OR destinationntdomain CONTAINS "talented-friendly-price.glitch.me" OR destinationntdomain CONTAINS "dflfmgsdokasdcpl.com" OR destinationntdomain CONTAINS "original-backend.com" OR destinationntdomain CONTAINS "07159889-coinbase.com" OR destinationntdomain CONTAINS "10195-coinbase.com" OR destinationntdomain CONTAINS "11246-coinbase.com" OR destinationntdomain CONTAINS "11247-coinbase.com" OR destinationntdomain CONTAINS "11248-coinbase.com" OR destinationntdomain CONTAINS "11258-coinbase.com" OR destinationntdomain CONTAINS "11259-coinbase.com" OR destinationntdomain CONTAINS "113912-coinbase.com" OR destinationntdomain CONTAINS "11472-coinbase.com" OR destinationntdomain CONTAINS "11923-coinbase.com" OR destinationntdomain CONTAINS "11957-coinbase.com" OR destinationntdomain CONTAINS "128147-coinbase.com" OR destinationntdomain CONTAINS "12958-coinbase.com" OR destinationntdomain CONTAINS "12984-okta.com" OR destinationntdomain CONTAINS "12985-coinbase.com" OR destinationntdomain CONTAINS "13130-coinbase.com" OR destinationntdomain CONTAINS "13247-coinbase.com" OR destinationntdomain CONTAINS "13247-icloud.com" OR destinationntdomain CONTAINS "13267-coinbase.com" OR destinationntdomain CONTAINS "146271510-coinbase.com" OR destinationntdomain CONTAINS "146282-coinbase.com" OR destinationntdomain CONTAINS "146284-coinbase.com" OR destinationntdomain CONTAINS "147260-coinbase.com" OR destinationntdomain CONTAINS "14765-coinbase.com" OR destinationntdomain CONTAINS "14817582-coinbase.com" OR destinationntdomain CONTAINS "14871904-coinbase.com" OR destinationntdomain CONTAINS "14891902-coinbase.com" OR destinationntdomain CONTAINS "1492864-coinbase.com" OR destinationntdomain CONTAINS "158312-coinbase.com" OR destinationntdomain CONTAINS "158372-coinbase.com" OR destinationntdomain CONTAINS "158702-coinbase.com" OR destinationntdomain CONTAINS "16171675-coinbase.com" OR destinationntdomain CONTAINS "16171832-coinbase.com" OR destinationntdomain CONTAINS "16178234-coinbase.com" OR destinationntdomain CONTAINS "16178237-coinbase.com" OR destinationntdomain CONTAINS "16178434-coinbase.com" OR destinationntdomain CONTAINS "162178-coinbase.com" OR destinationntdomain CONTAINS "162478-coinbase.com" OR destinationntdomain CONTAINS "162782-coinbase.com" OR destinationntdomain CONTAINS "162812-coinbase.com" OR destinationntdomain CONTAINS "162814-coinbase.com" OR destinationntdomain CONTAINS "16442580-coinbase.com" OR destinationntdomain CONTAINS "16450107-coinbase.com")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND requesturl NOT NULL AND (requesturl CONTAINS "official-server.com" OR requesturl CONTAINS "server694590423.tech" OR requesturl CONTAINS "island-placid-bromine.glitch.me" OR requesturl CONTAINS "circular-noon-farmhouse.glitch.me" OR requesturl CONTAINS "talented-friendly-price.glitch.me" OR requesturl CONTAINS "dflfmgsdokasdcpl.com" OR requesturl CONTAINS "original-backend.com" OR requesturl CONTAINS "07159889-coinbase.com" OR requesturl CONTAINS "10195-coinbase.com" OR requesturl CONTAINS "11246-coinbase.com" OR requesturl CONTAINS "11247-coinbase.com" OR requesturl CONTAINS "11248-coinbase.com" OR requesturl CONTAINS "11258-coinbase.com" OR requesturl CONTAINS "11259-coinbase.com" OR requesturl CONTAINS "113912-coinbase.com" OR requesturl CONTAINS "11472-coinbase.com" OR requesturl CONTAINS "11923-coinbase.com" OR requesturl CONTAINS "11957-coinbase.com" OR requesturl CONTAINS "128147-coinbase.com" OR requesturl CONTAINS "12958-coinbase.com" OR requesturl CONTAINS "12984-okta.com" OR requesturl CONTAINS "12985-coinbase.com" OR requesturl CONTAINS "13130-coinbase.com" OR requesturl CONTAINS "13247-coinbase.com" OR requesturl CONTAINS "13247-icloud.com" OR requesturl CONTAINS "13267-coinbase.com" OR requesturl CONTAINS "146271510-coinbase.com" OR requesturl CONTAINS "146282-coinbase.com" OR requesturl CONTAINS "146284-coinbase.com" OR requesturl CONTAINS "147260-coinbase.com" OR requesturl CONTAINS "14765-coinbase.com" OR requesturl CONTAINS "14817582-coinbase.com" OR requesturl CONTAINS "14871904-coinbase.com" OR requesturl CONTAINS "14891902-coinbase.com" OR requesturl CONTAINS "1492864-coinbase.com" OR requesturl CONTAINS "158312-coinbase.com" OR requesturl CONTAINS "158372-coinbase.com" OR requesturl CONTAINS "158702-coinbase.com" OR requesturl CONTAINS "16171675-coinbase.com" OR requesturl CONTAINS "16171832-coinbase.com" OR requesturl CONTAINS "16178234-coinbase.com" OR requesturl CONTAINS "16178237-coinbase.com" OR requesturl CONTAINS "16178434-coinbase.com" OR requesturl CONTAINS "162178-coinbase.com" OR requesturl CONTAINS "162478-coinbase.com" OR requesturl CONTAINS "162782-coinbase.com" OR requesturl CONTAINS "162812-coinbase.com" OR requesturl CONTAINS "162814-coinbase.com" OR requesturl CONTAINS "16442580-coinbase.com" OR requesturl CONTAINS "16450107-coinbase.com")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "16450207-coinbase.com" OR destinationhostname CONTAINS "16458207-coinbase.com" OR destinationhostname CONTAINS "16478202-coinbase.com" OR destinationhostname CONTAINS "164872942-coinbase.com" OR destinationhostname CONTAINS "16590-coinbase.com" OR destinationhostname CONTAINS "16594373-coinbase.com" OR destinationhostname CONTAINS "16624831-coinbase.com" OR destinationhostname CONTAINS "16642124-coinbase.com" OR destinationhostname CONTAINS "16642172-coinbase.com" OR destinationhostname CONTAINS "16642580-coinbase.com" OR destinationhostname CONTAINS "16642721-coinbase.com" OR destinationhostname CONTAINS "16642724-coinbase.com" OR destinationhostname CONTAINS "16642871-coinbase.com" OR destinationhostname CONTAINS "16642872-coinbase.com" OR destinationhostname CONTAINS "16712942-coinbase.com" OR destinationhostname CONTAINS "16718672-coinbase.com" OR destinationhostname CONTAINS "16728342-coinbase.com" OR destinationhostname CONTAINS "16728348-coinbase.com" OR destinationhostname CONTAINS "16728442-coinbase.com" OR destinationhostname CONTAINS "16728472-coinbase.com" OR destinationhostname CONTAINS "167285-coinbase.com" OR destinationhostname CONTAINS "16729042-coinbase.com" OR destinationhostname CONTAINS "16748272-coinbase.com" OR destinationhostname CONTAINS "16782942-coinbase.com" OR destinationhostname CONTAINS "16827420-coinbase.com" OR destinationhostname CONTAINS "16827423-coinbase.com" OR destinationhostname CONTAINS "16847145-coinbase.com" OR destinationhostname CONTAINS "16893924-coinbase.com" OR destinationhostname CONTAINS "17182-coinbase.com" OR destinationhostname CONTAINS "17255030-coinbase.com" OR destinationhostname CONTAINS "17259-kraken.com" OR destinationhostname CONTAINS "172486-coinbase.com" OR destinationhostname CONTAINS "17284652-coinbase.com" OR destinationhostname CONTAINS "17286-coinbase.com" OR destinationhostname CONTAINS "17334522-coinbase.com" OR destinationhostname CONTAINS "17334522-kraken.com" OR destinationhostname CONTAINS "17384522-coinbase.com" OR destinationhostname CONTAINS "173912-coinbase.com" OR destinationhostname CONTAINS "17494976-coinbase.com" OR destinationhostname CONTAINS "17512854-coinbase.com" OR destinationhostname CONTAINS "17512857-coinbase.com" OR destinationhostname CONTAINS "1751954-coinbase.com" OR destinationhostname CONTAINS "17525030-coinbase.com" OR destinationhostname CONTAINS "17529580-coinbase.com" OR destinationhostname CONTAINS "17614-coinbase.com" OR destinationhostname CONTAINS "17618412-coinbase.com" OR destinationhostname CONTAINS "17619-coinbase.com" OR destinationhostname CONTAINS "176284-coinbase.com" OR destinationhostname CONTAINS "17823920-coinbase.com" OR destinationhostname CONTAINS "178253-coinbase.com")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "16450207-coinbase.com" OR sourcentdomain CONTAINS "16458207-coinbase.com" OR sourcentdomain CONTAINS "16478202-coinbase.com" OR sourcentdomain CONTAINS "164872942-coinbase.com" OR sourcentdomain CONTAINS "16590-coinbase.com" OR sourcentdomain CONTAINS "16594373-coinbase.com" OR sourcentdomain CONTAINS "16624831-coinbase.com" OR sourcentdomain CONTAINS "16642124-coinbase.com" OR sourcentdomain CONTAINS "16642172-coinbase.com" OR sourcentdomain CONTAINS "16642580-coinbase.com" OR sourcentdomain CONTAINS "16642721-coinbase.com" OR sourcentdomain CONTAINS "16642724-coinbase.com" OR sourcentdomain CONTAINS "16642871-coinbase.com" OR sourcentdomain CONTAINS "16642872-coinbase.com" OR sourcentdomain CONTAINS "16712942-coinbase.com" OR sourcentdomain CONTAINS "16718672-coinbase.com" OR sourcentdomain CONTAINS "16728342-coinbase.com" OR sourcentdomain CONTAINS "16728348-coinbase.com" OR sourcentdomain CONTAINS "16728442-coinbase.com" OR sourcentdomain CONTAINS "16728472-coinbase.com" OR sourcentdomain CONTAINS "167285-coinbase.com" OR sourcentdomain CONTAINS "16729042-coinbase.com" OR sourcentdomain CONTAINS "16748272-coinbase.com" OR sourcentdomain CONTAINS "16782942-coinbase.com" OR sourcentdomain CONTAINS "16827420-coinbase.com" OR sourcentdomain CONTAINS "16827423-coinbase.com" OR sourcentdomain CONTAINS "16847145-coinbase.com" OR sourcentdomain CONTAINS "16893924-coinbase.com" OR sourcentdomain CONTAINS "17182-coinbase.com" OR sourcentdomain CONTAINS "17255030-coinbase.com" OR sourcentdomain CONTAINS "17259-kraken.com" OR sourcentdomain CONTAINS "172486-coinbase.com" OR sourcentdomain CONTAINS "17284652-coinbase.com" OR sourcentdomain CONTAINS "17286-coinbase.com" OR sourcentdomain CONTAINS "17334522-coinbase.com" OR sourcentdomain CONTAINS "17334522-kraken.com" OR sourcentdomain CONTAINS "17384522-coinbase.com" OR sourcentdomain CONTAINS "173912-coinbase.com" OR sourcentdomain CONTAINS "17494976-coinbase.com" OR sourcentdomain CONTAINS "17512854-coinbase.com" OR sourcentdomain CONTAINS "17512857-coinbase.com" OR sourcentdomain CONTAINS "1751954-coinbase.com" OR sourcentdomain CONTAINS "17525030-coinbase.com" OR sourcentdomain CONTAINS "17529580-coinbase.com" OR sourcentdomain CONTAINS "17614-coinbase.com" OR sourcentdomain CONTAINS "17618412-coinbase.com" OR sourcentdomain CONTAINS "17619-coinbase.com" OR sourcentdomain CONTAINS "176284-coinbase.com" OR sourcentdomain CONTAINS "17823920-coinbase.com" OR sourcentdomain CONTAINS "178253-coinbase.com")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "16450207-coinbase.com" OR sourcehostname CONTAINS "16458207-coinbase.com" OR sourcehostname CONTAINS "16478202-coinbase.com" OR sourcehostname CONTAINS "164872942-coinbase.com" OR sourcehostname CONTAINS "16590-coinbase.com" OR sourcehostname CONTAINS "16594373-coinbase.com" OR sourcehostname CONTAINS "16624831-coinbase.com" OR sourcehostname CONTAINS "16642124-coinbase.com" OR sourcehostname CONTAINS "16642172-coinbase.com" OR sourcehostname CONTAINS "16642580-coinbase.com" OR sourcehostname CONTAINS "16642721-coinbase.com" OR sourcehostname CONTAINS "16642724-coinbase.com" OR sourcehostname CONTAINS "16642871-coinbase.com" OR sourcehostname CONTAINS "16642872-coinbase.com" OR sourcehostname CONTAINS "16712942-coinbase.com" OR sourcehostname CONTAINS "16718672-coinbase.com" OR sourcehostname CONTAINS "16728342-coinbase.com" OR sourcehostname CONTAINS "16728348-coinbase.com" OR sourcehostname CONTAINS "16728442-coinbase.com" OR sourcehostname CONTAINS "16728472-coinbase.com" OR sourcehostname CONTAINS "167285-coinbase.com" OR sourcehostname CONTAINS "16729042-coinbase.com" OR sourcehostname CONTAINS "16748272-coinbase.com" OR sourcehostname CONTAINS "16782942-coinbase.com" OR sourcehostname CONTAINS "16827420-coinbase.com" OR sourcehostname CONTAINS "16827423-coinbase.com" OR sourcehostname CONTAINS "16847145-coinbase.com" OR sourcehostname CONTAINS "16893924-coinbase.com" OR sourcehostname CONTAINS "17182-coinbase.com" OR sourcehostname CONTAINS "17255030-coinbase.com" OR sourcehostname CONTAINS "17259-kraken.com" OR sourcehostname CONTAINS "172486-coinbase.com" OR sourcehostname CONTAINS "17284652-coinbase.com" OR sourcehostname CONTAINS "17286-coinbase.com" OR sourcehostname CONTAINS "17334522-coinbase.com" OR sourcehostname CONTAINS "17334522-kraken.com" OR sourcehostname CONTAINS "17384522-coinbase.com" OR sourcehostname CONTAINS "173912-coinbase.com" OR sourcehostname CONTAINS "17494976-coinbase.com" OR sourcehostname CONTAINS "17512854-coinbase.com" OR sourcehostname CONTAINS "17512857-coinbase.com" OR sourcehostname CONTAINS "1751954-coinbase.com" OR sourcehostname CONTAINS "17525030-coinbase.com" OR sourcehostname CONTAINS "17529580-coinbase.com" OR sourcehostname CONTAINS "17614-coinbase.com" OR sourcehostname CONTAINS "17618412-coinbase.com" OR sourcehostname CONTAINS "17619-coinbase.com" OR sourcehostname CONTAINS "176284-coinbase.com" OR sourcehostname CONTAINS "17823920-coinbase.com" OR sourcehostname CONTAINS "178253-coinbase.com")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "16450207-coinbase.com" OR destinationntdomain CONTAINS "16458207-coinbase.com" OR destinationntdomain CONTAINS "16478202-coinbase.com" OR destinationntdomain CONTAINS "164872942-coinbase.com" OR destinationntdomain CONTAINS "16590-coinbase.com" OR destinationntdomain CONTAINS "16594373-coinbase.com" OR destinationntdomain CONTAINS "16624831-coinbase.com" OR destinationntdomain CONTAINS "16642124-coinbase.com" OR destinationntdomain CONTAINS "16642172-coinbase.com" OR destinationntdomain CONTAINS "16642580-coinbase.com" OR destinationntdomain CONTAINS "16642721-coinbase.com" OR destinationntdomain CONTAINS "16642724-coinbase.com" OR destinationntdomain CONTAINS "16642871-coinbase.com" OR destinationntdomain CONTAINS "16642872-coinbase.com" OR destinationntdomain CONTAINS "16712942-coinbase.com" OR destinationntdomain CONTAINS "16718672-coinbase.com" OR destinationntdomain CONTAINS "16728342-coinbase.com" OR destinationntdomain CONTAINS "16728348-coinbase.com" OR destinationntdomain CONTAINS "16728442-coinbase.com" OR destinationntdomain CONTAINS "16728472-coinbase.com" OR destinationntdomain CONTAINS "167285-coinbase.com" OR destinationntdomain CONTAINS "16729042-coinbase.com" OR destinationntdomain CONTAINS "16748272-coinbase.com" OR destinationntdomain CONTAINS "16782942-coinbase.com" OR destinationntdomain CONTAINS "16827420-coinbase.com" OR destinationntdomain CONTAINS "16827423-coinbase.com" OR destinationntdomain CONTAINS "16847145-coinbase.com" OR destinationntdomain CONTAINS "16893924-coinbase.com" OR destinationntdomain CONTAINS "17182-coinbase.com" OR destinationntdomain CONTAINS "17255030-coinbase.com" OR destinationntdomain CONTAINS "17259-kraken.com" OR destinationntdomain CONTAINS "172486-coinbase.com" OR destinationntdomain CONTAINS "17284652-coinbase.com" OR destinationntdomain CONTAINS "17286-coinbase.com" OR destinationntdomain CONTAINS "17334522-coinbase.com" OR destinationntdomain CONTAINS "17334522-kraken.com" OR destinationntdomain CONTAINS "17384522-coinbase.com" OR destinationntdomain CONTAINS "173912-coinbase.com" OR destinationntdomain CONTAINS "17494976-coinbase.com" OR destinationntdomain CONTAINS "17512854-coinbase.com" OR destinationntdomain CONTAINS "17512857-coinbase.com" OR destinationntdomain CONTAINS "1751954-coinbase.com" OR destinationntdomain CONTAINS "17525030-coinbase.com" OR destinationntdomain CONTAINS "17529580-coinbase.com" OR destinationntdomain CONTAINS "17614-coinbase.com" OR destinationntdomain CONTAINS "17618412-coinbase.com" OR destinationntdomain CONTAINS "17619-coinbase.com" OR destinationntdomain CONTAINS "176284-coinbase.com" OR destinationntdomain CONTAINS "17823920-coinbase.com" OR destinationntdomain CONTAINS "178253-coinbase.com")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND requesturl NOT NULL AND (requesturl CONTAINS "16450207-coinbase.com" OR requesturl CONTAINS "16458207-coinbase.com" OR requesturl CONTAINS "16478202-coinbase.com" OR requesturl CONTAINS "164872942-coinbase.com" OR requesturl CONTAINS "16590-coinbase.com" OR requesturl CONTAINS "16594373-coinbase.com" OR requesturl CONTAINS "16624831-coinbase.com" OR requesturl CONTAINS "16642124-coinbase.com" OR requesturl CONTAINS "16642172-coinbase.com" OR requesturl CONTAINS "16642580-coinbase.com" OR requesturl CONTAINS "16642721-coinbase.com" OR requesturl CONTAINS "16642724-coinbase.com" OR requesturl CONTAINS "16642871-coinbase.com" OR requesturl CONTAINS "16642872-coinbase.com" OR requesturl CONTAINS "16712942-coinbase.com" OR requesturl CONTAINS "16718672-coinbase.com" OR requesturl CONTAINS "16728342-coinbase.com" OR requesturl CONTAINS "16728348-coinbase.com" OR requesturl CONTAINS "16728442-coinbase.com" OR requesturl CONTAINS "16728472-coinbase.com" OR requesturl CONTAINS "167285-coinbase.com" OR requesturl CONTAINS "16729042-coinbase.com" OR requesturl CONTAINS "16748272-coinbase.com" OR requesturl CONTAINS "16782942-coinbase.com" OR requesturl CONTAINS "16827420-coinbase.com" OR requesturl CONTAINS "16827423-coinbase.com" OR requesturl CONTAINS "16847145-coinbase.com" OR requesturl CONTAINS "16893924-coinbase.com" OR requesturl CONTAINS "17182-coinbase.com" OR requesturl CONTAINS "17255030-coinbase.com" OR requesturl CONTAINS "17259-kraken.com" OR requesturl CONTAINS "172486-coinbase.com" OR requesturl CONTAINS "17284652-coinbase.com" OR requesturl CONTAINS "17286-coinbase.com" OR requesturl CONTAINS "17334522-coinbase.com" OR requesturl CONTAINS "17334522-kraken.com" OR requesturl CONTAINS "17384522-coinbase.com" OR requesturl CONTAINS "173912-coinbase.com" OR requesturl CONTAINS "17494976-coinbase.com" OR requesturl CONTAINS "17512854-coinbase.com" OR requesturl CONTAINS "17512857-coinbase.com" OR requesturl CONTAINS "1751954-coinbase.com" OR requesturl CONTAINS "17525030-coinbase.com" OR requesturl CONTAINS "17529580-coinbase.com" OR requesturl CONTAINS "17614-coinbase.com" OR requesturl CONTAINS "17618412-coinbase.com" OR requesturl CONTAINS "17619-coinbase.com" OR requesturl CONTAINS "176284-coinbase.com" OR requesturl CONTAINS "17823920-coinbase.com" OR requesturl CONTAINS "178253-coinbase.com")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "178294-coinbase.com" OR destinationhostname CONTAINS "17912-coinbase.com" OR destinationhostname CONTAINS "17914-coinbase.com" OR destinationhostname CONTAINS "17917-coinbase.com" OR destinationhostname CONTAINS "17954-coinbase.com" OR destinationhostname CONTAINS "17958-coinbase.com" OR destinationhostname CONTAINS "182043-coinbase.com" OR destinationhostname CONTAINS "18275-gemini.com" OR destinationhostname CONTAINS "18276-coinbase.com" OR destinationhostname CONTAINS "18290185-coinbase.com" OR destinationhostname CONTAINS "182967-coinbase.com" OR destinationhostname CONTAINS "18560-coinbase.com" OR destinationhostname CONTAINS "18571-coinbase.com" OR destinationhostname CONTAINS "185912-coinbase.com" OR destinationhostname CONTAINS "185914-coinbase.com" OR destinationhostname CONTAINS "18592176-coinbase.com" OR destinationhostname CONTAINS "18594162-coinbase.com" OR destinationhostname CONTAINS "18594962-coinbase.com" OR destinationhostname CONTAINS "18597162-coinbase.com" OR destinationhostname CONTAINS "18719562-coinbase.com" OR destinationhostname CONTAINS "1875290-coinbase.com" OR destinationhostname CONTAINS "1882730-coinbase.com" OR destinationhostname CONTAINS "18902-coinbase.com" OR destinationhostname CONTAINS "18903-coinbase.com" OR destinationhostname CONTAINS "189126-coinbase.com" OR destinationhostname CONTAINS "18952-coinbase.com" OR destinationhostname CONTAINS "192854-coinbase.com" OR destinationhostname CONTAINS "192856-coinbase.com" OR destinationhostname CONTAINS "19287-binance.com" OR destinationhostname CONTAINS "19572-coinbase.com" OR destinationhostname CONTAINS "195812-coinbase.com" OR destinationhostname CONTAINS "195826-coinbase.com" OR destinationhostname CONTAINS "1958262-coinbase.com" OR destinationhostname CONTAINS "195827-binance.com" OR destinationhostname CONTAINS "1958297-coinbase.com" OR destinationhostname CONTAINS "19582970-coinbase.com" OR destinationhostname CONTAINS "19582971-coinbase.com" OR destinationhostname CONTAINS "19583-coinbase.com" OR destinationhostname CONTAINS "19592653-coinbase.com" OR destinationhostname CONTAINS "197304-coinbase.com" OR destinationhostname CONTAINS "19730492-coinbase.com" OR destinationhostname CONTAINS "19764162-coinbase.com" OR destinationhostname CONTAINS "19803-coinbase.com" OR destinationhostname CONTAINS "201784289-coinbase.com" OR destinationhostname CONTAINS "210823644-coinbase.com" OR destinationhostname CONTAINS "21158-coinbase.com" OR destinationhostname CONTAINS "21509-coinbase.com" OR destinationhostname CONTAINS "25985-coinbase.com" OR destinationhostname CONTAINS "27699-coinbase.com" OR destinationhostname CONTAINS "28367-coinbase.com")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "178294-coinbase.com" OR sourcentdomain CONTAINS "17912-coinbase.com" OR sourcentdomain CONTAINS "17914-coinbase.com" OR sourcentdomain CONTAINS "17917-coinbase.com" OR sourcentdomain CONTAINS "17954-coinbase.com" OR sourcentdomain CONTAINS "17958-coinbase.com" OR sourcentdomain CONTAINS "182043-coinbase.com" OR sourcentdomain CONTAINS "18275-gemini.com" OR sourcentdomain CONTAINS "18276-coinbase.com" OR sourcentdomain CONTAINS "18290185-coinbase.com" OR sourcentdomain CONTAINS "182967-coinbase.com" OR sourcentdomain CONTAINS "18560-coinbase.com" OR sourcentdomain CONTAINS "18571-coinbase.com" OR sourcentdomain CONTAINS "185912-coinbase.com" OR sourcentdomain CONTAINS "185914-coinbase.com" OR sourcentdomain CONTAINS "18592176-coinbase.com" OR sourcentdomain CONTAINS "18594162-coinbase.com" OR sourcentdomain CONTAINS "18594962-coinbase.com" OR sourcentdomain CONTAINS "18597162-coinbase.com" OR sourcentdomain CONTAINS "18719562-coinbase.com" OR sourcentdomain CONTAINS "1875290-coinbase.com" OR sourcentdomain CONTAINS "1882730-coinbase.com" OR sourcentdomain CONTAINS "18902-coinbase.com" OR sourcentdomain CONTAINS "18903-coinbase.com" OR sourcentdomain CONTAINS "189126-coinbase.com" OR sourcentdomain CONTAINS "18952-coinbase.com" OR sourcentdomain CONTAINS "192854-coinbase.com" OR sourcentdomain CONTAINS "192856-coinbase.com" OR sourcentdomain CONTAINS "19287-binance.com" OR sourcentdomain CONTAINS "19572-coinbase.com" OR sourcentdomain CONTAINS "195812-coinbase.com" OR sourcentdomain CONTAINS "195826-coinbase.com" OR sourcentdomain CONTAINS "1958262-coinbase.com" OR sourcentdomain CONTAINS "195827-binance.com" OR sourcentdomain CONTAINS "1958297-coinbase.com" OR sourcentdomain CONTAINS "19582970-coinbase.com" OR sourcentdomain CONTAINS "19582971-coinbase.com" OR sourcentdomain CONTAINS "19583-coinbase.com" OR sourcentdomain CONTAINS "19592653-coinbase.com" OR sourcentdomain CONTAINS "197304-coinbase.com" OR sourcentdomain CONTAINS "19730492-coinbase.com" OR sourcentdomain CONTAINS "19764162-coinbase.com" OR sourcentdomain CONTAINS "19803-coinbase.com" OR sourcentdomain CONTAINS "201784289-coinbase.com" OR sourcentdomain CONTAINS "210823644-coinbase.com" OR sourcentdomain CONTAINS "21158-coinbase.com" OR sourcentdomain CONTAINS "21509-coinbase.com" OR sourcentdomain CONTAINS "25985-coinbase.com" OR sourcentdomain CONTAINS "27699-coinbase.com" OR sourcentdomain CONTAINS "28367-coinbase.com")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "178294-coinbase.com" OR sourcehostname CONTAINS "17912-coinbase.com" OR sourcehostname CONTAINS "17914-coinbase.com" OR sourcehostname CONTAINS "17917-coinbase.com" OR sourcehostname CONTAINS "17954-coinbase.com" OR sourcehostname CONTAINS "17958-coinbase.com" OR sourcehostname CONTAINS "182043-coinbase.com" OR sourcehostname CONTAINS "18275-gemini.com" OR sourcehostname CONTAINS "18276-coinbase.com" OR sourcehostname CONTAINS "18290185-coinbase.com" OR sourcehostname CONTAINS "182967-coinbase.com" OR sourcehostname CONTAINS "18560-coinbase.com" OR sourcehostname CONTAINS "18571-coinbase.com" OR sourcehostname CONTAINS "185912-coinbase.com" OR sourcehostname CONTAINS "185914-coinbase.com" OR sourcehostname CONTAINS "18592176-coinbase.com" OR sourcehostname CONTAINS "18594162-coinbase.com" OR sourcehostname CONTAINS "18594962-coinbase.com" OR sourcehostname CONTAINS "18597162-coinbase.com" OR sourcehostname CONTAINS "18719562-coinbase.com" OR sourcehostname CONTAINS "1875290-coinbase.com" OR sourcehostname CONTAINS "1882730-coinbase.com" OR sourcehostname CONTAINS "18902-coinbase.com" OR sourcehostname CONTAINS "18903-coinbase.com" OR sourcehostname CONTAINS "189126-coinbase.com" OR sourcehostname CONTAINS "18952-coinbase.com" OR sourcehostname CONTAINS "192854-coinbase.com" OR sourcehostname CONTAINS "192856-coinbase.com" OR sourcehostname CONTAINS "19287-binance.com" OR sourcehostname CONTAINS "19572-coinbase.com" OR sourcehostname CONTAINS "195812-coinbase.com" OR sourcehostname CONTAINS "195826-coinbase.com" OR sourcehostname CONTAINS "1958262-coinbase.com" OR sourcehostname CONTAINS "195827-binance.com" OR sourcehostname CONTAINS "1958297-coinbase.com" OR sourcehostname CONTAINS "19582970-coinbase.com" OR sourcehostname CONTAINS "19582971-coinbase.com" OR sourcehostname CONTAINS "19583-coinbase.com" OR sourcehostname CONTAINS "19592653-coinbase.com" OR sourcehostname CONTAINS "197304-coinbase.com" OR sourcehostname CONTAINS "19730492-coinbase.com" OR sourcehostname CONTAINS "19764162-coinbase.com" OR sourcehostname CONTAINS "19803-coinbase.com" OR sourcehostname CONTAINS "201784289-coinbase.com" OR sourcehostname CONTAINS "210823644-coinbase.com" OR sourcehostname CONTAINS "21158-coinbase.com" OR sourcehostname CONTAINS "21509-coinbase.com" OR sourcehostname CONTAINS "25985-coinbase.com" OR sourcehostname CONTAINS "27699-coinbase.com" OR sourcehostname CONTAINS "28367-coinbase.com")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "178294-coinbase.com" OR destinationntdomain CONTAINS "17912-coinbase.com" OR destinationntdomain CONTAINS "17914-coinbase.com" OR destinationntdomain CONTAINS "17917-coinbase.com" OR destinationntdomain CONTAINS "17954-coinbase.com" OR destinationntdomain CONTAINS "17958-coinbase.com" OR destinationntdomain CONTAINS "182043-coinbase.com" OR destinationntdomain CONTAINS "18275-gemini.com" OR destinationntdomain CONTAINS "18276-coinbase.com" OR destinationntdomain CONTAINS "18290185-coinbase.com" OR destinationntdomain CONTAINS "182967-coinbase.com" OR destinationntdomain CONTAINS "18560-coinbase.com" OR destinationntdomain CONTAINS "18571-coinbase.com" OR destinationntdomain CONTAINS "185912-coinbase.com" OR destinationntdomain CONTAINS "185914-coinbase.com" OR destinationntdomain CONTAINS "18592176-coinbase.com" OR destinationntdomain CONTAINS "18594162-coinbase.com" OR destinationntdomain CONTAINS "18594962-coinbase.com" OR destinationntdomain CONTAINS "18597162-coinbase.com" OR destinationntdomain CONTAINS "18719562-coinbase.com" OR destinationntdomain CONTAINS "1875290-coinbase.com" OR destinationntdomain CONTAINS "1882730-coinbase.com" OR destinationntdomain CONTAINS "18902-coinbase.com" OR destinationntdomain CONTAINS "18903-coinbase.com" OR destinationntdomain CONTAINS "189126-coinbase.com" OR destinationntdomain CONTAINS "18952-coinbase.com" OR destinationntdomain CONTAINS "192854-coinbase.com" OR destinationntdomain CONTAINS "192856-coinbase.com" OR destinationntdomain CONTAINS "19287-binance.com" OR destinationntdomain CONTAINS "19572-coinbase.com" OR destinationntdomain CONTAINS "195812-coinbase.com" OR destinationntdomain CONTAINS "195826-coinbase.com" OR destinationntdomain CONTAINS "1958262-coinbase.com" OR destinationntdomain CONTAINS "195827-binance.com" OR destinationntdomain CONTAINS "1958297-coinbase.com" OR destinationntdomain CONTAINS "19582970-coinbase.com" OR destinationntdomain CONTAINS "19582971-coinbase.com" OR destinationntdomain CONTAINS "19583-coinbase.com" OR destinationntdomain CONTAINS "19592653-coinbase.com" OR destinationntdomain CONTAINS "197304-coinbase.com" OR destinationntdomain CONTAINS "19730492-coinbase.com" OR destinationntdomain CONTAINS "19764162-coinbase.com" OR destinationntdomain CONTAINS "19803-coinbase.com" OR destinationntdomain CONTAINS "201784289-coinbase.com" OR destinationntdomain CONTAINS "210823644-coinbase.com" OR destinationntdomain CONTAINS "21158-coinbase.com" OR destinationntdomain CONTAINS "21509-coinbase.com" OR destinationntdomain CONTAINS "25985-coinbase.com" OR destinationntdomain CONTAINS "27699-coinbase.com" OR destinationntdomain CONTAINS "28367-coinbase.com")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND requesturl NOT NULL AND (requesturl CONTAINS "178294-coinbase.com" OR requesturl CONTAINS "17912-coinbase.com" OR requesturl CONTAINS "17914-coinbase.com" OR requesturl CONTAINS "17917-coinbase.com" OR requesturl CONTAINS "17954-coinbase.com" OR requesturl CONTAINS "17958-coinbase.com" OR requesturl CONTAINS "182043-coinbase.com" OR requesturl CONTAINS "18275-gemini.com" OR requesturl CONTAINS "18276-coinbase.com" OR requesturl CONTAINS "18290185-coinbase.com" OR requesturl CONTAINS "182967-coinbase.com" OR requesturl CONTAINS "18560-coinbase.com" OR requesturl CONTAINS "18571-coinbase.com" OR requesturl CONTAINS "185912-coinbase.com" OR requesturl CONTAINS "185914-coinbase.com" OR requesturl CONTAINS "18592176-coinbase.com" OR requesturl CONTAINS "18594162-coinbase.com" OR requesturl CONTAINS "18594962-coinbase.com" OR requesturl CONTAINS "18597162-coinbase.com" OR requesturl CONTAINS "18719562-coinbase.com" OR requesturl CONTAINS "1875290-coinbase.com" OR requesturl CONTAINS "1882730-coinbase.com" OR requesturl CONTAINS "18902-coinbase.com" OR requesturl CONTAINS "18903-coinbase.com" OR requesturl CONTAINS "189126-coinbase.com" OR requesturl CONTAINS "18952-coinbase.com" OR requesturl CONTAINS "192854-coinbase.com" OR requesturl CONTAINS "192856-coinbase.com" OR requesturl CONTAINS "19287-binance.com" OR requesturl CONTAINS "19572-coinbase.com" OR requesturl CONTAINS "195812-coinbase.com" OR requesturl CONTAINS "195826-coinbase.com" OR requesturl CONTAINS "1958262-coinbase.com" OR requesturl CONTAINS "195827-binance.com" OR requesturl CONTAINS "1958297-coinbase.com" OR requesturl CONTAINS "19582970-coinbase.com" OR requesturl CONTAINS "19582971-coinbase.com" OR requesturl CONTAINS "19583-coinbase.com" OR requesturl CONTAINS "19592653-coinbase.com" OR requesturl CONTAINS "197304-coinbase.com" OR requesturl CONTAINS "19730492-coinbase.com" OR requesturl CONTAINS "19764162-coinbase.com" OR requesturl CONTAINS "19803-coinbase.com" OR requesturl CONTAINS "201784289-coinbase.com" OR requesturl CONTAINS "210823644-coinbase.com" OR requesturl CONTAINS "21158-coinbase.com" OR requesturl CONTAINS "21509-coinbase.com" OR requesturl CONTAINS "25985-coinbase.com" OR requesturl CONTAINS "27699-coinbase.com" OR requesturl CONTAINS "28367-coinbase.com")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "28676-coinbase.com" OR destinationhostname CONTAINS "29185-coinbase.com" OR destinationhostname CONTAINS "29195-coinbase.com" OR destinationhostname CONTAINS "2a-coinbase.com" OR destinationhostname CONTAINS "2b-coinbase.com" OR destinationhostname CONTAINS "2c-coinbase.com" OR destinationhostname CONTAINS "2f-coinbase.com" OR destinationhostname CONTAINS "2fas-coinbase.com" OR destinationhostname CONTAINS "2o-coinbase.com" OR destinationhostname CONTAINS "2r-coinbase.com" OR destinationhostname CONTAINS "2s-coinbase.com" OR destinationhostname CONTAINS "2sv-coinbase.com" OR destinationhostname CONTAINS "352134951-coinbase.com" OR destinationhostname CONTAINS "38468-coinbase.com" OR destinationhostname CONTAINS "39590-coinbase.com" OR destinationhostname CONTAINS "41260-coinbase.com" OR destinationhostname CONTAINS "427883-coinbase.com" OR destinationhostname CONTAINS "43017-coinbase.com" OR destinationhostname CONTAINS "47562-coinbase.com" OR destinationhostname CONTAINS "50195-coinbase.com" OR destinationhostname CONTAINS "5247-coinbase.com" OR destinationhostname CONTAINS "54765-coinbase.com" OR destinationhostname CONTAINS "57197-coinbase.com" OR destinationhostname CONTAINS "58176-coinbase.com" OR destinationhostname CONTAINS "58297-coinbase.com" OR destinationhostname CONTAINS "61250-coinbase.com" OR destinationhostname CONTAINS "61835-coinbase.com" OR destinationhostname CONTAINS "61851-coinbase.com" OR destinationhostname CONTAINS "61937-coinbase.com" OR destinationhostname CONTAINS "71925-coinbase.com" OR destinationhostname CONTAINS "72957-coinbase.com" OR destinationhostname CONTAINS "72985-coinbase.com" OR destinationhostname CONTAINS "74651-coinbase.com" OR destinationhostname CONTAINS "754668948-coinbase.com" OR destinationhostname CONTAINS "76159869-coinbase.com" OR destinationhostname CONTAINS "76153-coinbase.com" OR destinationhostname CONTAINS "81758-coinbase.com" OR destinationhostname CONTAINS "81920-coinbase.com" OR destinationhostname CONTAINS "81926-coinbase.com" OR destinationhostname CONTAINS "81958-coinbase.com" OR destinationhostname CONTAINS "826298-coinbase.com" OR destinationhostname CONTAINS "83216-coinbase.com" OR destinationhostname CONTAINS "837613-coinbase.com" OR destinationhostname CONTAINS "83956-coinbase.com" OR destinationhostname CONTAINS "87157-coinbase.com" OR destinationhostname CONTAINS "87312-coinbase.com" OR destinationhostname CONTAINS "89304-coinbase.com" OR destinationhostname CONTAINS "89375-coinbase.com" OR destinationhostname CONTAINS "91723-gemini.com" OR destinationhostname CONTAINS "91752-coinbase.com")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "28676-coinbase.com" OR sourcentdomain CONTAINS "29185-coinbase.com" OR sourcentdomain CONTAINS "29195-coinbase.com" OR sourcentdomain CONTAINS "2a-coinbase.com" OR sourcentdomain CONTAINS "2b-coinbase.com" OR sourcentdomain CONTAINS "2c-coinbase.com" OR sourcentdomain CONTAINS "2f-coinbase.com" OR sourcentdomain CONTAINS "2fas-coinbase.com" OR sourcentdomain CONTAINS "2o-coinbase.com" OR sourcentdomain CONTAINS "2r-coinbase.com" OR sourcentdomain CONTAINS "2s-coinbase.com" OR sourcentdomain CONTAINS "2sv-coinbase.com" OR sourcentdomain CONTAINS "352134951-coinbase.com" OR sourcentdomain CONTAINS "38468-coinbase.com" OR sourcentdomain CONTAINS "39590-coinbase.com" OR sourcentdomain CONTAINS "41260-coinbase.com" OR sourcentdomain CONTAINS "427883-coinbase.com" OR sourcentdomain CONTAINS "43017-coinbase.com" OR sourcentdomain CONTAINS "47562-coinbase.com" OR sourcentdomain CONTAINS "50195-coinbase.com" OR sourcentdomain CONTAINS "5247-coinbase.com" OR sourcentdomain CONTAINS "54765-coinbase.com" OR sourcentdomain CONTAINS "57197-coinbase.com" OR sourcentdomain CONTAINS "58176-coinbase.com" OR sourcentdomain CONTAINS "58297-coinbase.com" OR sourcentdomain CONTAINS "61250-coinbase.com" OR sourcentdomain CONTAINS "61835-coinbase.com" OR sourcentdomain CONTAINS "61851-coinbase.com" OR sourcentdomain CONTAINS "61937-coinbase.com" OR sourcentdomain CONTAINS "71925-coinbase.com" OR sourcentdomain CONTAINS "72957-coinbase.com" OR sourcentdomain CONTAINS "72985-coinbase.com" OR sourcentdomain CONTAINS "74651-coinbase.com" OR sourcentdomain CONTAINS "754668948-coinbase.com" OR sourcentdomain CONTAINS "76159869-coinbase.com" OR sourcentdomain CONTAINS "76153-coinbase.com" OR sourcentdomain CONTAINS "81758-coinbase.com" OR sourcentdomain CONTAINS "81920-coinbase.com" OR sourcentdomain CONTAINS "81926-coinbase.com" OR sourcentdomain CONTAINS "81958-coinbase.com" OR sourcentdomain CONTAINS "826298-coinbase.com" OR sourcentdomain CONTAINS "83216-coinbase.com" OR sourcentdomain CONTAINS "837613-coinbase.com" OR sourcentdomain CONTAINS "83956-coinbase.com" OR sourcentdomain CONTAINS "87157-coinbase.com" OR sourcentdomain CONTAINS "87312-coinbase.com" OR sourcentdomain CONTAINS "89304-coinbase.com" OR sourcentdomain CONTAINS "89375-coinbase.com" OR sourcentdomain CONTAINS "91723-gemini.com" OR sourcentdomain CONTAINS "91752-coinbase.com")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "28676-coinbase.com" OR sourcehostname CONTAINS "29185-coinbase.com" OR sourcehostname CONTAINS "29195-coinbase.com" OR sourcehostname CONTAINS "2a-coinbase.com" OR sourcehostname CONTAINS "2b-coinbase.com" OR sourcehostname CONTAINS "2c-coinbase.com" OR sourcehostname CONTAINS "2f-coinbase.com" OR sourcehostname CONTAINS "2fas-coinbase.com" OR sourcehostname CONTAINS "2o-coinbase.com" OR sourcehostname CONTAINS "2r-coinbase.com" OR sourcehostname CONTAINS "2s-coinbase.com" OR sourcehostname CONTAINS "2sv-coinbase.com" OR sourcehostname CONTAINS "352134951-coinbase.com" OR sourcehostname CONTAINS "38468-coinbase.com" OR sourcehostname CONTAINS "39590-coinbase.com" OR sourcehostname CONTAINS "41260-coinbase.com" OR sourcehostname CONTAINS "427883-coinbase.com" OR sourcehostname CONTAINS "43017-coinbase.com" OR sourcehostname CONTAINS "47562-coinbase.com" OR sourcehostname CONTAINS "50195-coinbase.com" OR sourcehostname CONTAINS "5247-coinbase.com" OR sourcehostname CONTAINS "54765-coinbase.com" OR sourcehostname CONTAINS "57197-coinbase.com" OR sourcehostname CONTAINS "58176-coinbase.com" OR sourcehostname CONTAINS "58297-coinbase.com" OR sourcehostname CONTAINS "61250-coinbase.com" OR sourcehostname CONTAINS "61835-coinbase.com" OR sourcehostname CONTAINS "61851-coinbase.com" OR sourcehostname CONTAINS "61937-coinbase.com" OR sourcehostname CONTAINS "71925-coinbase.com" OR sourcehostname CONTAINS "72957-coinbase.com" OR sourcehostname CONTAINS "72985-coinbase.com" OR sourcehostname CONTAINS "74651-coinbase.com" OR sourcehostname CONTAINS "754668948-coinbase.com" OR sourcehostname CONTAINS "76159869-coinbase.com" OR sourcehostname CONTAINS "76153-coinbase.com" OR sourcehostname CONTAINS "81758-coinbase.com" OR sourcehostname CONTAINS "81920-coinbase.com" OR sourcehostname CONTAINS "81926-coinbase.com" OR sourcehostname CONTAINS "81958-coinbase.com" OR sourcehostname CONTAINS "826298-coinbase.com" OR sourcehostname CONTAINS "83216-coinbase.com" OR sourcehostname CONTAINS "837613-coinbase.com" OR sourcehostname CONTAINS "83956-coinbase.com" OR sourcehostname CONTAINS "87157-coinbase.com" OR sourcehostname CONTAINS "87312-coinbase.com" OR sourcehostname CONTAINS "89304-coinbase.com" OR sourcehostname CONTAINS "89375-coinbase.com" OR sourcehostname CONTAINS "91723-gemini.com" OR sourcehostname CONTAINS "91752-coinbase.com")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "28676-coinbase.com" OR destinationntdomain CONTAINS "29185-coinbase.com" OR destinationntdomain CONTAINS "29195-coinbase.com" OR destinationntdomain CONTAINS "2a-coinbase.com" OR destinationntdomain CONTAINS "2b-coinbase.com" OR destinationntdomain CONTAINS "2c-coinbase.com" OR destinationntdomain CONTAINS "2f-coinbase.com" OR destinationntdomain CONTAINS "2fas-coinbase.com" OR destinationntdomain CONTAINS "2o-coinbase.com" OR destinationntdomain CONTAINS "2r-coinbase.com" OR destinationntdomain CONTAINS "2s-coinbase.com" OR destinationntdomain CONTAINS "2sv-coinbase.com" OR destinationntdomain CONTAINS "352134951-coinbase.com" OR destinationntdomain CONTAINS "38468-coinbase.com" OR destinationntdomain CONTAINS "39590-coinbase.com" OR destinationntdomain CONTAINS "41260-coinbase.com" OR destinationntdomain CONTAINS "427883-coinbase.com" OR destinationntdomain CONTAINS "43017-coinbase.com" OR destinationntdomain CONTAINS "47562-coinbase.com" OR destinationntdomain CONTAINS "50195-coinbase.com" OR destinationntdomain CONTAINS "5247-coinbase.com" OR destinationntdomain CONTAINS "54765-coinbase.com" OR destinationntdomain CONTAINS "57197-coinbase.com" OR destinationntdomain CONTAINS "58176-coinbase.com" OR destinationntdomain CONTAINS "58297-coinbase.com" OR destinationntdomain CONTAINS "61250-coinbase.com" OR destinationntdomain CONTAINS "61835-coinbase.com" OR destinationntdomain CONTAINS "61851-coinbase.com" OR destinationntdomain CONTAINS "61937-coinbase.com" OR destinationntdomain CONTAINS "71925-coinbase.com" OR destinationntdomain CONTAINS "72957-coinbase.com" OR destinationntdomain CONTAINS "72985-coinbase.com" OR destinationntdomain CONTAINS "74651-coinbase.com" OR destinationntdomain CONTAINS "754668948-coinbase.com" OR destinationntdomain CONTAINS "76159869-coinbase.com" OR destinationntdomain CONTAINS "76153-coinbase.com" OR destinationntdomain CONTAINS "81758-coinbase.com" OR destinationntdomain CONTAINS "81920-coinbase.com" OR destinationntdomain CONTAINS "81926-coinbase.com" OR destinationntdomain CONTAINS "81958-coinbase.com" OR destinationntdomain CONTAINS "826298-coinbase.com" OR destinationntdomain CONTAINS "83216-coinbase.com" OR destinationntdomain CONTAINS "837613-coinbase.com" OR destinationntdomain CONTAINS "83956-coinbase.com" OR destinationntdomain CONTAINS "87157-coinbase.com" OR destinationntdomain CONTAINS "87312-coinbase.com" OR destinationntdomain CONTAINS "89304-coinbase.com" OR destinationntdomain CONTAINS "89375-coinbase.com" OR destinationntdomain CONTAINS "91723-gemini.com" OR destinationntdomain CONTAINS "91752-coinbase.com")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND requesturl NOT NULL AND (requesturl CONTAINS "28676-coinbase.com" OR requesturl CONTAINS "29185-coinbase.com" OR requesturl CONTAINS "29195-coinbase.com" OR requesturl CONTAINS "2a-coinbase.com" OR requesturl CONTAINS "2b-coinbase.com" OR requesturl CONTAINS "2c-coinbase.com" OR requesturl CONTAINS "2f-coinbase.com" OR requesturl CONTAINS "2fas-coinbase.com" OR requesturl CONTAINS "2o-coinbase.com" OR requesturl CONTAINS "2r-coinbase.com" OR requesturl CONTAINS "2s-coinbase.com" OR requesturl CONTAINS "2sv-coinbase.com" OR requesturl CONTAINS "352134951-coinbase.com" OR requesturl CONTAINS "38468-coinbase.com" OR requesturl CONTAINS "39590-coinbase.com" OR requesturl CONTAINS "41260-coinbase.com" OR requesturl CONTAINS "427883-coinbase.com" OR requesturl CONTAINS "43017-coinbase.com" OR requesturl CONTAINS "47562-coinbase.com" OR requesturl CONTAINS "50195-coinbase.com" OR requesturl CONTAINS "5247-coinbase.com" OR requesturl CONTAINS "54765-coinbase.com" OR requesturl CONTAINS "57197-coinbase.com" OR requesturl CONTAINS "58176-coinbase.com" OR requesturl CONTAINS "58297-coinbase.com" OR requesturl CONTAINS "61250-coinbase.com" OR requesturl CONTAINS "61835-coinbase.com" OR requesturl CONTAINS "61851-coinbase.com" OR requesturl CONTAINS "61937-coinbase.com" OR requesturl CONTAINS "71925-coinbase.com" OR requesturl CONTAINS "72957-coinbase.com" OR requesturl CONTAINS "72985-coinbase.com" OR requesturl CONTAINS "74651-coinbase.com" OR requesturl CONTAINS "754668948-coinbase.com" OR requesturl CONTAINS "76159869-coinbase.com" OR requesturl CONTAINS "76153-coinbase.com" OR requesturl CONTAINS "81758-coinbase.com" OR requesturl CONTAINS "81920-coinbase.com" OR requesturl CONTAINS "81926-coinbase.com" OR requesturl CONTAINS "81958-coinbase.com" OR requesturl CONTAINS "826298-coinbase.com" OR requesturl CONTAINS "83216-coinbase.com" OR requesturl CONTAINS "837613-coinbase.com" OR requesturl CONTAINS "83956-coinbase.com" OR requesturl CONTAINS "87157-coinbase.com" OR requesturl CONTAINS "87312-coinbase.com" OR requesturl CONTAINS "89304-coinbase.com" OR requesturl CONTAINS "89375-coinbase.com" OR requesturl CONTAINS "91723-gemini.com" OR requesturl CONTAINS "91752-coinbase.com")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "91756-coinbase.com" OR destinationhostname CONTAINS "91782-coinbase.com" OR destinationhostname CONTAINS "91835-coinbase.com" OR destinationhostname CONTAINS "91845-coinbase.com" OR destinationhostname CONTAINS "91923-coinbase.com" OR destinationhostname CONTAINS "92758-coinbase.com" OR destinationhostname CONTAINS "948122061-coinbase.com" OR destinationhostname CONTAINS "978941-coinbase.com" OR destinationhostname CONTAINS "accountrecovery-coinbase.com" OR destinationhostname CONTAINS "action-shakepay.com" OR destinationhostname CONTAINS "adjust-coinbase.com" OR destinationhostname CONTAINS "admin-kraken.com" OR destinationhostname CONTAINS "applechargebacks.com" OR destinationhostname CONTAINS "authenticate-gemini.com" OR destinationhostname CONTAINS "authorize-gmail.com" OR destinationhostname CONTAINS "binance-okta.com" OR destinationhostname CONTAINS "captcha-coinbase.com" OR destinationhostname CONTAINS "cd-coinbase.com" OR destinationhostname CONTAINS "coinbase-heip.com" OR destinationhostname CONTAINS "coinbase-live.support" OR destinationhostname CONTAINS "coinbase-reject.com" OR destinationhostname CONTAINS "coinbase-ticket.com" OR destinationhostname CONTAINS "coinbaseheip.com" OR destinationhostname CONTAINS "com-2fa.help" OR destinationhostname CONTAINS "com-2fa.support" OR destinationhostname CONTAINS "com-3845.support" OR destinationhostname CONTAINS "com-connect.help" OR destinationhostname CONTAINS "com-fraud.support" OR destinationhostname CONTAINS "com-help.support" OR destinationhostname CONTAINS "com-reset.help" OR destinationhostname CONTAINS "com-reset.net" OR destinationhostname CONTAINS "com-ticket.live" OR destinationhostname CONTAINS "com-ticket.support" OR destinationhostname CONTAINS "contact-nexo.com" OR destinationhostname CONTAINS "convert-coinbase.com" OR destinationhostname CONTAINS "customerservice-coinbase.com" OR destinationhostname CONTAINS "default-coinbase.com" OR destinationhostname CONTAINS "defend-coinbase.com" OR destinationhostname CONTAINS "deny-coinbase.com" OR destinationhostname CONTAINS "disconnect-coinbase.com" OR destinationhostname CONTAINS "escalate-coinbase.com" OR destinationhostname CONTAINS "establish-coinbase.com" OR destinationhostname CONTAINS "fcc-okta.com" OR destinationhostname CONTAINS "fraudulent-coinbase.com" OR destinationhostname CONTAINS "guard-apple.com" OR destinationhostname CONTAINS "guard-icloud.com" OR destinationhostname CONTAINS "guardian-coinbase.com" OR destinationhostname CONTAINS "guide-gemini.com" OR destinationhostname CONTAINS "help-bitfinex.com" OR destinationhostname CONTAINS "help-shakepay.com")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "91756-coinbase.com" OR sourcentdomain CONTAINS "91782-coinbase.com" OR sourcentdomain CONTAINS "91835-coinbase.com" OR sourcentdomain CONTAINS "91845-coinbase.com" OR sourcentdomain CONTAINS "91923-coinbase.com" OR sourcentdomain CONTAINS "92758-coinbase.com" OR sourcentdomain CONTAINS "948122061-coinbase.com" OR sourcentdomain CONTAINS "978941-coinbase.com" OR sourcentdomain CONTAINS "accountrecovery-coinbase.com" OR sourcentdomain CONTAINS "action-shakepay.com" OR sourcentdomain CONTAINS "adjust-coinbase.com" OR sourcentdomain CONTAINS "admin-kraken.com" OR sourcentdomain CONTAINS "applechargebacks.com" OR sourcentdomain CONTAINS "authenticate-gemini.com" OR sourcentdomain CONTAINS "authorize-gmail.com" OR sourcentdomain CONTAINS "binance-okta.com" OR sourcentdomain CONTAINS "captcha-coinbase.com" OR sourcentdomain CONTAINS "cd-coinbase.com" OR sourcentdomain CONTAINS "coinbase-heip.com" OR sourcentdomain CONTAINS "coinbase-live.support" OR sourcentdomain CONTAINS "coinbase-reject.com" OR sourcentdomain CONTAINS "coinbase-ticket.com" OR sourcentdomain CONTAINS "coinbaseheip.com" OR sourcentdomain CONTAINS "com-2fa.help" OR sourcentdomain CONTAINS "com-2fa.support" OR sourcentdomain CONTAINS "com-3845.support" OR sourcentdomain CONTAINS "com-connect.help" OR sourcentdomain CONTAINS "com-fraud.support" OR sourcentdomain CONTAINS "com-help.support" OR sourcentdomain CONTAINS "com-reset.help" OR sourcentdomain CONTAINS "com-reset.net" OR sourcentdomain CONTAINS "com-ticket.live" OR sourcentdomain CONTAINS "com-ticket.support" OR sourcentdomain CONTAINS "contact-nexo.com" OR sourcentdomain CONTAINS "convert-coinbase.com" OR sourcentdomain CONTAINS "customerservice-coinbase.com" OR sourcentdomain CONTAINS "default-coinbase.com" OR sourcentdomain CONTAINS "defend-coinbase.com" OR sourcentdomain CONTAINS "deny-coinbase.com" OR sourcentdomain CONTAINS "disconnect-coinbase.com" OR sourcentdomain CONTAINS "escalate-coinbase.com" OR sourcentdomain CONTAINS "establish-coinbase.com" OR sourcentdomain CONTAINS "fcc-okta.com" OR sourcentdomain CONTAINS "fraudulent-coinbase.com" OR sourcentdomain CONTAINS "guard-apple.com" OR sourcentdomain CONTAINS "guard-icloud.com" OR sourcentdomain CONTAINS "guardian-coinbase.com" OR sourcentdomain CONTAINS "guide-gemini.com" OR sourcentdomain CONTAINS "help-bitfinex.com" OR sourcentdomain CONTAINS "help-shakepay.com")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "91756-coinbase.com" OR sourcehostname CONTAINS "91782-coinbase.com" OR sourcehostname CONTAINS "91835-coinbase.com" OR sourcehostname CONTAINS "91845-coinbase.com" OR sourcehostname CONTAINS "91923-coinbase.com" OR sourcehostname CONTAINS "92758-coinbase.com" OR sourcehostname CONTAINS "948122061-coinbase.com" OR sourcehostname CONTAINS "978941-coinbase.com" OR sourcehostname CONTAINS "accountrecovery-coinbase.com" OR sourcehostname CONTAINS "action-shakepay.com" OR sourcehostname CONTAINS "adjust-coinbase.com" OR sourcehostname CONTAINS "admin-kraken.com" OR sourcehostname CONTAINS "applechargebacks.com" OR sourcehostname CONTAINS "authenticate-gemini.com" OR sourcehostname CONTAINS "authorize-gmail.com" OR sourcehostname CONTAINS "binance-okta.com" OR sourcehostname CONTAINS "captcha-coinbase.com" OR sourcehostname CONTAINS "cd-coinbase.com" OR sourcehostname CONTAINS "coinbase-heip.com" OR sourcehostname CONTAINS "coinbase-live.support" OR sourcehostname CONTAINS "coinbase-reject.com" OR sourcehostname CONTAINS "coinbase-ticket.com" OR sourcehostname CONTAINS "coinbaseheip.com" OR sourcehostname CONTAINS "com-2fa.help" OR sourcehostname CONTAINS "com-2fa.support" OR sourcehostname CONTAINS "com-3845.support" OR sourcehostname CONTAINS "com-connect.help" OR sourcehostname CONTAINS "com-fraud.support" OR sourcehostname CONTAINS "com-help.support" OR sourcehostname CONTAINS "com-reset.help" OR sourcehostname CONTAINS "com-reset.net" OR sourcehostname CONTAINS "com-ticket.live" OR sourcehostname CONTAINS "com-ticket.support" OR sourcehostname CONTAINS "contact-nexo.com" OR sourcehostname CONTAINS "convert-coinbase.com" OR sourcehostname CONTAINS "customerservice-coinbase.com" OR sourcehostname CONTAINS "default-coinbase.com" OR sourcehostname CONTAINS "defend-coinbase.com" OR sourcehostname CONTAINS "deny-coinbase.com" OR sourcehostname CONTAINS "disconnect-coinbase.com" OR sourcehostname CONTAINS "escalate-coinbase.com" OR sourcehostname CONTAINS "establish-coinbase.com" OR sourcehostname CONTAINS "fcc-okta.com" OR sourcehostname CONTAINS "fraudulent-coinbase.com" OR sourcehostname CONTAINS "guard-apple.com" OR sourcehostname CONTAINS "guard-icloud.com" OR sourcehostname CONTAINS "guardian-coinbase.com" OR sourcehostname CONTAINS "guide-gemini.com" OR sourcehostname CONTAINS "help-bitfinex.com" OR sourcehostname CONTAINS "help-shakepay.com")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "91756-coinbase.com" OR destinationntdomain CONTAINS "91782-coinbase.com" OR destinationntdomain CONTAINS "91835-coinbase.com" OR destinationntdomain CONTAINS "91845-coinbase.com" OR destinationntdomain CONTAINS "91923-coinbase.com" OR destinationntdomain CONTAINS "92758-coinbase.com" OR destinationntdomain CONTAINS "948122061-coinbase.com" OR destinationntdomain CONTAINS "978941-coinbase.com" OR destinationntdomain CONTAINS "accountrecovery-coinbase.com" OR destinationntdomain CONTAINS "action-shakepay.com" OR destinationntdomain CONTAINS "adjust-coinbase.com" OR destinationntdomain CONTAINS "admin-kraken.com" OR destinationntdomain CONTAINS "applechargebacks.com" OR destinationntdomain CONTAINS "authenticate-gemini.com" OR destinationntdomain CONTAINS "authorize-gmail.com" OR destinationntdomain CONTAINS "binance-okta.com" OR destinationntdomain CONTAINS "captcha-coinbase.com" OR destinationntdomain CONTAINS "cd-coinbase.com" OR destinationntdomain CONTAINS "coinbase-heip.com" OR destinationntdomain CONTAINS "coinbase-live.support" OR destinationntdomain CONTAINS "coinbase-reject.com" OR destinationntdomain CONTAINS "coinbase-ticket.com" OR destinationntdomain CONTAINS "coinbaseheip.com" OR destinationntdomain CONTAINS "com-2fa.help" OR destinationntdomain CONTAINS "com-2fa.support" OR destinationntdomain CONTAINS "com-3845.support" OR destinationntdomain CONTAINS "com-connect.help" OR destinationntdomain CONTAINS "com-fraud.support" OR destinationntdomain CONTAINS "com-help.support" OR destinationntdomain CONTAINS "com-reset.help" OR destinationntdomain CONTAINS "com-reset.net" OR destinationntdomain CONTAINS "com-ticket.live" OR destinationntdomain CONTAINS "com-ticket.support" OR destinationntdomain CONTAINS "contact-nexo.com" OR destinationntdomain CONTAINS "convert-coinbase.com" OR destinationntdomain CONTAINS "customerservice-coinbase.com" OR destinationntdomain CONTAINS "default-coinbase.com" OR destinationntdomain CONTAINS "defend-coinbase.com" OR destinationntdomain CONTAINS "deny-coinbase.com" OR destinationntdomain CONTAINS "disconnect-coinbase.com" OR destinationntdomain CONTAINS "escalate-coinbase.com" OR destinationntdomain CONTAINS "establish-coinbase.com" OR destinationntdomain CONTAINS "fcc-okta.com" OR destinationntdomain CONTAINS "fraudulent-coinbase.com" OR destinationntdomain CONTAINS "guard-apple.com" OR destinationntdomain CONTAINS "guard-icloud.com" OR destinationntdomain CONTAINS "guardian-coinbase.com" OR destinationntdomain CONTAINS "guide-gemini.com" OR destinationntdomain CONTAINS "help-bitfinex.com" OR destinationntdomain CONTAINS "help-shakepay.com")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND requesturl NOT NULL AND (requesturl CONTAINS "91756-coinbase.com" OR requesturl CONTAINS "91782-coinbase.com" OR requesturl CONTAINS "91835-coinbase.com" OR requesturl CONTAINS "91845-coinbase.com" OR requesturl CONTAINS "91923-coinbase.com" OR requesturl CONTAINS "92758-coinbase.com" OR requesturl CONTAINS "948122061-coinbase.com" OR requesturl CONTAINS "978941-coinbase.com" OR requesturl CONTAINS "accountrecovery-coinbase.com" OR requesturl CONTAINS "action-shakepay.com" OR requesturl CONTAINS "adjust-coinbase.com" OR requesturl CONTAINS "admin-kraken.com" OR requesturl CONTAINS "applechargebacks.com" OR requesturl CONTAINS "authenticate-gemini.com" OR requesturl CONTAINS "authorize-gmail.com" OR requesturl CONTAINS "binance-okta.com" OR requesturl CONTAINS "captcha-coinbase.com" OR requesturl CONTAINS "cd-coinbase.com" OR requesturl CONTAINS "coinbase-heip.com" OR requesturl CONTAINS "coinbase-live.support" OR requesturl CONTAINS "coinbase-reject.com" OR requesturl CONTAINS "coinbase-ticket.com" OR requesturl CONTAINS "coinbaseheip.com" OR requesturl CONTAINS "com-2fa.help" OR requesturl CONTAINS "com-2fa.support" OR requesturl CONTAINS "com-3845.support" OR requesturl CONTAINS "com-connect.help" OR requesturl CONTAINS "com-fraud.support" OR requesturl CONTAINS "com-help.support" OR requesturl CONTAINS "com-reset.help" OR requesturl CONTAINS "com-reset.net" OR requesturl CONTAINS "com-ticket.live" OR requesturl CONTAINS "com-ticket.support" OR requesturl CONTAINS "contact-nexo.com" OR requesturl CONTAINS "convert-coinbase.com" OR requesturl CONTAINS "customerservice-coinbase.com" OR requesturl CONTAINS "default-coinbase.com" OR requesturl CONTAINS "defend-coinbase.com" OR requesturl CONTAINS "deny-coinbase.com" OR requesturl CONTAINS "disconnect-coinbase.com" OR requesturl CONTAINS "escalate-coinbase.com" OR requesturl CONTAINS "establish-coinbase.com" OR requesturl CONTAINS "fcc-okta.com" OR requesturl CONTAINS "fraudulent-coinbase.com" OR requesturl CONTAINS "guard-apple.com" OR requesturl CONTAINS "guard-icloud.com" OR requesturl CONTAINS "guardian-coinbase.com" OR requesturl CONTAINS "guide-gemini.com" OR requesturl CONTAINS "help-bitfinex.com" OR requesturl CONTAINS "help-shakepay.com")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "helpdesk-apple.com" OR destinationhostname CONTAINS "helpdesk-gemini.com" OR destinationhostname CONTAINS "helpdesk-icloud.com" OR destinationhostname CONTAINS "identification-coinbase.com" OR destinationhostname CONTAINS "lockdown-coinbase.com" OR destinationhostname CONTAINS "login-nexo.com" OR destinationhostname CONTAINS "keys-coinbase.com" OR destinationhostname CONTAINS "messages-coinbase.com" OR destinationhostname CONTAINS "newpassword-coinbase.com" OR destinationhostname CONTAINS "prompt-coinbase.com" OR destinationhostname CONTAINS "protect-apple.com" OR destinationhostname CONTAINS "protect-coinbase.com" OR destinationhostname CONTAINS "protect-gmail.com" OR destinationhostname CONTAINS "protect-kraken.com" OR destinationhostname CONTAINS "recoverme-coinbase.com" OR destinationhostname CONTAINS "recoveryportal-coinbase.com" OR destinationhostname CONTAINS "refunds-coinbase.com" OR destinationhostname CONTAINS "reset-okta.com" OR destinationhostname CONTAINS "restore-coinbase.com" OR destinationhostname CONTAINS "return-coinbase.com" OR destinationhostname CONTAINS "reverts-coinbase.com" OR destinationhostname CONTAINS "secure-binance.us" OR destinationhostname CONTAINS "secure-icloud.com" OR destinationhostname CONTAINS "secure-nexo.com" OR destinationhostname CONTAINS "secure-shakepay.com" OR destinationhostname CONTAINS "security-umusic.com" OR destinationhostname CONTAINS "server694590423.tech" OR destinationhostname CONTAINS "session-coinbase.com" OR destinationhostname CONTAINS "startrecovery-coinbase.com" OR destinationhostname CONTAINS "signin-kraken.com" OR destinationhostname CONTAINS "suite-trezor.io" OR destinationhostname CONTAINS "supportportal-coinbase.com" OR destinationhostname CONTAINS "tech-icloud.com" OR destinationhostname CONTAINS "threat-coinbase.com" OR destinationhostname CONTAINS "ticket-apple.com" OR destinationhostname CONTAINS "ticket-coinbase.com" OR destinationhostname CONTAINS "tickets-apple.com" OR destinationhostname CONTAINS "tokens-coinbase.com" OR destinationhostname CONTAINS "unblock-coinbase.com" OR destinationhostname CONTAINS "unlink-coinbase.com" OR destinationhostname CONTAINS "your-coinbase.com" OR destinationhostname CONTAINS "welcome-coinbase.com" OR destinationhostname CONTAINS "www-coinbasewallet.com" OR destinationhostname CONTAINS "www-help-coinbase.com" OR destinationhostname CONTAINS "www-help-gemini.com")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "helpdesk-apple.com" OR sourcentdomain CONTAINS "helpdesk-gemini.com" OR sourcentdomain CONTAINS "helpdesk-icloud.com" OR sourcentdomain CONTAINS "identification-coinbase.com" OR sourcentdomain CONTAINS "lockdown-coinbase.com" OR sourcentdomain CONTAINS "login-nexo.com" OR sourcentdomain CONTAINS "keys-coinbase.com" OR sourcentdomain CONTAINS "messages-coinbase.com" OR sourcentdomain CONTAINS "newpassword-coinbase.com" OR sourcentdomain CONTAINS "prompt-coinbase.com" OR sourcentdomain CONTAINS "protect-apple.com" OR sourcentdomain CONTAINS "protect-coinbase.com" OR sourcentdomain CONTAINS "protect-gmail.com" OR sourcentdomain CONTAINS "protect-kraken.com" OR sourcentdomain CONTAINS "recoverme-coinbase.com" OR sourcentdomain CONTAINS "recoveryportal-coinbase.com" OR sourcentdomain CONTAINS "refunds-coinbase.com" OR sourcentdomain CONTAINS "reset-okta.com" OR sourcentdomain CONTAINS "restore-coinbase.com" OR sourcentdomain CONTAINS "return-coinbase.com" OR sourcentdomain CONTAINS "reverts-coinbase.com" OR sourcentdomain CONTAINS "secure-binance.us" OR sourcentdomain CONTAINS "secure-icloud.com" OR sourcentdomain CONTAINS "secure-nexo.com" OR sourcentdomain CONTAINS "secure-shakepay.com" OR sourcentdomain CONTAINS "security-umusic.com" OR sourcentdomain CONTAINS "server694590423.tech" OR sourcentdomain CONTAINS "session-coinbase.com" OR sourcentdomain CONTAINS "startrecovery-coinbase.com" OR sourcentdomain CONTAINS "signin-kraken.com" OR sourcentdomain CONTAINS "suite-trezor.io" OR sourcentdomain CONTAINS "supportportal-coinbase.com" OR sourcentdomain CONTAINS "tech-icloud.com" OR sourcentdomain CONTAINS "threat-coinbase.com" OR sourcentdomain CONTAINS "ticket-apple.com" OR sourcentdomain CONTAINS "ticket-coinbase.com" OR sourcentdomain CONTAINS "tickets-apple.com" OR sourcentdomain CONTAINS "tokens-coinbase.com" OR sourcentdomain CONTAINS "unblock-coinbase.com" OR sourcentdomain CONTAINS "unlink-coinbase.com" OR sourcentdomain CONTAINS "your-coinbase.com" OR sourcentdomain CONTAINS "welcome-coinbase.com" OR sourcentdomain CONTAINS "www-coinbasewallet.com" OR sourcentdomain CONTAINS "www-help-coinbase.com" OR sourcentdomain CONTAINS "www-help-gemini.com")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "helpdesk-apple.com" OR sourcehostname CONTAINS "helpdesk-gemini.com" OR sourcehostname CONTAINS "helpdesk-icloud.com" OR sourcehostname CONTAINS "identification-coinbase.com" OR sourcehostname CONTAINS "lockdown-coinbase.com" OR sourcehostname CONTAINS "login-nexo.com" OR sourcehostname CONTAINS "keys-coinbase.com" OR sourcehostname CONTAINS "messages-coinbase.com" OR sourcehostname CONTAINS "newpassword-coinbase.com" OR sourcehostname CONTAINS "prompt-coinbase.com" OR sourcehostname CONTAINS "protect-apple.com" OR sourcehostname CONTAINS "protect-coinbase.com" OR sourcehostname CONTAINS "protect-gmail.com" OR sourcehostname CONTAINS "protect-kraken.com" OR sourcehostname CONTAINS "recoverme-coinbase.com" OR sourcehostname CONTAINS "recoveryportal-coinbase.com" OR sourcehostname CONTAINS "refunds-coinbase.com" OR sourcehostname CONTAINS "reset-okta.com" OR sourcehostname CONTAINS "restore-coinbase.com" OR sourcehostname CONTAINS "return-coinbase.com" OR sourcehostname CONTAINS "reverts-coinbase.com" OR sourcehostname CONTAINS "secure-binance.us" OR sourcehostname CONTAINS "secure-icloud.com" OR sourcehostname CONTAINS "secure-nexo.com" OR sourcehostname CONTAINS "secure-shakepay.com" OR sourcehostname CONTAINS "security-umusic.com" OR sourcehostname CONTAINS "server694590423.tech" OR sourcehostname CONTAINS "session-coinbase.com" OR sourcehostname CONTAINS "startrecovery-coinbase.com" OR sourcehostname CONTAINS "signin-kraken.com" OR sourcehostname CONTAINS "suite-trezor.io" OR sourcehostname CONTAINS "supportportal-coinbase.com" OR sourcehostname CONTAINS "tech-icloud.com" OR sourcehostname CONTAINS "threat-coinbase.com" OR sourcehostname CONTAINS "ticket-apple.com" OR sourcehostname CONTAINS "ticket-coinbase.com" OR sourcehostname CONTAINS "tickets-apple.com" OR sourcehostname CONTAINS "tokens-coinbase.com" OR sourcehostname CONTAINS "unblock-coinbase.com" OR sourcehostname CONTAINS "unlink-coinbase.com" OR sourcehostname CONTAINS "your-coinbase.com" OR sourcehostname CONTAINS "welcome-coinbase.com" OR sourcehostname CONTAINS "www-coinbasewallet.com" OR sourcehostname CONTAINS "www-help-coinbase.com" OR sourcehostname CONTAINS "www-help-gemini.com")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "helpdesk-apple.com" OR destinationntdomain CONTAINS "helpdesk-gemini.com" OR destinationntdomain CONTAINS "helpdesk-icloud.com" OR destinationntdomain CONTAINS "identification-coinbase.com" OR destinationntdomain CONTAINS "lockdown-coinbase.com" OR destinationntdomain CONTAINS "login-nexo.com" OR destinationntdomain CONTAINS "keys-coinbase.com" OR destinationntdomain CONTAINS "messages-coinbase.com" OR destinationntdomain CONTAINS "newpassword-coinbase.com" OR destinationntdomain CONTAINS "prompt-coinbase.com" OR destinationntdomain CONTAINS "protect-apple.com" OR destinationntdomain CONTAINS "protect-coinbase.com" OR destinationntdomain CONTAINS "protect-gmail.com" OR destinationntdomain CONTAINS "protect-kraken.com" OR destinationntdomain CONTAINS "recoverme-coinbase.com" OR destinationntdomain CONTAINS "recoveryportal-coinbase.com" OR destinationntdomain CONTAINS "refunds-coinbase.com" OR destinationntdomain CONTAINS "reset-okta.com" OR destinationntdomain CONTAINS "restore-coinbase.com" OR destinationntdomain CONTAINS "return-coinbase.com" OR destinationntdomain CONTAINS "reverts-coinbase.com" OR destinationntdomain CONTAINS "secure-binance.us" OR destinationntdomain CONTAINS "secure-icloud.com" OR destinationntdomain CONTAINS "secure-nexo.com" OR destinationntdomain CONTAINS "secure-shakepay.com" OR destinationntdomain CONTAINS "security-umusic.com" OR destinationntdomain CONTAINS "server694590423.tech" OR destinationntdomain CONTAINS "session-coinbase.com" OR destinationntdomain CONTAINS "startrecovery-coinbase.com" OR destinationntdomain CONTAINS "signin-kraken.com" OR destinationntdomain CONTAINS "suite-trezor.io" OR destinationntdomain CONTAINS "supportportal-coinbase.com" OR destinationntdomain CONTAINS "tech-icloud.com" OR destinationntdomain CONTAINS "threat-coinbase.com" OR destinationntdomain CONTAINS "ticket-apple.com" OR destinationntdomain CONTAINS "ticket-coinbase.com" OR destinationntdomain CONTAINS "tickets-apple.com" OR destinationntdomain CONTAINS "tokens-coinbase.com" OR destinationntdomain CONTAINS "unblock-coinbase.com" OR destinationntdomain CONTAINS "unlink-coinbase.com" OR destinationntdomain CONTAINS "your-coinbase.com" OR destinationntdomain CONTAINS "welcome-coinbase.com" OR destinationntdomain CONTAINS "www-coinbasewallet.com" OR destinationntdomain CONTAINS "www-help-coinbase.com" OR destinationntdomain CONTAINS "www-help-gemini.com")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND requesturl NOT NULL AND (requesturl CONTAINS "helpdesk-apple.com" OR requesturl CONTAINS "helpdesk-gemini.com" OR requesturl CONTAINS "helpdesk-icloud.com" OR requesturl CONTAINS "identification-coinbase.com" OR requesturl CONTAINS "lockdown-coinbase.com" OR requesturl CONTAINS "login-nexo.com" OR requesturl CONTAINS "keys-coinbase.com" OR requesturl CONTAINS "messages-coinbase.com" OR requesturl CONTAINS "newpassword-coinbase.com" OR requesturl CONTAINS "prompt-coinbase.com" OR requesturl CONTAINS "protect-apple.com" OR requesturl CONTAINS "protect-coinbase.com" OR requesturl CONTAINS "protect-gmail.com" OR requesturl CONTAINS "protect-kraken.com" OR requesturl CONTAINS "recoverme-coinbase.com" OR requesturl CONTAINS "recoveryportal-coinbase.com" OR requesturl CONTAINS "refunds-coinbase.com" OR requesturl CONTAINS "reset-okta.com" OR requesturl CONTAINS "restore-coinbase.com" OR requesturl CONTAINS "return-coinbase.com" OR requesturl CONTAINS "reverts-coinbase.com" OR requesturl CONTAINS "secure-binance.us" OR requesturl CONTAINS "secure-icloud.com" OR requesturl CONTAINS "secure-nexo.com" OR requesturl CONTAINS "secure-shakepay.com" OR requesturl CONTAINS "security-umusic.com" OR requesturl CONTAINS "server694590423.tech" OR requesturl CONTAINS "session-coinbase.com" OR requesturl CONTAINS "startrecovery-coinbase.com" OR requesturl CONTAINS "signin-kraken.com" OR requesturl CONTAINS "suite-trezor.io" OR requesturl CONTAINS "supportportal-coinbase.com" OR requesturl CONTAINS "tech-icloud.com" OR requesturl CONTAINS "threat-coinbase.com" OR requesturl CONTAINS "ticket-apple.com" OR requesturl CONTAINS "ticket-coinbase.com" OR requesturl CONTAINS "tickets-apple.com" OR requesturl CONTAINS "tokens-coinbase.com" OR requesturl CONTAINS "unblock-coinbase.com" OR requesturl CONTAINS "unlink-coinbase.com" OR requesturl CONTAINS "your-coinbase.com" OR requesturl CONTAINS "welcome-coinbase.com" OR requesturl CONTAINS "www-coinbasewallet.com" OR requesturl CONTAINS "www-help-coinbase.com" OR requesturl CONTAINS "www-help-gemini.com")
index=activity AND rg_functionality="Cloud Application Security Broker" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "official-server.com" OR destinationhostname CONTAINS "server694590423.tech" OR destinationhostname CONTAINS "island-placid-bromine.glitch.me" OR destinationhostname CONTAINS "circular-noon-farmhouse.glitch.me" OR destinationhostname CONTAINS "talented-friendly-price.glitch.me" OR destinationhostname CONTAINS "dflfmgsdokasdcpl.com" OR destinationhostname CONTAINS "original-backend.com" OR destinationhostname CONTAINS "07159889-coinbase.com" OR destinationhostname CONTAINS "10195-coinbase.com" OR destinationhostname CONTAINS "11246-coinbase.com" OR destinationhostname CONTAINS "11247-coinbase.com" OR destinationhostname CONTAINS "11248-coinbase.com" OR destinationhostname CONTAINS "11258-coinbase.com" OR destinationhostname CONTAINS "11259-coinbase.com" OR destinationhostname CONTAINS "113912-coinbase.com" OR destinationhostname CONTAINS "11472-coinbase.com" OR destinationhostname CONTAINS "11923-coinbase.com" OR destinationhostname CONTAINS "11957-coinbase.com" OR destinationhostname CONTAINS "128147-coinbase.com" OR destinationhostname CONTAINS "12958-coinbase.com" OR destinationhostname CONTAINS "12984-okta.com" OR destinationhostname CONTAINS "12985-coinbase.com" OR destinationhostname CONTAINS "13130-coinbase.com" OR destinationhostname CONTAINS "13247-coinbase.com" OR destinationhostname CONTAINS "13247-icloud.com" OR destinationhostname CONTAINS "13267-coinbase.com" OR destinationhostname CONTAINS "146271510-coinbase.com" OR destinationhostname CONTAINS "146282-coinbase.com" OR destinationhostname CONTAINS "146284-coinbase.com" OR destinationhostname CONTAINS "147260-coinbase.com" OR destinationhostname CONTAINS "14765-coinbase.com" OR destinationhostname CONTAINS "14817582-coinbase.com" OR destinationhostname CONTAINS "14871904-coinbase.com" OR destinationhostname CONTAINS "14891902-coinbase.com" OR destinationhostname CONTAINS "1492864-coinbase.com" OR destinationhostname CONTAINS "158312-coinbase.com" OR destinationhostname CONTAINS "158372-coinbase.com" OR destinationhostname CONTAINS "158702-coinbase.com" OR destinationhostname CONTAINS "16171675-coinbase.com" OR destinationhostname CONTAINS "16171832-coinbase.com" OR destinationhostname CONTAINS "16178234-coinbase.com" OR destinationhostname CONTAINS "16178237-coinbase.com" OR destinationhostname CONTAINS "16178434-coinbase.com" OR destinationhostname CONTAINS "162178-coinbase.com" OR destinationhostname CONTAINS "162478-coinbase.com" OR destinationhostname CONTAINS "162782-coinbase.com" OR destinationhostname CONTAINS "162812-coinbase.com" OR destinationhostname CONTAINS "162814-coinbase.com" OR destinationhostname CONTAINS "16442580-coinbase.com" OR destinationhostname CONTAINS "16450107-coinbase.com")
index=activity AND rg_functionality="Cloud Application Security Broker" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "official-server.com" OR sourcentdomain CONTAINS "server694590423.tech" OR sourcentdomain CONTAINS "island-placid-bromine.glitch.me" OR sourcentdomain CONTAINS "circular-noon-farmhouse.glitch.me" OR sourcentdomain CONTAINS "talented-friendly-price.glitch.me" OR sourcentdomain CONTAINS "dflfmgsdokasdcpl.com" OR sourcentdomain CONTAINS "original-backend.com" OR sourcentdomain CONTAINS "07159889-coinbase.com" OR sourcentdomain CONTAINS "10195-coinbase.com" OR sourcentdomain CONTAINS "11246-coinbase.com" OR sourcentdomain CONTAINS "11247-coinbase.com" OR sourcentdomain CONTAINS "11248-coinbase.com" OR sourcentdomain CONTAINS "11258-coinbase.com" OR sourcentdomain CONTAINS "11259-coinbase.com" OR sourcentdomain CONTAINS "113912-coinbase.com" OR sourcentdomain CONTAINS "11472-coinbase.com" OR sourcentdomain CONTAINS "11923-coinbase.com" OR sourcentdomain CONTAINS "11957-coinbase.com" OR sourcentdomain CONTAINS "128147-coinbase.com" OR sourcentdomain CONTAINS "12958-coinbase.com" OR sourcentdomain CONTAINS "12984-okta.com" OR sourcentdomain CONTAINS "12985-coinbase.com" OR sourcentdomain CONTAINS "13130-coinbase.com" OR sourcentdomain CONTAINS "13247-coinbase.com" OR sourcentdomain CONTAINS "13247-icloud.com" OR sourcentdomain CONTAINS "13267-coinbase.com" OR sourcentdomain CONTAINS "146271510-coinbase.com" OR sourcentdomain CONTAINS "146282-coinbase.com" OR sourcentdomain CONTAINS "146284-coinbase.com" OR sourcentdomain CONTAINS "147260-coinbase.com" OR sourcentdomain CONTAINS "14765-coinbase.com" OR sourcentdomain CONTAINS "14817582-coinbase.com" OR sourcentdomain CONTAINS "14871904-coinbase.com" OR sourcentdomain CONTAINS "14891902-coinbase.com" OR sourcentdomain CONTAINS "1492864-coinbase.com" OR sourcentdomain CONTAINS "158312-coinbase.com" OR sourcentdomain CONTAINS "158372-coinbase.com" OR sourcentdomain CONTAINS "158702-coinbase.com" OR sourcentdomain CONTAINS "16171675-coinbase.com" OR sourcentdomain CONTAINS "16171832-coinbase.com" OR sourcentdomain CONTAINS "16178234-coinbase.com" OR sourcentdomain CONTAINS "16178237-coinbase.com" OR sourcentdomain CONTAINS "16178434-coinbase.com" OR sourcentdomain CONTAINS "162178-coinbase.com" OR sourcentdomain CONTAINS "162478-coinbase.com" OR sourcentdomain CONTAINS "162782-coinbase.com" OR sourcentdomain CONTAINS "162812-coinbase.com" OR sourcentdomain CONTAINS "162814-coinbase.com" OR sourcentdomain CONTAINS "16442580-coinbase.com" OR sourcentdomain CONTAINS "16450107-coinbase.com")
index=activity AND rg_functionality="Cloud Application Security Broker" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "official-server.com" OR sourcehostname CONTAINS "server694590423.tech" OR sourcehostname CONTAINS "island-placid-bromine.glitch.me" OR sourcehostname CONTAINS "circular-noon-farmhouse.glitch.me" OR sourcehostname CONTAINS "talented-friendly-price.glitch.me" OR sourcehostname CONTAINS "dflfmgsdokasdcpl.com" OR sourcehostname CONTAINS "original-backend.com" OR sourcehostname CONTAINS "07159889-coinbase.com" OR sourcehostname CONTAINS "10195-coinbase.com" OR sourcehostname CONTAINS "11246-coinbase.com" OR sourcehostname CONTAINS "11247-coinbase.com" OR sourcehostname CONTAINS "11248-coinbase.com" OR sourcehostname CONTAINS "11258-coinbase.com" OR sourcehostname CONTAINS "11259-coinbase.com" OR sourcehostname CONTAINS "113912-coinbase.com" OR sourcehostname CONTAINS "11472-coinbase.com" OR sourcehostname CONTAINS "11923-coinbase.com" OR sourcehostname CONTAINS "11957-coinbase.com" OR sourcehostname CONTAINS "128147-coinbase.com" OR sourcehostname CONTAINS "12958-coinbase.com" OR sourcehostname CONTAINS "12984-okta.com" OR sourcehostname CONTAINS "12985-coinbase.com" OR sourcehostname CONTAINS "13130-coinbase.com" OR sourcehostname CONTAINS "13247-coinbase.com" OR sourcehostname CONTAINS "13247-icloud.com" OR sourcehostname CONTAINS "13267-coinbase.com" OR sourcehostname CONTAINS "146271510-coinbase.com" OR sourcehostname CONTAINS "146282-coinbase.com" OR sourcehostname CONTAINS "146284-coinbase.com" OR sourcehostname CONTAINS "147260-coinbase.com" OR sourcehostname CONTAINS "14765-coinbase.com" OR sourcehostname CONTAINS "14817582-coinbase.com" OR sourcehostname CONTAINS "14871904-coinbase.com" OR sourcehostname CONTAINS "14891902-coinbase.com" OR sourcehostname CONTAINS "1492864-coinbase.com" OR sourcehostname CONTAINS "158312-coinbase.com" OR sourcehostname CONTAINS "158372-coinbase.com" OR sourcehostname CONTAINS "158702-coinbase.com" OR sourcehostname CONTAINS "16171675-coinbase.com" OR sourcehostname CONTAINS "16171832-coinbase.com" OR sourcehostname CONTAINS "16178234-coinbase.com" OR sourcehostname CONTAINS "16178237-coinbase.com" OR sourcehostname CONTAINS "16178434-coinbase.com" OR sourcehostname CONTAINS "162178-coinbase.com" OR sourcehostname CONTAINS "162478-coinbase.com" OR sourcehostname CONTAINS "162782-coinbase.com" OR sourcehostname CONTAINS "162812-coinbase.com" OR sourcehostname CONTAINS "162814-coinbase.com" OR sourcehostname CONTAINS "16442580-coinbase.com" OR sourcehostname CONTAINS "16450107-coinbase.com")
index=activity AND rg_functionality="Cloud Application Security Broker" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "official-server.com" OR destinationntdomain CONTAINS "server694590423.tech" OR destinationntdomain CONTAINS "island-placid-bromine.glitch.me" OR destinationntdomain CONTAINS "circular-noon-farmhouse.glitch.me" OR destinationntdomain CONTAINS "talented-friendly-price.glitch.me" OR destinationntdomain CONTAINS "dflfmgsdokasdcpl.com" OR destinationntdomain CONTAINS "original-backend.com" OR destinationntdomain CONTAINS "07159889-coinbase.com" OR destinationntdomain CONTAINS "10195-coinbase.com" OR destinationntdomain CONTAINS "11246-coinbase.com" OR destinationntdomain CONTAINS "11247-coinbase.com" OR destinationntdomain CONTAINS "11248-coinbase.com" OR destinationntdomain CONTAINS "11258-coinbase.com" OR destinationntdomain CONTAINS "11259-coinbase.com" OR destinationntdomain CONTAINS "113912-coinbase.com" OR destinationntdomain CONTAINS "11472-coinbase.com" OR destinationntdomain CONTAINS "11923-coinbase.com" OR destinationntdomain CONTAINS "11957-coinbase.com" OR destinationntdomain CONTAINS "128147-coinbase.com" OR destinationntdomain CONTAINS "12958-coinbase.com" OR destinationntdomain CONTAINS "12984-okta.com" OR destinationntdomain CONTAINS "12985-coinbase.com" OR destinationntdomain CONTAINS "13130-coinbase.com" OR destinationntdomain CONTAINS "13247-coinbase.com" OR destinationntdomain CONTAINS "13247-icloud.com" OR destinationntdomain CONTAINS "13267-coinbase.com" OR destinationntdomain CONTAINS "146271510-coinbase.com" OR destinationntdomain CONTAINS "146282-coinbase.com" OR destinationntdomain CONTAINS "146284-coinbase.com" OR destinationntdomain CONTAINS "147260-coinbase.com" OR destinationntdomain CONTAINS "14765-coinbase.com" OR destinationntdomain CONTAINS "14817582-coinbase.com" OR destinationntdomain CONTAINS "14871904-coinbase.com" OR destinationntdomain CONTAINS "14891902-coinbase.com" OR destinationntdomain CONTAINS "1492864-coinbase.com" OR destinationntdomain CONTAINS "158312-coinbase.com" OR destinationntdomain CONTAINS "158372-coinbase.com" OR destinationntdomain CONTAINS "158702-coinbase.com" OR destinationntdomain CONTAINS "16171675-coinbase.com" OR destinationntdomain CONTAINS "16171832-coinbase.com" OR destinationntdomain CONTAINS "16178234-coinbase.com" OR destinationntdomain CONTAINS "16178237-coinbase.com" OR destinationntdomain CONTAINS "16178434-coinbase.com" OR destinationntdomain CONTAINS "162178-coinbase.com" OR destinationntdomain CONTAINS "162478-coinbase.com" OR destinationntdomain CONTAINS "162782-coinbase.com" OR destinationntdomain CONTAINS "162812-coinbase.com" OR destinationntdomain CONTAINS "162814-coinbase.com" OR destinationntdomain CONTAINS "16442580-coinbase.com" OR destinationntdomain CONTAINS "16450107-coinbase.com")
index=activity AND rg_functionality="Cloud Application Security Broker" AND requesturl NOT NULL AND (requesturl CONTAINS "official-server.com" OR requesturl CONTAINS "server694590423.tech" OR requesturl CONTAINS "island-placid-bromine.glitch.me" OR requesturl CONTAINS "circular-noon-farmhouse.glitch.me" OR requesturl CONTAINS "talented-friendly-price.glitch.me" OR requesturl CONTAINS "dflfmgsdokasdcpl.com" OR requesturl CONTAINS "original-backend.com" OR requesturl CONTAINS "07159889-coinbase.com" OR requesturl CONTAINS "10195-coinbase.com" OR requesturl CONTAINS "11246-coinbase.com" OR requesturl CONTAINS "11247-coinbase.com" OR requesturl CONTAINS "11248-coinbase.com" OR requesturl CONTAINS "11258-coinbase.com" OR requesturl CONTAINS "11259-coinbase.com" OR requesturl CONTAINS "113912-coinbase.com" OR requesturl CONTAINS "11472-coinbase.com" OR requesturl CONTAINS "11923-coinbase.com" OR requesturl CONTAINS "11957-coinbase.com" OR requesturl CONTAINS "128147-coinbase.com" OR requesturl CONTAINS "12958-coinbase.com" OR requesturl CONTAINS "12984-okta.com" OR requesturl CONTAINS "12985-coinbase.com" OR requesturl CONTAINS "13130-coinbase.com" OR requesturl CONTAINS "13247-coinbase.com" OR requesturl CONTAINS "13247-icloud.com" OR requesturl CONTAINS "13267-coinbase.com" OR requesturl CONTAINS "146271510-coinbase.com" OR requesturl CONTAINS "146282-coinbase.com" OR requesturl CONTAINS "146284-coinbase.com" OR requesturl CONTAINS "147260-coinbase.com" OR requesturl CONTAINS "14765-coinbase.com" OR requesturl CONTAINS "14817582-coinbase.com" OR requesturl CONTAINS "14871904-coinbase.com" OR requesturl CONTAINS "14891902-coinbase.com" OR requesturl CONTAINS "1492864-coinbase.com" OR requesturl CONTAINS "158312-coinbase.com" OR requesturl CONTAINS "158372-coinbase.com" OR requesturl CONTAINS "158702-coinbase.com" OR requesturl CONTAINS "16171675-coinbase.com" OR requesturl CONTAINS "16171832-coinbase.com" OR requesturl CONTAINS "16178234-coinbase.com" OR requesturl CONTAINS "16178237-coinbase.com" OR requesturl CONTAINS "16178434-coinbase.com" OR requesturl CONTAINS "162178-coinbase.com" OR requesturl CONTAINS "162478-coinbase.com" OR requesturl CONTAINS "162782-coinbase.com" OR requesturl CONTAINS "162812-coinbase.com" OR requesturl CONTAINS "162814-coinbase.com" OR requesturl CONTAINS "16442580-coinbase.com" OR requesturl CONTAINS "16450107-coinbase.com")
index=activity AND rg_functionality="Cloud Application Security Broker" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "16450207-coinbase.com" OR destinationhostname CONTAINS "16458207-coinbase.com" OR destinationhostname CONTAINS "16478202-coinbase.com" OR destinationhostname CONTAINS "164872942-coinbase.com" OR destinationhostname CONTAINS "16590-coinbase.com" OR destinationhostname CONTAINS "16594373-coinbase.com" OR destinationhostname CONTAINS "16624831-coinbase.com" OR destinationhostname CONTAINS "16642124-coinbase.com" OR destinationhostname CONTAINS "16642172-coinbase.com" OR destinationhostname CONTAINS "16642580-coinbase.com" OR destinationhostname CONTAINS "16642721-coinbase.com" OR destinationhostname CONTAINS "16642724-coinbase.com" OR destinationhostname CONTAINS "16642871-coinbase.com" OR destinationhostname CONTAINS "16642872-coinbase.com" OR destinationhostname CONTAINS "16712942-coinbase.com" OR destinationhostname CONTAINS "16718672-coinbase.com" OR destinationhostname CONTAINS "16728342-coinbase.com" OR destinationhostname CONTAINS "16728348-coinbase.com" OR destinationhostname CONTAINS "16728442-coinbase.com" OR destinationhostname CONTAINS "16728472-coinbase.com" OR destinationhostname CONTAINS "167285-coinbase.com" OR destinationhostname CONTAINS "16729042-coinbase.com" OR destinationhostname CONTAINS "16748272-coinbase.com" OR destinationhostname CONTAINS "16782942-coinbase.com" OR destinationhostname CONTAINS "16827420-coinbase.com" OR destinationhostname CONTAINS "16827423-coinbase.com" OR destinationhostname CONTAINS "16847145-coinbase.com" OR destinationhostname CONTAINS "16893924-coinbase.com" OR destinationhostname CONTAINS "17182-coinbase.com" OR destinationhostname CONTAINS "17255030-coinbase.com" OR destinationhostname CONTAINS "17259-kraken.com" OR destinationhostname CONTAINS "172486-coinbase.com" OR destinationhostname CONTAINS "17284652-coinbase.com" OR destinationhostname CONTAINS "17286-coinbase.com" OR destinationhostname CONTAINS "17334522-coinbase.com" OR destinationhostname CONTAINS "17334522-kraken.com" OR destinationhostname CONTAINS "17384522-coinbase.com" OR destinationhostname CONTAINS "173912-coinbase.com" OR destinationhostname CONTAINS "17494976-coinbase.com" OR destinationhostname CONTAINS "17512854-coinbase.com" OR destinationhostname CONTAINS "17512857-coinbase.com" OR destinationhostname CONTAINS "1751954-coinbase.com" OR destinationhostname CONTAINS "17525030-coinbase.com" OR destinationhostname CONTAINS "17529580-coinbase.com" OR destinationhostname CONTAINS "17614-coinbase.com" OR destinationhostname CONTAINS "17618412-coinbase.com" OR destinationhostname CONTAINS "17619-coinbase.com" OR destinationhostname CONTAINS "176284-coinbase.com" OR destinationhostname CONTAINS "17823920-coinbase.com" OR destinationhostname CONTAINS "178253-coinbase.com")
index=activity AND rg_functionality="Cloud Application Security Broker" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "16450207-coinbase.com" OR sourcentdomain CONTAINS "16458207-coinbase.com" OR sourcentdomain CONTAINS "16478202-coinbase.com" OR sourcentdomain CONTAINS "164872942-coinbase.com" OR sourcentdomain CONTAINS "16590-coinbase.com" OR sourcentdomain CONTAINS "16594373-coinbase.com" OR sourcentdomain CONTAINS "16624831-coinbase.com" OR sourcentdomain CONTAINS "16642124-coinbase.com" OR sourcentdomain CONTAINS "16642172-coinbase.com" OR sourcentdomain CONTAINS "16642580-coinbase.com" OR sourcentdomain CONTAINS "16642721-coinbase.com" OR sourcentdomain CONTAINS "16642724-coinbase.com" OR sourcentdomain CONTAINS "16642871-coinbase.com" OR sourcentdomain CONTAINS "16642872-coinbase.com" OR sourcentdomain CONTAINS "16712942-coinbase.com" OR sourcentdomain CONTAINS "16718672-coinbase.com" OR sourcentdomain CONTAINS "16728342-coinbase.com" OR sourcentdomain CONTAINS "16728348-coinbase.com" OR sourcentdomain CONTAINS "16728442-coinbase.com" OR sourcentdomain CONTAINS "16728472-coinbase.com" OR sourcentdomain CONTAINS "167285-coinbase.com" OR sourcentdomain CONTAINS "16729042-coinbase.com" OR sourcentdomain CONTAINS "16748272-coinbase.com" OR sourcentdomain CONTAINS "16782942-coinbase.com" OR sourcentdomain CONTAINS "16827420-coinbase.com" OR sourcentdomain CONTAINS "16827423-coinbase.com" OR sourcentdomain CONTAINS "16847145-coinbase.com" OR sourcentdomain CONTAINS "16893924-coinbase.com" OR sourcentdomain CONTAINS "17182-coinbase.com" OR sourcentdomain CONTAINS "17255030-coinbase.com" OR sourcentdomain CONTAINS "17259-kraken.com" OR sourcentdomain CONTAINS "172486-coinbase.com" OR sourcentdomain CONTAINS "17284652-coinbase.com" OR sourcentdomain CONTAINS "17286-coinbase.com" OR sourcentdomain CONTAINS "17334522-coinbase.com" OR sourcentdomain CONTAINS "17334522-kraken.com" OR sourcentdomain CONTAINS "17384522-coinbase.com" OR sourcentdomain CONTAINS "173912-coinbase.com" OR sourcentdomain CONTAINS "17494976-coinbase.com" OR sourcentdomain CONTAINS "17512854-coinbase.com" OR sourcentdomain CONTAINS "17512857-coinbase.com" OR sourcentdomain CONTAINS "1751954-coinbase.com" OR sourcentdomain CONTAINS "17525030-coinbase.com" OR sourcentdomain CONTAINS "17529580-coinbase.com" OR sourcentdomain CONTAINS "17614-coinbase.com" OR sourcentdomain CONTAINS "17618412-coinbase.com" OR sourcentdomain CONTAINS "17619-coinbase.com" OR sourcentdomain CONTAINS "176284-coinbase.com" OR sourcentdomain CONTAINS "17823920-coinbase.com" OR sourcentdomain CONTAINS "178253-coinbase.com")
index=activity AND rg_functionality="Cloud Application Security Broker" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "16450207-coinbase.com" OR sourcehostname CONTAINS "16458207-coinbase.com" OR sourcehostname CONTAINS "16478202-coinbase.com" OR sourcehostname CONTAINS "164872942-coinbase.com" OR sourcehostname CONTAINS "16590-coinbase.com" OR sourcehostname CONTAINS "16594373-coinbase.com" OR sourcehostname CONTAINS "16624831-coinbase.com" OR sourcehostname CONTAINS "16642124-coinbase.com" OR sourcehostname CONTAINS "16642172-coinbase.com" OR sourcehostname CONTAINS "16642580-coinbase.com" OR sourcehostname CONTAINS "16642721-coinbase.com" OR sourcehostname CONTAINS "16642724-coinbase.com" OR sourcehostname CONTAINS "16642871-coinbase.com" OR sourcehostname CONTAINS "16642872-coinbase.com" OR sourcehostname CONTAINS "16712942-coinbase.com" OR sourcehostname CONTAINS "16718672-coinbase.com" OR sourcehostname CONTAINS "16728342-coinbase.com" OR sourcehostname CONTAINS "16728348-coinbase.com" OR sourcehostname CONTAINS "16728442-coinbase.com" OR sourcehostname CONTAINS "16728472-coinbase.com" OR sourcehostname CONTAINS "167285-coinbase.com" OR sourcehostname CONTAINS "16729042-coinbase.com" OR sourcehostname CONTAINS "16748272-coinbase.com" OR sourcehostname CONTAINS "16782942-coinbase.com" OR sourcehostname CONTAINS "16827420-coinbase.com" OR sourcehostname CONTAINS "16827423-coinbase.com" OR sourcehostname CONTAINS "16847145-coinbase.com" OR sourcehostname CONTAINS "16893924-coinbase.com" OR sourcehostname CONTAINS "17182-coinbase.com" OR sourcehostname CONTAINS "17255030-coinbase.com" OR sourcehostname CONTAINS "17259-kraken.com" OR sourcehostname CONTAINS "172486-coinbase.com" OR sourcehostname CONTAINS "17284652-coinbase.com" OR sourcehostname CONTAINS "17286-coinbase.com" OR sourcehostname CONTAINS "17334522-coinbase.com" OR sourcehostname CONTAINS "17334522-kraken.com" OR sourcehostname CONTAINS "17384522-coinbase.com" OR sourcehostname CONTAINS "173912-coinbase.com" OR sourcehostname CONTAINS "17494976-coinbase.com" OR sourcehostname CONTAINS "17512854-coinbase.com" OR sourcehostname CONTAINS "17512857-coinbase.com" OR sourcehostname CONTAINS "1751954-coinbase.com" OR sourcehostname CONTAINS "17525030-coinbase.com" OR sourcehostname CONTAINS "17529580-coinbase.com" OR sourcehostname CONTAINS "17614-coinbase.com" OR sourcehostname CONTAINS "17618412-coinbase.com" OR sourcehostname CONTAINS "17619-coinbase.com" OR sourcehostname CONTAINS "176284-coinbase.com" OR sourcehostname CONTAINS "17823920-coinbase.com" OR sourcehostname CONTAINS "178253-coinbase.com")
index=activity AND rg_functionality="Cloud Application Security Broker" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "16450207-coinbase.com" OR destinationntdomain CONTAINS "16458207-coinbase.com" OR destinationntdomain CONTAINS "16478202-coinbase.com" OR destinationntdomain CONTAINS "164872942-coinbase.com" OR destinationntdomain CONTAINS "16590-coinbase.com" OR destinationntdomain CONTAINS "16594373-coinbase.com" OR destinationntdomain CONTAINS "16624831-coinbase.com" OR destinationntdomain CONTAINS "16642124-coinbase.com" OR destinationntdomain CONTAINS "16642172-coinbase.com" OR destinationntdomain CONTAINS "16642580-coinbase.com" OR destinationntdomain CONTAINS "16642721-coinbase.com" OR destinationntdomain CONTAINS "16642724-coinbase.com" OR destinationntdomain CONTAINS "16642871-coinbase.com" OR destinationntdomain CONTAINS "16642872-coinbase.com" OR destinationntdomain CONTAINS "16712942-coinbase.com" OR destinationntdomain CONTAINS "16718672-coinbase.com" OR destinationntdomain CONTAINS "16728342-coinbase.com" OR destinationntdomain CONTAINS "16728348-coinbase.com" OR destinationntdomain CONTAINS "16728442-coinbase.com" OR destinationntdomain CONTAINS "16728472-coinbase.com" OR destinationntdomain CONTAINS "167285-coinbase.com" OR destinationntdomain CONTAINS "16729042-coinbase.com" OR destinationntdomain CONTAINS "16748272-coinbase.com" OR destinationntdomain CONTAINS "16782942-coinbase.com" OR destinationntdomain CONTAINS "16827420-coinbase.com" OR destinationntdomain CONTAINS "16827423-coinbase.com" OR destinationntdomain CONTAINS "16847145-coinbase.com" OR destinationntdomain CONTAINS "16893924-coinbase.com" OR destinationntdomain CONTAINS "17182-coinbase.com" OR destinationntdomain CONTAINS "17255030-coinbase.com" OR destinationntdomain CONTAINS "17259-kraken.com" OR destinationntdomain CONTAINS "172486-coinbase.com" OR destinationntdomain CONTAINS "17284652-coinbase.com" OR destinationntdomain CONTAINS "17286-coinbase.com" OR destinationntdomain CONTAINS "17334522-coinbase.com" OR destinationntdomain CONTAINS "17334522-kraken.com" OR destinationntdomain CONTAINS "17384522-coinbase.com" OR destinationntdomain CONTAINS "173912-coinbase.com" OR destinationntdomain CONTAINS "17494976-coinbase.com" OR destinationntdomain CONTAINS "17512854-coinbase.com" OR destinationntdomain CONTAINS "17512857-coinbase.com" OR destinationntdomain CONTAINS "1751954-coinbase.com" OR destinationntdomain CONTAINS "17525030-coinbase.com" OR destinationntdomain CONTAINS "17529580-coinbase.com" OR destinationntdomain CONTAINS "17614-coinbase.com" OR destinationntdomain CONTAINS "17618412-coinbase.com" OR destinationntdomain CONTAINS "17619-coinbase.com" OR destinationntdomain CONTAINS "176284-coinbase.com" OR destinationntdomain CONTAINS "17823920-coinbase.com" OR destinationntdomain CONTAINS "178253-coinbase.com")
index=activity AND rg_functionality="Cloud Application Security Broker" AND requesturl NOT NULL AND (requesturl CONTAINS "16450207-coinbase.com" OR requesturl CONTAINS "16458207-coinbase.com" OR requesturl CONTAINS "16478202-coinbase.com" OR requesturl CONTAINS "164872942-coinbase.com" OR requesturl CONTAINS "16590-coinbase.com" OR requesturl CONTAINS "16594373-coinbase.com" OR requesturl CONTAINS "16624831-coinbase.com" OR requesturl CONTAINS "16642124-coinbase.com" OR requesturl CONTAINS "16642172-coinbase.com" OR requesturl CONTAINS "16642580-coinbase.com" OR requesturl CONTAINS "16642721-coinbase.com" OR requesturl CONTAINS "16642724-coinbase.com" OR requesturl CONTAINS "16642871-coinbase.com" OR requesturl CONTAINS "16642872-coinbase.com" OR requesturl CONTAINS "16712942-coinbase.com" OR requesturl CONTAINS "16718672-coinbase.com" OR requesturl CONTAINS "16728342-coinbase.com" OR requesturl CONTAINS "16728348-coinbase.com" OR requesturl CONTAINS "16728442-coinbase.com" OR requesturl CONTAINS "16728472-coinbase.com" OR requesturl CONTAINS "167285-coinbase.com" OR requesturl CONTAINS "16729042-coinbase.com" OR requesturl CONTAINS "16748272-coinbase.com" OR requesturl CONTAINS "16782942-coinbase.com" OR requesturl CONTAINS "16827420-coinbase.com" OR requesturl CONTAINS "16827423-coinbase.com" OR requesturl CONTAINS "16847145-coinbase.com" OR requesturl CONTAINS "16893924-coinbase.com" OR requesturl CONTAINS "17182-coinbase.com" OR requesturl CONTAINS "17255030-coinbase.com" OR requesturl CONTAINS "17259-kraken.com" OR requesturl CONTAINS "172486-coinbase.com" OR requesturl CONTAINS "17284652-coinbase.com" OR requesturl CONTAINS "17286-coinbase.com" OR requesturl CONTAINS "17334522-coinbase.com" OR requesturl CONTAINS "17334522-kraken.com" OR requesturl CONTAINS "17384522-coinbase.com" OR requesturl CONTAINS "173912-coinbase.com" OR requesturl CONTAINS "17494976-coinbase.com" OR requesturl CONTAINS "17512854-coinbase.com" OR requesturl CONTAINS "17512857-coinbase.com" OR requesturl CONTAINS "1751954-coinbase.com" OR requesturl CONTAINS "17525030-coinbase.com" OR requesturl CONTAINS "17529580-coinbase.com" OR requesturl CONTAINS "17614-coinbase.com" OR requesturl CONTAINS "17618412-coinbase.com" OR requesturl CONTAINS "17619-coinbase.com" OR requesturl CONTAINS "176284-coinbase.com" OR requesturl CONTAINS "17823920-coinbase.com" OR requesturl CONTAINS "178253-coinbase.com")
index=activity AND rg_functionality="Cloud Application Security Broker" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "178294-coinbase.com" OR destinationhostname CONTAINS "17912-coinbase.com" OR destinationhostname CONTAINS "17914-coinbase.com" OR destinationhostname CONTAINS "17917-coinbase.com" OR destinationhostname CONTAINS "17954-coinbase.com" OR destinationhostname CONTAINS "17958-coinbase.com" OR destinationhostname CONTAINS "182043-coinbase.com" OR destinationhostname CONTAINS "18275-gemini.com" OR destinationhostname CONTAINS "18276-coinbase.com" OR destinationhostname CONTAINS "18290185-coinbase.com" OR destinationhostname CONTAINS "182967-coinbase.com" OR destinationhostname CONTAINS "18560-coinbase.com" OR destinationhostname CONTAINS "18571-coinbase.com" OR destinationhostname CONTAINS "185912-coinbase.com" OR destinationhostname CONTAINS "185914-coinbase.com" OR destinationhostname CONTAINS "18592176-coinbase.com" OR destinationhostname CONTAINS "18594162-coinbase.com" OR destinationhostname CONTAINS "18594962-coinbase.com" OR destinationhostname CONTAINS "18597162-coinbase.com" OR destinationhostname CONTAINS "18719562-coinbase.com" OR destinationhostname CONTAINS "1875290-coinbase.com" OR destinationhostname CONTAINS "1882730-coinbase.com" OR destinationhostname CONTAINS "18902-coinbase.com" OR destinationhostname CONTAINS "18903-coinbase.com" OR destinationhostname CONTAINS "189126-coinbase.com" OR destinationhostname CONTAINS "18952-coinbase.com" OR destinationhostname CONTAINS "192854-coinbase.com" OR destinationhostname CONTAINS "192856-coinbase.com" OR destinationhostname CONTAINS "19287-binance.com" OR destinationhostname CONTAINS "19572-coinbase.com" OR destinationhostname CONTAINS "195812-coinbase.com" OR destinationhostname CONTAINS "195826-coinbase.com" OR destinationhostname CONTAINS "1958262-coinbase.com" OR destinationhostname CONTAINS "195827-binance.com" OR destinationhostname CONTAINS "1958297-coinbase.com" OR destinationhostname CONTAINS "19582970-coinbase.com" OR destinationhostname CONTAINS "19582971-coinbase.com" OR destinationhostname CONTAINS "19583-coinbase.com" OR destinationhostname CONTAINS "19592653-coinbase.com" OR destinationhostname CONTAINS "197304-coinbase.com" OR destinationhostname CONTAINS "19730492-coinbase.com" OR destinationhostname CONTAINS "19764162-coinbase.com" OR destinationhostname CONTAINS "19803-coinbase.com" OR destinationhostname CONTAINS "201784289-coinbase.com" OR destinationhostname CONTAINS "210823644-coinbase.com" OR destinationhostname CONTAINS "21158-coinbase.com" OR destinationhostname CONTAINS "21509-coinbase.com" OR destinationhostname CONTAINS "25985-coinbase.com" OR destinationhostname CONTAINS "27699-coinbase.com" OR destinationhostname CONTAINS "28367-coinbase.com")
index=activity AND rg_functionality="Cloud Application Security Broker" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "178294-coinbase.com" OR sourcentdomain CONTAINS "17912-coinbase.com" OR sourcentdomain CONTAINS "17914-coinbase.com" OR sourcentdomain CONTAINS "17917-coinbase.com" OR sourcentdomain CONTAINS "17954-coinbase.com" OR sourcentdomain CONTAINS "17958-coinbase.com" OR sourcentdomain CONTAINS "182043-coinbase.com" OR sourcentdomain CONTAINS "18275-gemini.com" OR sourcentdomain CONTAINS "18276-coinbase.com" OR sourcentdomain CONTAINS "18290185-coinbase.com" OR sourcentdomain CONTAINS "182967-coinbase.com" OR sourcentdomain CONTAINS "18560-coinbase.com" OR sourcentdomain CONTAINS "18571-coinbase.com" OR sourcentdomain CONTAINS "185912-coinbase.com" OR sourcentdomain CONTAINS "185914-coinbase.com" OR sourcentdomain CONTAINS "18592176-coinbase.com" OR sourcentdomain CONTAINS "18594162-coinbase.com" OR sourcentdomain CONTAINS "18594962-coinbase.com" OR sourcentdomain CONTAINS "18597162-coinbase.com" OR sourcentdomain CONTAINS "18719562-coinbase.com" OR sourcentdomain CONTAINS "1875290-coinbase.com" OR sourcentdomain CONTAINS "1882730-coinbase.com" OR sourcentdomain CONTAINS "18902-coinbase.com" OR sourcentdomain CONTAINS "18903-coinbase.com" OR sourcentdomain CONTAINS "189126-coinbase.com" OR sourcentdomain CONTAINS "18952-coinbase.com" OR sourcentdomain CONTAINS "192854-coinbase.com" OR sourcentdomain CONTAINS "192856-coinbase.com" OR sourcentdomain CONTAINS "19287-binance.com" OR sourcentdomain CONTAINS "19572-coinbase.com" OR sourcentdomain CONTAINS "195812-coinbase.com" OR sourcentdomain CONTAINS "195826-coinbase.com" OR sourcentdomain CONTAINS "1958262-coinbase.com" OR sourcentdomain CONTAINS "195827-binance.com" OR sourcentdomain CONTAINS "1958297-coinbase.com" OR sourcentdomain CONTAINS "19582970-coinbase.com" OR sourcentdomain CONTAINS "19582971-coinbase.com" OR sourcentdomain CONTAINS "19583-coinbase.com" OR sourcentdomain CONTAINS "19592653-coinbase.com" OR sourcentdomain CONTAINS "197304-coinbase.com" OR sourcentdomain CONTAINS "19730492-coinbase.com" OR sourcentdomain CONTAINS "19764162-coinbase.com" OR sourcentdomain CONTAINS "19803-coinbase.com" OR sourcentdomain CONTAINS "201784289-coinbase.com" OR sourcentdomain CONTAINS "210823644-coinbase.com" OR sourcentdomain CONTAINS "21158-coinbase.com" OR sourcentdomain CONTAINS "21509-coinbase.com" OR sourcentdomain CONTAINS "25985-coinbase.com" OR sourcentdomain CONTAINS "27699-coinbase.com" OR sourcentdomain CONTAINS "28367-coinbase.com")
index=activity AND rg_functionality="Cloud Application Security Broker" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "178294-coinbase.com" OR sourcehostname CONTAINS "17912-coinbase.com" OR sourcehostname CONTAINS "17914-coinbase.com" OR sourcehostname CONTAINS "17917-coinbase.com" OR sourcehostname CONTAINS "17954-coinbase.com" OR sourcehostname CONTAINS "17958-coinbase.com" OR sourcehostname CONTAINS "182043-coinbase.com" OR sourcehostname CONTAINS "18275-gemini.com" OR sourcehostname CONTAINS "18276-coinbase.com" OR sourcehostname CONTAINS "18290185-coinbase.com" OR sourcehostname CONTAINS "182967-coinbase.com" OR sourcehostname CONTAINS "18560-coinbase.com" OR sourcehostname CONTAINS "18571-coinbase.com" OR sourcehostname CONTAINS "185912-coinbase.com" OR sourcehostname CONTAINS "185914-coinbase.com" OR sourcehostname CONTAINS "18592176-coinbase.com" OR sourcehostname CONTAINS "18594162-coinbase.com" OR sourcehostname CONTAINS "18594962-coinbase.com" OR sourcehostname CONTAINS "18597162-coinbase.com" OR sourcehostname CONTAINS "18719562-coinbase.com" OR sourcehostname CONTAINS "1875290-coinbase.com" OR sourcehostname CONTAINS "1882730-coinbase.com" OR sourcehostname CONTAINS "18902-coinbase.com" OR sourcehostname CONTAINS "18903-coinbase.com" OR sourcehostname CONTAINS "189126-coinbase.com" OR sourcehostname CONTAINS "18952-coinbase.com" OR sourcehostname CONTAINS "192854-coinbase.com" OR sourcehostname CONTAINS "192856-coinbase.com" OR sourcehostname CONTAINS "19287-binance.com" OR sourcehostname CONTAINS "19572-coinbase.com" OR sourcehostname CONTAINS "195812-coinbase.com" OR sourcehostname CONTAINS "195826-coinbase.com" OR sourcehostname CONTAINS "1958262-coinbase.com" OR sourcehostname CONTAINS "195827-binance.com" OR sourcehostname CONTAINS "1958297-coinbase.com" OR sourcehostname CONTAINS "19582970-coinbase.com" OR sourcehostname CONTAINS "19582971-coinbase.com" OR sourcehostname CONTAINS "19583-coinbase.com" OR sourcehostname CONTAINS "19592653-coinbase.com" OR sourcehostname CONTAINS "197304-coinbase.com" OR sourcehostname CONTAINS "19730492-coinbase.com" OR sourcehostname CONTAINS "19764162-coinbase.com" OR sourcehostname CONTAINS "19803-coinbase.com" OR sourcehostname CONTAINS "201784289-coinbase.com" OR sourcehostname CONTAINS "210823644-coinbase.com" OR sourcehostname CONTAINS "21158-coinbase.com" OR sourcehostname CONTAINS "21509-coinbase.com" OR sourcehostname CONTAINS "25985-coinbase.com" OR sourcehostname CONTAINS "27699-coinbase.com" OR sourcehostname CONTAINS "28367-coinbase.com")
index=activity AND rg_functionality="Cloud Application Security Broker" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "178294-coinbase.com" OR destinationntdomain CONTAINS "17912-coinbase.com" OR destinationntdomain CONTAINS "17914-coinbase.com" OR destinationntdomain CONTAINS "17917-coinbase.com" OR destinationntdomain CONTAINS "17954-coinbase.com" OR destinationntdomain CONTAINS "17958-coinbase.com" OR destinationntdomain CONTAINS "182043-coinbase.com" OR destinationntdomain CONTAINS "18275-gemini.com" OR destinationntdomain CONTAINS "18276-coinbase.com" OR destinationntdomain CONTAINS "18290185-coinbase.com" OR destinationntdomain CONTAINS "182967-coinbase.com" OR destinationntdomain CONTAINS "18560-coinbase.com" OR destinationntdomain CONTAINS "18571-coinbase.com" OR destinationntdomain CONTAINS "185912-coinbase.com" OR destinationntdomain CONTAINS "185914-coinbase.com" OR destinationntdomain CONTAINS "18592176-coinbase.com" OR destinationntdomain CONTAINS "18594162-coinbase.com" OR destinationntdomain CONTAINS "18594962-coinbase.com" OR destinationntdomain CONTAINS "18597162-coinbase.com" OR destinationntdomain CONTAINS "18719562-coinbase.com" OR destinationntdomain CONTAINS "1875290-coinbase.com" OR destinationntdomain CONTAINS "1882730-coinbase.com" OR destinationntdomain CONTAINS "18902-coinbase.com" OR destinationntdomain CONTAINS "18903-coinbase.com" OR destinationntdomain CONTAINS "189126-coinbase.com" OR destinationntdomain CONTAINS "18952-coinbase.com" OR destinationntdomain CONTAINS "192854-coinbase.com" OR destinationntdomain CONTAINS "192856-coinbase.com" OR destinationntdomain CONTAINS "19287-binance.com" OR destinationntdomain CONTAINS "19572-coinbase.com" OR destinationntdomain CONTAINS "195812-coinbase.com" OR destinationntdomain CONTAINS "195826-coinbase.com" OR destinationntdomain CONTAINS "1958262-coinbase.com" OR destinationntdomain CONTAINS "195827-binance.com" OR destinationntdomain CONTAINS "1958297-coinbase.com" OR destinationntdomain CONTAINS "19582970-coinbase.com" OR destinationntdomain CONTAINS "19582971-coinbase.com" OR destinationntdomain CONTAINS "19583-coinbase.com" OR destinationntdomain CONTAINS "19592653-coinbase.com" OR destinationntdomain CONTAINS "197304-coinbase.com" OR destinationntdomain CONTAINS "19730492-coinbase.com" OR destinationntdomain CONTAINS "19764162-coinbase.com" OR destinationntdomain CONTAINS "19803-coinbase.com" OR destinationntdomain CONTAINS "201784289-coinbase.com" OR destinationntdomain CONTAINS "210823644-coinbase.com" OR destinationntdomain CONTAINS "21158-coinbase.com" OR destinationntdomain CONTAINS "21509-coinbase.com" OR destinationntdomain CONTAINS "25985-coinbase.com" OR destinationntdomain CONTAINS "27699-coinbase.com" OR destinationntdomain CONTAINS "28367-coinbase.com")
index=activity AND rg_functionality="Cloud Application Security Broker" AND requesturl NOT NULL AND (requesturl CONTAINS "178294-coinbase.com" OR requesturl CONTAINS "17912-coinbase.com" OR requesturl CONTAINS "17914-coinbase.com" OR requesturl CONTAINS "17917-coinbase.com" OR requesturl CONTAINS "17954-coinbase.com" OR requesturl CONTAINS "17958-coinbase.com" OR requesturl CONTAINS "182043-coinbase.com" OR requesturl CONTAINS "18275-gemini.com" OR requesturl CONTAINS "18276-coinbase.com" OR requesturl CONTAINS "18290185-coinbase.com" OR requesturl CONTAINS "182967-coinbase.com" OR requesturl CONTAINS "18560-coinbase.com" OR requesturl CONTAINS "18571-coinbase.com" OR requesturl CONTAINS "185912-coinbase.com" OR requesturl CONTAINS "185914-coinbase.com" OR requesturl CONTAINS "18592176-coinbase.com" OR requesturl CONTAINS "18594162-coinbase.com" OR requesturl CONTAINS "18594962-coinbase.com" OR requesturl CONTAINS "18597162-coinbase.com" OR requesturl CONTAINS "18719562-coinbase.com" OR requesturl CONTAINS "1875290-coinbase.com" OR requesturl CONTAINS "1882730-coinbase.com" OR requesturl CONTAINS "18902-coinbase.com" OR requesturl CONTAINS "18903-coinbase.com" OR requesturl CONTAINS "189126-coinbase.com" OR requesturl CONTAINS "18952-coinbase.com" OR requesturl CONTAINS "192854-coinbase.com" OR requesturl CONTAINS "192856-coinbase.com" OR requesturl CONTAINS "19287-binance.com" OR requesturl CONTAINS "19572-coinbase.com" OR requesturl CONTAINS "195812-coinbase.com" OR requesturl CONTAINS "195826-coinbase.com" OR requesturl CONTAINS "1958262-coinbase.com" OR requesturl CONTAINS "195827-binance.com" OR requesturl CONTAINS "1958297-coinbase.com" OR requesturl CONTAINS "19582970-coinbase.com" OR requesturl CONTAINS "19582971-coinbase.com" OR requesturl CONTAINS "19583-coinbase.com" OR requesturl CONTAINS "19592653-coinbase.com" OR requesturl CONTAINS "197304-coinbase.com" OR requesturl CONTAINS "19730492-coinbase.com" OR requesturl CONTAINS "19764162-coinbase.com" OR requesturl CONTAINS "19803-coinbase.com" OR requesturl CONTAINS "201784289-coinbase.com" OR requesturl CONTAINS "210823644-coinbase.com" OR requesturl CONTAINS "21158-coinbase.com" OR requesturl CONTAINS "21509-coinbase.com" OR requesturl CONTAINS "25985-coinbase.com" OR requesturl CONTAINS "27699-coinbase.com" OR requesturl CONTAINS "28367-coinbase.com")
index=activity AND rg_functionality="Cloud Application Security Broker" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "28676-coinbase.com" OR destinationhostname CONTAINS "29185-coinbase.com" OR destinationhostname CONTAINS "29195-coinbase.com" OR destinationhostname CONTAINS "2a-coinbase.com" OR destinationhostname CONTAINS "2b-coinbase.com" OR destinationhostname CONTAINS "2c-coinbase.com" OR destinationhostname CONTAINS "2f-coinbase.com" OR destinationhostname CONTAINS "2fas-coinbase.com" OR destinationhostname CONTAINS "2o-coinbase.com" OR destinationhostname CONTAINS "2r-coinbase.com" OR destinationhostname CONTAINS "2s-coinbase.com" OR destinationhostname CONTAINS "2sv-coinbase.com" OR destinationhostname CONTAINS "352134951-coinbase.com" OR destinationhostname CONTAINS "38468-coinbase.com" OR destinationhostname CONTAINS "39590-coinbase.com" OR destinationhostname CONTAINS "41260-coinbase.com" OR destinationhostname CONTAINS "427883-coinbase.com" OR destinationhostname CONTAINS "43017-coinbase.com" OR destinationhostname CONTAINS "47562-coinbase.com" OR destinationhostname CONTAINS "50195-coinbase.com" OR destinationhostname CONTAINS "5247-coinbase.com" OR destinationhostname CONTAINS "54765-coinbase.com" OR destinationhostname CONTAINS "57197-coinbase.com" OR destinationhostname CONTAINS "58176-coinbase.com" OR destinationhostname CONTAINS "58297-coinbase.com" OR destinationhostname CONTAINS "61250-coinbase.com" OR destinationhostname CONTAINS "61835-coinbase.com" OR destinationhostname CONTAINS "61851-coinbase.com" OR destinationhostname CONTAINS "61937-coinbase.com" OR destinationhostname CONTAINS "71925-coinbase.com" OR destinationhostname CONTAINS "72957-coinbase.com" OR destinationhostname CONTAINS "72985-coinbase.com" OR destinationhostname CONTAINS "74651-coinbase.com" OR destinationhostname CONTAINS "754668948-coinbase.com" OR destinationhostname CONTAINS "76159869-coinbase.com" OR destinationhostname CONTAINS "76153-coinbase.com" OR destinationhostname CONTAINS "81758-coinbase.com" OR destinationhostname CONTAINS "81920-coinbase.com" OR destinationhostname CONTAINS "81926-coinbase.com" OR destinationhostname CONTAINS "81958-coinbase.com" OR destinationhostname CONTAINS "826298-coinbase.com" OR destinationhostname CONTAINS "83216-coinbase.com" OR destinationhostname CONTAINS "837613-coinbase.com" OR destinationhostname CONTAINS "83956-coinbase.com" OR destinationhostname CONTAINS "87157-coinbase.com" OR destinationhostname CONTAINS "87312-coinbase.com" OR destinationhostname CONTAINS "89304-coinbase.com" OR destinationhostname CONTAINS "89375-coinbase.com" OR destinationhostname CONTAINS "91723-gemini.com" OR destinationhostname CONTAINS "91752-coinbase.com")
index=activity AND rg_functionality="Cloud Application Security Broker" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "28676-coinbase.com" OR sourcentdomain CONTAINS "29185-coinbase.com" OR sourcentdomain CONTAINS "29195-coinbase.com" OR sourcentdomain CONTAINS "2a-coinbase.com" OR sourcentdomain CONTAINS "2b-coinbase.com" OR sourcentdomain CONTAINS "2c-coinbase.com" OR sourcentdomain CONTAINS "2f-coinbase.com" OR sourcentdomain CONTAINS "2fas-coinbase.com" OR sourcentdomain CONTAINS "2o-coinbase.com" OR sourcentdomain CONTAINS "2r-coinbase.com" OR sourcentdomain CONTAINS "2s-coinbase.com" OR sourcentdomain CONTAINS "2sv-coinbase.com" OR sourcentdomain CONTAINS "352134951-coinbase.com" OR sourcentdomain CONTAINS "38468-coinbase.com" OR sourcentdomain CONTAINS "39590-coinbase.com" OR sourcentdomain CONTAINS "41260-coinbase.com" OR sourcentdomain CONTAINS "427883-coinbase.com" OR sourcentdomain CONTAINS "43017-coinbase.com" OR sourcentdomain CONTAINS "47562-coinbase.com" OR sourcentdomain CONTAINS "50195-coinbase.com" OR sourcentdomain CONTAINS "5247-coinbase.com" OR sourcentdomain CONTAINS "54765-coinbase.com" OR sourcentdomain CONTAINS "57197-coinbase.com" OR sourcentdomain CONTAINS "58176-coinbase.com" OR sourcentdomain CONTAINS "58297-coinbase.com" OR sourcentdomain CONTAINS "61250-coinbase.com" OR sourcentdomain CONTAINS "61835-coinbase.com" OR sourcentdomain CONTAINS "61851-coinbase.com" OR sourcentdomain CONTAINS "61937-coinbase.com" OR sourcentdomain CONTAINS "71925-coinbase.com" OR sourcentdomain CONTAINS "72957-coinbase.com" OR sourcentdomain CONTAINS "72985-coinbase.com" OR sourcentdomain CONTAINS "74651-coinbase.com" OR sourcentdomain CONTAINS "754668948-coinbase.com" OR sourcentdomain CONTAINS "76159869-coinbase.com" OR sourcentdomain CONTAINS "76153-coinbase.com" OR sourcentdomain CONTAINS "81758-coinbase.com" OR sourcentdomain CONTAINS "81920-coinbase.com" OR sourcentdomain CONTAINS "81926-coinbase.com" OR sourcentdomain CONTAINS "81958-coinbase.com" OR sourcentdomain CONTAINS "826298-coinbase.com" OR sourcentdomain CONTAINS "83216-coinbase.com" OR sourcentdomain CONTAINS "837613-coinbase.com" OR sourcentdomain CONTAINS "83956-coinbase.com" OR sourcentdomain CONTAINS "87157-coinbase.com" OR sourcentdomain CONTAINS "87312-coinbase.com" OR sourcentdomain CONTAINS "89304-coinbase.com" OR sourcentdomain CONTAINS "89375-coinbase.com" OR sourcentdomain CONTAINS "91723-gemini.com" OR sourcentdomain CONTAINS "91752-coinbase.com")
index=activity AND rg_functionality="Cloud Application Security Broker" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "28676-coinbase.com" OR sourcehostname CONTAINS "29185-coinbase.com" OR sourcehostname CONTAINS "29195-coinbase.com" OR sourcehostname CONTAINS "2a-coinbase.com" OR sourcehostname CONTAINS "2b-coinbase.com" OR sourcehostname CONTAINS "2c-coinbase.com" OR sourcehostname CONTAINS "2f-coinbase.com" OR sourcehostname CONTAINS "2fas-coinbase.com" OR sourcehostname CONTAINS "2o-coinbase.com" OR sourcehostname CONTAINS "2r-coinbase.com" OR sourcehostname CONTAINS "2s-coinbase.com" OR sourcehostname CONTAINS "2sv-coinbase.com" OR sourcehostname CONTAINS "352134951-coinbase.com" OR sourcehostname CONTAINS "38468-coinbase.com" OR sourcehostname CONTAINS "39590-coinbase.com" OR sourcehostname CONTAINS "41260-coinbase.com" OR sourcehostname CONTAINS "427883-coinbase.com" OR sourcehostname CONTAINS "43017-coinbase.com" OR sourcehostname CONTAINS "47562-coinbase.com" OR sourcehostname CONTAINS "50195-coinbase.com" OR sourcehostname CONTAINS "5247-coinbase.com" OR sourcehostname CONTAINS "54765-coinbase.com" OR sourcehostname CONTAINS "57197-coinbase.com" OR sourcehostname CONTAINS "58176-coinbase.com" OR sourcehostname CONTAINS "58297-coinbase.com" OR sourcehostname CONTAINS "61250-coinbase.com" OR sourcehostname CONTAINS "61835-coinbase.com" OR sourcehostname CONTAINS "61851-coinbase.com" OR sourcehostname CONTAINS "61937-coinbase.com" OR sourcehostname CONTAINS "71925-coinbase.com" OR sourcehostname CONTAINS "72957-coinbase.com" OR sourcehostname CONTAINS "72985-coinbase.com" OR sourcehostname CONTAINS "74651-coinbase.com" OR sourcehostname CONTAINS "754668948-coinbase.com" OR sourcehostname CONTAINS "76159869-coinbase.com" OR sourcehostname CONTAINS "76153-coinbase.com" OR sourcehostname CONTAINS "81758-coinbase.com" OR sourcehostname CONTAINS "81920-coinbase.com" OR sourcehostname CONTAINS "81926-coinbase.com" OR sourcehostname CONTAINS "81958-coinbase.com" OR sourcehostname CONTAINS "826298-coinbase.com" OR sourcehostname CONTAINS "83216-coinbase.com" OR sourcehostname CONTAINS "837613-coinbase.com" OR sourcehostname CONTAINS "83956-coinbase.com" OR sourcehostname CONTAINS "87157-coinbase.com" OR sourcehostname CONTAINS "87312-coinbase.com" OR sourcehostname CONTAINS "89304-coinbase.com" OR sourcehostname CONTAINS "89375-coinbase.com" OR sourcehostname CONTAINS "91723-gemini.com" OR sourcehostname CONTAINS "91752-coinbase.com")
index=activity AND rg_functionality="Cloud Application Security Broker" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "28676-coinbase.com" OR destinationntdomain CONTAINS "29185-coinbase.com" OR destinationntdomain CONTAINS "29195-coinbase.com" OR destinationntdomain CONTAINS "2a-coinbase.com" OR destinationntdomain CONTAINS "2b-coinbase.com" OR destinationntdomain CONTAINS "2c-coinbase.com" OR destinationntdomain CONTAINS "2f-coinbase.com" OR destinationntdomain CONTAINS "2fas-coinbase.com" OR destinationntdomain CONTAINS "2o-coinbase.com" OR destinationntdomain CONTAINS "2r-coinbase.com" OR destinationntdomain CONTAINS "2s-coinbase.com" OR destinationntdomain CONTAINS "2sv-coinbase.com" OR destinationntdomain CONTAINS "352134951-coinbase.com" OR destinationntdomain CONTAINS "38468-coinbase.com" OR destinationntdomain CONTAINS "39590-coinbase.com" OR destinationntdomain CONTAINS "41260-coinbase.com" OR destinationntdomain CONTAINS "427883-coinbase.com" OR destinationntdomain CONTAINS "43017-coinbase.com" OR destinationntdomain CONTAINS "47562-coinbase.com" OR destinationntdomain CONTAINS "50195-coinbase.com" OR destinationntdomain CONTAINS "5247-coinbase.com" OR destinationntdomain CONTAINS "54765-coinbase.com" OR destinationntdomain CONTAINS "57197-coinbase.com" OR destinationntdomain CONTAINS "58176-coinbase.com" OR destinationntdomain CONTAINS "58297-coinbase.com" OR destinationntdomain CONTAINS "61250-coinbase.com" OR destinationntdomain CONTAINS "61835-coinbase.com" OR destinationntdomain CONTAINS "61851-coinbase.com" OR destinationntdomain CONTAINS "61937-coinbase.com" OR destinationntdomain CONTAINS "71925-coinbase.com" OR destinationntdomain CONTAINS "72957-coinbase.com" OR destinationntdomain CONTAINS "72985-coinbase.com" OR destinationntdomain CONTAINS "74651-coinbase.com" OR destinationntdomain CONTAINS "754668948-coinbase.com" OR destinationntdomain CONTAINS "76159869-coinbase.com" OR destinationntdomain CONTAINS "76153-coinbase.com" OR destinationntdomain CONTAINS "81758-coinbase.com" OR destinationntdomain CONTAINS "81920-coinbase.com" OR destinationntdomain CONTAINS "81926-coinbase.com" OR destinationntdomain CONTAINS "81958-coinbase.com" OR destinationntdomain CONTAINS "826298-coinbase.com" OR destinationntdomain CONTAINS "83216-coinbase.com" OR destinationntdomain CONTAINS "837613-coinbase.com" OR destinationntdomain CONTAINS "83956-coinbase.com" OR destinationntdomain CONTAINS "87157-coinbase.com" OR destinationntdomain CONTAINS "87312-coinbase.com" OR destinationntdomain CONTAINS "89304-coinbase.com" OR destinationntdomain CONTAINS "89375-coinbase.com" OR destinationntdomain CONTAINS "91723-gemini.com" OR destinationntdomain CONTAINS "91752-coinbase.com")
index=activity AND rg_functionality="Cloud Application Security Broker" AND requesturl NOT NULL AND (requesturl CONTAINS "28676-coinbase.com" OR requesturl CONTAINS "29185-coinbase.com" OR requesturl CONTAINS "29195-coinbase.com" OR requesturl CONTAINS "2a-coinbase.com" OR requesturl CONTAINS "2b-coinbase.com" OR requesturl CONTAINS "2c-coinbase.com" OR requesturl CONTAINS "2f-coinbase.com" OR requesturl CONTAINS "2fas-coinbase.com" OR requesturl CONTAINS "2o-coinbase.com" OR requesturl CONTAINS "2r-coinbase.com" OR requesturl CONTAINS "2s-coinbase.com" OR requesturl CONTAINS "2sv-coinbase.com" OR requesturl CONTAINS "352134951-coinbase.com" OR requesturl CONTAINS "38468-coinbase.com" OR requesturl CONTAINS "39590-coinbase.com" OR requesturl CONTAINS "41260-coinbase.com" OR requesturl CONTAINS "427883-coinbase.com" OR requesturl CONTAINS "43017-coinbase.com" OR requesturl CONTAINS "47562-coinbase.com" OR requesturl CONTAINS "50195-coinbase.com" OR requesturl CONTAINS "5247-coinbase.com" OR requesturl CONTAINS "54765-coinbase.com" OR requesturl CONTAINS "57197-coinbase.com" OR requesturl CONTAINS "58176-coinbase.com" OR requesturl CONTAINS "58297-coinbase.com" OR requesturl CONTAINS "61250-coinbase.com" OR requesturl CONTAINS "61835-coinbase.com" OR requesturl CONTAINS "61851-coinbase.com" OR requesturl CONTAINS "61937-coinbase.com" OR requesturl CONTAINS "71925-coinbase.com" OR requesturl CONTAINS "72957-coinbase.com" OR requesturl CONTAINS "72985-coinbase.com" OR requesturl CONTAINS "74651-coinbase.com" OR requesturl CONTAINS "754668948-coinbase.com" OR requesturl CONTAINS "76159869-coinbase.com" OR requesturl CONTAINS "76153-coinbase.com" OR requesturl CONTAINS "81758-coinbase.com" OR requesturl CONTAINS "81920-coinbase.com" OR requesturl CONTAINS "81926-coinbase.com" OR requesturl CONTAINS "81958-coinbase.com" OR requesturl CONTAINS "826298-coinbase.com" OR requesturl CONTAINS "83216-coinbase.com" OR requesturl CONTAINS "837613-coinbase.com" OR requesturl CONTAINS "83956-coinbase.com" OR requesturl CONTAINS "87157-coinbase.com" OR requesturl CONTAINS "87312-coinbase.com" OR requesturl CONTAINS "89304-coinbase.com" OR requesturl CONTAINS "89375-coinbase.com" OR requesturl CONTAINS "91723-gemini.com" OR requesturl CONTAINS "91752-coinbase.com")
index=activity AND rg_functionality="Cloud Application Security Broker" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "91756-coinbase.com" OR destinationhostname CONTAINS "91782-coinbase.com" OR destinationhostname CONTAINS "91835-coinbase.com" OR destinationhostname CONTAINS "91845-coinbase.com" OR destinationhostname CONTAINS "91923-coinbase.com" OR destinationhostname CONTAINS "92758-coinbase.com" OR destinationhostname CONTAINS "948122061-coinbase.com" OR destinationhostname CONTAINS "978941-coinbase.com" OR destinationhostname CONTAINS "accountrecovery-coinbase.com" OR destinationhostname CONTAINS "action-shakepay.com" OR destinationhostname CONTAINS "adjust-coinbase.com" OR destinationhostname CONTAINS "admin-kraken.com" OR destinationhostname CONTAINS "applechargebacks.com" OR destinationhostname CONTAINS "authenticate-gemini.com" OR destinationhostname CONTAINS "authorize-gmail.com" OR destinationhostname CONTAINS "binance-okta.com" OR destinationhostname CONTAINS "captcha-coinbase.com" OR destinationhostname CONTAINS "cd-coinbase.com" OR destinationhostname CONTAINS "coinbase-heip.com" OR destinationhostname CONTAINS "coinbase-live.support" OR destinationhostname CONTAINS "coinbase-reject.com" OR destinationhostname CONTAINS "coinbase-ticket.com" OR destinationhostname CONTAINS "coinbaseheip.com" OR destinationhostname CONTAINS "com-2fa.help" OR destinationhostname CONTAINS "com-2fa.support" OR destinationhostname CONTAINS "com-3845.support" OR destinationhostname CONTAINS "com-connect.help" OR destinationhostname CONTAINS "com-fraud.support" OR destinationhostname CONTAINS "com-help.support" OR destinationhostname CONTAINS "com-reset.help" OR destinationhostname CONTAINS "com-reset.net" OR destinationhostname CONTAINS "com-ticket.live" OR destinationhostname CONTAINS "com-ticket.support" OR destinationhostname CONTAINS "contact-nexo.com" OR destinationhostname CONTAINS "convert-coinbase.com" OR destinationhostname CONTAINS "customerservice-coinbase.com" OR destinationhostname CONTAINS "default-coinbase.com" OR destinationhostname CONTAINS "defend-coinbase.com" OR destinationhostname CONTAINS "deny-coinbase.com" OR destinationhostname CONTAINS "disconnect-coinbase.com" OR destinationhostname CONTAINS "escalate-coinbase.com" OR destinationhostname CONTAINS "establish-coinbase.com" OR destinationhostname CONTAINS "fcc-okta.com" OR destinationhostname CONTAINS "fraudulent-coinbase.com" OR destinationhostname CONTAINS "guard-apple.com" OR destinationhostname CONTAINS "guard-icloud.com" OR destinationhostname CONTAINS "guardian-coinbase.com" OR destinationhostname CONTAINS "guide-gemini.com" OR destinationhostname CONTAINS "help-bitfinex.com" OR destinationhostname CONTAINS "help-shakepay.com")
index=activity AND rg_functionality="Cloud Application Security Broker" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "91756-coinbase.com" OR sourcentdomain CONTAINS "91782-coinbase.com" OR sourcentdomain CONTAINS "91835-coinbase.com" OR sourcentdomain CONTAINS "91845-coinbase.com" OR sourcentdomain CONTAINS "91923-coinbase.com" OR sourcentdomain CONTAINS "92758-coinbase.com" OR sourcentdomain CONTAINS "948122061-coinbase.com" OR sourcentdomain CONTAINS "978941-coinbase.com" OR sourcentdomain CONTAINS "accountrecovery-coinbase.com" OR sourcentdomain CONTAINS "action-shakepay.com" OR sourcentdomain CONTAINS "adjust-coinbase.com" OR sourcentdomain CONTAINS "admin-kraken.com" OR sourcentdomain CONTAINS "applechargebacks.com" OR sourcentdomain CONTAINS "authenticate-gemini.com" OR sourcentdomain CONTAINS "authorize-gmail.com" OR sourcentdomain CONTAINS "binance-okta.com" OR sourcentdomain CONTAINS "captcha-coinbase.com" OR sourcentdomain CONTAINS "cd-coinbase.com" OR sourcentdomain CONTAINS "coinbase-heip.com" OR sourcentdomain CONTAINS "coinbase-live.support" OR sourcentdomain CONTAINS "coinbase-reject.com" OR sourcentdomain CONTAINS "coinbase-ticket.com" OR sourcentdomain CONTAINS "coinbaseheip.com" OR sourcentdomain CONTAINS "com-2fa.help" OR sourcentdomain CONTAINS "com-2fa.support" OR sourcentdomain CONTAINS "com-3845.support" OR sourcentdomain CONTAINS "com-connect.help" OR sourcentdomain CONTAINS "com-fraud.support" OR sourcentdomain CONTAINS "com-help.support" OR sourcentdomain CONTAINS "com-reset.help" OR sourcentdomain CONTAINS "com-reset.net" OR sourcentdomain CONTAINS "com-ticket.live" OR sourcentdomain CONTAINS "com-ticket.support" OR sourcentdomain CONTAINS "contact-nexo.com" OR sourcentdomain CONTAINS "convert-coinbase.com" OR sourcentdomain CONTAINS "customerservice-coinbase.com" OR sourcentdomain CONTAINS "default-coinbase.com" OR sourcentdomain CONTAINS "defend-coinbase.com" OR sourcentdomain CONTAINS "deny-coinbase.com" OR sourcentdomain CONTAINS "disconnect-coinbase.com" OR sourcentdomain CONTAINS "escalate-coinbase.com" OR sourcentdomain CONTAINS "establish-coinbase.com" OR sourcentdomain CONTAINS "fcc-okta.com" OR sourcentdomain CONTAINS "fraudulent-coinbase.com" OR sourcentdomain CONTAINS "guard-apple.com" OR sourcentdomain CONTAINS "guard-icloud.com" OR sourcentdomain CONTAINS "guardian-coinbase.com" OR sourcentdomain CONTAINS "guide-gemini.com" OR sourcentdomain CONTAINS "help-bitfinex.com" OR sourcentdomain CONTAINS "help-shakepay.com")
index=activity AND rg_functionality="Cloud Application Security Broker" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "91756-coinbase.com" OR sourcehostname CONTAINS "91782-coinbase.com" OR sourcehostname CONTAINS "91835-coinbase.com" OR sourcehostname CONTAINS "91845-coinbase.com" OR sourcehostname CONTAINS "91923-coinbase.com" OR sourcehostname CONTAINS "92758-coinbase.com" OR sourcehostname CONTAINS "948122061-coinbase.com" OR sourcehostname CONTAINS "978941-coinbase.com" OR sourcehostname CONTAINS "accountrecovery-coinbase.com" OR sourcehostname CONTAINS "action-shakepay.com" OR sourcehostname CONTAINS "adjust-coinbase.com" OR sourcehostname CONTAINS "admin-kraken.com" OR sourcehostname CONTAINS "applechargebacks.com" OR sourcehostname CONTAINS "authenticate-gemini.com" OR sourcehostname CONTAINS "authorize-gmail.com" OR sourcehostname CONTAINS "binance-okta.com" OR sourcehostname CONTAINS "captcha-coinbase.com" OR sourcehostname CONTAINS "cd-coinbase.com" OR sourcehostname CONTAINS "coinbase-heip.com" OR sourcehostname CONTAINS "coinbase-live.support" OR sourcehostname CONTAINS "coinbase-reject.com" OR sourcehostname CONTAINS "coinbase-ticket.com" OR sourcehostname CONTAINS "coinbaseheip.com" OR sourcehostname CONTAINS "com-2fa.help" OR sourcehostname CONTAINS "com-2fa.support" OR sourcehostname CONTAINS "com-3845.support" OR sourcehostname CONTAINS "com-connect.help" OR sourcehostname CONTAINS "com-fraud.support" OR sourcehostname CONTAINS "com-help.support" OR sourcehostname CONTAINS "com-reset.help" OR sourcehostname CONTAINS "com-reset.net" OR sourcehostname CONTAINS "com-ticket.live" OR sourcehostname CONTAINS "com-ticket.support" OR sourcehostname CONTAINS "contact-nexo.com" OR sourcehostname CONTAINS "convert-coinbase.com" OR sourcehostname CONTAINS "customerservice-coinbase.com" OR sourcehostname CONTAINS "default-coinbase.com" OR sourcehostname CONTAINS "defend-coinbase.com" OR sourcehostname CONTAINS "deny-coinbase.com" OR sourcehostname CONTAINS "disconnect-coinbase.com" OR sourcehostname CONTAINS "escalate-coinbase.com" OR sourcehostname CONTAINS "establish-coinbase.com" OR sourcehostname CONTAINS "fcc-okta.com" OR sourcehostname CONTAINS "fraudulent-coinbase.com" OR sourcehostname CONTAINS "guard-apple.com" OR sourcehostname CONTAINS "guard-icloud.com" OR sourcehostname CONTAINS "guardian-coinbase.com" OR sourcehostname CONTAINS "guide-gemini.com" OR sourcehostname CONTAINS "help-bitfinex.com" OR sourcehostname CONTAINS "help-shakepay.com")
index=activity AND rg_functionality="Cloud Application Security Broker" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "91756-coinbase.com" OR destinationntdomain CONTAINS "91782-coinbase.com" OR destinationntdomain CONTAINS "91835-coinbase.com" OR destinationntdomain CONTAINS "91845-coinbase.com" OR destinationntdomain CONTAINS "91923-coinbase.com" OR destinationntdomain CONTAINS "92758-coinbase.com" OR destinationntdomain CONTAINS "948122061-coinbase.com" OR destinationntdomain CONTAINS "978941-coinbase.com" OR destinationntdomain CONTAINS "accountrecovery-coinbase.com" OR destinationntdomain CONTAINS "action-shakepay.com" OR destinationntdomain CONTAINS "adjust-coinbase.com" OR destinationntdomain CONTAINS "admin-kraken.com" OR destinationntdomain CONTAINS "applechargebacks.com" OR destinationntdomain CONTAINS "authenticate-gemini.com" OR destinationntdomain CONTAINS "authorize-gmail.com" OR destinationntdomain CONTAINS "binance-okta.com" OR destinationntdomain CONTAINS "captcha-coinbase.com" OR destinationntdomain CONTAINS "cd-coinbase.com" OR destinationntdomain CONTAINS "coinbase-heip.com" OR destinationntdomain CONTAINS "coinbase-live.support" OR destinationntdomain CONTAINS "coinbase-reject.com" OR destinationntdomain CONTAINS "coinbase-ticket.com" OR destinationntdomain CONTAINS "coinbaseheip.com" OR destinationntdomain CONTAINS "com-2fa.help" OR destinationntdomain CONTAINS "com-2fa.support" OR destinationntdomain CONTAINS "com-3845.support" OR destinationntdomain CONTAINS "com-connect.help" OR destinationntdomain CONTAINS "com-fraud.support" OR destinationntdomain CONTAINS "com-help.support" OR destinationntdomain CONTAINS "com-reset.help" OR destinationntdomain CONTAINS "com-reset.net" OR destinationntdomain CONTAINS "com-ticket.live" OR destinationntdomain CONTAINS "com-ticket.support" OR destinationntdomain CONTAINS "contact-nexo.com" OR destinationntdomain CONTAINS "convert-coinbase.com" OR destinationntdomain CONTAINS "customerservice-coinbase.com" OR destinationntdomain CONTAINS "default-coinbase.com" OR destinationntdomain CONTAINS "defend-coinbase.com" OR destinationntdomain CONTAINS "deny-coinbase.com" OR destinationntdomain CONTAINS "disconnect-coinbase.com" OR destinationntdomain CONTAINS "escalate-coinbase.com" OR destinationntdomain CONTAINS "establish-coinbase.com" OR destinationntdomain CONTAINS "fcc-okta.com" OR destinationntdomain CONTAINS "fraudulent-coinbase.com" OR destinationntdomain CONTAINS "guard-apple.com" OR destinationntdomain CONTAINS "guard-icloud.com" OR destinationntdomain CONTAINS "guardian-coinbase.com" OR destinationntdomain CONTAINS "guide-gemini.com" OR destinationntdomain CONTAINS "help-bitfinex.com" OR destinationntdomain CONTAINS "help-shakepay.com")
index=activity AND rg_functionality="Cloud Application Security Broker" AND requesturl NOT NULL AND (requesturl CONTAINS "91756-coinbase.com" OR requesturl CONTAINS "91782-coinbase.com" OR requesturl CONTAINS "91835-coinbase.com" OR requesturl CONTAINS "91845-coinbase.com" OR requesturl CONTAINS "91923-coinbase.com" OR requesturl CONTAINS "92758-coinbase.com" OR requesturl CONTAINS "948122061-coinbase.com" OR requesturl CONTAINS "978941-coinbase.com" OR requesturl CONTAINS "accountrecovery-coinbase.com" OR requesturl CONTAINS "action-shakepay.com" OR requesturl CONTAINS "adjust-coinbase.com" OR requesturl CONTAINS "admin-kraken.com" OR requesturl CONTAINS "applechargebacks.com" OR requesturl CONTAINS "authenticate-gemini.com" OR requesturl CONTAINS "authorize-gmail.com" OR requesturl CONTAINS "binance-okta.com" OR requesturl CONTAINS "captcha-coinbase.com" OR requesturl CONTAINS "cd-coinbase.com" OR requesturl CONTAINS "coinbase-heip.com" OR requesturl CONTAINS "coinbase-live.support" OR requesturl CONTAINS "coinbase-reject.com" OR requesturl CONTAINS "coinbase-ticket.com" OR requesturl CONTAINS "coinbaseheip.com" OR requesturl CONTAINS "com-2fa.help" OR requesturl CONTAINS "com-2fa.support" OR requesturl CONTAINS "com-3845.support" OR requesturl CONTAINS "com-connect.help" OR requesturl CONTAINS "com-fraud.support" OR requesturl CONTAINS "com-help.support" OR requesturl CONTAINS "com-reset.help" OR requesturl CONTAINS "com-reset.net" OR requesturl CONTAINS "com-ticket.live" OR requesturl CONTAINS "com-ticket.support" OR requesturl CONTAINS "contact-nexo.com" OR requesturl CONTAINS "convert-coinbase.com" OR requesturl CONTAINS "customerservice-coinbase.com" OR requesturl CONTAINS "default-coinbase.com" OR requesturl CONTAINS "defend-coinbase.com" OR requesturl CONTAINS "deny-coinbase.com" OR requesturl CONTAINS "disconnect-coinbase.com" OR requesturl CONTAINS "escalate-coinbase.com" OR requesturl CONTAINS "establish-coinbase.com" OR requesturl CONTAINS "fcc-okta.com" OR requesturl CONTAINS "fraudulent-coinbase.com" OR requesturl CONTAINS "guard-apple.com" OR requesturl CONTAINS "guard-icloud.com" OR requesturl CONTAINS "guardian-coinbase.com" OR requesturl CONTAINS "guide-gemini.com" OR requesturl CONTAINS "help-bitfinex.com" OR requesturl CONTAINS "help-shakepay.com")
index=activity AND rg_functionality="Cloud Application Security Broker" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "helpdesk-apple.com" OR destinationhostname CONTAINS "helpdesk-gemini.com" OR destinationhostname CONTAINS "helpdesk-icloud.com" OR destinationhostname CONTAINS "identification-coinbase.com" OR destinationhostname CONTAINS "lockdown-coinbase.com" OR destinationhostname CONTAINS "login-nexo.com" OR destinationhostname CONTAINS "keys-coinbase.com" OR destinationhostname CONTAINS "messages-coinbase.com" OR destinationhostname CONTAINS "newpassword-coinbase.com" OR destinationhostname CONTAINS "prompt-coinbase.com" OR destinationhostname CONTAINS "protect-apple.com" OR destinationhostname CONTAINS "protect-coinbase.com" OR destinationhostname CONTAINS "protect-gmail.com" OR destinationhostname CONTAINS "protect-kraken.com" OR destinationhostname CONTAINS "recoverme-coinbase.com" OR destinationhostname CONTAINS "recoveryportal-coinbase.com" OR destinationhostname CONTAINS "refunds-coinbase.com" OR destinationhostname CONTAINS "reset-okta.com" OR destinationhostname CONTAINS "restore-coinbase.com" OR destinationhostname CONTAINS "return-coinbase.com" OR destinationhostname CONTAINS "reverts-coinbase.com" OR destinationhostname CONTAINS "secure-binance.us" OR destinationhostname CONTAINS "secure-icloud.com" OR destinationhostname CONTAINS "secure-nexo.com" OR destinationhostname CONTAINS "secure-shakepay.com" OR destinationhostname CONTAINS "security-umusic.com" OR destinationhostname CONTAINS "server694590423.tech" OR destinationhostname CONTAINS "session-coinbase.com" OR destinationhostname CONTAINS "startrecovery-coinbase.com" OR destinationhostname CONTAINS "signin-kraken.com" OR destinationhostname CONTAINS "suite-trezor.io" OR destinationhostname CONTAINS "supportportal-coinbase.com" OR destinationhostname CONTAINS "tech-icloud.com" OR destinationhostname CONTAINS "threat-coinbase.com" OR destinationhostname CONTAINS "ticket-apple.com" OR destinationhostname CONTAINS "ticket-coinbase.com" OR destinationhostname CONTAINS "tickets-apple.com" OR destinationhostname CONTAINS "tokens-coinbase.com" OR destinationhostname CONTAINS "unblock-coinbase.com" OR destinationhostname CONTAINS "unlink-coinbase.com" OR destinationhostname CONTAINS "your-coinbase.com" OR destinationhostname CONTAINS "welcome-coinbase.com" OR destinationhostname CONTAINS "www-coinbasewallet.com" OR destinationhostname CONTAINS "www-help-coinbase.com" OR destinationhostname CONTAINS "www-help-gemini.com")
index=activity AND rg_functionality="Cloud Application Security Broker" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "helpdesk-apple.com" OR sourcentdomain CONTAINS "helpdesk-gemini.com" OR sourcentdomain CONTAINS "helpdesk-icloud.com" OR sourcentdomain CONTAINS "identification-coinbase.com" OR sourcentdomain CONTAINS "lockdown-coinbase.com" OR sourcentdomain CONTAINS "login-nexo.com" OR sourcentdomain CONTAINS "keys-coinbase.com" OR sourcentdomain CONTAINS "messages-coinbase.com" OR sourcentdomain CONTAINS "newpassword-coinbase.com" OR sourcentdomain CONTAINS "prompt-coinbase.com" OR sourcentdomain CONTAINS "protect-apple.com" OR sourcentdomain CONTAINS "protect-coinbase.com" OR sourcentdomain CONTAINS "protect-gmail.com" OR sourcentdomain CONTAINS "protect-kraken.com" OR sourcentdomain CONTAINS "recoverme-coinbase.com" OR sourcentdomain CONTAINS "recoveryportal-coinbase.com" OR sourcentdomain CONTAINS "refunds-coinbase.com" OR sourcentdomain CONTAINS "reset-okta.com" OR sourcentdomain CONTAINS "restore-coinbase.com" OR sourcentdomain CONTAINS "return-coinbase.com" OR sourcentdomain CONTAINS "reverts-coinbase.com" OR sourcentdomain CONTAINS "secure-binance.us" OR sourcentdomain CONTAINS "secure-icloud.com" OR sourcentdomain CONTAINS "secure-nexo.com" OR sourcentdomain CONTAINS "secure-shakepay.com" OR sourcentdomain CONTAINS "security-umusic.com" OR sourcentdomain CONTAINS "server694590423.tech" OR sourcentdomain CONTAINS "session-coinbase.com" OR sourcentdomain CONTAINS "startrecovery-coinbase.com" OR sourcentdomain CONTAINS "signin-kraken.com" OR sourcentdomain CONTAINS "suite-trezor.io" OR sourcentdomain CONTAINS "supportportal-coinbase.com" OR sourcentdomain CONTAINS "tech-icloud.com" OR sourcentdomain CONTAINS "threat-coinbase.com" OR sourcentdomain CONTAINS "ticket-apple.com" OR sourcentdomain CONTAINS "ticket-coinbase.com" OR sourcentdomain CONTAINS "tickets-apple.com" OR sourcentdomain CONTAINS "tokens-coinbase.com" OR sourcentdomain CONTAINS "unblock-coinbase.com" OR sourcentdomain CONTAINS "unlink-coinbase.com" OR sourcentdomain CONTAINS "your-coinbase.com" OR sourcentdomain CONTAINS "welcome-coinbase.com" OR sourcentdomain CONTAINS "www-coinbasewallet.com" OR sourcentdomain CONTAINS "www-help-coinbase.com" OR sourcentdomain CONTAINS "www-help-gemini.com")
index=activity AND rg_functionality="Cloud Application Security Broker" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "helpdesk-apple.com" OR sourcehostname CONTAINS "helpdesk-gemini.com" OR sourcehostname CONTAINS "helpdesk-icloud.com" OR sourcehostname CONTAINS "identification-coinbase.com" OR sourcehostname CONTAINS "lockdown-coinbase.com" OR sourcehostname CONTAINS "login-nexo.com" OR sourcehostname CONTAINS "keys-coinbase.com" OR sourcehostname CONTAINS "messages-coinbase.com" OR sourcehostname CONTAINS "newpassword-coinbase.com" OR sourcehostname CONTAINS "prompt-coinbase.com" OR sourcehostname CONTAINS "protect-apple.com" OR sourcehostname CONTAINS "protect-coinbase.com" OR sourcehostname CONTAINS "protect-gmail.com" OR sourcehostname CONTAINS "protect-kraken.com" OR sourcehostname CONTAINS "recoverme-coinbase.com" OR sourcehostname CONTAINS "recoveryportal-coinbase.com" OR sourcehostname CONTAINS "refunds-coinbase.com" OR sourcehostname CONTAINS "reset-okta.com" OR sourcehostname CONTAINS "restore-coinbase.com" OR sourcehostname CONTAINS "return-coinbase.com" OR sourcehostname CONTAINS "reverts-coinbase.com" OR sourcehostname CONTAINS "secure-binance.us" OR sourcehostname CONTAINS "secure-icloud.com" OR sourcehostname CONTAINS "secure-nexo.com" OR sourcehostname CONTAINS "secure-shakepay.com" OR sourcehostname CONTAINS "security-umusic.com" OR sourcehostname CONTAINS "server694590423.tech" OR sourcehostname CONTAINS "session-coinbase.com" OR sourcehostname CONTAINS "startrecovery-coinbase.com" OR sourcehostname CONTAINS "signin-kraken.com" OR sourcehostname CONTAINS "suite-trezor.io" OR sourcehostname CONTAINS "supportportal-coinbase.com" OR sourcehostname CONTAINS "tech-icloud.com" OR sourcehostname CONTAINS "threat-coinbase.com" OR sourcehostname CONTAINS "ticket-apple.com" OR sourcehostname CONTAINS "ticket-coinbase.com" OR sourcehostname CONTAINS "tickets-apple.com" OR sourcehostname CONTAINS "tokens-coinbase.com" OR sourcehostname CONTAINS "unblock-coinbase.com" OR sourcehostname CONTAINS "unlink-coinbase.com" OR sourcehostname CONTAINS "your-coinbase.com" OR sourcehostname CONTAINS "welcome-coinbase.com" OR sourcehostname CONTAINS "www-coinbasewallet.com" OR sourcehostname CONTAINS "www-help-coinbase.com" OR sourcehostname CONTAINS "www-help-gemini.com")
index=activity AND rg_functionality="Cloud Application Security Broker" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "helpdesk-apple.com" OR destinationntdomain CONTAINS "helpdesk-gemini.com" OR destinationntdomain CONTAINS "helpdesk-icloud.com" OR destinationntdomain CONTAINS "identification-coinbase.com" OR destinationntdomain CONTAINS "lockdown-coinbase.com" OR destinationntdomain CONTAINS "login-nexo.com" OR destinationntdomain CONTAINS "keys-coinbase.com" OR destinationntdomain CONTAINS "messages-coinbase.com" OR destinationntdomain CONTAINS "newpassword-coinbase.com" OR destinationntdomain CONTAINS "prompt-coinbase.com" OR destinationntdomain CONTAINS "protect-apple.com" OR destinationntdomain CONTAINS "protect-coinbase.com" OR destinationntdomain CONTAINS "protect-gmail.com" OR destinationntdomain CONTAINS "protect-kraken.com" OR destinationntdomain CONTAINS "recoverme-coinbase.com" OR destinationntdomain CONTAINS "recoveryportal-coinbase.com" OR destinationntdomain CONTAINS "refunds-coinbase.com" OR destinationntdomain CONTAINS "reset-okta.com" OR destinationntdomain CONTAINS "restore-coinbase.com" OR destinationntdomain CONTAINS "return-coinbase.com" OR destinationntdomain CONTAINS "reverts-coinbase.com" OR destinationntdomain CONTAINS "secure-binance.us" OR destinationntdomain CONTAINS "secure-icloud.com" OR destinationntdomain CONTAINS "secure-nexo.com" OR destinationntdomain CONTAINS "secure-shakepay.com" OR destinationntdomain CONTAINS "security-umusic.com" OR destinationntdomain CONTAINS "server694590423.tech" OR destinationntdomain CONTAINS "session-coinbase.com" OR destinationntdomain CONTAINS "startrecovery-coinbase.com" OR destinationntdomain CONTAINS "signin-kraken.com" OR destinationntdomain CONTAINS "suite-trezor.io" OR destinationntdomain CONTAINS "supportportal-coinbase.com" OR destinationntdomain CONTAINS "tech-icloud.com" OR destinationntdomain CONTAINS "threat-coinbase.com" OR destinationntdomain CONTAINS "ticket-apple.com" OR destinationntdomain CONTAINS "ticket-coinbase.com" OR destinationntdomain CONTAINS "tickets-apple.com" OR destinationntdomain CONTAINS "tokens-coinbase.com" OR destinationntdomain CONTAINS "unblock-coinbase.com" OR destinationntdomain CONTAINS "unlink-coinbase.com" OR destinationntdomain CONTAINS "your-coinbase.com" OR destinationntdomain CONTAINS "welcome-coinbase.com" OR destinationntdomain CONTAINS "www-coinbasewallet.com" OR destinationntdomain CONTAINS "www-help-coinbase.com" OR destinationntdomain CONTAINS "www-help-gemini.com")
index=activity AND rg_functionality="Cloud Application Security Broker" AND requesturl NOT NULL AND (requesturl CONTAINS "helpdesk-apple.com" OR requesturl CONTAINS "helpdesk-gemini.com" OR requesturl CONTAINS "helpdesk-icloud.com" OR requesturl CONTAINS "identification-coinbase.com" OR requesturl CONTAINS "lockdown-coinbase.com" OR requesturl CONTAINS "login-nexo.com" OR requesturl CONTAINS "keys-coinbase.com" OR requesturl CONTAINS "messages-coinbase.com" OR requesturl CONTAINS "newpassword-coinbase.com" OR requesturl CONTAINS "prompt-coinbase.com" OR requesturl CONTAINS "protect-apple.com" OR requesturl CONTAINS "protect-coinbase.com" OR requesturl CONTAINS "protect-gmail.com" OR requesturl CONTAINS "protect-kraken.com" OR requesturl CONTAINS "recoverme-coinbase.com" OR requesturl CONTAINS "recoveryportal-coinbase.com" OR requesturl CONTAINS "refunds-coinbase.com" OR requesturl CONTAINS "reset-okta.com" OR requesturl CONTAINS "restore-coinbase.com" OR requesturl CONTAINS "return-coinbase.com" OR requesturl CONTAINS "reverts-coinbase.com" OR requesturl CONTAINS "secure-binance.us" OR requesturl CONTAINS "secure-icloud.com" OR requesturl CONTAINS "secure-nexo.com" OR requesturl CONTAINS "secure-shakepay.com" OR requesturl CONTAINS "security-umusic.com" OR requesturl CONTAINS "server694590423.tech" OR requesturl CONTAINS "session-coinbase.com" OR requesturl CONTAINS "startrecovery-coinbase.com" OR requesturl CONTAINS "signin-kraken.com" OR requesturl CONTAINS "suite-trezor.io" OR requesturl CONTAINS "supportportal-coinbase.com" OR requesturl CONTAINS "tech-icloud.com" OR requesturl CONTAINS "threat-coinbase.com" OR requesturl CONTAINS "ticket-apple.com" OR requesturl CONTAINS "ticket-coinbase.com" OR requesturl CONTAINS "tickets-apple.com" OR requesturl CONTAINS "tokens-coinbase.com" OR requesturl CONTAINS "unblock-coinbase.com" OR requesturl CONTAINS "unlink-coinbase.com" OR requesturl CONTAINS "your-coinbase.com" OR requesturl CONTAINS "welcome-coinbase.com" OR requesturl CONTAINS "www-coinbasewallet.com" OR requesturl CONTAINS "www-help-coinbase.com" OR requesturl CONTAINS "www-help-gemini.com")
index=activity AND rg_functionality="Source Code Repository" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "official-server.com" OR destinationhostname CONTAINS "server694590423.tech" OR destinationhostname CONTAINS "island-placid-bromine.glitch.me" OR destinationhostname CONTAINS "circular-noon-farmhouse.glitch.me" OR destinationhostname CONTAINS "talented-friendly-price.glitch.me" OR destinationhostname CONTAINS "dflfmgsdokasdcpl.com" OR destinationhostname CONTAINS "original-backend.com" OR destinationhostname CONTAINS "07159889-coinbase.com" OR destinationhostname CONTAINS "10195-coinbase.com" OR destinationhostname CONTAINS "11246-coinbase.com" OR destinationhostname CONTAINS "11247-coinbase.com" OR destinationhostname CONTAINS "11248-coinbase.com" OR destinationhostname CONTAINS "11258-coinbase.com" OR destinationhostname CONTAINS "11259-coinbase.com" OR destinationhostname CONTAINS "113912-coinbase.com" OR destinationhostname CONTAINS "11472-coinbase.com" OR destinationhostname CONTAINS "11923-coinbase.com" OR destinationhostname CONTAINS "11957-coinbase.com" OR destinationhostname CONTAINS "128147-coinbase.com" OR destinationhostname CONTAINS "12958-coinbase.com" OR destinationhostname CONTAINS "12984-okta.com" OR destinationhostname CONTAINS "12985-coinbase.com" OR destinationhostname CONTAINS "13130-coinbase.com" OR destinationhostname CONTAINS "13247-coinbase.com" OR destinationhostname CONTAINS "13247-icloud.com" OR destinationhostname CONTAINS "13267-coinbase.com" OR destinationhostname CONTAINS "146271510-coinbase.com" OR destinationhostname CONTAINS "146282-coinbase.com" OR destinationhostname CONTAINS "146284-coinbase.com" OR destinationhostname CONTAINS "147260-coinbase.com" OR destinationhostname CONTAINS "14765-coinbase.com" OR destinationhostname CONTAINS "14817582-coinbase.com" OR destinationhostname CONTAINS "14871904-coinbase.com" OR destinationhostname CONTAINS "14891902-coinbase.com" OR destinationhostname CONTAINS "1492864-coinbase.com" OR destinationhostname CONTAINS "158312-coinbase.com" OR destinationhostname CONTAINS "158372-coinbase.com" OR destinationhostname CONTAINS "158702-coinbase.com" OR destinationhostname CONTAINS "16171675-coinbase.com" OR destinationhostname CONTAINS "16171832-coinbase.com" OR destinationhostname CONTAINS "16178234-coinbase.com" OR destinationhostname CONTAINS "16178237-coinbase.com" OR destinationhostname CONTAINS "16178434-coinbase.com" OR destinationhostname CONTAINS "162178-coinbase.com" OR destinationhostname CONTAINS "162478-coinbase.com" OR destinationhostname CONTAINS "162782-coinbase.com" OR destinationhostname CONTAINS "162812-coinbase.com" OR destinationhostname CONTAINS "162814-coinbase.com" OR destinationhostname CONTAINS "16442580-coinbase.com" OR destinationhostname CONTAINS "16450107-coinbase.com")
index=activity AND rg_functionality="Source Code Repository" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "official-server.com" OR sourcentdomain CONTAINS "server694590423.tech" OR sourcentdomain CONTAINS "island-placid-bromine.glitch.me" OR sourcentdomain CONTAINS "circular-noon-farmhouse.glitch.me" OR sourcentdomain CONTAINS "talented-friendly-price.glitch.me" OR sourcentdomain CONTAINS "dflfmgsdokasdcpl.com" OR sourcentdomain CONTAINS "original-backend.com" OR sourcentdomain CONTAINS "07159889-coinbase.com" OR sourcentdomain CONTAINS "10195-coinbase.com" OR sourcentdomain CONTAINS "11246-coinbase.com" OR sourcentdomain CONTAINS "11247-coinbase.com" OR sourcentdomain CONTAINS "11248-coinbase.com" OR sourcentdomain CONTAINS "11258-coinbase.com" OR sourcentdomain CONTAINS "11259-coinbase.com" OR sourcentdomain CONTAINS "113912-coinbase.com" OR sourcentdomain CONTAINS "11472-coinbase.com" OR sourcentdomain CONTAINS "11923-coinbase.com" OR sourcentdomain CONTAINS "11957-coinbase.com" OR sourcentdomain CONTAINS "128147-coinbase.com" OR sourcentdomain CONTAINS "12958-coinbase.com" OR sourcentdomain CONTAINS "12984-okta.com" OR sourcentdomain CONTAINS "12985-coinbase.com" OR sourcentdomain CONTAINS "13130-coinbase.com" OR sourcentdomain CONTAINS "13247-coinbase.com" OR sourcentdomain CONTAINS "13247-icloud.com" OR sourcentdomain CONTAINS "13267-coinbase.com" OR sourcentdomain CONTAINS "146271510-coinbase.com" OR sourcentdomain CONTAINS "146282-coinbase.com" OR sourcentdomain CONTAINS "146284-coinbase.com" OR sourcentdomain CONTAINS "147260-coinbase.com" OR sourcentdomain CONTAINS "14765-coinbase.com" OR sourcentdomain CONTAINS "14817582-coinbase.com" OR sourcentdomain CONTAINS "14871904-coinbase.com" OR sourcentdomain CONTAINS "14891902-coinbase.com" OR sourcentdomain CONTAINS "1492864-coinbase.com" OR sourcentdomain CONTAINS "158312-coinbase.com" OR sourcentdomain CONTAINS "158372-coinbase.com" OR sourcentdomain CONTAINS "158702-coinbase.com" OR sourcentdomain CONTAINS "16171675-coinbase.com" OR sourcentdomain CONTAINS "16171832-coinbase.com" OR sourcentdomain CONTAINS "16178234-coinbase.com" OR sourcentdomain CONTAINS "16178237-coinbase.com" OR sourcentdomain CONTAINS "16178434-coinbase.com" OR sourcentdomain CONTAINS "162178-coinbase.com" OR sourcentdomain CONTAINS "162478-coinbase.com" OR sourcentdomain CONTAINS "162782-coinbase.com" OR sourcentdomain CONTAINS "162812-coinbase.com" OR sourcentdomain CONTAINS "162814-coinbase.com" OR sourcentdomain CONTAINS "16442580-coinbase.com" OR sourcentdomain CONTAINS "16450107-coinbase.com")
index=activity AND rg_functionality="Source Code Repository" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "official-server.com" OR sourcehostname CONTAINS "server694590423.tech" OR sourcehostname CONTAINS "island-placid-bromine.glitch.me" OR sourcehostname CONTAINS "circular-noon-farmhouse.glitch.me" OR sourcehostname CONTAINS "talented-friendly-price.glitch.me" OR sourcehostname CONTAINS "dflfmgsdokasdcpl.com" OR sourcehostname CONTAINS "original-backend.com" OR sourcehostname CONTAINS "07159889-coinbase.com" OR sourcehostname CONTAINS "10195-coinbase.com" OR sourcehostname CONTAINS "11246-coinbase.com" OR sourcehostname CONTAINS "11247-coinbase.com" OR sourcehostname CONTAINS "11248-coinbase.com" OR sourcehostname CONTAINS "11258-coinbase.com" OR sourcehostname CONTAINS "11259-coinbase.com" OR sourcehostname CONTAINS "113912-coinbase.com" OR sourcehostname CONTAINS "11472-coinbase.com" OR sourcehostname CONTAINS "11923-coinbase.com" OR sourcehostname CONTAINS "11957-coinbase.com" OR sourcehostname CONTAINS "128147-coinbase.com" OR sourcehostname CONTAINS "12958-coinbase.com" OR sourcehostname CONTAINS "12984-okta.com" OR sourcehostname CONTAINS "12985-coinbase.com" OR sourcehostname CONTAINS "13130-coinbase.com" OR sourcehostname CONTAINS "13247-coinbase.com" OR sourcehostname CONTAINS "13247-icloud.com" OR sourcehostname CONTAINS "13267-coinbase.com" OR sourcehostname CONTAINS "146271510-coinbase.com" OR sourcehostname CONTAINS "146282-coinbase.com" OR sourcehostname CONTAINS "146284-coinbase.com" OR sourcehostname CONTAINS "147260-coinbase.com" OR sourcehostname CONTAINS "14765-coinbase.com" OR sourcehostname CONTAINS "14817582-coinbase.com" OR sourcehostname CONTAINS "14871904-coinbase.com" OR sourcehostname CONTAINS "14891902-coinbase.com" OR sourcehostname CONTAINS "1492864-coinbase.com" OR sourcehostname CONTAINS "158312-coinbase.com" OR sourcehostname CONTAINS "158372-coinbase.com" OR sourcehostname CONTAINS "158702-coinbase.com" OR sourcehostname CONTAINS "16171675-coinbase.com" OR sourcehostname CONTAINS "16171832-coinbase.com" OR sourcehostname CONTAINS "16178234-coinbase.com" OR sourcehostname CONTAINS "16178237-coinbase.com" OR sourcehostname CONTAINS "16178434-coinbase.com" OR sourcehostname CONTAINS "162178-coinbase.com" OR sourcehostname CONTAINS "162478-coinbase.com" OR sourcehostname CONTAINS "162782-coinbase.com" OR sourcehostname CONTAINS "162812-coinbase.com" OR sourcehostname CONTAINS "162814-coinbase.com" OR sourcehostname CONTAINS "16442580-coinbase.com" OR sourcehostname CONTAINS "16450107-coinbase.com")
index=activity AND rg_functionality="Source Code Repository" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "official-server.com" OR destinationntdomain CONTAINS "server694590423.tech" OR destinationntdomain CONTAINS "island-placid-bromine.glitch.me" OR destinationntdomain CONTAINS "circular-noon-farmhouse.glitch.me" OR destinationntdomain CONTAINS "talented-friendly-price.glitch.me" OR destinationntdomain CONTAINS "dflfmgsdokasdcpl.com" OR destinationntdomain CONTAINS "original-backend.com" OR destinationntdomain CONTAINS "07159889-coinbase.com" OR destinationntdomain CONTAINS "10195-coinbase.com" OR destinationntdomain CONTAINS "11246-coinbase.com" OR destinationntdomain CONTAINS "11247-coinbase.com" OR destinationntdomain CONTAINS "11248-coinbase.com" OR destinationntdomain CONTAINS "11258-coinbase.com" OR destinationntdomain CONTAINS "11259-coinbase.com" OR destinationntdomain CONTAINS "113912-coinbase.com" OR destinationntdomain CONTAINS "11472-coinbase.com" OR destinationntdomain CONTAINS "11923-coinbase.com" OR destinationntdomain CONTAINS "11957-coinbase.com" OR destinationntdomain CONTAINS "128147-coinbase.com" OR destinationntdomain CONTAINS "12958-coinbase.com" OR destinationntdomain CONTAINS "12984-okta.com" OR destinationntdomain CONTAINS "12985-coinbase.com" OR destinationntdomain CONTAINS "13130-coinbase.com" OR destinationntdomain CONTAINS "13247-coinbase.com" OR destinationntdomain CONTAINS "13247-icloud.com" OR destinationntdomain CONTAINS "13267-coinbase.com" OR destinationntdomain CONTAINS "146271510-coinbase.com" OR destinationntdomain CONTAINS "146282-coinbase.com" OR destinationntdomain CONTAINS "146284-coinbase.com" OR destinationntdomain CONTAINS "147260-coinbase.com" OR destinationntdomain CONTAINS "14765-coinbase.com" OR destinationntdomain CONTAINS "14817582-coinbase.com" OR destinationntdomain CONTAINS "14871904-coinbase.com" OR destinationntdomain CONTAINS "14891902-coinbase.com" OR destinationntdomain CONTAINS "1492864-coinbase.com" OR destinationntdomain CONTAINS "158312-coinbase.com" OR destinationntdomain CONTAINS "158372-coinbase.com" OR destinationntdomain CONTAINS "158702-coinbase.com" OR destinationntdomain CONTAINS "16171675-coinbase.com" OR destinationntdomain CONTAINS "16171832-coinbase.com" OR destinationntdomain CONTAINS "16178234-coinbase.com" OR destinationntdomain CONTAINS "16178237-coinbase.com" OR destinationntdomain CONTAINS "16178434-coinbase.com" OR destinationntdomain CONTAINS "162178-coinbase.com" OR destinationntdomain CONTAINS "162478-coinbase.com" OR destinationntdomain CONTAINS "162782-coinbase.com" OR destinationntdomain CONTAINS "162812-coinbase.com" OR destinationntdomain CONTAINS "162814-coinbase.com" OR destinationntdomain CONTAINS "16442580-coinbase.com" OR destinationntdomain CONTAINS "16450107-coinbase.com")
index=activity AND rg_functionality="Source Code Repository" AND requesturl NOT NULL AND (requesturl CONTAINS "official-server.com" OR requesturl CONTAINS "server694590423.tech" OR requesturl CONTAINS "island-placid-bromine.glitch.me" OR requesturl CONTAINS "circular-noon-farmhouse.glitch.me" OR requesturl CONTAINS "talented-friendly-price.glitch.me" OR requesturl CONTAINS "dflfmgsdokasdcpl.com" OR requesturl CONTAINS "original-backend.com" OR requesturl CONTAINS "07159889-coinbase.com" OR requesturl CONTAINS "10195-coinbase.com" OR requesturl CONTAINS "11246-coinbase.com" OR requesturl CONTAINS "11247-coinbase.com" OR requesturl CONTAINS "11248-coinbase.com" OR requesturl CONTAINS "11258-coinbase.com" OR requesturl CONTAINS "11259-coinbase.com" OR requesturl CONTAINS "113912-coinbase.com" OR requesturl CONTAINS "11472-coinbase.com" OR requesturl CONTAINS "11923-coinbase.com" OR requesturl CONTAINS "11957-coinbase.com" OR requesturl CONTAINS "128147-coinbase.com" OR requesturl CONTAINS "12958-coinbase.com" OR requesturl CONTAINS "12984-okta.com" OR requesturl CONTAINS "12985-coinbase.com" OR requesturl CONTAINS "13130-coinbase.com" OR requesturl CONTAINS "13247-coinbase.com" OR requesturl CONTAINS "13247-icloud.com" OR requesturl CONTAINS "13267-coinbase.com" OR requesturl CONTAINS "146271510-coinbase.com" OR requesturl CONTAINS "146282-coinbase.com" OR requesturl CONTAINS "146284-coinbase.com" OR requesturl CONTAINS "147260-coinbase.com" OR requesturl CONTAINS "14765-coinbase.com" OR requesturl CONTAINS "14817582-coinbase.com" OR requesturl CONTAINS "14871904-coinbase.com" OR requesturl CONTAINS "14891902-coinbase.com" OR requesturl CONTAINS "1492864-coinbase.com" OR requesturl CONTAINS "158312-coinbase.com" OR requesturl CONTAINS "158372-coinbase.com" OR requesturl CONTAINS "158702-coinbase.com" OR requesturl CONTAINS "16171675-coinbase.com" OR requesturl CONTAINS "16171832-coinbase.com" OR requesturl CONTAINS "16178234-coinbase.com" OR requesturl CONTAINS "16178237-coinbase.com" OR requesturl CONTAINS "16178434-coinbase.com" OR requesturl CONTAINS "162178-coinbase.com" OR requesturl CONTAINS "162478-coinbase.com" OR requesturl CONTAINS "162782-coinbase.com" OR requesturl CONTAINS "162812-coinbase.com" OR requesturl CONTAINS "162814-coinbase.com" OR requesturl CONTAINS "16442580-coinbase.com" OR requesturl CONTAINS "16450107-coinbase.com")
index=activity AND rg_functionality="Source Code Repository" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "16450207-coinbase.com" OR destinationhostname CONTAINS "16458207-coinbase.com" OR destinationhostname CONTAINS "16478202-coinbase.com" OR destinationhostname CONTAINS "164872942-coinbase.com" OR destinationhostname CONTAINS "16590-coinbase.com" OR destinationhostname CONTAINS "16594373-coinbase.com" OR destinationhostname CONTAINS "16624831-coinbase.com" OR destinationhostname CONTAINS "16642124-coinbase.com" OR destinationhostname CONTAINS "16642172-coinbase.com" OR destinationhostname CONTAINS "16642580-coinbase.com" OR destinationhostname CONTAINS "16642721-coinbase.com" OR destinationhostname CONTAINS "16642724-coinbase.com" OR destinationhostname CONTAINS "16642871-coinbase.com" OR destinationhostname CONTAINS "16642872-coinbase.com" OR destinationhostname CONTAINS "16712942-coinbase.com" OR destinationhostname CONTAINS "16718672-coinbase.com" OR destinationhostname CONTAINS "16728342-coinbase.com" OR destinationhostname CONTAINS "16728348-coinbase.com" OR destinationhostname CONTAINS "16728442-coinbase.com" OR destinationhostname CONTAINS "16728472-coinbase.com" OR destinationhostname CONTAINS "167285-coinbase.com" OR destinationhostname CONTAINS "16729042-coinbase.com" OR destinationhostname CONTAINS "16748272-coinbase.com" OR destinationhostname CONTAINS "16782942-coinbase.com" OR destinationhostname CONTAINS "16827420-coinbase.com" OR destinationhostname CONTAINS "16827423-coinbase.com" OR destinationhostname CONTAINS "16847145-coinbase.com" OR destinationhostname CONTAINS "16893924-coinbase.com" OR destinationhostname CONTAINS "17182-coinbase.com" OR destinationhostname CONTAINS "17255030-coinbase.com" OR destinationhostname CONTAINS "17259-kraken.com" OR destinationhostname CONTAINS "172486-coinbase.com" OR destinationhostname CONTAINS "17284652-coinbase.com" OR destinationhostname CONTAINS "17286-coinbase.com" OR destinationhostname CONTAINS "17334522-coinbase.com" OR destinationhostname CONTAINS "17334522-kraken.com" OR destinationhostname CONTAINS "17384522-coinbase.com" OR destinationhostname CONTAINS "173912-coinbase.com" OR destinationhostname CONTAINS "17494976-coinbase.com" OR destinationhostname CONTAINS "17512854-coinbase.com" OR destinationhostname CONTAINS "17512857-coinbase.com" OR destinationhostname CONTAINS "1751954-coinbase.com" OR destinationhostname CONTAINS "17525030-coinbase.com" OR destinationhostname CONTAINS "17529580-coinbase.com" OR destinationhostname CONTAINS "17614-coinbase.com" OR destinationhostname CONTAINS "17618412-coinbase.com" OR destinationhostname CONTAINS "17619-coinbase.com" OR destinationhostname CONTAINS "176284-coinbase.com" OR destinationhostname CONTAINS "17823920-coinbase.com" OR destinationhostname CONTAINS "178253-coinbase.com")
index=activity AND rg_functionality="Source Code Repository" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "16450207-coinbase.com" OR sourcentdomain CONTAINS "16458207-coinbase.com" OR sourcentdomain CONTAINS "16478202-coinbase.com" OR sourcentdomain CONTAINS "164872942-coinbase.com" OR sourcentdomain CONTAINS "16590-coinbase.com" OR sourcentdomain CONTAINS "16594373-coinbase.com" OR sourcentdomain CONTAINS "16624831-coinbase.com" OR sourcentdomain CONTAINS "16642124-coinbase.com" OR sourcentdomain CONTAINS "16642172-coinbase.com" OR sourcentdomain CONTAINS "16642580-coinbase.com" OR sourcentdomain CONTAINS "16642721-coinbase.com" OR sourcentdomain CONTAINS "16642724-coinbase.com" OR sourcentdomain CONTAINS "16642871-coinbase.com" OR sourcentdomain CONTAINS "16642872-coinbase.com" OR sourcentdomain CONTAINS "16712942-coinbase.com" OR sourcentdomain CONTAINS "16718672-coinbase.com" OR sourcentdomain CONTAINS "16728342-coinbase.com" OR sourcentdomain CONTAINS "16728348-coinbase.com" OR sourcentdomain CONTAINS "16728442-coinbase.com" OR sourcentdomain CONTAINS "16728472-coinbase.com" OR sourcentdomain CONTAINS "167285-coinbase.com" OR sourcentdomain CONTAINS "16729042-coinbase.com" OR sourcentdomain CONTAINS "16748272-coinbase.com" OR sourcentdomain CONTAINS "16782942-coinbase.com" OR sourcentdomain CONTAINS "16827420-coinbase.com" OR sourcentdomain CONTAINS "16827423-coinbase.com" OR sourcentdomain CONTAINS "16847145-coinbase.com" OR sourcentdomain CONTAINS "16893924-coinbase.com" OR sourcentdomain CONTAINS "17182-coinbase.com" OR sourcentdomain CONTAINS "17255030-coinbase.com" OR sourcentdomain CONTAINS "17259-kraken.com" OR sourcentdomain CONTAINS "172486-coinbase.com" OR sourcentdomain CONTAINS "17284652-coinbase.com" OR sourcentdomain CONTAINS "17286-coinbase.com" OR sourcentdomain CONTAINS "17334522-coinbase.com" OR sourcentdomain CONTAINS "17334522-kraken.com" OR sourcentdomain CONTAINS "17384522-coinbase.com" OR sourcentdomain CONTAINS "173912-coinbase.com" OR sourcentdomain CONTAINS "17494976-coinbase.com" OR sourcentdomain CONTAINS "17512854-coinbase.com" OR sourcentdomain CONTAINS "17512857-coinbase.com" OR sourcentdomain CONTAINS "1751954-coinbase.com" OR sourcentdomain CONTAINS "17525030-coinbase.com" OR sourcentdomain CONTAINS "17529580-coinbase.com" OR sourcentdomain CONTAINS "17614-coinbase.com" OR sourcentdomain CONTAINS "17618412-coinbase.com" OR sourcentdomain CONTAINS "17619-coinbase.com" OR sourcentdomain CONTAINS "176284-coinbase.com" OR sourcentdomain CONTAINS "17823920-coinbase.com" OR sourcentdomain CONTAINS "178253-coinbase.com")
index=activity AND rg_functionality="Source Code Repository" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "16450207-coinbase.com" OR sourcehostname CONTAINS "16458207-coinbase.com" OR sourcehostname CONTAINS "16478202-coinbase.com" OR sourcehostname CONTAINS "164872942-coinbase.com" OR sourcehostname CONTAINS "16590-coinbase.com" OR sourcehostname CONTAINS "16594373-coinbase.com" OR sourcehostname CONTAINS "16624831-coinbase.com" OR sourcehostname CONTAINS "16642124-coinbase.com" OR sourcehostname CONTAINS "16642172-coinbase.com" OR sourcehostname CONTAINS "16642580-coinbase.com" OR sourcehostname CONTAINS "16642721-coinbase.com" OR sourcehostname CONTAINS "16642724-coinbase.com" OR sourcehostname CONTAINS "16642871-coinbase.com" OR sourcehostname CONTAINS "16642872-coinbase.com" OR sourcehostname CONTAINS "16712942-coinbase.com" OR sourcehostname CONTAINS "16718672-coinbase.com" OR sourcehostname CONTAINS "16728342-coinbase.com" OR sourcehostname CONTAINS "16728348-coinbase.com" OR sourcehostname CONTAINS "16728442-coinbase.com" OR sourcehostname CONTAINS "16728472-coinbase.com" OR sourcehostname CONTAINS "167285-coinbase.com" OR sourcehostname CONTAINS "16729042-coinbase.com" OR sourcehostname CONTAINS "16748272-coinbase.com" OR sourcehostname CONTAINS "16782942-coinbase.com" OR sourcehostname CONTAINS "16827420-coinbase.com" OR sourcehostname CONTAINS "16827423-coinbase.com" OR sourcehostname CONTAINS "16847145-coinbase.com" OR sourcehostname CONTAINS "16893924-coinbase.com" OR sourcehostname CONTAINS "17182-coinbase.com" OR sourcehostname CONTAINS "17255030-coinbase.com" OR sourcehostname CONTAINS "17259-kraken.com" OR sourcehostname CONTAINS "172486-coinbase.com" OR sourcehostname CONTAINS "17284652-coinbase.com" OR sourcehostname CONTAINS "17286-coinbase.com" OR sourcehostname CONTAINS "17334522-coinbase.com" OR sourcehostname CONTAINS "17334522-kraken.com" OR sourcehostname CONTAINS "17384522-coinbase.com" OR sourcehostname CONTAINS "173912-coinbase.com" OR sourcehostname CONTAINS "17494976-coinbase.com" OR sourcehostname CONTAINS "17512854-coinbase.com" OR sourcehostname CONTAINS "17512857-coinbase.com" OR sourcehostname CONTAINS "1751954-coinbase.com" OR sourcehostname CONTAINS "17525030-coinbase.com" OR sourcehostname CONTAINS "17529580-coinbase.com" OR sourcehostname CONTAINS "17614-coinbase.com" OR sourcehostname CONTAINS "17618412-coinbase.com" OR sourcehostname CONTAINS "17619-coinbase.com" OR sourcehostname CONTAINS "176284-coinbase.com" OR sourcehostname CONTAINS "17823920-coinbase.com" OR sourcehostname CONTAINS "178253-coinbase.com")
index=activity AND rg_functionality="Source Code Repository" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "16450207-coinbase.com" OR destinationntdomain CONTAINS "16458207-coinbase.com" OR destinationntdomain CONTAINS "16478202-coinbase.com" OR destinationntdomain CONTAINS "164872942-coinbase.com" OR destinationntdomain CONTAINS "16590-coinbase.com" OR destinationntdomain CONTAINS "16594373-coinbase.com" OR destinationntdomain CONTAINS "16624831-coinbase.com" OR destinationntdomain CONTAINS "16642124-coinbase.com" OR destinationntdomain CONTAINS "16642172-coinbase.com" OR destinationntdomain CONTAINS "16642580-coinbase.com" OR destinationntdomain CONTAINS "16642721-coinbase.com" OR destinationntdomain CONTAINS "16642724-coinbase.com" OR destinationntdomain CONTAINS "16642871-coinbase.com" OR destinationntdomain CONTAINS "16642872-coinbase.com" OR destinationntdomain CONTAINS "16712942-coinbase.com" OR destinationntdomain CONTAINS "16718672-coinbase.com" OR destinationntdomain CONTAINS "16728342-coinbase.com" OR destinationntdomain CONTAINS "16728348-coinbase.com" OR destinationntdomain CONTAINS "16728442-coinbase.com" OR destinationntdomain CONTAINS "16728472-coinbase.com" OR destinationntdomain CONTAINS "167285-coinbase.com" OR destinationntdomain CONTAINS "16729042-coinbase.com" OR destinationntdomain CONTAINS "16748272-coinbase.com" OR destinationntdomain CONTAINS "16782942-coinbase.com" OR destinationntdomain CONTAINS "16827420-coinbase.com" OR destinationntdomain CONTAINS "16827423-coinbase.com" OR destinationntdomain CONTAINS "16847145-coinbase.com" OR destinationntdomain CONTAINS "16893924-coinbase.com" OR destinationntdomain CONTAINS "17182-coinbase.com" OR destinationntdomain CONTAINS "17255030-coinbase.com" OR destinationntdomain CONTAINS "17259-kraken.com" OR destinationntdomain CONTAINS "172486-coinbase.com" OR destinationntdomain CONTAINS "17284652-coinbase.com" OR destinationntdomain CONTAINS "17286-coinbase.com" OR destinationntdomain CONTAINS "17334522-coinbase.com" OR destinationntdomain CONTAINS "17334522-kraken.com" OR destinationntdomain CONTAINS "17384522-coinbase.com" OR destinationntdomain CONTAINS "173912-coinbase.com" OR destinationntdomain CONTAINS "17494976-coinbase.com" OR destinationntdomain CONTAINS "17512854-coinbase.com" OR destinationntdomain CONTAINS "17512857-coinbase.com" OR destinationntdomain CONTAINS "1751954-coinbase.com" OR destinationntdomain CONTAINS "17525030-coinbase.com" OR destinationntdomain CONTAINS "17529580-coinbase.com" OR destinationntdomain CONTAINS "17614-coinbase.com" OR destinationntdomain CONTAINS "17618412-coinbase.com" OR destinationntdomain CONTAINS "17619-coinbase.com" OR destinationntdomain CONTAINS "176284-coinbase.com" OR destinationntdomain CONTAINS "17823920-coinbase.com" OR destinationntdomain CONTAINS "178253-coinbase.com")
index=activity AND rg_functionality="Source Code Repository" AND requesturl NOT NULL AND (requesturl CONTAINS "16450207-coinbase.com" OR requesturl CONTAINS "16458207-coinbase.com" OR requesturl CONTAINS "16478202-coinbase.com" OR requesturl CONTAINS "164872942-coinbase.com" OR requesturl CONTAINS "16590-coinbase.com" OR requesturl CONTAINS "16594373-coinbase.com" OR requesturl CONTAINS "16624831-coinbase.com" OR requesturl CONTAINS "16642124-coinbase.com" OR requesturl CONTAINS "16642172-coinbase.com" OR requesturl CONTAINS "16642580-coinbase.com" OR requesturl CONTAINS "16642721-coinbase.com" OR requesturl CONTAINS "16642724-coinbase.com" OR requesturl CONTAINS "16642871-coinbase.com" OR requesturl CONTAINS "16642872-coinbase.com" OR requesturl CONTAINS "16712942-coinbase.com" OR requesturl CONTAINS "16718672-coinbase.com" OR requesturl CONTAINS "16728342-coinbase.com" OR requesturl CONTAINS "16728348-coinbase.com" OR requesturl CONTAINS "16728442-coinbase.com" OR requesturl CONTAINS "16728472-coinbase.com" OR requesturl CONTAINS "167285-coinbase.com" OR requesturl CONTAINS "16729042-coinbase.com" OR requesturl CONTAINS "16748272-coinbase.com" OR requesturl CONTAINS "16782942-coinbase.com" OR requesturl CONTAINS "16827420-coinbase.com" OR requesturl CONTAINS "16827423-coinbase.com" OR requesturl CONTAINS "16847145-coinbase.com" OR requesturl CONTAINS "16893924-coinbase.com" OR requesturl CONTAINS "17182-coinbase.com" OR requesturl CONTAINS "17255030-coinbase.com" OR requesturl CONTAINS "17259-kraken.com" OR requesturl CONTAINS "172486-coinbase.com" OR requesturl CONTAINS "17284652-coinbase.com" OR requesturl CONTAINS "17286-coinbase.com" OR requesturl CONTAINS "17334522-coinbase.com" OR requesturl CONTAINS "17334522-kraken.com" OR requesturl CONTAINS "17384522-coinbase.com" OR requesturl CONTAINS "173912-coinbase.com" OR requesturl CONTAINS "17494976-coinbase.com" OR requesturl CONTAINS "17512854-coinbase.com" OR requesturl CONTAINS "17512857-coinbase.com" OR requesturl CONTAINS "1751954-coinbase.com" OR requesturl CONTAINS "17525030-coinbase.com" OR requesturl CONTAINS "17529580-coinbase.com" OR requesturl CONTAINS "17614-coinbase.com" OR requesturl CONTAINS "17618412-coinbase.com" OR requesturl CONTAINS "17619-coinbase.com" OR requesturl CONTAINS "176284-coinbase.com" OR requesturl CONTAINS "17823920-coinbase.com" OR requesturl CONTAINS "178253-coinbase.com")
index=activity AND rg_functionality="Source Code Repository" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "178294-coinbase.com" OR destinationhostname CONTAINS "17912-coinbase.com" OR destinationhostname CONTAINS "17914-coinbase.com" OR destinationhostname CONTAINS "17917-coinbase.com" OR destinationhostname CONTAINS "17954-coinbase.com" OR destinationhostname CONTAINS "17958-coinbase.com" OR destinationhostname CONTAINS "182043-coinbase.com" OR destinationhostname CONTAINS "18275-gemini.com" OR destinationhostname CONTAINS "18276-coinbase.com" OR destinationhostname CONTAINS "18290185-coinbase.com" OR destinationhostname CONTAINS "182967-coinbase.com" OR destinationhostname CONTAINS "18560-coinbase.com" OR destinationhostname CONTAINS "18571-coinbase.com" OR destinationhostname CONTAINS "185912-coinbase.com" OR destinationhostname CONTAINS "185914-coinbase.com" OR destinationhostname CONTAINS "18592176-coinbase.com" OR destinationhostname CONTAINS "18594162-coinbase.com" OR destinationhostname CONTAINS "18594962-coinbase.com" OR destinationhostname CONTAINS "18597162-coinbase.com" OR destinationhostname CONTAINS "18719562-coinbase.com" OR destinationhostname CONTAINS "1875290-coinbase.com" OR destinationhostname CONTAINS "1882730-coinbase.com" OR destinationhostname CONTAINS "18902-coinbase.com" OR destinationhostname CONTAINS "18903-coinbase.com" OR destinationhostname CONTAINS "189126-coinbase.com" OR destinationhostname CONTAINS "18952-coinbase.com" OR destinationhostname CONTAINS "192854-coinbase.com" OR destinationhostname CONTAINS "192856-coinbase.com" OR destinationhostname CONTAINS "19287-binance.com" OR destinationhostname CONTAINS "19572-coinbase.com" OR destinationhostname CONTAINS "195812-coinbase.com" OR destinationhostname CONTAINS "195826-coinbase.com" OR destinationhostname CONTAINS "1958262-coinbase.com" OR destinationhostname CONTAINS "195827-binance.com" OR destinationhostname CONTAINS "1958297-coinbase.com" OR destinationhostname CONTAINS "19582970-coinbase.com" OR destinationhostname CONTAINS "19582971-coinbase.com" OR destinationhostname CONTAINS "19583-coinbase.com" OR destinationhostname CONTAINS "19592653-coinbase.com" OR destinationhostname CONTAINS "197304-coinbase.com" OR destinationhostname CONTAINS "19730492-coinbase.com" OR destinationhostname CONTAINS "19764162-coinbase.com" OR destinationhostname CONTAINS "19803-coinbase.com" OR destinationhostname CONTAINS "201784289-coinbase.com" OR destinationhostname CONTAINS "210823644-coinbase.com" OR destinationhostname CONTAINS "21158-coinbase.com" OR destinationhostname CONTAINS "21509-coinbase.com" OR destinationhostname CONTAINS "25985-coinbase.com" OR destinationhostname CONTAINS "27699-coinbase.com" OR destinationhostname CONTAINS "28367-coinbase.com")
index=activity AND rg_functionality="Source Code Repository" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "178294-coinbase.com" OR sourcentdomain CONTAINS "17912-coinbase.com" OR sourcentdomain CONTAINS "17914-coinbase.com" OR sourcentdomain CONTAINS "17917-coinbase.com" OR sourcentdomain CONTAINS "17954-coinbase.com" OR sourcentdomain CONTAINS "17958-coinbase.com" OR sourcentdomain CONTAINS "182043-coinbase.com" OR sourcentdomain CONTAINS "18275-gemini.com" OR sourcentdomain CONTAINS "18276-coinbase.com" OR sourcentdomain CONTAINS "18290185-coinbase.com" OR sourcentdomain CONTAINS "182967-coinbase.com" OR sourcentdomain CONTAINS "18560-coinbase.com" OR sourcentdomain CONTAINS "18571-coinbase.com" OR sourcentdomain CONTAINS "185912-coinbase.com" OR sourcentdomain CONTAINS "185914-coinbase.com" OR sourcentdomain CONTAINS "18592176-coinbase.com" OR sourcentdomain CONTAINS "18594162-coinbase.com" OR sourcentdomain CONTAINS "18594962-coinbase.com" OR sourcentdomain CONTAINS "18597162-coinbase.com" OR sourcentdomain CONTAINS "18719562-coinbase.com" OR sourcentdomain CONTAINS "1875290-coinbase.com" OR sourcentdomain CONTAINS "1882730-coinbase.com" OR sourcentdomain CONTAINS "18902-coinbase.com" OR sourcentdomain CONTAINS "18903-coinbase.com" OR sourcentdomain CONTAINS "189126-coinbase.com" OR sourcentdomain CONTAINS "18952-coinbase.com" OR sourcentdomain CONTAINS "192854-coinbase.com" OR sourcentdomain CONTAINS "192856-coinbase.com" OR sourcentdomain CONTAINS "19287-binance.com" OR sourcentdomain CONTAINS "19572-coinbase.com" OR sourcentdomain CONTAINS "195812-coinbase.com" OR sourcentdomain CONTAINS "195826-coinbase.com" OR sourcentdomain CONTAINS "1958262-coinbase.com" OR sourcentdomain CONTAINS "195827-binance.com" OR sourcentdomain CONTAINS "1958297-coinbase.com" OR sourcentdomain CONTAINS "19582970-coinbase.com" OR sourcentdomain CONTAINS "19582971-coinbase.com" OR sourcentdomain CONTAINS "19583-coinbase.com" OR sourcentdomain CONTAINS "19592653-coinbase.com" OR sourcentdomain CONTAINS "197304-coinbase.com" OR sourcentdomain CONTAINS "19730492-coinbase.com" OR sourcentdomain CONTAINS "19764162-coinbase.com" OR sourcentdomain CONTAINS "19803-coinbase.com" OR sourcentdomain CONTAINS "201784289-coinbase.com" OR sourcentdomain CONTAINS "210823644-coinbase.com" OR sourcentdomain CONTAINS "21158-coinbase.com" OR sourcentdomain CONTAINS "21509-coinbase.com" OR sourcentdomain CONTAINS "25985-coinbase.com" OR sourcentdomain CONTAINS "27699-coinbase.com" OR sourcentdomain CONTAINS "28367-coinbase.com")
index=activity AND rg_functionality="Source Code Repository" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "178294-coinbase.com" OR sourcehostname CONTAINS "17912-coinbase.com" OR sourcehostname CONTAINS "17914-coinbase.com" OR sourcehostname CONTAINS "17917-coinbase.com" OR sourcehostname CONTAINS "17954-coinbase.com" OR sourcehostname CONTAINS "17958-coinbase.com" OR sourcehostname CONTAINS "182043-coinbase.com" OR sourcehostname CONTAINS "18275-gemini.com" OR sourcehostname CONTAINS "18276-coinbase.com" OR sourcehostname CONTAINS "18290185-coinbase.com" OR sourcehostname CONTAINS "182967-coinbase.com" OR sourcehostname CONTAINS "18560-coinbase.com" OR sourcehostname CONTAINS "18571-coinbase.com" OR sourcehostname CONTAINS "185912-coinbase.com" OR sourcehostname CONTAINS "185914-coinbase.com" OR sourcehostname CONTAINS "18592176-coinbase.com" OR sourcehostname CONTAINS "18594162-coinbase.com" OR sourcehostname CONTAINS "18594962-coinbase.com" OR sourcehostname CONTAINS "18597162-coinbase.com" OR sourcehostname CONTAINS "18719562-coinbase.com" OR sourcehostname CONTAINS "1875290-coinbase.com" OR sourcehostname CONTAINS "1882730-coinbase.com" OR sourcehostname CONTAINS "18902-coinbase.com" OR sourcehostname CONTAINS "18903-coinbase.com" OR sourcehostname CONTAINS "189126-coinbase.com" OR sourcehostname CONTAINS "18952-coinbase.com" OR sourcehostname CONTAINS "192854-coinbase.com" OR sourcehostname CONTAINS "192856-coinbase.com" OR sourcehostname CONTAINS "19287-binance.com" OR sourcehostname CONTAINS "19572-coinbase.com" OR sourcehostname CONTAINS "195812-coinbase.com" OR sourcehostname CONTAINS "195826-coinbase.com" OR sourcehostname CONTAINS "1958262-coinbase.com" OR sourcehostname CONTAINS "195827-binance.com" OR sourcehostname CONTAINS "1958297-coinbase.com" OR sourcehostname CONTAINS "19582970-coinbase.com" OR sourcehostname CONTAINS "19582971-coinbase.com" OR sourcehostname CONTAINS "19583-coinbase.com" OR sourcehostname CONTAINS "19592653-coinbase.com" OR sourcehostname CONTAINS "197304-coinbase.com" OR sourcehostname CONTAINS "19730492-coinbase.com" OR sourcehostname CONTAINS "19764162-coinbase.com" OR sourcehostname CONTAINS "19803-coinbase.com" OR sourcehostname CONTAINS "201784289-coinbase.com" OR sourcehostname CONTAINS "210823644-coinbase.com" OR sourcehostname CONTAINS "21158-coinbase.com" OR sourcehostname CONTAINS "21509-coinbase.com" OR sourcehostname CONTAINS "25985-coinbase.com" OR sourcehostname CONTAINS "27699-coinbase.com" OR sourcehostname CONTAINS "28367-coinbase.com")
index=activity AND rg_functionality="Source Code Repository" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "178294-coinbase.com" OR destinationntdomain CONTAINS "17912-coinbase.com" OR destinationntdomain CONTAINS "17914-coinbase.com" OR destinationntdomain CONTAINS "17917-coinbase.com" OR destinationntdomain CONTAINS "17954-coinbase.com" OR destinationntdomain CONTAINS "17958-coinbase.com" OR destinationntdomain CONTAINS "182043-coinbase.com" OR destinationntdomain CONTAINS "18275-gemini.com" OR destinationntdomain CONTAINS "18276-coinbase.com" OR destinationntdomain CONTAINS "18290185-coinbase.com" OR destinationntdomain CONTAINS "182967-coinbase.com" OR destinationntdomain CONTAINS "18560-coinbase.com" OR destinationntdomain CONTAINS "18571-coinbase.com" OR destinationntdomain CONTAINS "185912-coinbase.com" OR destinationntdomain CONTAINS "185914-coinbase.com" OR destinationntdomain CONTAINS "18592176-coinbase.com" OR destinationntdomain CONTAINS "18594162-coinbase.com" OR destinationntdomain CONTAINS "18594962-coinbase.com" OR destinationntdomain CONTAINS "18597162-coinbase.com" OR destinationntdomain CONTAINS "18719562-coinbase.com" OR destinationntdomain CONTAINS "1875290-coinbase.com" OR destinationntdomain CONTAINS "1882730-coinbase.com" OR destinationntdomain CONTAINS "18902-coinbase.com" OR destinationntdomain CONTAINS "18903-coinbase.com" OR destinationntdomain CONTAINS "189126-coinbase.com" OR destinationntdomain CONTAINS "18952-coinbase.com" OR destinationntdomain CONTAINS "192854-coinbase.com" OR destinationntdomain CONTAINS "192856-coinbase.com" OR destinationntdomain CONTAINS "19287-binance.com" OR destinationntdomain CONTAINS "19572-coinbase.com" OR destinationntdomain CONTAINS "195812-coinbase.com" OR destinationntdomain CONTAINS "195826-coinbase.com" OR destinationntdomain CONTAINS "1958262-coinbase.com" OR destinationntdomain CONTAINS "195827-binance.com" OR destinationntdomain CONTAINS "1958297-coinbase.com" OR destinationntdomain CONTAINS "19582970-coinbase.com" OR destinationntdomain CONTAINS "19582971-coinbase.com" OR destinationntdomain CONTAINS "19583-coinbase.com" OR destinationntdomain CONTAINS "19592653-coinbase.com" OR destinationntdomain CONTAINS "197304-coinbase.com" OR destinationntdomain CONTAINS "19730492-coinbase.com" OR destinationntdomain CONTAINS "19764162-coinbase.com" OR destinationntdomain CONTAINS "19803-coinbase.com" OR destinationntdomain CONTAINS "201784289-coinbase.com" OR destinationntdomain CONTAINS "210823644-coinbase.com" OR destinationntdomain CONTAINS "21158-coinbase.com" OR destinationntdomain CONTAINS "21509-coinbase.com" OR destinationntdomain CONTAINS "25985-coinbase.com" OR destinationntdomain CONTAINS "27699-coinbase.com" OR destinationntdomain CONTAINS "28367-coinbase.com")
index=activity AND rg_functionality="Source Code Repository" AND requesturl NOT NULL AND (requesturl CONTAINS "178294-coinbase.com" OR requesturl CONTAINS "17912-coinbase.com" OR requesturl CONTAINS "17914-coinbase.com" OR requesturl CONTAINS "17917-coinbase.com" OR requesturl CONTAINS "17954-coinbase.com" OR requesturl CONTAINS "17958-coinbase.com" OR requesturl CONTAINS "182043-coinbase.com" OR requesturl CONTAINS "18275-gemini.com" OR requesturl CONTAINS "18276-coinbase.com" OR requesturl CONTAINS "18290185-coinbase.com" OR requesturl CONTAINS "182967-coinbase.com" OR requesturl CONTAINS "18560-coinbase.com" OR requesturl CONTAINS "18571-coinbase.com" OR requesturl CONTAINS "185912-coinbase.com" OR requesturl CONTAINS "185914-coinbase.com" OR requesturl CONTAINS "18592176-coinbase.com" OR requesturl CONTAINS "18594162-coinbase.com" OR requesturl CONTAINS "18594962-coinbase.com" OR requesturl CONTAINS "18597162-coinbase.com" OR requesturl CONTAINS "18719562-coinbase.com" OR requesturl CONTAINS "1875290-coinbase.com" OR requesturl CONTAINS "1882730-coinbase.com" OR requesturl CONTAINS "18902-coinbase.com" OR requesturl CONTAINS "18903-coinbase.com" OR requesturl CONTAINS "189126-coinbase.com" OR requesturl CONTAINS "18952-coinbase.com" OR requesturl CONTAINS "192854-coinbase.com" OR requesturl CONTAINS "192856-coinbase.com" OR requesturl CONTAINS "19287-binance.com" OR requesturl CONTAINS "19572-coinbase.com" OR requesturl CONTAINS "195812-coinbase.com" OR requesturl CONTAINS "195826-coinbase.com" OR requesturl CONTAINS "1958262-coinbase.com" OR requesturl CONTAINS "195827-binance.com" OR requesturl CONTAINS "1958297-coinbase.com" OR requesturl CONTAINS "19582970-coinbase.com" OR requesturl CONTAINS "19582971-coinbase.com" OR requesturl CONTAINS "19583-coinbase.com" OR requesturl CONTAINS "19592653-coinbase.com" OR requesturl CONTAINS "197304-coinbase.com" OR requesturl CONTAINS "19730492-coinbase.com" OR requesturl CONTAINS "19764162-coinbase.com" OR requesturl CONTAINS "19803-coinbase.com" OR requesturl CONTAINS "201784289-coinbase.com" OR requesturl CONTAINS "210823644-coinbase.com" OR requesturl CONTAINS "21158-coinbase.com" OR requesturl CONTAINS "21509-coinbase.com" OR requesturl CONTAINS "25985-coinbase.com" OR requesturl CONTAINS "27699-coinbase.com" OR requesturl CONTAINS "28367-coinbase.com")
index=activity AND rg_functionality="Source Code Repository" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "28676-coinbase.com" OR destinationhostname CONTAINS "29185-coinbase.com" OR destinationhostname CONTAINS "29195-coinbase.com" OR destinationhostname CONTAINS "2a-coinbase.com" OR destinationhostname CONTAINS "2b-coinbase.com" OR destinationhostname CONTAINS "2c-coinbase.com" OR destinationhostname CONTAINS "2f-coinbase.com" OR destinationhostname CONTAINS "2fas-coinbase.com" OR destinationhostname CONTAINS "2o-coinbase.com" OR destinationhostname CONTAINS "2r-coinbase.com" OR destinationhostname CONTAINS "2s-coinbase.com" OR destinationhostname CONTAINS "2sv-coinbase.com" OR destinationhostname CONTAINS "352134951-coinbase.com" OR destinationhostname CONTAINS "38468-coinbase.com" OR destinationhostname CONTAINS "39590-coinbase.com" OR destinationhostname CONTAINS "41260-coinbase.com" OR destinationhostname CONTAINS "427883-coinbase.com" OR destinationhostname CONTAINS "43017-coinbase.com" OR destinationhostname CONTAINS "47562-coinbase.com" OR destinationhostname CONTAINS "50195-coinbase.com" OR destinationhostname CONTAINS "5247-coinbase.com" OR destinationhostname CONTAINS "54765-coinbase.com" OR destinationhostname CONTAINS "57197-coinbase.com" OR destinationhostname CONTAINS "58176-coinbase.com" OR destinationhostname CONTAINS "58297-coinbase.com" OR destinationhostname CONTAINS "61250-coinbase.com" OR destinationhostname CONTAINS "61835-coinbase.com" OR destinationhostname CONTAINS "61851-coinbase.com" OR destinationhostname CONTAINS "61937-coinbase.com" OR destinationhostname CONTAINS "71925-coinbase.com" OR destinationhostname CONTAINS "72957-coinbase.com" OR destinationhostname CONTAINS "72985-coinbase.com" OR destinationhostname CONTAINS "74651-coinbase.com" OR destinationhostname CONTAINS "754668948-coinbase.com" OR destinationhostname CONTAINS "76159869-coinbase.com" OR destinationhostname CONTAINS "76153-coinbase.com" OR destinationhostname CONTAINS "81758-coinbase.com" OR destinationhostname CONTAINS "81920-coinbase.com" OR destinationhostname CONTAINS "81926-coinbase.com" OR destinationhostname CONTAINS "81958-coinbase.com" OR destinationhostname CONTAINS "826298-coinbase.com" OR destinationhostname CONTAINS "83216-coinbase.com" OR destinationhostname CONTAINS "837613-coinbase.com" OR destinationhostname CONTAINS "83956-coinbase.com" OR destinationhostname CONTAINS "87157-coinbase.com" OR destinationhostname CONTAINS "87312-coinbase.com" OR destinationhostname CONTAINS "89304-coinbase.com" OR destinationhostname CONTAINS "89375-coinbase.com" OR destinationhostname CONTAINS "91723-gemini.com" OR destinationhostname CONTAINS "91752-coinbase.com")
index=activity AND rg_functionality="Source Code Repository" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "28676-coinbase.com" OR sourcentdomain CONTAINS "29185-coinbase.com" OR sourcentdomain CONTAINS "29195-coinbase.com" OR sourcentdomain CONTAINS "2a-coinbase.com" OR sourcentdomain CONTAINS "2b-coinbase.com" OR sourcentdomain CONTAINS "2c-coinbase.com" OR sourcentdomain CONTAINS "2f-coinbase.com" OR sourcentdomain CONTAINS "2fas-coinbase.com" OR sourcentdomain CONTAINS "2o-coinbase.com" OR sourcentdomain CONTAINS "2r-coinbase.com" OR sourcentdomain CONTAINS "2s-coinbase.com" OR sourcentdomain CONTAINS "2sv-coinbase.com" OR sourcentdomain CONTAINS "352134951-coinbase.com" OR sourcentdomain CONTAINS "38468-coinbase.com" OR sourcentdomain CONTAINS "39590-coinbase.com" OR sourcentdomain CONTAINS "41260-coinbase.com" OR sourcentdomain CONTAINS "427883-coinbase.com" OR sourcentdomain CONTAINS "43017-coinbase.com" OR sourcentdomain CONTAINS "47562-coinbase.com" OR sourcentdomain CONTAINS "50195-coinbase.com" OR sourcentdomain CONTAINS "5247-coinbase.com" OR sourcentdomain CONTAINS "54765-coinbase.com" OR sourcentdomain CONTAINS "57197-coinbase.com" OR sourcentdomain CONTAINS "58176-coinbase.com" OR sourcentdomain CONTAINS "58297-coinbase.com" OR sourcentdomain CONTAINS "61250-coinbase.com" OR sourcentdomain CONTAINS "61835-coinbase.com" OR sourcentdomain CONTAINS "61851-coinbase.com" OR sourcentdomain CONTAINS "61937-coinbase.com" OR sourcentdomain CONTAINS "71925-coinbase.com" OR sourcentdomain CONTAINS "72957-coinbase.com" OR sourcentdomain CONTAINS "72985-coinbase.com" OR sourcentdomain CONTAINS "74651-coinbase.com" OR sourcentdomain CONTAINS "754668948-coinbase.com" OR sourcentdomain CONTAINS "76159869-coinbase.com" OR sourcentdomain CONTAINS "76153-coinbase.com" OR sourcentdomain CONTAINS "81758-coinbase.com" OR sourcentdomain CONTAINS "81920-coinbase.com" OR sourcentdomain CONTAINS "81926-coinbase.com" OR sourcentdomain CONTAINS "81958-coinbase.com" OR sourcentdomain CONTAINS "826298-coinbase.com" OR sourcentdomain CONTAINS "83216-coinbase.com" OR sourcentdomain CONTAINS "837613-coinbase.com" OR sourcentdomain CONTAINS "83956-coinbase.com" OR sourcentdomain CONTAINS "87157-coinbase.com" OR sourcentdomain CONTAINS "87312-coinbase.com" OR sourcentdomain CONTAINS "89304-coinbase.com" OR sourcentdomain CONTAINS "89375-coinbase.com" OR sourcentdomain CONTAINS "91723-gemini.com" OR sourcentdomain CONTAINS "91752-coinbase.com")
index=activity AND rg_functionality="Source Code Repository" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "28676-coinbase.com" OR sourcehostname CONTAINS "29185-coinbase.com" OR sourcehostname CONTAINS "29195-coinbase.com" OR sourcehostname CONTAINS "2a-coinbase.com" OR sourcehostname CONTAINS "2b-coinbase.com" OR sourcehostname CONTAINS "2c-coinbase.com" OR sourcehostname CONTAINS "2f-coinbase.com" OR sourcehostname CONTAINS "2fas-coinbase.com" OR sourcehostname CONTAINS "2o-coinbase.com" OR sourcehostname CONTAINS "2r-coinbase.com" OR sourcehostname CONTAINS "2s-coinbase.com" OR sourcehostname CONTAINS "2sv-coinbase.com" OR sourcehostname CONTAINS "352134951-coinbase.com" OR sourcehostname CONTAINS "38468-coinbase.com" OR sourcehostname CONTAINS "39590-coinbase.com" OR sourcehostname CONTAINS "41260-coinbase.com" OR sourcehostname CONTAINS "427883-coinbase.com" OR sourcehostname CONTAINS "43017-coinbase.com" OR sourcehostname CONTAINS "47562-coinbase.com" OR sourcehostname CONTAINS "50195-coinbase.com" OR sourcehostname CONTAINS "5247-coinbase.com" OR sourcehostname CONTAINS "54765-coinbase.com" OR sourcehostname CONTAINS "57197-coinbase.com" OR sourcehostname CONTAINS "58176-coinbase.com" OR sourcehostname CONTAINS "58297-coinbase.com" OR sourcehostname CONTAINS "61250-coinbase.com" OR sourcehostname CONTAINS "61835-coinbase.com" OR sourcehostname CONTAINS "61851-coinbase.com" OR sourcehostname CONTAINS "61937-coinbase.com" OR sourcehostname CONTAINS "71925-coinbase.com" OR sourcehostname CONTAINS "72957-coinbase.com" OR sourcehostname CONTAINS "72985-coinbase.com" OR sourcehostname CONTAINS "74651-coinbase.com" OR sourcehostname CONTAINS "754668948-coinbase.com" OR sourcehostname CONTAINS "76159869-coinbase.com" OR sourcehostname CONTAINS "76153-coinbase.com" OR sourcehostname CONTAINS "81758-coinbase.com" OR sourcehostname CONTAINS "81920-coinbase.com" OR sourcehostname CONTAINS "81926-coinbase.com" OR sourcehostname CONTAINS "81958-coinbase.com" OR sourcehostname CONTAINS "826298-coinbase.com" OR sourcehostname CONTAINS "83216-coinbase.com" OR sourcehostname CONTAINS "837613-coinbase.com" OR sourcehostname CONTAINS "83956-coinbase.com" OR sourcehostname CONTAINS "87157-coinbase.com" OR sourcehostname CONTAINS "87312-coinbase.com" OR sourcehostname CONTAINS "89304-coinbase.com" OR sourcehostname CONTAINS "89375-coinbase.com" OR sourcehostname CONTAINS "91723-gemini.com" OR sourcehostname CONTAINS "91752-coinbase.com")
index=activity AND rg_functionality="Source Code Repository" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "28676-coinbase.com" OR destinationntdomain CONTAINS "29185-coinbase.com" OR destinationntdomain CONTAINS "29195-coinbase.com" OR destinationntdomain CONTAINS "2a-coinbase.com" OR destinationntdomain CONTAINS "2b-coinbase.com" OR destinationntdomain CONTAINS "2c-coinbase.com" OR destinationntdomain CONTAINS "2f-coinbase.com" OR destinationntdomain CONTAINS "2fas-coinbase.com" OR destinationntdomain CONTAINS "2o-coinbase.com" OR destinationntdomain CONTAINS "2r-coinbase.com" OR destinationntdomain CONTAINS "2s-coinbase.com" OR destinationntdomain CONTAINS "2sv-coinbase.com" OR destinationntdomain CONTAINS "352134951-coinbase.com" OR destinationntdomain CONTAINS "38468-coinbase.com" OR destinationntdomain CONTAINS "39590-coinbase.com" OR destinationntdomain CONTAINS "41260-coinbase.com" OR destinationntdomain CONTAINS "427883-coinbase.com" OR destinationntdomain CONTAINS "43017-coinbase.com" OR destinationntdomain CONTAINS "47562-coinbase.com" OR destinationntdomain CONTAINS "50195-coinbase.com" OR destinationntdomain CONTAINS "5247-coinbase.com" OR destinationntdomain CONTAINS "54765-coinbase.com" OR destinationntdomain CONTAINS "57197-coinbase.com" OR destinationntdomain CONTAINS "58176-coinbase.com" OR destinationntdomain CONTAINS "58297-coinbase.com" OR destinationntdomain CONTAINS "61250-coinbase.com" OR destinationntdomain CONTAINS "61835-coinbase.com" OR destinationntdomain CONTAINS "61851-coinbase.com" OR destinationntdomain CONTAINS "61937-coinbase.com" OR destinationntdomain CONTAINS "71925-coinbase.com" OR destinationntdomain CONTAINS "72957-coinbase.com" OR destinationntdomain CONTAINS "72985-coinbase.com" OR destinationntdomain CONTAINS "74651-coinbase.com" OR destinationntdomain CONTAINS "754668948-coinbase.com" OR destinationntdomain CONTAINS "76159869-coinbase.com" OR destinationntdomain CONTAINS "76153-coinbase.com" OR destinationntdomain CONTAINS "81758-coinbase.com" OR destinationntdomain CONTAINS "81920-coinbase.com" OR destinationntdomain CONTAINS "81926-coinbase.com" OR destinationntdomain CONTAINS "81958-coinbase.com" OR destinationntdomain CONTAINS "826298-coinbase.com" OR destinationntdomain CONTAINS "83216-coinbase.com" OR destinationntdomain CONTAINS "837613-coinbase.com" OR destinationntdomain CONTAINS "83956-coinbase.com" OR destinationntdomain CONTAINS "87157-coinbase.com" OR destinationntdomain CONTAINS "87312-coinbase.com" OR destinationntdomain CONTAINS "89304-coinbase.com" OR destinationntdomain CONTAINS "89375-coinbase.com" OR destinationntdomain CONTAINS "91723-gemini.com" OR destinationntdomain CONTAINS "91752-coinbase.com")
index=activity AND rg_functionality="Source Code Repository" AND requesturl NOT NULL AND (requesturl CONTAINS "28676-coinbase.com" OR requesturl CONTAINS "29185-coinbase.com" OR requesturl CONTAINS "29195-coinbase.com" OR requesturl CONTAINS "2a-coinbase.com" OR requesturl CONTAINS "2b-coinbase.com" OR requesturl CONTAINS "2c-coinbase.com" OR requesturl CONTAINS "2f-coinbase.com" OR requesturl CONTAINS "2fas-coinbase.com" OR requesturl CONTAINS "2o-coinbase.com" OR requesturl CONTAINS "2r-coinbase.com" OR requesturl CONTAINS "2s-coinbase.com" OR requesturl CONTAINS "2sv-coinbase.com" OR requesturl CONTAINS "352134951-coinbase.com" OR requesturl CONTAINS "38468-coinbase.com" OR requesturl CONTAINS "39590-coinbase.com" OR requesturl CONTAINS "41260-coinbase.com" OR requesturl CONTAINS "427883-coinbase.com" OR requesturl CONTAINS "43017-coinbase.com" OR requesturl CONTAINS "47562-coinbase.com" OR requesturl CONTAINS "50195-coinbase.com" OR requesturl CONTAINS "5247-coinbase.com" OR requesturl CONTAINS "54765-coinbase.com" OR requesturl CONTAINS "57197-coinbase.com" OR requesturl CONTAINS "58176-coinbase.com" OR requesturl CONTAINS "58297-coinbase.com" OR requesturl CONTAINS "61250-coinbase.com" OR requesturl CONTAINS "61835-coinbase.com" OR requesturl CONTAINS "61851-coinbase.com" OR requesturl CONTAINS "61937-coinbase.com" OR requesturl CONTAINS "71925-coinbase.com" OR requesturl CONTAINS "72957-coinbase.com" OR requesturl CONTAINS "72985-coinbase.com" OR requesturl CONTAINS "74651-coinbase.com" OR requesturl CONTAINS "754668948-coinbase.com" OR requesturl CONTAINS "76159869-coinbase.com" OR requesturl CONTAINS "76153-coinbase.com" OR requesturl CONTAINS "81758-coinbase.com" OR requesturl CONTAINS "81920-coinbase.com" OR requesturl CONTAINS "81926-coinbase.com" OR requesturl CONTAINS "81958-coinbase.com" OR requesturl CONTAINS "826298-coinbase.com" OR requesturl CONTAINS "83216-coinbase.com" OR requesturl CONTAINS "837613-coinbase.com" OR requesturl CONTAINS "83956-coinbase.com" OR requesturl CONTAINS "87157-coinbase.com" OR requesturl CONTAINS "87312-coinbase.com" OR requesturl CONTAINS "89304-coinbase.com" OR requesturl CONTAINS "89375-coinbase.com" OR requesturl CONTAINS "91723-gemini.com" OR requesturl CONTAINS "91752-coinbase.com")
index=activity AND rg_functionality="Source Code Repository" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "91756-coinbase.com" OR destinationhostname CONTAINS "91782-coinbase.com" OR destinationhostname CONTAINS "91835-coinbase.com" OR destinationhostname CONTAINS "91845-coinbase.com" OR destinationhostname CONTAINS "91923-coinbase.com" OR destinationhostname CONTAINS "92758-coinbase.com" OR destinationhostname CONTAINS "948122061-coinbase.com" OR destinationhostname CONTAINS "978941-coinbase.com" OR destinationhostname CONTAINS "accountrecovery-coinbase.com" OR destinationhostname CONTAINS "action-shakepay.com" OR destinationhostname CONTAINS "adjust-coinbase.com" OR destinationhostname CONTAINS "admin-kraken.com" OR destinationhostname CONTAINS "applechargebacks.com" OR destinationhostname CONTAINS "authenticate-gemini.com" OR destinationhostname CONTAINS "authorize-gmail.com" OR destinationhostname CONTAINS "binance-okta.com" OR destinationhostname CONTAINS "captcha-coinbase.com" OR destinationhostname CONTAINS "cd-coinbase.com" OR destinationhostname CONTAINS "coinbase-heip.com" OR destinationhostname CONTAINS "coinbase-live.support" OR destinationhostname CONTAINS "coinbase-reject.com" OR destinationhostname CONTAINS "coinbase-ticket.com" OR destinationhostname CONTAINS "coinbaseheip.com" OR destinationhostname CONTAINS "com-2fa.help" OR destinationhostname CONTAINS "com-2fa.support" OR destinationhostname CONTAINS "com-3845.support" OR destinationhostname CONTAINS "com-connect.help" OR destinationhostname CONTAINS "com-fraud.support" OR destinationhostname CONTAINS "com-help.support" OR destinationhostname CONTAINS "com-reset.help" OR destinationhostname CONTAINS "com-reset.net" OR destinationhostname CONTAINS "com-ticket.live" OR destinationhostname CONTAINS "com-ticket.support" OR destinationhostname CONTAINS "contact-nexo.com" OR destinationhostname CONTAINS "convert-coinbase.com" OR destinationhostname CONTAINS "customerservice-coinbase.com" OR destinationhostname CONTAINS "default-coinbase.com" OR destinationhostname CONTAINS "defend-coinbase.com" OR destinationhostname CONTAINS "deny-coinbase.com" OR destinationhostname CONTAINS "disconnect-coinbase.com" OR destinationhostname CONTAINS "escalate-coinbase.com" OR destinationhostname CONTAINS "establish-coinbase.com" OR destinationhostname CONTAINS "fcc-okta.com" OR destinationhostname CONTAINS "fraudulent-coinbase.com" OR destinationhostname CONTAINS "guard-apple.com" OR destinationhostname CONTAINS "guard-icloud.com" OR destinationhostname CONTAINS "guardian-coinbase.com" OR destinationhostname CONTAINS "guide-gemini.com" OR destinationhostname CONTAINS "help-bitfinex.com" OR destinationhostname CONTAINS "help-shakepay.com")
index=activity AND rg_functionality="Source Code Repository" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "91756-coinbase.com" OR sourcentdomain CONTAINS "91782-coinbase.com" OR sourcentdomain CONTAINS "91835-coinbase.com" OR sourcentdomain CONTAINS "91845-coinbase.com" OR sourcentdomain CONTAINS "91923-coinbase.com" OR sourcentdomain CONTAINS "92758-coinbase.com" OR sourcentdomain CONTAINS "948122061-coinbase.com" OR sourcentdomain CONTAINS "978941-coinbase.com" OR sourcentdomain CONTAINS "accountrecovery-coinbase.com" OR sourcentdomain CONTAINS "action-shakepay.com" OR sourcentdomain CONTAINS "adjust-coinbase.com" OR sourcentdomain CONTAINS "admin-kraken.com" OR sourcentdomain CONTAINS "applechargebacks.com" OR sourcentdomain CONTAINS "authenticate-gemini.com" OR sourcentdomain CONTAINS "authorize-gmail.com" OR sourcentdomain CONTAINS "binance-okta.com" OR sourcentdomain CONTAINS "captcha-coinbase.com" OR sourcentdomain CONTAINS "cd-coinbase.com" OR sourcentdomain CONTAINS "coinbase-heip.com" OR sourcentdomain CONTAINS "coinbase-live.support" OR sourcentdomain CONTAINS "coinbase-reject.com" OR sourcentdomain CONTAINS "coinbase-ticket.com" OR sourcentdomain CONTAINS "coinbaseheip.com" OR sourcentdomain CONTAINS "com-2fa.help" OR sourcentdomain CONTAINS "com-2fa.support" OR sourcentdomain CONTAINS "com-3845.support" OR sourcentdomain CONTAINS "com-connect.help" OR sourcentdomain CONTAINS "com-fraud.support" OR sourcentdomain CONTAINS "com-help.support" OR sourcentdomain CONTAINS "com-reset.help" OR sourcentdomain CONTAINS "com-reset.net" OR sourcentdomain CONTAINS "com-ticket.live" OR sourcentdomain CONTAINS "com-ticket.support" OR sourcentdomain CONTAINS "contact-nexo.com" OR sourcentdomain CONTAINS "convert-coinbase.com" OR sourcentdomain CONTAINS "customerservice-coinbase.com" OR sourcentdomain CONTAINS "default-coinbase.com" OR sourcentdomain CONTAINS "defend-coinbase.com" OR sourcentdomain CONTAINS "deny-coinbase.com" OR sourcentdomain CONTAINS "disconnect-coinbase.com" OR sourcentdomain CONTAINS "escalate-coinbase.com" OR sourcentdomain CONTAINS "establish-coinbase.com" OR sourcentdomain CONTAINS "fcc-okta.com" OR sourcentdomain CONTAINS "fraudulent-coinbase.com" OR sourcentdomain CONTAINS "guard-apple.com" OR sourcentdomain CONTAINS "guard-icloud.com" OR sourcentdomain CONTAINS "guardian-coinbase.com" OR sourcentdomain CONTAINS "guide-gemini.com" OR sourcentdomain CONTAINS "help-bitfinex.com" OR sourcentdomain CONTAINS "help-shakepay.com")
index=activity AND rg_functionality="Source Code Repository" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "91756-coinbase.com" OR sourcehostname CONTAINS "91782-coinbase.com" OR sourcehostname CONTAINS "91835-coinbase.com" OR sourcehostname CONTAINS "91845-coinbase.com" OR sourcehostname CONTAINS "91923-coinbase.com" OR sourcehostname CONTAINS "92758-coinbase.com" OR sourcehostname CONTAINS "948122061-coinbase.com" OR sourcehostname CONTAINS "978941-coinbase.com" OR sourcehostname CONTAINS "accountrecovery-coinbase.com" OR sourcehostname CONTAINS "action-shakepay.com" OR sourcehostname CONTAINS "adjust-coinbase.com" OR sourcehostname CONTAINS "admin-kraken.com" OR sourcehostname CONTAINS "applechargebacks.com" OR sourcehostname CONTAINS "authenticate-gemini.com" OR sourcehostname CONTAINS "authorize-gmail.com" OR sourcehostname CONTAINS "binance-okta.com" OR sourcehostname CONTAINS "captcha-coinbase.com" OR sourcehostname CONTAINS "cd-coinbase.com" OR sourcehostname CONTAINS "coinbase-heip.com" OR sourcehostname CONTAINS "coinbase-live.support" OR sourcehostname CONTAINS "coinbase-reject.com" OR sourcehostname CONTAINS "coinbase-ticket.com" OR sourcehostname CONTAINS "coinbaseheip.com" OR sourcehostname CONTAINS "com-2fa.help" OR sourcehostname CONTAINS "com-2fa.support" OR sourcehostname CONTAINS "com-3845.support" OR sourcehostname CONTAINS "com-connect.help" OR sourcehostname CONTAINS "com-fraud.support" OR sourcehostname CONTAINS "com-help.support" OR sourcehostname CONTAINS "com-reset.help" OR sourcehostname CONTAINS "com-reset.net" OR sourcehostname CONTAINS "com-ticket.live" OR sourcehostname CONTAINS "com-ticket.support" OR sourcehostname CONTAINS "contact-nexo.com" OR sourcehostname CONTAINS "convert-coinbase.com" OR sourcehostname CONTAINS "customerservice-coinbase.com" OR sourcehostname CONTAINS "default-coinbase.com" OR sourcehostname CONTAINS "defend-coinbase.com" OR sourcehostname CONTAINS "deny-coinbase.com" OR sourcehostname CONTAINS "disconnect-coinbase.com" OR sourcehostname CONTAINS "escalate-coinbase.com" OR sourcehostname CONTAINS "establish-coinbase.com" OR sourcehostname CONTAINS "fcc-okta.com" OR sourcehostname CONTAINS "fraudulent-coinbase.com" OR sourcehostname CONTAINS "guard-apple.com" OR sourcehostname CONTAINS "guard-icloud.com" OR sourcehostname CONTAINS "guardian-coinbase.com" OR sourcehostname CONTAINS "guide-gemini.com" OR sourcehostname CONTAINS "help-bitfinex.com" OR sourcehostname CONTAINS "help-shakepay.com")
index=activity AND rg_functionality="Source Code Repository" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "91756-coinbase.com" OR destinationntdomain CONTAINS "91782-coinbase.com" OR destinationntdomain CONTAINS "91835-coinbase.com" OR destinationntdomain CONTAINS "91845-coinbase.com" OR destinationntdomain CONTAINS "91923-coinbase.com" OR destinationntdomain CONTAINS "92758-coinbase.com" OR destinationntdomain CONTAINS "948122061-coinbase.com" OR destinationntdomain CONTAINS "978941-coinbase.com" OR destinationntdomain CONTAINS "accountrecovery-coinbase.com" OR destinationntdomain CONTAINS "action-shakepay.com" OR destinationntdomain CONTAINS "adjust-coinbase.com" OR destinationntdomain CONTAINS "admin-kraken.com" OR destinationntdomain CONTAINS "applechargebacks.com" OR destinationntdomain CONTAINS "authenticate-gemini.com" OR destinationntdomain CONTAINS "authorize-gmail.com" OR destinationntdomain CONTAINS "binance-okta.com" OR destinationntdomain CONTAINS "captcha-coinbase.com" OR destinationntdomain CONTAINS "cd-coinbase.com" OR destinationntdomain CONTAINS "coinbase-heip.com" OR destinationntdomain CONTAINS "coinbase-live.support" OR destinationntdomain CONTAINS "coinbase-reject.com" OR destinationntdomain CONTAINS "coinbase-ticket.com" OR destinationntdomain CONTAINS "coinbaseheip.com" OR destinationntdomain CONTAINS "com-2fa.help" OR destinationntdomain CONTAINS "com-2fa.support" OR destinationntdomain CONTAINS "com-3845.support" OR destinationntdomain CONTAINS "com-connect.help" OR destinationntdomain CONTAINS "com-fraud.support" OR destinationntdomain CONTAINS "com-help.support" OR destinationntdomain CONTAINS "com-reset.help" OR destinationntdomain CONTAINS "com-reset.net" OR destinationntdomain CONTAINS "com-ticket.live" OR destinationntdomain CONTAINS "com-ticket.support" OR destinationntdomain CONTAINS "contact-nexo.com" OR destinationntdomain CONTAINS "convert-coinbase.com" OR destinationntdomain CONTAINS "customerservice-coinbase.com" OR destinationntdomain CONTAINS "default-coinbase.com" OR destinationntdomain CONTAINS "defend-coinbase.com" OR destinationntdomain CONTAINS "deny-coinbase.com" OR destinationntdomain CONTAINS "disconnect-coinbase.com" OR destinationntdomain CONTAINS "escalate-coinbase.com" OR destinationntdomain CONTAINS "establish-coinbase.com" OR destinationntdomain CONTAINS "fcc-okta.com" OR destinationntdomain CONTAINS "fraudulent-coinbase.com" OR destinationntdomain CONTAINS "guard-apple.com" OR destinationntdomain CONTAINS "guard-icloud.com" OR destinationntdomain CONTAINS "guardian-coinbase.com" OR destinationntdomain CONTAINS "guide-gemini.com" OR destinationntdomain CONTAINS "help-bitfinex.com" OR destinationntdomain CONTAINS "help-shakepay.com")
index=activity AND rg_functionality="Source Code Repository" AND requesturl NOT NULL AND (requesturl CONTAINS "91756-coinbase.com" OR requesturl CONTAINS "91782-coinbase.com" OR requesturl CONTAINS "91835-coinbase.com" OR requesturl CONTAINS "91845-coinbase.com" OR requesturl CONTAINS "91923-coinbase.com" OR requesturl CONTAINS "92758-coinbase.com" OR requesturl CONTAINS "948122061-coinbase.com" OR requesturl CONTAINS "978941-coinbase.com" OR requesturl CONTAINS "accountrecovery-coinbase.com" OR requesturl CONTAINS "action-shakepay.com" OR requesturl CONTAINS "adjust-coinbase.com" OR requesturl CONTAINS "admin-kraken.com" OR requesturl CONTAINS "applechargebacks.com" OR requesturl CONTAINS "authenticate-gemini.com" OR requesturl CONTAINS "authorize-gmail.com" OR requesturl CONTAINS "binance-okta.com" OR requesturl CONTAINS "captcha-coinbase.com" OR requesturl CONTAINS "cd-coinbase.com" OR requesturl CONTAINS "coinbase-heip.com" OR requesturl CONTAINS "coinbase-live.support" OR requesturl CONTAINS "coinbase-reject.com" OR requesturl CONTAINS "coinbase-ticket.com" OR requesturl CONTAINS "coinbaseheip.com" OR requesturl CONTAINS "com-2fa.help" OR requesturl CONTAINS "com-2fa.support" OR requesturl CONTAINS "com-3845.support" OR requesturl CONTAINS "com-connect.help" OR requesturl CONTAINS "com-fraud.support" OR requesturl CONTAINS "com-help.support" OR requesturl CONTAINS "com-reset.help" OR requesturl CONTAINS "com-reset.net" OR requesturl CONTAINS "com-ticket.live" OR requesturl CONTAINS "com-ticket.support" OR requesturl CONTAINS "contact-nexo.com" OR requesturl CONTAINS "convert-coinbase.com" OR requesturl CONTAINS "customerservice-coinbase.com" OR requesturl CONTAINS "default-coinbase.com" OR requesturl CONTAINS "defend-coinbase.com" OR requesturl CONTAINS "deny-coinbase.com" OR requesturl CONTAINS "disconnect-coinbase.com" OR requesturl CONTAINS "escalate-coinbase.com" OR requesturl CONTAINS "establish-coinbase.com" OR requesturl CONTAINS "fcc-okta.com" OR requesturl CONTAINS "fraudulent-coinbase.com" OR requesturl CONTAINS "guard-apple.com" OR requesturl CONTAINS "guard-icloud.com" OR requesturl CONTAINS "guardian-coinbase.com" OR requesturl CONTAINS "guide-gemini.com" OR requesturl CONTAINS "help-bitfinex.com" OR requesturl CONTAINS "help-shakepay.com")
index=activity AND rg_functionality="Source Code Repository" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "helpdesk-apple.com" OR destinationhostname CONTAINS "helpdesk-gemini.com" OR destinationhostname CONTAINS "helpdesk-icloud.com" OR destinationhostname CONTAINS "identification-coinbase.com" OR destinationhostname CONTAINS "lockdown-coinbase.com" OR destinationhostname CONTAINS "login-nexo.com" OR destinationhostname CONTAINS "keys-coinbase.com" OR destinationhostname CONTAINS "messages-coinbase.com" OR destinationhostname CONTAINS "newpassword-coinbase.com" OR destinationhostname CONTAINS "prompt-coinbase.com" OR destinationhostname CONTAINS "protect-apple.com" OR destinationhostname CONTAINS "protect-coinbase.com" OR destinationhostname CONTAINS "protect-gmail.com" OR destinationhostname CONTAINS "protect-kraken.com" OR destinationhostname CONTAINS "recoverme-coinbase.com" OR destinationhostname CONTAINS "recoveryportal-coinbase.com" OR destinationhostname CONTAINS "refunds-coinbase.com" OR destinationhostname CONTAINS "reset-okta.com" OR destinationhostname CONTAINS "restore-coinbase.com" OR destinationhostname CONTAINS "return-coinbase.com" OR destinationhostname CONTAINS "reverts-coinbase.com" OR destinationhostname CONTAINS "secure-binance.us" OR destinationhostname CONTAINS "secure-icloud.com" OR destinationhostname CONTAINS "secure-nexo.com" OR destinationhostname CONTAINS "secure-shakepay.com" OR destinationhostname CONTAINS "security-umusic.com" OR destinationhostname CONTAINS "server694590423.tech" OR destinationhostname CONTAINS "session-coinbase.com" OR destinationhostname CONTAINS "startrecovery-coinbase.com" OR destinationhostname CONTAINS "signin-kraken.com" OR destinationhostname CONTAINS "suite-trezor.io" OR destinationhostname CONTAINS "supportportal-coinbase.com" OR destinationhostname CONTAINS "tech-icloud.com" OR destinationhostname CONTAINS "threat-coinbase.com" OR destinationhostname CONTAINS "ticket-apple.com" OR destinationhostname CONTAINS "ticket-coinbase.com" OR destinationhostname CONTAINS "tickets-apple.com" OR destinationhostname CONTAINS "tokens-coinbase.com" OR destinationhostname CONTAINS "unblock-coinbase.com" OR destinationhostname CONTAINS "unlink-coinbase.com" OR destinationhostname CONTAINS "your-coinbase.com" OR destinationhostname CONTAINS "welcome-coinbase.com" OR destinationhostname CONTAINS "www-coinbasewallet.com" OR destinationhostname CONTAINS "www-help-coinbase.com" OR destinationhostname CONTAINS "www-help-gemini.com")
index=activity AND rg_functionality="Source Code Repository" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "helpdesk-apple.com" OR sourcentdomain CONTAINS "helpdesk-gemini.com" OR sourcentdomain CONTAINS "helpdesk-icloud.com" OR sourcentdomain CONTAINS "identification-coinbase.com" OR sourcentdomain CONTAINS "lockdown-coinbase.com" OR sourcentdomain CONTAINS "login-nexo.com" OR sourcentdomain CONTAINS "keys-coinbase.com" OR sourcentdomain CONTAINS "messages-coinbase.com" OR sourcentdomain CONTAINS "newpassword-coinbase.com" OR sourcentdomain CONTAINS "prompt-coinbase.com" OR sourcentdomain CONTAINS "protect-apple.com" OR sourcentdomain CONTAINS "protect-coinbase.com" OR sourcentdomain CONTAINS "protect-gmail.com" OR sourcentdomain CONTAINS "protect-kraken.com" OR sourcentdomain CONTAINS "recoverme-coinbase.com" OR sourcentdomain CONTAINS "recoveryportal-coinbase.com" OR sourcentdomain CONTAINS "refunds-coinbase.com" OR sourcentdomain CONTAINS "reset-okta.com" OR sourcentdomain CONTAINS "restore-coinbase.com" OR sourcentdomain CONTAINS "return-coinbase.com" OR sourcentdomain CONTAINS "reverts-coinbase.com" OR sourcentdomain CONTAINS "secure-binance.us" OR sourcentdomain CONTAINS "secure-icloud.com" OR sourcentdomain CONTAINS "secure-nexo.com" OR sourcentdomain CONTAINS "secure-shakepay.com" OR sourcentdomain CONTAINS "security-umusic.com" OR sourcentdomain CONTAINS "server694590423.tech" OR sourcentdomain CONTAINS "session-coinbase.com" OR sourcentdomain CONTAINS "startrecovery-coinbase.com" OR sourcentdomain CONTAINS "signin-kraken.com" OR sourcentdomain CONTAINS "suite-trezor.io" OR sourcentdomain CONTAINS "supportportal-coinbase.com" OR sourcentdomain CONTAINS "tech-icloud.com" OR sourcentdomain CONTAINS "threat-coinbase.com" OR sourcentdomain CONTAINS "ticket-apple.com" OR sourcentdomain CONTAINS "ticket-coinbase.com" OR sourcentdomain CONTAINS "tickets-apple.com" OR sourcentdomain CONTAINS "tokens-coinbase.com" OR sourcentdomain CONTAINS "unblock-coinbase.com" OR sourcentdomain CONTAINS "unlink-coinbase.com" OR sourcentdomain CONTAINS "your-coinbase.com" OR sourcentdomain CONTAINS "welcome-coinbase.com" OR sourcentdomain CONTAINS "www-coinbasewallet.com" OR sourcentdomain CONTAINS "www-help-coinbase.com" OR sourcentdomain CONTAINS "www-help-gemini.com")
index=activity AND rg_functionality="Source Code Repository" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "helpdesk-apple.com" OR sourcehostname CONTAINS "helpdesk-gemini.com" OR sourcehostname CONTAINS "helpdesk-icloud.com" OR sourcehostname CONTAINS "identification-coinbase.com" OR sourcehostname CONTAINS "lockdown-coinbase.com" OR sourcehostname CONTAINS "login-nexo.com" OR sourcehostname CONTAINS "keys-coinbase.com" OR sourcehostname CONTAINS "messages-coinbase.com" OR sourcehostname CONTAINS "newpassword-coinbase.com" OR sourcehostname CONTAINS "prompt-coinbase.com" OR sourcehostname CONTAINS "protect-apple.com" OR sourcehostname CONTAINS "protect-coinbase.com" OR sourcehostname CONTAINS "protect-gmail.com" OR sourcehostname CONTAINS "protect-kraken.com" OR sourcehostname CONTAINS "recoverme-coinbase.com" OR sourcehostname CONTAINS "recoveryportal-coinbase.com" OR sourcehostname CONTAINS "refunds-coinbase.com" OR sourcehostname CONTAINS "reset-okta.com" OR sourcehostname CONTAINS "restore-coinbase.com" OR sourcehostname CONTAINS "return-coinbase.com" OR sourcehostname CONTAINS "reverts-coinbase.com" OR sourcehostname CONTAINS "secure-binance.us" OR sourcehostname CONTAINS "secure-icloud.com" OR sourcehostname CONTAINS "secure-nexo.com" OR sourcehostname CONTAINS "secure-shakepay.com" OR sourcehostname CONTAINS "security-umusic.com" OR sourcehostname CONTAINS "server694590423.tech" OR sourcehostname CONTAINS "session-coinbase.com" OR sourcehostname CONTAINS "startrecovery-coinbase.com" OR sourcehostname CONTAINS "signin-kraken.com" OR sourcehostname CONTAINS "suite-trezor.io" OR sourcehostname CONTAINS "supportportal-coinbase.com" OR sourcehostname CONTAINS "tech-icloud.com" OR sourcehostname CONTAINS "threat-coinbase.com" OR sourcehostname CONTAINS "ticket-apple.com" OR sourcehostname CONTAINS "ticket-coinbase.com" OR sourcehostname CONTAINS "tickets-apple.com" OR sourcehostname CONTAINS "tokens-coinbase.com" OR sourcehostname CONTAINS "unblock-coinbase.com" OR sourcehostname CONTAINS "unlink-coinbase.com" OR sourcehostname CONTAINS "your-coinbase.com" OR sourcehostname CONTAINS "welcome-coinbase.com" OR sourcehostname CONTAINS "www-coinbasewallet.com" OR sourcehostname CONTAINS "www-help-coinbase.com" OR sourcehostname CONTAINS "www-help-gemini.com")
index=activity AND rg_functionality="Source Code Repository" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "helpdesk-apple.com" OR destinationntdomain CONTAINS "helpdesk-gemini.com" OR destinationntdomain CONTAINS "helpdesk-icloud.com" OR destinationntdomain CONTAINS "identification-coinbase.com" OR destinationntdomain CONTAINS "lockdown-coinbase.com" OR destinationntdomain CONTAINS "login-nexo.com" OR destinationntdomain CONTAINS "keys-coinbase.com" OR destinationntdomain CONTAINS "messages-coinbase.com" OR destinationntdomain CONTAINS "newpassword-coinbase.com" OR destinationntdomain CONTAINS "prompt-coinbase.com" OR destinationntdomain CONTAINS "protect-apple.com" OR destinationntdomain CONTAINS "protect-coinbase.com" OR destinationntdomain CONTAINS "protect-gmail.com" OR destinationntdomain CONTAINS "protect-kraken.com" OR destinationntdomain CONTAINS "recoverme-coinbase.com" OR destinationntdomain CONTAINS "recoveryportal-coinbase.com" OR destinationntdomain CONTAINS "refunds-coinbase.com" OR destinationntdomain CONTAINS "reset-okta.com" OR destinationntdomain CONTAINS "restore-coinbase.com" OR destinationntdomain CONTAINS "return-coinbase.com" OR destinationntdomain CONTAINS "reverts-coinbase.com" OR destinationntdomain CONTAINS "secure-binance.us" OR destinationntdomain CONTAINS "secure-icloud.com" OR destinationntdomain CONTAINS "secure-nexo.com" OR destinationntdomain CONTAINS "secure-shakepay.com" OR destinationntdomain CONTAINS "security-umusic.com" OR destinationntdomain CONTAINS "server694590423.tech" OR destinationntdomain CONTAINS "session-coinbase.com" OR destinationntdomain CONTAINS "startrecovery-coinbase.com" OR destinationntdomain CONTAINS "signin-kraken.com" OR destinationntdomain CONTAINS "suite-trezor.io" OR destinationntdomain CONTAINS "supportportal-coinbase.com" OR destinationntdomain CONTAINS "tech-icloud.com" OR destinationntdomain CONTAINS "threat-coinbase.com" OR destinationntdomain CONTAINS "ticket-apple.com" OR destinationntdomain CONTAINS "ticket-coinbase.com" OR destinationntdomain CONTAINS "tickets-apple.com" OR destinationntdomain CONTAINS "tokens-coinbase.com" OR destinationntdomain CONTAINS "unblock-coinbase.com" OR destinationntdomain CONTAINS "unlink-coinbase.com" OR destinationntdomain CONTAINS "your-coinbase.com" OR destinationntdomain CONTAINS "welcome-coinbase.com" OR destinationntdomain CONTAINS "www-coinbasewallet.com" OR destinationntdomain CONTAINS "www-help-coinbase.com" OR destinationntdomain CONTAINS "www-help-gemini.com")
index=activity AND rg_functionality="Source Code Repository" AND requesturl NOT NULL AND (requesturl CONTAINS "helpdesk-apple.com" OR requesturl CONTAINS "helpdesk-gemini.com" OR requesturl CONTAINS "helpdesk-icloud.com" OR requesturl CONTAINS "identification-coinbase.com" OR requesturl CONTAINS "lockdown-coinbase.com" OR requesturl CONTAINS "login-nexo.com" OR requesturl CONTAINS "keys-coinbase.com" OR requesturl CONTAINS "messages-coinbase.com" OR requesturl CONTAINS "newpassword-coinbase.com" OR requesturl CONTAINS "prompt-coinbase.com" OR requesturl CONTAINS "protect-apple.com" OR requesturl CONTAINS "protect-coinbase.com" OR requesturl CONTAINS "protect-gmail.com" OR requesturl CONTAINS "protect-kraken.com" OR requesturl CONTAINS "recoverme-coinbase.com" OR requesturl CONTAINS "recoveryportal-coinbase.com" OR requesturl CONTAINS "refunds-coinbase.com" OR requesturl CONTAINS "reset-okta.com" OR requesturl CONTAINS "restore-coinbase.com" OR requesturl CONTAINS "return-coinbase.com" OR requesturl CONTAINS "reverts-coinbase.com" OR requesturl CONTAINS "secure-binance.us" OR requesturl CONTAINS "secure-icloud.com" OR requesturl CONTAINS "secure-nexo.com" OR requesturl CONTAINS "secure-shakepay.com" OR requesturl CONTAINS "security-umusic.com" OR requesturl CONTAINS "server694590423.tech" OR requesturl CONTAINS "session-coinbase.com" OR requesturl CONTAINS "startrecovery-coinbase.com" OR requesturl CONTAINS "signin-kraken.com" OR requesturl CONTAINS "suite-trezor.io" OR requesturl CONTAINS "supportportal-coinbase.com" OR requesturl CONTAINS "tech-icloud.com" OR requesturl CONTAINS "threat-coinbase.com" OR requesturl CONTAINS "ticket-apple.com" OR requesturl CONTAINS "ticket-coinbase.com" OR requesturl CONTAINS "tickets-apple.com" OR requesturl CONTAINS "tokens-coinbase.com" OR requesturl CONTAINS "unblock-coinbase.com" OR requesturl CONTAINS "unlink-coinbase.com" OR requesturl CONTAINS "your-coinbase.com" OR requesturl CONTAINS "welcome-coinbase.com" OR requesturl CONTAINS "www-coinbasewallet.com" OR requesturl CONTAINS "www-help-coinbase.com" OR requesturl CONTAINS "www-help-gemini.com")
index=activity AND rg_functionality="Cloud Email / Email Security" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "official-server.com" OR destinationhostname CONTAINS "server694590423.tech" OR destinationhostname CONTAINS "island-placid-bromine.glitch.me" OR destinationhostname CONTAINS "circular-noon-farmhouse.glitch.me" OR destinationhostname CONTAINS "talented-friendly-price.glitch.me" OR destinationhostname CONTAINS "dflfmgsdokasdcpl.com" OR destinationhostname CONTAINS "original-backend.com" OR destinationhostname CONTAINS "07159889-coinbase.com" OR destinationhostname CONTAINS "10195-coinbase.com" OR destinationhostname CONTAINS "11246-coinbase.com" OR destinationhostname CONTAINS "11247-coinbase.com" OR destinationhostname CONTAINS "11248-coinbase.com" OR destinationhostname CONTAINS "11258-coinbase.com" OR destinationhostname CONTAINS "11259-coinbase.com" OR destinationhostname CONTAINS "113912-coinbase.com" OR destinationhostname CONTAINS "11472-coinbase.com" OR destinationhostname CONTAINS "11923-coinbase.com" OR destinationhostname CONTAINS "11957-coinbase.com" OR destinationhostname CONTAINS "128147-coinbase.com" OR destinationhostname CONTAINS "12958-coinbase.com" OR destinationhostname CONTAINS "12984-okta.com" OR destinationhostname CONTAINS "12985-coinbase.com" OR destinationhostname CONTAINS "13130-coinbase.com" OR destinationhostname CONTAINS "13247-coinbase.com" OR destinationhostname CONTAINS "13247-icloud.com" OR destinationhostname CONTAINS "13267-coinbase.com" OR destinationhostname CONTAINS "146271510-coinbase.com" OR destinationhostname CONTAINS "146282-coinbase.com" OR destinationhostname CONTAINS "146284-coinbase.com" OR destinationhostname CONTAINS "147260-coinbase.com" OR destinationhostname CONTAINS "14765-coinbase.com" OR destinationhostname CONTAINS "14817582-coinbase.com" OR destinationhostname CONTAINS "14871904-coinbase.com" OR destinationhostname CONTAINS "14891902-coinbase.com" OR destinationhostname CONTAINS "1492864-coinbase.com" OR destinationhostname CONTAINS "158312-coinbase.com" OR destinationhostname CONTAINS "158372-coinbase.com" OR destinationhostname CONTAINS "158702-coinbase.com" OR destinationhostname CONTAINS "16171675-coinbase.com" OR destinationhostname CONTAINS "16171832-coinbase.com" OR destinationhostname CONTAINS "16178234-coinbase.com" OR destinationhostname CONTAINS "16178237-coinbase.com" OR destinationhostname CONTAINS "16178434-coinbase.com" OR destinationhostname CONTAINS "162178-coinbase.com" OR destinationhostname CONTAINS "162478-coinbase.com" OR destinationhostname CONTAINS "162782-coinbase.com" OR destinationhostname CONTAINS "162812-coinbase.com" OR destinationhostname CONTAINS "162814-coinbase.com" OR destinationhostname CONTAINS "16442580-coinbase.com" OR destinationhostname CONTAINS "16450107-coinbase.com")
index=activity AND rg_functionality="Cloud Email / Email Security" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "official-server.com" OR sourcentdomain CONTAINS "server694590423.tech" OR sourcentdomain CONTAINS "island-placid-bromine.glitch.me" OR sourcentdomain CONTAINS "circular-noon-farmhouse.glitch.me" OR sourcentdomain CONTAINS "talented-friendly-price.glitch.me" OR sourcentdomain CONTAINS "dflfmgsdokasdcpl.com" OR sourcentdomain CONTAINS "original-backend.com" OR sourcentdomain CONTAINS "07159889-coinbase.com" OR sourcentdomain CONTAINS "10195-coinbase.com" OR sourcentdomain CONTAINS "11246-coinbase.com" OR sourcentdomain CONTAINS "11247-coinbase.com" OR sourcentdomain CONTAINS "11248-coinbase.com" OR sourcentdomain CONTAINS "11258-coinbase.com" OR sourcentdomain CONTAINS "11259-coinbase.com" OR sourcentdomain CONTAINS "113912-coinbase.com" OR sourcentdomain CONTAINS "11472-coinbase.com" OR sourcentdomain CONTAINS "11923-coinbase.com" OR sourcentdomain CONTAINS "11957-coinbase.com" OR sourcentdomain CONTAINS "128147-coinbase.com" OR sourcentdomain CONTAINS "12958-coinbase.com" OR sourcentdomain CONTAINS "12984-okta.com" OR sourcentdomain CONTAINS "12985-coinbase.com" OR sourcentdomain CONTAINS "13130-coinbase.com" OR sourcentdomain CONTAINS "13247-coinbase.com" OR sourcentdomain CONTAINS "13247-icloud.com" OR sourcentdomain CONTAINS "13267-coinbase.com" OR sourcentdomain CONTAINS "146271510-coinbase.com" OR sourcentdomain CONTAINS "146282-coinbase.com" OR sourcentdomain CONTAINS "146284-coinbase.com" OR sourcentdomain CONTAINS "147260-coinbase.com" OR sourcentdomain CONTAINS "14765-coinbase.com" OR sourcentdomain CONTAINS "14817582-coinbase.com" OR sourcentdomain CONTAINS "14871904-coinbase.com" OR sourcentdomain CONTAINS "14891902-coinbase.com" OR sourcentdomain CONTAINS "1492864-coinbase.com" OR sourcentdomain CONTAINS "158312-coinbase.com" OR sourcentdomain CONTAINS "158372-coinbase.com" OR sourcentdomain CONTAINS "158702-coinbase.com" OR sourcentdomain CONTAINS "16171675-coinbase.com" OR sourcentdomain CONTAINS "16171832-coinbase.com" OR sourcentdomain CONTAINS "16178234-coinbase.com" OR sourcentdomain CONTAINS "16178237-coinbase.com" OR sourcentdomain CONTAINS "16178434-coinbase.com" OR sourcentdomain CONTAINS "162178-coinbase.com" OR sourcentdomain CONTAINS "162478-coinbase.com" OR sourcentdomain CONTAINS "162782-coinbase.com" OR sourcentdomain CONTAINS "162812-coinbase.com" OR sourcentdomain CONTAINS "162814-coinbase.com" OR sourcentdomain CONTAINS "16442580-coinbase.com" OR sourcentdomain CONTAINS "16450107-coinbase.com")
index=activity AND rg_functionality="Cloud Email / Email Security" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "official-server.com" OR sourcehostname CONTAINS "server694590423.tech" OR sourcehostname CONTAINS "island-placid-bromine.glitch.me" OR sourcehostname CONTAINS "circular-noon-farmhouse.glitch.me" OR sourcehostname CONTAINS "talented-friendly-price.glitch.me" OR sourcehostname CONTAINS "dflfmgsdokasdcpl.com" OR sourcehostname CONTAINS "original-backend.com" OR sourcehostname CONTAINS "07159889-coinbase.com" OR sourcehostname CONTAINS "10195-coinbase.com" OR sourcehostname CONTAINS "11246-coinbase.com" OR sourcehostname CONTAINS "11247-coinbase.com" OR sourcehostname CONTAINS "11248-coinbase.com" OR sourcehostname CONTAINS "11258-coinbase.com" OR sourcehostname CONTAINS "11259-coinbase.com" OR sourcehostname CONTAINS "113912-coinbase.com" OR sourcehostname CONTAINS "11472-coinbase.com" OR sourcehostname CONTAINS "11923-coinbase.com" OR sourcehostname CONTAINS "11957-coinbase.com" OR sourcehostname CONTAINS "128147-coinbase.com" OR sourcehostname CONTAINS "12958-coinbase.com" OR sourcehostname CONTAINS "12984-okta.com" OR sourcehostname CONTAINS "12985-coinbase.com" OR sourcehostname CONTAINS "13130-coinbase.com" OR sourcehostname CONTAINS "13247-coinbase.com" OR sourcehostname CONTAINS "13247-icloud.com" OR sourcehostname CONTAINS "13267-coinbase.com" OR sourcehostname CONTAINS "146271510-coinbase.com" OR sourcehostname CONTAINS "146282-coinbase.com" OR sourcehostname CONTAINS "146284-coinbase.com" OR sourcehostname CONTAINS "147260-coinbase.com" OR sourcehostname CONTAINS "14765-coinbase.com" OR sourcehostname CONTAINS "14817582-coinbase.com" OR sourcehostname CONTAINS "14871904-coinbase.com" OR sourcehostname CONTAINS "14891902-coinbase.com" OR sourcehostname CONTAINS "1492864-coinbase.com" OR sourcehostname CONTAINS "158312-coinbase.com" OR sourcehostname CONTAINS "158372-coinbase.com" OR sourcehostname CONTAINS "158702-coinbase.com" OR sourcehostname CONTAINS "16171675-coinbase.com" OR sourcehostname CONTAINS "16171832-coinbase.com" OR sourcehostname CONTAINS "16178234-coinbase.com" OR sourcehostname CONTAINS "16178237-coinbase.com" OR sourcehostname CONTAINS "16178434-coinbase.com" OR sourcehostname CONTAINS "162178-coinbase.com" OR sourcehostname CONTAINS "162478-coinbase.com" OR sourcehostname CONTAINS "162782-coinbase.com" OR sourcehostname CONTAINS "162812-coinbase.com" OR sourcehostname CONTAINS "162814-coinbase.com" OR sourcehostname CONTAINS "16442580-coinbase.com" OR sourcehostname CONTAINS "16450107-coinbase.com")
index=activity AND rg_functionality="Cloud Email / Email Security" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "official-server.com" OR destinationntdomain CONTAINS "server694590423.tech" OR destinationntdomain CONTAINS "island-placid-bromine.glitch.me" OR destinationntdomain CONTAINS "circular-noon-farmhouse.glitch.me" OR destinationntdomain CONTAINS "talented-friendly-price.glitch.me" OR destinationntdomain CONTAINS "dflfmgsdokasdcpl.com" OR destinationntdomain CONTAINS "original-backend.com" OR destinationntdomain CONTAINS "07159889-coinbase.com" OR destinationntdomain CONTAINS "10195-coinbase.com" OR destinationntdomain CONTAINS "11246-coinbase.com" OR destinationntdomain CONTAINS "11247-coinbase.com" OR destinationntdomain CONTAINS "11248-coinbase.com" OR destinationntdomain CONTAINS "11258-coinbase.com" OR destinationntdomain CONTAINS "11259-coinbase.com" OR destinationntdomain CONTAINS "113912-coinbase.com" OR destinationntdomain CONTAINS "11472-coinbase.com" OR destinationntdomain CONTAINS "11923-coinbase.com" OR destinationntdomain CONTAINS "11957-coinbase.com" OR destinationntdomain CONTAINS "128147-coinbase.com" OR destinationntdomain CONTAINS "12958-coinbase.com" OR destinationntdomain CONTAINS "12984-okta.com" OR destinationntdomain CONTAINS "12985-coinbase.com" OR destinationntdomain CONTAINS "13130-coinbase.com" OR destinationntdomain CONTAINS "13247-coinbase.com" OR destinationntdomain CONTAINS "13247-icloud.com" OR destinationntdomain CONTAINS "13267-coinbase.com" OR destinationntdomain CONTAINS "146271510-coinbase.com" OR destinationntdomain CONTAINS "146282-coinbase.com" OR destinationntdomain CONTAINS "146284-coinbase.com" OR destinationntdomain CONTAINS "147260-coinbase.com" OR destinationntdomain CONTAINS "14765-coinbase.com" OR destinationntdomain CONTAINS "14817582-coinbase.com" OR destinationntdomain CONTAINS "14871904-coinbase.com" OR destinationntdomain CONTAINS "14891902-coinbase.com" OR destinationntdomain CONTAINS "1492864-coinbase.com" OR destinationntdomain CONTAINS "158312-coinbase.com" OR destinationntdomain CONTAINS "158372-coinbase.com" OR destinationntdomain CONTAINS "158702-coinbase.com" OR destinationntdomain CONTAINS "16171675-coinbase.com" OR destinationntdomain CONTAINS "16171832-coinbase.com" OR destinationntdomain CONTAINS "16178234-coinbase.com" OR destinationntdomain CONTAINS "16178237-coinbase.com" OR destinationntdomain CONTAINS "16178434-coinbase.com" OR destinationntdomain CONTAINS "162178-coinbase.com" OR destinationntdomain CONTAINS "162478-coinbase.com" OR destinationntdomain CONTAINS "162782-coinbase.com" OR destinationntdomain CONTAINS "162812-coinbase.com" OR destinationntdomain CONTAINS "162814-coinbase.com" OR destinationntdomain CONTAINS "16442580-coinbase.com" OR destinationntdomain CONTAINS "16450107-coinbase.com")
index=activity AND rg_functionality="Cloud Email / Email Security" AND requesturl NOT NULL AND (requesturl CONTAINS "official-server.com" OR requesturl CONTAINS "server694590423.tech" OR requesturl CONTAINS "island-placid-bromine.glitch.me" OR requesturl CONTAINS "circular-noon-farmhouse.glitch.me" OR requesturl CONTAINS "talented-friendly-price.glitch.me" OR requesturl CONTAINS "dflfmgsdokasdcpl.com" OR requesturl CONTAINS "original-backend.com" OR requesturl CONTAINS "07159889-coinbase.com" OR requesturl CONTAINS "10195-coinbase.com" OR requesturl CONTAINS "11246-coinbase.com" OR requesturl CONTAINS "11247-coinbase.com" OR requesturl CONTAINS "11248-coinbase.com" OR requesturl CONTAINS "11258-coinbase.com" OR requesturl CONTAINS "11259-coinbase.com" OR requesturl CONTAINS "113912-coinbase.com" OR requesturl CONTAINS "11472-coinbase.com" OR requesturl CONTAINS "11923-coinbase.com" OR requesturl CONTAINS "11957-coinbase.com" OR requesturl CONTAINS "128147-coinbase.com" OR requesturl CONTAINS "12958-coinbase.com" OR requesturl CONTAINS "12984-okta.com" OR requesturl CONTAINS "12985-coinbase.com" OR requesturl CONTAINS "13130-coinbase.com" OR requesturl CONTAINS "13247-coinbase.com" OR requesturl CONTAINS "13247-icloud.com" OR requesturl CONTAINS "13267-coinbase.com" OR requesturl CONTAINS "146271510-coinbase.com" OR requesturl CONTAINS "146282-coinbase.com" OR requesturl CONTAINS "146284-coinbase.com" OR requesturl CONTAINS "147260-coinbase.com" OR requesturl CONTAINS "14765-coinbase.com" OR requesturl CONTAINS "14817582-coinbase.com" OR requesturl CONTAINS "14871904-coinbase.com" OR requesturl CONTAINS "14891902-coinbase.com" OR requesturl CONTAINS "1492864-coinbase.com" OR requesturl CONTAINS "158312-coinbase.com" OR requesturl CONTAINS "158372-coinbase.com" OR requesturl CONTAINS "158702-coinbase.com" OR requesturl CONTAINS "16171675-coinbase.com" OR requesturl CONTAINS "16171832-coinbase.com" OR requesturl CONTAINS "16178234-coinbase.com" OR requesturl CONTAINS "16178237-coinbase.com" OR requesturl CONTAINS "16178434-coinbase.com" OR requesturl CONTAINS "162178-coinbase.com" OR requesturl CONTAINS "162478-coinbase.com" OR requesturl CONTAINS "162782-coinbase.com" OR requesturl CONTAINS "162812-coinbase.com" OR requesturl CONTAINS "162814-coinbase.com" OR requesturl CONTAINS "16442580-coinbase.com" OR requesturl CONTAINS "16450107-coinbase.com")
index=activity AND rg_functionality="Cloud Email / Email Security" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "16450207-coinbase.com" OR destinationhostname CONTAINS "16458207-coinbase.com" OR destinationhostname CONTAINS "16478202-coinbase.com" OR destinationhostname CONTAINS "164872942-coinbase.com" OR destinationhostname CONTAINS "16590-coinbase.com" OR destinationhostname CONTAINS "16594373-coinbase.com" OR destinationhostname CONTAINS "16624831-coinbase.com" OR destinationhostname CONTAINS "16642124-coinbase.com" OR destinationhostname CONTAINS "16642172-coinbase.com" OR destinationhostname CONTAINS "16642580-coinbase.com" OR destinationhostname CONTAINS "16642721-coinbase.com" OR destinationhostname CONTAINS "16642724-coinbase.com" OR destinationhostname CONTAINS "16642871-coinbase.com" OR destinationhostname CONTAINS "16642872-coinbase.com" OR destinationhostname CONTAINS "16712942-coinbase.com" OR destinationhostname CONTAINS "16718672-coinbase.com" OR destinationhostname CONTAINS "16728342-coinbase.com" OR destinationhostname CONTAINS "16728348-coinbase.com" OR destinationhostname CONTAINS "16728442-coinbase.com" OR destinationhostname CONTAINS "16728472-coinbase.com" OR destinationhostname CONTAINS "167285-coinbase.com" OR destinationhostname CONTAINS "16729042-coinbase.com" OR destinationhostname CONTAINS "16748272-coinbase.com" OR destinationhostname CONTAINS "16782942-coinbase.com" OR destinationhostname CONTAINS "16827420-coinbase.com" OR destinationhostname CONTAINS "16827423-coinbase.com" OR destinationhostname CONTAINS "16847145-coinbase.com" OR destinationhostname CONTAINS "16893924-coinbase.com" OR destinationhostname CONTAINS "17182-coinbase.com" OR destinationhostname CONTAINS "17255030-coinbase.com" OR destinationhostname CONTAINS "17259-kraken.com" OR destinationhostname CONTAINS "172486-coinbase.com" OR destinationhostname CONTAINS "17284652-coinbase.com" OR destinationhostname CONTAINS "17286-coinbase.com" OR destinationhostname CONTAINS "17334522-coinbase.com" OR destinationhostname CONTAINS "17334522-kraken.com" OR destinationhostname CONTAINS "17384522-coinbase.com" OR destinationhostname CONTAINS "173912-coinbase.com" OR destinationhostname CONTAINS "17494976-coinbase.com" OR destinationhostname CONTAINS "17512854-coinbase.com" OR destinationhostname CONTAINS "17512857-coinbase.com" OR destinationhostname CONTAINS "1751954-coinbase.com" OR destinationhostname CONTAINS "17525030-coinbase.com" OR destinationhostname CONTAINS "17529580-coinbase.com" OR destinationhostname CONTAINS "17614-coinbase.com" OR destinationhostname CONTAINS "17618412-coinbase.com" OR destinationhostname CONTAINS "17619-coinbase.com" OR destinationhostname CONTAINS "176284-coinbase.com" OR destinationhostname CONTAINS "17823920-coinbase.com" OR destinationhostname CONTAINS "178253-coinbase.com")
index=activity AND rg_functionality="Cloud Email / Email Security" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "16450207-coinbase.com" OR sourcentdomain CONTAINS "16458207-coinbase.com" OR sourcentdomain CONTAINS "16478202-coinbase.com" OR sourcentdomain CONTAINS "164872942-coinbase.com" OR sourcentdomain CONTAINS "16590-coinbase.com" OR sourcentdomain CONTAINS "16594373-coinbase.com" OR sourcentdomain CONTAINS "16624831-coinbase.com" OR sourcentdomain CONTAINS "16642124-coinbase.com" OR sourcentdomain CONTAINS "16642172-coinbase.com" OR sourcentdomain CONTAINS "16642580-coinbase.com" OR sourcentdomain CONTAINS "16642721-coinbase.com" OR sourcentdomain CONTAINS "16642724-coinbase.com" OR sourcentdomain CONTAINS "16642871-coinbase.com" OR sourcentdomain CONTAINS "16642872-coinbase.com" OR sourcentdomain CONTAINS "16712942-coinbase.com" OR sourcentdomain CONTAINS "16718672-coinbase.com" OR sourcentdomain CONTAINS "16728342-coinbase.com" OR sourcentdomain CONTAINS "16728348-coinbase.com" OR sourcentdomain CONTAINS "16728442-coinbase.com" OR sourcentdomain CONTAINS "16728472-coinbase.com" OR sourcentdomain CONTAINS "167285-coinbase.com" OR sourcentdomain CONTAINS "16729042-coinbase.com" OR sourcentdomain CONTAINS "16748272-coinbase.com" OR sourcentdomain CONTAINS "16782942-coinbase.com" OR sourcentdomain CONTAINS "16827420-coinbase.com" OR sourcentdomain CONTAINS "16827423-coinbase.com" OR sourcentdomain CONTAINS "16847145-coinbase.com" OR sourcentdomain CONTAINS "16893924-coinbase.com" OR sourcentdomain CONTAINS "17182-coinbase.com" OR sourcentdomain CONTAINS "17255030-coinbase.com" OR sourcentdomain CONTAINS "17259-kraken.com" OR sourcentdomain CONTAINS "172486-coinbase.com" OR sourcentdomain CONTAINS "17284652-coinbase.com" OR sourcentdomain CONTAINS "17286-coinbase.com" OR sourcentdomain CONTAINS "17334522-coinbase.com" OR sourcentdomain CONTAINS "17334522-kraken.com" OR sourcentdomain CONTAINS "17384522-coinbase.com" OR sourcentdomain CONTAINS "173912-coinbase.com" OR sourcentdomain CONTAINS "17494976-coinbase.com" OR sourcentdomain CONTAINS "17512854-coinbase.com" OR sourcentdomain CONTAINS "17512857-coinbase.com" OR sourcentdomain CONTAINS "1751954-coinbase.com" OR sourcentdomain CONTAINS "17525030-coinbase.com" OR sourcentdomain CONTAINS "17529580-coinbase.com" OR sourcentdomain CONTAINS "17614-coinbase.com" OR sourcentdomain CONTAINS "17618412-coinbase.com" OR sourcentdomain CONTAINS "17619-coinbase.com" OR sourcentdomain CONTAINS "176284-coinbase.com" OR sourcentdomain CONTAINS "17823920-coinbase.com" OR sourcentdomain CONTAINS "178253-coinbase.com")
index=activity AND rg_functionality="Cloud Email / Email Security" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "16450207-coinbase.com" OR sourcehostname CONTAINS "16458207-coinbase.com" OR sourcehostname CONTAINS "16478202-coinbase.com" OR sourcehostname CONTAINS "164872942-coinbase.com" OR sourcehostname CONTAINS "16590-coinbase.com" OR sourcehostname CONTAINS "16594373-coinbase.com" OR sourcehostname CONTAINS "16624831-coinbase.com" OR sourcehostname CONTAINS "16642124-coinbase.com" OR sourcehostname CONTAINS "16642172-coinbase.com" OR sourcehostname CONTAINS "16642580-coinbase.com" OR sourcehostname CONTAINS "16642721-coinbase.com" OR sourcehostname CONTAINS "16642724-coinbase.com" OR sourcehostname CONTAINS "16642871-coinbase.com" OR sourcehostname CONTAINS "16642872-coinbase.com" OR sourcehostname CONTAINS "16712942-coinbase.com" OR sourcehostname CONTAINS "16718672-coinbase.com" OR sourcehostname CONTAINS "16728342-coinbase.com" OR sourcehostname CONTAINS "16728348-coinbase.com" OR sourcehostname CONTAINS "16728442-coinbase.com" OR sourcehostname CONTAINS "16728472-coinbase.com" OR sourcehostname CONTAINS "167285-coinbase.com" OR sourcehostname CONTAINS "16729042-coinbase.com" OR sourcehostname CONTAINS "16748272-coinbase.com" OR sourcehostname CONTAINS "16782942-coinbase.com" OR sourcehostname CONTAINS "16827420-coinbase.com" OR sourcehostname CONTAINS "16827423-coinbase.com" OR sourcehostname CONTAINS "16847145-coinbase.com" OR sourcehostname CONTAINS "16893924-coinbase.com" OR sourcehostname CONTAINS "17182-coinbase.com" OR sourcehostname CONTAINS "17255030-coinbase.com" OR sourcehostname CONTAINS "17259-kraken.com" OR sourcehostname CONTAINS "172486-coinbase.com" OR sourcehostname CONTAINS "17284652-coinbase.com" OR sourcehostname CONTAINS "17286-coinbase.com" OR sourcehostname CONTAINS "17334522-coinbase.com" OR sourcehostname CONTAINS "17334522-kraken.com" OR sourcehostname CONTAINS "17384522-coinbase.com" OR sourcehostname CONTAINS "173912-coinbase.com" OR sourcehostname CONTAINS "17494976-coinbase.com" OR sourcehostname CONTAINS "17512854-coinbase.com" OR sourcehostname CONTAINS "17512857-coinbase.com" OR sourcehostname CONTAINS "1751954-coinbase.com" OR sourcehostname CONTAINS "17525030-coinbase.com" OR sourcehostname CONTAINS "17529580-coinbase.com" OR sourcehostname CONTAINS "17614-coinbase.com" OR sourcehostname CONTAINS "17618412-coinbase.com" OR sourcehostname CONTAINS "17619-coinbase.com" OR sourcehostname CONTAINS "176284-coinbase.com" OR sourcehostname CONTAINS "17823920-coinbase.com" OR sourcehostname CONTAINS "178253-coinbase.com")
index=activity AND rg_functionality="Cloud Email / Email Security" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "16450207-coinbase.com" OR destinationntdomain CONTAINS "16458207-coinbase.com" OR destinationntdomain CONTAINS "16478202-coinbase.com" OR destinationntdomain CONTAINS "164872942-coinbase.com" OR destinationntdomain CONTAINS "16590-coinbase.com" OR destinationntdomain CONTAINS "16594373-coinbase.com" OR destinationntdomain CONTAINS "16624831-coinbase.com" OR destinationntdomain CONTAINS "16642124-coinbase.com" OR destinationntdomain CONTAINS "16642172-coinbase.com" OR destinationntdomain CONTAINS "16642580-coinbase.com" OR destinationntdomain CONTAINS "16642721-coinbase.com" OR destinationntdomain CONTAINS "16642724-coinbase.com" OR destinationntdomain CONTAINS "16642871-coinbase.com" OR destinationntdomain CONTAINS "16642872-coinbase.com" OR destinationntdomain CONTAINS "16712942-coinbase.com" OR destinationntdomain CONTAINS "16718672-coinbase.com" OR destinationntdomain CONTAINS "16728342-coinbase.com" OR destinationntdomain CONTAINS "16728348-coinbase.com" OR destinationntdomain CONTAINS "16728442-coinbase.com" OR destinationntdomain CONTAINS "16728472-coinbase.com" OR destinationntdomain CONTAINS "167285-coinbase.com" OR destinationntdomain CONTAINS "16729042-coinbase.com" OR destinationntdomain CONTAINS "16748272-coinbase.com" OR destinationntdomain CONTAINS "16782942-coinbase.com" OR destinationntdomain CONTAINS "16827420-coinbase.com" OR destinationntdomain CONTAINS "16827423-coinbase.com" OR destinationntdomain CONTAINS "16847145-coinbase.com" OR destinationntdomain CONTAINS "16893924-coinbase.com" OR destinationntdomain CONTAINS "17182-coinbase.com" OR destinationntdomain CONTAINS "17255030-coinbase.com" OR destinationntdomain CONTAINS "17259-kraken.com" OR destinationntdomain CONTAINS "172486-coinbase.com" OR destinationntdomain CONTAINS "17284652-coinbase.com" OR destinationntdomain CONTAINS "17286-coinbase.com" OR destinationntdomain CONTAINS "17334522-coinbase.com" OR destinationntdomain CONTAINS "17334522-kraken.com" OR destinationntdomain CONTAINS "17384522-coinbase.com" OR destinationntdomain CONTAINS "173912-coinbase.com" OR destinationntdomain CONTAINS "17494976-coinbase.com" OR destinationntdomain CONTAINS "17512854-coinbase.com" OR destinationntdomain CONTAINS "17512857-coinbase.com" OR destinationntdomain CONTAINS "1751954-coinbase.com" OR destinationntdomain CONTAINS "17525030-coinbase.com" OR destinationntdomain CONTAINS "17529580-coinbase.com" OR destinationntdomain CONTAINS "17614-coinbase.com" OR destinationntdomain CONTAINS "17618412-coinbase.com" OR destinationntdomain CONTAINS "17619-coinbase.com" OR destinationntdomain CONTAINS "176284-coinbase.com" OR destinationntdomain CONTAINS "17823920-coinbase.com" OR destinationntdomain CONTAINS "178253-coinbase.com")
index=activity AND rg_functionality="Cloud Email / Email Security" AND requesturl NOT NULL AND (requesturl CONTAINS "16450207-coinbase.com" OR requesturl CONTAINS "16458207-coinbase.com" OR requesturl CONTAINS "16478202-coinbase.com" OR requesturl CONTAINS "164872942-coinbase.com" OR requesturl CONTAINS "16590-coinbase.com" OR requesturl CONTAINS "16594373-coinbase.com" OR requesturl CONTAINS "16624831-coinbase.com" OR requesturl CONTAINS "16642124-coinbase.com" OR requesturl CONTAINS "16642172-coinbase.com" OR requesturl CONTAINS "16642580-coinbase.com" OR requesturl CONTAINS "16642721-coinbase.com" OR requesturl CONTAINS "16642724-coinbase.com" OR requesturl CONTAINS "16642871-coinbase.com" OR requesturl CONTAINS "16642872-coinbase.com" OR requesturl CONTAINS "16712942-coinbase.com" OR requesturl CONTAINS "16718672-coinbase.com" OR requesturl CONTAINS "16728342-coinbase.com" OR requesturl CONTAINS "16728348-coinbase.com" OR requesturl CONTAINS "16728442-coinbase.com" OR requesturl CONTAINS "16728472-coinbase.com" OR requesturl CONTAINS "167285-coinbase.com" OR requesturl CONTAINS "16729042-coinbase.com" OR requesturl CONTAINS "16748272-coinbase.com" OR requesturl CONTAINS "16782942-coinbase.com" OR requesturl CONTAINS "16827420-coinbase.com" OR requesturl CONTAINS "16827423-coinbase.com" OR requesturl CONTAINS "16847145-coinbase.com" OR requesturl CONTAINS "16893924-coinbase.com" OR requesturl CONTAINS "17182-coinbase.com" OR requesturl CONTAINS "17255030-coinbase.com" OR requesturl CONTAINS "17259-kraken.com" OR requesturl CONTAINS "172486-coinbase.com" OR requesturl CONTAINS "17284652-coinbase.com" OR requesturl CONTAINS "17286-coinbase.com" OR requesturl CONTAINS "17334522-coinbase.com" OR requesturl CONTAINS "17334522-kraken.com" OR requesturl CONTAINS "17384522-coinbase.com" OR requesturl CONTAINS "173912-coinbase.com" OR requesturl CONTAINS "17494976-coinbase.com" OR requesturl CONTAINS "17512854-coinbase.com" OR requesturl CONTAINS "17512857-coinbase.com" OR requesturl CONTAINS "1751954-coinbase.com" OR requesturl CONTAINS "17525030-coinbase.com" OR requesturl CONTAINS "17529580-coinbase.com" OR requesturl CONTAINS "17614-coinbase.com" OR requesturl CONTAINS "17618412-coinbase.com" OR requesturl CONTAINS "17619-coinbase.com" OR requesturl CONTAINS "176284-coinbase.com" OR requesturl CONTAINS "17823920-coinbase.com" OR requesturl CONTAINS "178253-coinbase.com")
index=activity AND rg_functionality="Cloud Email / Email Security" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "178294-coinbase.com" OR destinationhostname CONTAINS "17912-coinbase.com" OR destinationhostname CONTAINS "17914-coinbase.com" OR destinationhostname CONTAINS "17917-coinbase.com" OR destinationhostname CONTAINS "17954-coinbase.com" OR destinationhostname CONTAINS "17958-coinbase.com" OR destinationhostname CONTAINS "182043-coinbase.com" OR destinationhostname CONTAINS "18275-gemini.com" OR destinationhostname CONTAINS "18276-coinbase.com" OR destinationhostname CONTAINS "18290185-coinbase.com" OR destinationhostname CONTAINS "182967-coinbase.com" OR destinationhostname CONTAINS "18560-coinbase.com" OR destinationhostname CONTAINS "18571-coinbase.com" OR destinationhostname CONTAINS "185912-coinbase.com" OR destinationhostname CONTAINS "185914-coinbase.com" OR destinationhostname CONTAINS "18592176-coinbase.com" OR destinationhostname CONTAINS "18594162-coinbase.com" OR destinationhostname CONTAINS "18594962-coinbase.com" OR destinationhostname CONTAINS "18597162-coinbase.com" OR destinationhostname CONTAINS "18719562-coinbase.com" OR destinationhostname CONTAINS "1875290-coinbase.com" OR destinationhostname CONTAINS "1882730-coinbase.com" OR destinationhostname CONTAINS "18902-coinbase.com" OR destinationhostname CONTAINS "18903-coinbase.com" OR destinationhostname CONTAINS "189126-coinbase.com" OR destinationhostname CONTAINS "18952-coinbase.com" OR destinationhostname CONTAINS "192854-coinbase.com" OR destinationhostname CONTAINS "192856-coinbase.com" OR destinationhostname CONTAINS "19287-binance.com" OR destinationhostname CONTAINS "19572-coinbase.com" OR destinationhostname CONTAINS "195812-coinbase.com" OR destinationhostname CONTAINS "195826-coinbase.com" OR destinationhostname CONTAINS "1958262-coinbase.com" OR destinationhostname CONTAINS "195827-binance.com" OR destinationhostname CONTAINS "1958297-coinbase.com" OR destinationhostname CONTAINS "19582970-coinbase.com" OR destinationhostname CONTAINS "19582971-coinbase.com" OR destinationhostname CONTAINS "19583-coinbase.com" OR destinationhostname CONTAINS "19592653-coinbase.com" OR destinationhostname CONTAINS "197304-coinbase.com" OR destinationhostname CONTAINS "19730492-coinbase.com" OR destinationhostname CONTAINS "19764162-coinbase.com" OR destinationhostname CONTAINS "19803-coinbase.com" OR destinationhostname CONTAINS "201784289-coinbase.com" OR destinationhostname CONTAINS "210823644-coinbase.com" OR destinationhostname CONTAINS "21158-coinbase.com" OR destinationhostname CONTAINS "21509-coinbase.com" OR destinationhostname CONTAINS "25985-coinbase.com" OR destinationhostname CONTAINS "27699-coinbase.com" OR destinationhostname CONTAINS "28367-coinbase.com")
index=activity AND rg_functionality="Cloud Email / Email Security" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "178294-coinbase.com" OR sourcentdomain CONTAINS "17912-coinbase.com" OR sourcentdomain CONTAINS "17914-coinbase.com" OR sourcentdomain CONTAINS "17917-coinbase.com" OR sourcentdomain CONTAINS "17954-coinbase.com" OR sourcentdomain CONTAINS "17958-coinbase.com" OR sourcentdomain CONTAINS "182043-coinbase.com" OR sourcentdomain CONTAINS "18275-gemini.com" OR sourcentdomain CONTAINS "18276-coinbase.com" OR sourcentdomain CONTAINS "18290185-coinbase.com" OR sourcentdomain CONTAINS "182967-coinbase.com" OR sourcentdomain CONTAINS "18560-coinbase.com" OR sourcentdomain CONTAINS "18571-coinbase.com" OR sourcentdomain CONTAINS "185912-coinbase.com" OR sourcentdomain CONTAINS "185914-coinbase.com" OR sourcentdomain CONTAINS "18592176-coinbase.com" OR sourcentdomain CONTAINS "18594162-coinbase.com" OR sourcentdomain CONTAINS "18594962-coinbase.com" OR sourcentdomain CONTAINS "18597162-coinbase.com" OR sourcentdomain CONTAINS "18719562-coinbase.com" OR sourcentdomain CONTAINS "1875290-coinbase.com" OR sourcentdomain CONTAINS "1882730-coinbase.com" OR sourcentdomain CONTAINS "18902-coinbase.com" OR sourcentdomain CONTAINS "18903-coinbase.com" OR sourcentdomain CONTAINS "189126-coinbase.com" OR sourcentdomain CONTAINS "18952-coinbase.com" OR sourcentdomain CONTAINS "192854-coinbase.com" OR sourcentdomain CONTAINS "192856-coinbase.com" OR sourcentdomain CONTAINS "19287-binance.com" OR sourcentdomain CONTAINS "19572-coinbase.com" OR sourcentdomain CONTAINS "195812-coinbase.com" OR sourcentdomain CONTAINS "195826-coinbase.com" OR sourcentdomain CONTAINS "1958262-coinbase.com" OR sourcentdomain CONTAINS "195827-binance.com" OR sourcentdomain CONTAINS "1958297-coinbase.com" OR sourcentdomain CONTAINS "19582970-coinbase.com" OR sourcentdomain CONTAINS "19582971-coinbase.com" OR sourcentdomain CONTAINS "19583-coinbase.com" OR sourcentdomain CONTAINS "19592653-coinbase.com" OR sourcentdomain CONTAINS "197304-coinbase.com" OR sourcentdomain CONTAINS "19730492-coinbase.com" OR sourcentdomain CONTAINS "19764162-coinbase.com" OR sourcentdomain CONTAINS "19803-coinbase.com" OR sourcentdomain CONTAINS "201784289-coinbase.com" OR sourcentdomain CONTAINS "210823644-coinbase.com" OR sourcentdomain CONTAINS "21158-coinbase.com" OR sourcentdomain CONTAINS "21509-coinbase.com" OR sourcentdomain CONTAINS "25985-coinbase.com" OR sourcentdomain CONTAINS "27699-coinbase.com" OR sourcentdomain CONTAINS "28367-coinbase.com")
index=activity AND rg_functionality="Cloud Email / Email Security" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "178294-coinbase.com" OR sourcehostname CONTAINS "17912-coinbase.com" OR sourcehostname CONTAINS "17914-coinbase.com" OR sourcehostname CONTAINS "17917-coinbase.com" OR sourcehostname CONTAINS "17954-coinbase.com" OR sourcehostname CONTAINS "17958-coinbase.com" OR sourcehostname CONTAINS "182043-coinbase.com" OR sourcehostname CONTAINS "18275-gemini.com" OR sourcehostname CONTAINS "18276-coinbase.com" OR sourcehostname CONTAINS "18290185-coinbase.com" OR sourcehostname CONTAINS "182967-coinbase.com" OR sourcehostname CONTAINS "18560-coinbase.com" OR sourcehostname CONTAINS "18571-coinbase.com" OR sourcehostname CONTAINS "185912-coinbase.com" OR sourcehostname CONTAINS "185914-coinbase.com" OR sourcehostname CONTAINS "18592176-coinbase.com" OR sourcehostname CONTAINS "18594162-coinbase.com" OR sourcehostname CONTAINS "18594962-coinbase.com" OR sourcehostname CONTAINS "18597162-coinbase.com" OR sourcehostname CONTAINS "18719562-coinbase.com" OR sourcehostname CONTAINS "1875290-coinbase.com" OR sourcehostname CONTAINS "1882730-coinbase.com" OR sourcehostname CONTAINS "18902-coinbase.com" OR sourcehostname CONTAINS "18903-coinbase.com" OR sourcehostname CONTAINS "189126-coinbase.com" OR sourcehostname CONTAINS "18952-coinbase.com" OR sourcehostname CONTAINS "192854-coinbase.com" OR sourcehostname CONTAINS "192856-coinbase.com" OR sourcehostname CONTAINS "19287-binance.com" OR sourcehostname CONTAINS "19572-coinbase.com" OR sourcehostname CONTAINS "195812-coinbase.com" OR sourcehostname CONTAINS "195826-coinbase.com" OR sourcehostname CONTAINS "1958262-coinbase.com" OR sourcehostname CONTAINS "195827-binance.com" OR sourcehostname CONTAINS "1958297-coinbase.com" OR sourcehostname CONTAINS "19582970-coinbase.com" OR sourcehostname CONTAINS "19582971-coinbase.com" OR sourcehostname CONTAINS "19583-coinbase.com" OR sourcehostname CONTAINS "19592653-coinbase.com" OR sourcehostname CONTAINS "197304-coinbase.com" OR sourcehostname CONTAINS "19730492-coinbase.com" OR sourcehostname CONTAINS "19764162-coinbase.com" OR sourcehostname CONTAINS "19803-coinbase.com" OR sourcehostname CONTAINS "201784289-coinbase.com" OR sourcehostname CONTAINS "210823644-coinbase.com" OR sourcehostname CONTAINS "21158-coinbase.com" OR sourcehostname CONTAINS "21509-coinbase.com" OR sourcehostname CONTAINS "25985-coinbase.com" OR sourcehostname CONTAINS "27699-coinbase.com" OR sourcehostname CONTAINS "28367-coinbase.com")
index=activity AND rg_functionality="Cloud Email / Email Security" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "178294-coinbase.com" OR destinationntdomain CONTAINS "17912-coinbase.com" OR destinationntdomain CONTAINS "17914-coinbase.com" OR destinationntdomain CONTAINS "17917-coinbase.com" OR destinationntdomain CONTAINS "17954-coinbase.com" OR destinationntdomain CONTAINS "17958-coinbase.com" OR destinationntdomain CONTAINS "182043-coinbase.com" OR destinationntdomain CONTAINS "18275-gemini.com" OR destinationntdomain CONTAINS "18276-coinbase.com" OR destinationntdomain CONTAINS "18290185-coinbase.com" OR destinationntdomain CONTAINS "182967-coinbase.com" OR destinationntdomain CONTAINS "18560-coinbase.com" OR destinationntdomain CONTAINS "18571-coinbase.com" OR destinationntdomain CONTAINS "185912-coinbase.com" OR destinationntdomain CONTAINS "185914-coinbase.com" OR destinationntdomain CONTAINS "18592176-coinbase.com" OR destinationntdomain CONTAINS "18594162-coinbase.com" OR destinationntdomain CONTAINS "18594962-coinbase.com" OR destinationntdomain CONTAINS "18597162-coinbase.com" OR destinationntdomain CONTAINS "18719562-coinbase.com" OR destinationntdomain CONTAINS "1875290-coinbase.com" OR destinationntdomain CONTAINS "1882730-coinbase.com" OR destinationntdomain CONTAINS "18902-coinbase.com" OR destinationntdomain CONTAINS "18903-coinbase.com" OR destinationntdomain CONTAINS "189126-coinbase.com" OR destinationntdomain CONTAINS "18952-coinbase.com" OR destinationntdomain CONTAINS "192854-coinbase.com" OR destinationntdomain CONTAINS "192856-coinbase.com" OR destinationntdomain CONTAINS "19287-binance.com" OR destinationntdomain CONTAINS "19572-coinbase.com" OR destinationntdomain CONTAINS "195812-coinbase.com" OR destinationntdomain CONTAINS "195826-coinbase.com" OR destinationntdomain CONTAINS "1958262-coinbase.com" OR destinationntdomain CONTAINS "195827-binance.com" OR destinationntdomain CONTAINS "1958297-coinbase.com" OR destinationntdomain CONTAINS "19582970-coinbase.com" OR destinationntdomain CONTAINS "19582971-coinbase.com" OR destinationntdomain CONTAINS "19583-coinbase.com" OR destinationntdomain CONTAINS "19592653-coinbase.com" OR destinationntdomain CONTAINS "197304-coinbase.com" OR destinationntdomain CONTAINS "19730492-coinbase.com" OR destinationntdomain CONTAINS "19764162-coinbase.com" OR destinationntdomain CONTAINS "19803-coinbase.com" OR destinationntdomain CONTAINS "201784289-coinbase.com" OR destinationntdomain CONTAINS "210823644-coinbase.com" OR destinationntdomain CONTAINS "21158-coinbase.com" OR destinationntdomain CONTAINS "21509-coinbase.com" OR destinationntdomain CONTAINS "25985-coinbase.com" OR destinationntdomain CONTAINS "27699-coinbase.com" OR destinationntdomain CONTAINS "28367-coinbase.com")
index=activity AND rg_functionality="Cloud Email / Email Security" AND requesturl NOT NULL AND (requesturl CONTAINS "178294-coinbase.com" OR requesturl CONTAINS "17912-coinbase.com" OR requesturl CONTAINS "17914-coinbase.com" OR requesturl CONTAINS "17917-coinbase.com" OR requesturl CONTAINS "17954-coinbase.com" OR requesturl CONTAINS "17958-coinbase.com" OR requesturl CONTAINS "182043-coinbase.com" OR requesturl CONTAINS "18275-gemini.com" OR requesturl CONTAINS "18276-coinbase.com" OR requesturl CONTAINS "18290185-coinbase.com" OR requesturl CONTAINS "182967-coinbase.com" OR requesturl CONTAINS "18560-coinbase.com" OR requesturl CONTAINS "18571-coinbase.com" OR requesturl CONTAINS "185912-coinbase.com" OR requesturl CONTAINS "185914-coinbase.com" OR requesturl CONTAINS "18592176-coinbase.com" OR requesturl CONTAINS "18594162-coinbase.com" OR requesturl CONTAINS "18594962-coinbase.com" OR requesturl CONTAINS "18597162-coinbase.com" OR requesturl CONTAINS "18719562-coinbase.com" OR requesturl CONTAINS "1875290-coinbase.com" OR requesturl CONTAINS "1882730-coinbase.com" OR requesturl CONTAINS "18902-coinbase.com" OR requesturl CONTAINS "18903-coinbase.com" OR requesturl CONTAINS "189126-coinbase.com" OR requesturl CONTAINS "18952-coinbase.com" OR requesturl CONTAINS "192854-coinbase.com" OR requesturl CONTAINS "192856-coinbase.com" OR requesturl CONTAINS "19287-binance.com" OR requesturl CONTAINS "19572-coinbase.com" OR requesturl CONTAINS "195812-coinbase.com" OR requesturl CONTAINS "195826-coinbase.com" OR requesturl CONTAINS "1958262-coinbase.com" OR requesturl CONTAINS "195827-binance.com" OR requesturl CONTAINS "1958297-coinbase.com" OR requesturl CONTAINS "19582970-coinbase.com" OR requesturl CONTAINS "19582971-coinbase.com" OR requesturl CONTAINS "19583-coinbase.com" OR requesturl CONTAINS "19592653-coinbase.com" OR requesturl CONTAINS "197304-coinbase.com" OR requesturl CONTAINS "19730492-coinbase.com" OR requesturl CONTAINS "19764162-coinbase.com" OR requesturl CONTAINS "19803-coinbase.com" OR requesturl CONTAINS "201784289-coinbase.com" OR requesturl CONTAINS "210823644-coinbase.com" OR requesturl CONTAINS "21158-coinbase.com" OR requesturl CONTAINS "21509-coinbase.com" OR requesturl CONTAINS "25985-coinbase.com" OR requesturl CONTAINS "27699-coinbase.com" OR requesturl CONTAINS "28367-coinbase.com")
index=activity AND rg_functionality="Cloud Email / Email Security" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "28676-coinbase.com" OR destinationhostname CONTAINS "29185-coinbase.com" OR destinationhostname CONTAINS "29195-coinbase.com" OR destinationhostname CONTAINS "2a-coinbase.com" OR destinationhostname CONTAINS "2b-coinbase.com" OR destinationhostname CONTAINS "2c-coinbase.com" OR destinationhostname CONTAINS "2f-coinbase.com" OR destinationhostname CONTAINS "2fas-coinbase.com" OR destinationhostname CONTAINS "2o-coinbase.com" OR destinationhostname CONTAINS "2r-coinbase.com" OR destinationhostname CONTAINS "2s-coinbase.com" OR destinationhostname CONTAINS "2sv-coinbase.com" OR destinationhostname CONTAINS "352134951-coinbase.com" OR destinationhostname CONTAINS "38468-coinbase.com" OR destinationhostname CONTAINS "39590-coinbase.com" OR destinationhostname CONTAINS "41260-coinbase.com" OR destinationhostname CONTAINS "427883-coinbase.com" OR destinationhostname CONTAINS "43017-coinbase.com" OR destinationhostname CONTAINS "47562-coinbase.com" OR destinationhostname CONTAINS "50195-coinbase.com" OR destinationhostname CONTAINS "5247-coinbase.com" OR destinationhostname CONTAINS "54765-coinbase.com" OR destinationhostname CONTAINS "57197-coinbase.com" OR destinationhostname CONTAINS "58176-coinbase.com" OR destinationhostname CONTAINS "58297-coinbase.com" OR destinationhostname CONTAINS "61250-coinbase.com" OR destinationhostname CONTAINS "61835-coinbase.com" OR destinationhostname CONTAINS "61851-coinbase.com" OR destinationhostname CONTAINS "61937-coinbase.com" OR destinationhostname CONTAINS "71925-coinbase.com" OR destinationhostname CONTAINS "72957-coinbase.com" OR destinationhostname CONTAINS "72985-coinbase.com" OR destinationhostname CONTAINS "74651-coinbase.com" OR destinationhostname CONTAINS "754668948-coinbase.com" OR destinationhostname CONTAINS "76159869-coinbase.com" OR destinationhostname CONTAINS "76153-coinbase.com" OR destinationhostname CONTAINS "81758-coinbase.com" OR destinationhostname CONTAINS "81920-coinbase.com" OR destinationhostname CONTAINS "81926-coinbase.com" OR destinationhostname CONTAINS "81958-coinbase.com" OR destinationhostname CONTAINS "826298-coinbase.com" OR destinationhostname CONTAINS "83216-coinbase.com" OR destinationhostname CONTAINS "837613-coinbase.com" OR destinationhostname CONTAINS "83956-coinbase.com" OR destinationhostname CONTAINS "87157-coinbase.com" OR destinationhostname CONTAINS "87312-coinbase.com" OR destinationhostname CONTAINS "89304-coinbase.com" OR destinationhostname CONTAINS "89375-coinbase.com" OR destinationhostname CONTAINS "91723-gemini.com" OR destinationhostname CONTAINS "91752-coinbase.com")
index=activity AND rg_functionality="Cloud Email / Email Security" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "28676-coinbase.com" OR sourcentdomain CONTAINS "29185-coinbase.com" OR sourcentdomain CONTAINS "29195-coinbase.com" OR sourcentdomain CONTAINS "2a-coinbase.com" OR sourcentdomain CONTAINS "2b-coinbase.com" OR sourcentdomain CONTAINS "2c-coinbase.com" OR sourcentdomain CONTAINS "2f-coinbase.com" OR sourcentdomain CONTAINS "2fas-coinbase.com" OR sourcentdomain CONTAINS "2o-coinbase.com" OR sourcentdomain CONTAINS "2r-coinbase.com" OR sourcentdomain CONTAINS "2s-coinbase.com" OR sourcentdomain CONTAINS "2sv-coinbase.com" OR sourcentdomain CONTAINS "352134951-coinbase.com" OR sourcentdomain CONTAINS "38468-coinbase.com" OR sourcentdomain CONTAINS "39590-coinbase.com" OR sourcentdomain CONTAINS "41260-coinbase.com" OR sourcentdomain CONTAINS "427883-coinbase.com" OR sourcentdomain CONTAINS "43017-coinbase.com" OR sourcentdomain CONTAINS "47562-coinbase.com" OR sourcentdomain CONTAINS "50195-coinbase.com" OR sourcentdomain CONTAINS "5247-coinbase.com" OR sourcentdomain CONTAINS "54765-coinbase.com" OR sourcentdomain CONTAINS "57197-coinbase.com" OR sourcentdomain CONTAINS "58176-coinbase.com" OR sourcentdomain CONTAINS "58297-coinbase.com" OR sourcentdomain CONTAINS "61250-coinbase.com" OR sourcentdomain CONTAINS "61835-coinbase.com" OR sourcentdomain CONTAINS "61851-coinbase.com" OR sourcentdomain CONTAINS "61937-coinbase.com" OR sourcentdomain CONTAINS "71925-coinbase.com" OR sourcentdomain CONTAINS "72957-coinbase.com" OR sourcentdomain CONTAINS "72985-coinbase.com" OR sourcentdomain CONTAINS "74651-coinbase.com" OR sourcentdomain CONTAINS "754668948-coinbase.com" OR sourcentdomain CONTAINS "76159869-coinbase.com" OR sourcentdomain CONTAINS "76153-coinbase.com" OR sourcentdomain CONTAINS "81758-coinbase.com" OR sourcentdomain CONTAINS "81920-coinbase.com" OR sourcentdomain CONTAINS "81926-coinbase.com" OR sourcentdomain CONTAINS "81958-coinbase.com" OR sourcentdomain CONTAINS "826298-coinbase.com" OR sourcentdomain CONTAINS "83216-coinbase.com" OR sourcentdomain CONTAINS "837613-coinbase.com" OR sourcentdomain CONTAINS "83956-coinbase.com" OR sourcentdomain CONTAINS "87157-coinbase.com" OR sourcentdomain CONTAINS "87312-coinbase.com" OR sourcentdomain CONTAINS "89304-coinbase.com" OR sourcentdomain CONTAINS "89375-coinbase.com" OR sourcentdomain CONTAINS "91723-gemini.com" OR sourcentdomain CONTAINS "91752-coinbase.com")
index=activity AND rg_functionality="Cloud Email / Email Security" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "28676-coinbase.com" OR sourcehostname CONTAINS "29185-coinbase.com" OR sourcehostname CONTAINS "29195-coinbase.com" OR sourcehostname CONTAINS "2a-coinbase.com" OR sourcehostname CONTAINS "2b-coinbase.com" OR sourcehostname CONTAINS "2c-coinbase.com" OR sourcehostname CONTAINS "2f-coinbase.com" OR sourcehostname CONTAINS "2fas-coinbase.com" OR sourcehostname CONTAINS "2o-coinbase.com" OR sourcehostname CONTAINS "2r-coinbase.com" OR sourcehostname CONTAINS "2s-coinbase.com" OR sourcehostname CONTAINS "2sv-coinbase.com" OR sourcehostname CONTAINS "352134951-coinbase.com" OR sourcehostname CONTAINS "38468-coinbase.com" OR sourcehostname CONTAINS "39590-coinbase.com" OR sourcehostname CONTAINS "41260-coinbase.com" OR sourcehostname CONTAINS "427883-coinbase.com" OR sourcehostname CONTAINS "43017-coinbase.com" OR sourcehostname CONTAINS "47562-coinbase.com" OR sourcehostname CONTAINS "50195-coinbase.com" OR sourcehostname CONTAINS "5247-coinbase.com" OR sourcehostname CONTAINS "54765-coinbase.com" OR sourcehostname CONTAINS "57197-coinbase.com" OR sourcehostname CONTAINS "58176-coinbase.com" OR sourcehostname CONTAINS "58297-coinbase.com" OR sourcehostname CONTAINS "61250-coinbase.com" OR sourcehostname CONTAINS "61835-coinbase.com" OR sourcehostname CONTAINS "61851-coinbase.com" OR sourcehostname CONTAINS "61937-coinbase.com" OR sourcehostname CONTAINS "71925-coinbase.com" OR sourcehostname CONTAINS "72957-coinbase.com" OR sourcehostname CONTAINS "72985-coinbase.com" OR sourcehostname CONTAINS "74651-coinbase.com" OR sourcehostname CONTAINS "754668948-coinbase.com" OR sourcehostname CONTAINS "76159869-coinbase.com" OR sourcehostname CONTAINS "76153-coinbase.com" OR sourcehostname CONTAINS "81758-coinbase.com" OR sourcehostname CONTAINS "81920-coinbase.com" OR sourcehostname CONTAINS "81926-coinbase.com" OR sourcehostname CONTAINS "81958-coinbase.com" OR sourcehostname CONTAINS "826298-coinbase.com" OR sourcehostname CONTAINS "83216-coinbase.com" OR sourcehostname CONTAINS "837613-coinbase.com" OR sourcehostname CONTAINS "83956-coinbase.com" OR sourcehostname CONTAINS "87157-coinbase.com" OR sourcehostname CONTAINS "87312-coinbase.com" OR sourcehostname CONTAINS "89304-coinbase.com" OR sourcehostname CONTAINS "89375-coinbase.com" OR sourcehostname CONTAINS "91723-gemini.com" OR sourcehostname CONTAINS "91752-coinbase.com")
index=activity AND rg_functionality="Cloud Email / Email Security" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "28676-coinbase.com" OR destinationntdomain CONTAINS "29185-coinbase.com" OR destinationntdomain CONTAINS "29195-coinbase.com" OR destinationntdomain CONTAINS "2a-coinbase.com" OR destinationntdomain CONTAINS "2b-coinbase.com" OR destinationntdomain CONTAINS "2c-coinbase.com" OR destinationntdomain CONTAINS "2f-coinbase.com" OR destinationntdomain CONTAINS "2fas-coinbase.com" OR destinationntdomain CONTAINS "2o-coinbase.com" OR destinationntdomain CONTAINS "2r-coinbase.com" OR destinationntdomain CONTAINS "2s-coinbase.com" OR destinationntdomain CONTAINS "2sv-coinbase.com" OR destinationntdomain CONTAINS "352134951-coinbase.com" OR destinationntdomain CONTAINS "38468-coinbase.com" OR destinationntdomain CONTAINS "39590-coinbase.com" OR destinationntdomain CONTAINS "41260-coinbase.com" OR destinationntdomain CONTAINS "427883-coinbase.com" OR destinationntdomain CONTAINS "43017-coinbase.com" OR destinationntdomain CONTAINS "47562-coinbase.com" OR destinationntdomain CONTAINS "50195-coinbase.com" OR destinationntdomain CONTAINS "5247-coinbase.com" OR destinationntdomain CONTAINS "54765-coinbase.com" OR destinationntdomain CONTAINS "57197-coinbase.com" OR destinationntdomain CONTAINS "58176-coinbase.com" OR destinationntdomain CONTAINS "58297-coinbase.com" OR destinationntdomain CONTAINS "61250-coinbase.com" OR destinationntdomain CONTAINS "61835-coinbase.com" OR destinationntdomain CONTAINS "61851-coinbase.com" OR destinationntdomain CONTAINS "61937-coinbase.com" OR destinationntdomain CONTAINS "71925-coinbase.com" OR destinationntdomain CONTAINS "72957-coinbase.com" OR destinationntdomain CONTAINS "72985-coinbase.com" OR destinationntdomain CONTAINS "74651-coinbase.com" OR destinationntdomain CONTAINS "754668948-coinbase.com" OR destinationntdomain CONTAINS "76159869-coinbase.com" OR destinationntdomain CONTAINS "76153-coinbase.com" OR destinationntdomain CONTAINS "81758-coinbase.com" OR destinationntdomain CONTAINS "81920-coinbase.com" OR destinationntdomain CONTAINS "81926-coinbase.com" OR destinationntdomain CONTAINS "81958-coinbase.com" OR destinationntdomain CONTAINS "826298-coinbase.com" OR destinationntdomain CONTAINS "83216-coinbase.com" OR destinationntdomain CONTAINS "837613-coinbase.com" OR destinationntdomain CONTAINS "83956-coinbase.com" OR destinationntdomain CONTAINS "87157-coinbase.com" OR destinationntdomain CONTAINS "87312-coinbase.com" OR destinationntdomain CONTAINS "89304-coinbase.com" OR destinationntdomain CONTAINS "89375-coinbase.com" OR destinationntdomain CONTAINS "91723-gemini.com" OR destinationntdomain CONTAINS "91752-coinbase.com")
index=activity AND rg_functionality="Cloud Email / Email Security" AND requesturl NOT NULL AND (requesturl CONTAINS "28676-coinbase.com" OR requesturl CONTAINS "29185-coinbase.com" OR requesturl CONTAINS "29195-coinbase.com" OR requesturl CONTAINS "2a-coinbase.com" OR requesturl CONTAINS "2b-coinbase.com" OR requesturl CONTAINS "2c-coinbase.com" OR requesturl CONTAINS "2f-coinbase.com" OR requesturl CONTAINS "2fas-coinbase.com" OR requesturl CONTAINS "2o-coinbase.com" OR requesturl CONTAINS "2r-coinbase.com" OR requesturl CONTAINS "2s-coinbase.com" OR requesturl CONTAINS "2sv-coinbase.com" OR requesturl CONTAINS "352134951-coinbase.com" OR requesturl CONTAINS "38468-coinbase.com" OR requesturl CONTAINS "39590-coinbase.com" OR requesturl CONTAINS "41260-coinbase.com" OR requesturl CONTAINS "427883-coinbase.com" OR requesturl CONTAINS "43017-coinbase.com" OR requesturl CONTAINS "47562-coinbase.com" OR requesturl CONTAINS "50195-coinbase.com" OR requesturl CONTAINS "5247-coinbase.com" OR requesturl CONTAINS "54765-coinbase.com" OR requesturl CONTAINS "57197-coinbase.com" OR requesturl CONTAINS "58176-coinbase.com" OR requesturl CONTAINS "58297-coinbase.com" OR requesturl CONTAINS "61250-coinbase.com" OR requesturl CONTAINS "61835-coinbase.com" OR requesturl CONTAINS "61851-coinbase.com" OR requesturl CONTAINS "61937-coinbase.com" OR requesturl CONTAINS "71925-coinbase.com" OR requesturl CONTAINS "72957-coinbase.com" OR requesturl CONTAINS "72985-coinbase.com" OR requesturl CONTAINS "74651-coinbase.com" OR requesturl CONTAINS "754668948-coinbase.com" OR requesturl CONTAINS "76159869-coinbase.com" OR requesturl CONTAINS "76153-coinbase.com" OR requesturl CONTAINS "81758-coinbase.com" OR requesturl CONTAINS "81920-coinbase.com" OR requesturl CONTAINS "81926-coinbase.com" OR requesturl CONTAINS "81958-coinbase.com" OR requesturl CONTAINS "826298-coinbase.com" OR requesturl CONTAINS "83216-coinbase.com" OR requesturl CONTAINS "837613-coinbase.com" OR requesturl CONTAINS "83956-coinbase.com" OR requesturl CONTAINS "87157-coinbase.com" OR requesturl CONTAINS "87312-coinbase.com" OR requesturl CONTAINS "89304-coinbase.com" OR requesturl CONTAINS "89375-coinbase.com" OR requesturl CONTAINS "91723-gemini.com" OR requesturl CONTAINS "91752-coinbase.com")
index=activity AND rg_functionality="Cloud Email / Email Security" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "91756-coinbase.com" OR destinationhostname CONTAINS "91782-coinbase.com" OR destinationhostname CONTAINS "91835-coinbase.com" OR destinationhostname CONTAINS "91845-coinbase.com" OR destinationhostname CONTAINS "91923-coinbase.com" OR destinationhostname CONTAINS "92758-coinbase.com" OR destinationhostname CONTAINS "948122061-coinbase.com" OR destinationhostname CONTAINS "978941-coinbase.com" OR destinationhostname CONTAINS "accountrecovery-coinbase.com" OR destinationhostname CONTAINS "action-shakepay.com" OR destinationhostname CONTAINS "adjust-coinbase.com" OR destinationhostname CONTAINS "admin-kraken.com" OR destinationhostname CONTAINS "applechargebacks.com" OR destinationhostname CONTAINS "authenticate-gemini.com" OR destinationhostname CONTAINS "authorize-gmail.com" OR destinationhostname CONTAINS "binance-okta.com" OR destinationhostname CONTAINS "captcha-coinbase.com" OR destinationhostname CONTAINS "cd-coinbase.com" OR destinationhostname CONTAINS "coinbase-heip.com" OR destinationhostname CONTAINS "coinbase-live.support" OR destinationhostname CONTAINS "coinbase-reject.com" OR destinationhostname CONTAINS "coinbase-ticket.com" OR destinationhostname CONTAINS "coinbaseheip.com" OR destinationhostname CONTAINS "com-2fa.help" OR destinationhostname CONTAINS "com-2fa.support" OR destinationhostname CONTAINS "com-3845.support" OR destinationhostname CONTAINS "com-connect.help" OR destinationhostname CONTAINS "com-fraud.support" OR destinationhostname CONTAINS "com-help.support" OR destinationhostname CONTAINS "com-reset.help" OR destinationhostname CONTAINS "com-reset.net" OR destinationhostname CONTAINS "com-ticket.live" OR destinationhostname CONTAINS "com-ticket.support" OR destinationhostname CONTAINS "contact-nexo.com" OR destinationhostname CONTAINS "convert-coinbase.com" OR destinationhostname CONTAINS "customerservice-coinbase.com" OR destinationhostname CONTAINS "default-coinbase.com" OR destinationhostname CONTAINS "defend-coinbase.com" OR destinationhostname CONTAINS "deny-coinbase.com" OR destinationhostname CONTAINS "disconnect-coinbase.com" OR destinationhostname CONTAINS "escalate-coinbase.com" OR destinationhostname CONTAINS "establish-coinbase.com" OR destinationhostname CONTAINS "fcc-okta.com" OR destinationhostname CONTAINS "fraudulent-coinbase.com" OR destinationhostname CONTAINS "guard-apple.com" OR destinationhostname CONTAINS "guard-icloud.com" OR destinationhostname CONTAINS "guardian-coinbase.com" OR destinationhostname CONTAINS "guide-gemini.com" OR destinationhostname CONTAINS "help-bitfinex.com" OR destinationhostname CONTAINS "help-shakepay.com")
index=activity AND rg_functionality="Cloud Email / Email Security" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "91756-coinbase.com" OR sourcentdomain CONTAINS "91782-coinbase.com" OR sourcentdomain CONTAINS "91835-coinbase.com" OR sourcentdomain CONTAINS "91845-coinbase.com" OR sourcentdomain CONTAINS "91923-coinbase.com" OR sourcentdomain CONTAINS "92758-coinbase.com" OR sourcentdomain CONTAINS "948122061-coinbase.com" OR sourcentdomain CONTAINS "978941-coinbase.com" OR sourcentdomain CONTAINS "accountrecovery-coinbase.com" OR sourcentdomain CONTAINS "action-shakepay.com" OR sourcentdomain CONTAINS "adjust-coinbase.com" OR sourcentdomain CONTAINS "admin-kraken.com" OR sourcentdomain CONTAINS "applechargebacks.com" OR sourcentdomain CONTAINS "authenticate-gemini.com" OR sourcentdomain CONTAINS "authorize-gmail.com" OR sourcentdomain CONTAINS "binance-okta.com" OR sourcentdomain CONTAINS "captcha-coinbase.com" OR sourcentdomain CONTAINS "cd-coinbase.com" OR sourcentdomain CONTAINS "coinbase-heip.com" OR sourcentdomain CONTAINS "coinbase-live.support" OR sourcentdomain CONTAINS "coinbase-reject.com" OR sourcentdomain CONTAINS "coinbase-ticket.com" OR sourcentdomain CONTAINS "coinbaseheip.com" OR sourcentdomain CONTAINS "com-2fa.help" OR sourcentdomain CONTAINS "com-2fa.support" OR sourcentdomain CONTAINS "com-3845.support" OR sourcentdomain CONTAINS "com-connect.help" OR sourcentdomain CONTAINS "com-fraud.support" OR sourcentdomain CONTAINS "com-help.support" OR sourcentdomain CONTAINS "com-reset.help" OR sourcentdomain CONTAINS "com-reset.net" OR sourcentdomain CONTAINS "com-ticket.live" OR sourcentdomain CONTAINS "com-ticket.support" OR sourcentdomain CONTAINS "contact-nexo.com" OR sourcentdomain CONTAINS "convert-coinbase.com" OR sourcentdomain CONTAINS "customerservice-coinbase.com" OR sourcentdomain CONTAINS "default-coinbase.com" OR sourcentdomain CONTAINS "defend-coinbase.com" OR sourcentdomain CONTAINS "deny-coinbase.com" OR sourcentdomain CONTAINS "disconnect-coinbase.com" OR sourcentdomain CONTAINS "escalate-coinbase.com" OR sourcentdomain CONTAINS "establish-coinbase.com" OR sourcentdomain CONTAINS "fcc-okta.com" OR sourcentdomain CONTAINS "fraudulent-coinbase.com" OR sourcentdomain CONTAINS "guard-apple.com" OR sourcentdomain CONTAINS "guard-icloud.com" OR sourcentdomain CONTAINS "guardian-coinbase.com" OR sourcentdomain CONTAINS "guide-gemini.com" OR sourcentdomain CONTAINS "help-bitfinex.com" OR sourcentdomain CONTAINS "help-shakepay.com")
index=activity AND rg_functionality="Cloud Email / Email Security" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "91756-coinbase.com" OR sourcehostname CONTAINS "91782-coinbase.com" OR sourcehostname CONTAINS "91835-coinbase.com" OR sourcehostname CONTAINS "91845-coinbase.com" OR sourcehostname CONTAINS "91923-coinbase.com" OR sourcehostname CONTAINS "92758-coinbase.com" OR sourcehostname CONTAINS "948122061-coinbase.com" OR sourcehostname CONTAINS "978941-coinbase.com" OR sourcehostname CONTAINS "accountrecovery-coinbase.com" OR sourcehostname CONTAINS "action-shakepay.com" OR sourcehostname CONTAINS "adjust-coinbase.com" OR sourcehostname CONTAINS "admin-kraken.com" OR sourcehostname CONTAINS "applechargebacks.com" OR sourcehostname CONTAINS "authenticate-gemini.com" OR sourcehostname CONTAINS "authorize-gmail.com" OR sourcehostname CONTAINS "binance-okta.com" OR sourcehostname CONTAINS "captcha-coinbase.com" OR sourcehostname CONTAINS "cd-coinbase.com" OR sourcehostname CONTAINS "coinbase-heip.com" OR sourcehostname CONTAINS "coinbase-live.support" OR sourcehostname CONTAINS "coinbase-reject.com" OR sourcehostname CONTAINS "coinbase-ticket.com" OR sourcehostname CONTAINS "coinbaseheip.com" OR sourcehostname CONTAINS "com-2fa.help" OR sourcehostname CONTAINS "com-2fa.support" OR sourcehostname CONTAINS "com-3845.support" OR sourcehostname CONTAINS "com-connect.help" OR sourcehostname CONTAINS "com-fraud.support" OR sourcehostname CONTAINS "com-help.support" OR sourcehostname CONTAINS "com-reset.help" OR sourcehostname CONTAINS "com-reset.net" OR sourcehostname CONTAINS "com-ticket.live" OR sourcehostname CONTAINS "com-ticket.support" OR sourcehostname CONTAINS "contact-nexo.com" OR sourcehostname CONTAINS "convert-coinbase.com" OR sourcehostname CONTAINS "customerservice-coinbase.com" OR sourcehostname CONTAINS "default-coinbase.com" OR sourcehostname CONTAINS "defend-coinbase.com" OR sourcehostname CONTAINS "deny-coinbase.com" OR sourcehostname CONTAINS "disconnect-coinbase.com" OR sourcehostname CONTAINS "escalate-coinbase.com" OR sourcehostname CONTAINS "establish-coinbase.com" OR sourcehostname CONTAINS "fcc-okta.com" OR sourcehostname CONTAINS "fraudulent-coinbase.com" OR sourcehostname CONTAINS "guard-apple.com" OR sourcehostname CONTAINS "guard-icloud.com" OR sourcehostname CONTAINS "guardian-coinbase.com" OR sourcehostname CONTAINS "guide-gemini.com" OR sourcehostname CONTAINS "help-bitfinex.com" OR sourcehostname CONTAINS "help-shakepay.com")
index=activity AND rg_functionality="Cloud Email / Email Security" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "91756-coinbase.com" OR destinationntdomain CONTAINS "91782-coinbase.com" OR destinationntdomain CONTAINS "91835-coinbase.com" OR destinationntdomain CONTAINS "91845-coinbase.com" OR destinationntdomain CONTAINS "91923-coinbase.com" OR destinationntdomain CONTAINS "92758-coinbase.com" OR destinationntdomain CONTAINS "948122061-coinbase.com" OR destinationntdomain CONTAINS "978941-coinbase.com" OR destinationntdomain CONTAINS "accountrecovery-coinbase.com" OR destinationntdomain CONTAINS "action-shakepay.com" OR destinationntdomain CONTAINS "adjust-coinbase.com" OR destinationntdomain CONTAINS "admin-kraken.com" OR destinationntdomain CONTAINS "applechargebacks.com" OR destinationntdomain CONTAINS "authenticate-gemini.com" OR destinationntdomain CONTAINS "authorize-gmail.com" OR destinationntdomain CONTAINS "binance-okta.com" OR destinationntdomain CONTAINS "captcha-coinbase.com" OR destinationntdomain CONTAINS "cd-coinbase.com" OR destinationntdomain CONTAINS "coinbase-heip.com" OR destinationntdomain CONTAINS "coinbase-live.support" OR destinationntdomain CONTAINS "coinbase-reject.com" OR destinationntdomain CONTAINS "coinbase-ticket.com" OR destinationntdomain CONTAINS "coinbaseheip.com" OR destinationntdomain CONTAINS "com-2fa.help" OR destinationntdomain CONTAINS "com-2fa.support" OR destinationntdomain CONTAINS "com-3845.support" OR destinationntdomain CONTAINS "com-connect.help" OR destinationntdomain CONTAINS "com-fraud.support" OR destinationntdomain CONTAINS "com-help.support" OR destinationntdomain CONTAINS "com-reset.help" OR destinationntdomain CONTAINS "com-reset.net" OR destinationntdomain CONTAINS "com-ticket.live" OR destinationntdomain CONTAINS "com-ticket.support" OR destinationntdomain CONTAINS "contact-nexo.com" OR destinationntdomain CONTAINS "convert-coinbase.com" OR destinationntdomain CONTAINS "customerservice-coinbase.com" OR destinationntdomain CONTAINS "default-coinbase.com" OR destinationntdomain CONTAINS "defend-coinbase.com" OR destinationntdomain CONTAINS "deny-coinbase.com" OR destinationntdomain CONTAINS "disconnect-coinbase.com" OR destinationntdomain CONTAINS "escalate-coinbase.com" OR destinationntdomain CONTAINS "establish-coinbase.com" OR destinationntdomain CONTAINS "fcc-okta.com" OR destinationntdomain CONTAINS "fraudulent-coinbase.com" OR destinationntdomain CONTAINS "guard-apple.com" OR destinationntdomain CONTAINS "guard-icloud.com" OR destinationntdomain CONTAINS "guardian-coinbase.com" OR destinationntdomain CONTAINS "guide-gemini.com" OR destinationntdomain CONTAINS "help-bitfinex.com" OR destinationntdomain CONTAINS "help-shakepay.com")
index=activity AND rg_functionality="Cloud Email / Email Security" AND requesturl NOT NULL AND (requesturl CONTAINS "91756-coinbase.com" OR requesturl CONTAINS "91782-coinbase.com" OR requesturl CONTAINS "91835-coinbase.com" OR requesturl CONTAINS "91845-coinbase.com" OR requesturl CONTAINS "91923-coinbase.com" OR requesturl CONTAINS "92758-coinbase.com" OR requesturl CONTAINS "948122061-coinbase.com" OR requesturl CONTAINS "978941-coinbase.com" OR requesturl CONTAINS "accountrecovery-coinbase.com" OR requesturl CONTAINS "action-shakepay.com" OR requesturl CONTAINS "adjust-coinbase.com" OR requesturl CONTAINS "admin-kraken.com" OR requesturl CONTAINS "applechargebacks.com" OR requesturl CONTAINS "authenticate-gemini.com" OR requesturl CONTAINS "authorize-gmail.com" OR requesturl CONTAINS "binance-okta.com" OR requesturl CONTAINS "captcha-coinbase.com" OR requesturl CONTAINS "cd-coinbase.com" OR requesturl CONTAINS "coinbase-heip.com" OR requesturl CONTAINS "coinbase-live.support" OR requesturl CONTAINS "coinbase-reject.com" OR requesturl CONTAINS "coinbase-ticket.com" OR requesturl CONTAINS "coinbaseheip.com" OR requesturl CONTAINS "com-2fa.help" OR requesturl CONTAINS "com-2fa.support" OR requesturl CONTAINS "com-3845.support" OR requesturl CONTAINS "com-connect.help" OR requesturl CONTAINS "com-fraud.support" OR requesturl CONTAINS "com-help.support" OR requesturl CONTAINS "com-reset.help" OR requesturl CONTAINS "com-reset.net" OR requesturl CONTAINS "com-ticket.live" OR requesturl CONTAINS "com-ticket.support" OR requesturl CONTAINS "contact-nexo.com" OR requesturl CONTAINS "convert-coinbase.com" OR requesturl CONTAINS "customerservice-coinbase.com" OR requesturl CONTAINS "default-coinbase.com" OR requesturl CONTAINS "defend-coinbase.com" OR requesturl CONTAINS "deny-coinbase.com" OR requesturl CONTAINS "disconnect-coinbase.com" OR requesturl CONTAINS "escalate-coinbase.com" OR requesturl CONTAINS "establish-coinbase.com" OR requesturl CONTAINS "fcc-okta.com" OR requesturl CONTAINS "fraudulent-coinbase.com" OR requesturl CONTAINS "guard-apple.com" OR requesturl CONTAINS "guard-icloud.com" OR requesturl CONTAINS "guardian-coinbase.com" OR requesturl CONTAINS "guide-gemini.com" OR requesturl CONTAINS "help-bitfinex.com" OR requesturl CONTAINS "help-shakepay.com")
index=activity AND rg_functionality="Cloud Email / Email Security" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "helpdesk-apple.com" OR destinationhostname CONTAINS "helpdesk-gemini.com" OR destinationhostname CONTAINS "helpdesk-icloud.com" OR destinationhostname CONTAINS "identification-coinbase.com" OR destinationhostname CONTAINS "lockdown-coinbase.com" OR destinationhostname CONTAINS "login-nexo.com" OR destinationhostname CONTAINS "keys-coinbase.com" OR destinationhostname CONTAINS "messages-coinbase.com" OR destinationhostname CONTAINS "newpassword-coinbase.com" OR destinationhostname CONTAINS "prompt-coinbase.com" OR destinationhostname CONTAINS "protect-apple.com" OR destinationhostname CONTAINS "protect-coinbase.com" OR destinationhostname CONTAINS "protect-gmail.com" OR destinationhostname CONTAINS "protect-kraken.com" OR destinationhostname CONTAINS "recoverme-coinbase.com" OR destinationhostname CONTAINS "recoveryportal-coinbase.com" OR destinationhostname CONTAINS "refunds-coinbase.com" OR destinationhostname CONTAINS "reset-okta.com" OR destinationhostname CONTAINS "restore-coinbase.com" OR destinationhostname CONTAINS "return-coinbase.com" OR destinationhostname CONTAINS "reverts-coinbase.com" OR destinationhostname CONTAINS "secure-binance.us" OR destinationhostname CONTAINS "secure-icloud.com" OR destinationhostname CONTAINS "secure-nexo.com" OR destinationhostname CONTAINS "secure-shakepay.com" OR destinationhostname CONTAINS "security-umusic.com" OR destinationhostname CONTAINS "server694590423.tech" OR destinationhostname CONTAINS "session-coinbase.com" OR destinationhostname CONTAINS "startrecovery-coinbase.com" OR destinationhostname CONTAINS "signin-kraken.com" OR destinationhostname CONTAINS "suite-trezor.io" OR destinationhostname CONTAINS "supportportal-coinbase.com" OR destinationhostname CONTAINS "tech-icloud.com" OR destinationhostname CONTAINS "threat-coinbase.com" OR destinationhostname CONTAINS "ticket-apple.com" OR destinationhostname CONTAINS "ticket-coinbase.com" OR destinationhostname CONTAINS "tickets-apple.com" OR destinationhostname CONTAINS "tokens-coinbase.com" OR destinationhostname CONTAINS "unblock-coinbase.com" OR destinationhostname CONTAINS "unlink-coinbase.com" OR destinationhostname CONTAINS "your-coinbase.com" OR destinationhostname CONTAINS "welcome-coinbase.com" OR destinationhostname CONTAINS "www-coinbasewallet.com" OR destinationhostname CONTAINS "www-help-coinbase.com" OR destinationhostname CONTAINS "www-help-gemini.com")
index=activity AND rg_functionality="Cloud Email / Email Security" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "helpdesk-apple.com" OR sourcentdomain CONTAINS "helpdesk-gemini.com" OR sourcentdomain CONTAINS "helpdesk-icloud.com" OR sourcentdomain CONTAINS "identification-coinbase.com" OR sourcentdomain CONTAINS "lockdown-coinbase.com" OR sourcentdomain CONTAINS "login-nexo.com" OR sourcentdomain CONTAINS "keys-coinbase.com" OR sourcentdomain CONTAINS "messages-coinbase.com" OR sourcentdomain CONTAINS "newpassword-coinbase.com" OR sourcentdomain CONTAINS "prompt-coinbase.com" OR sourcentdomain CONTAINS "protect-apple.com" OR sourcentdomain CONTAINS "protect-coinbase.com" OR sourcentdomain CONTAINS "protect-gmail.com" OR sourcentdomain CONTAINS "protect-kraken.com" OR sourcentdomain CONTAINS "recoverme-coinbase.com" OR sourcentdomain CONTAINS "recoveryportal-coinbase.com" OR sourcentdomain CONTAINS "refunds-coinbase.com" OR sourcentdomain CONTAINS "reset-okta.com" OR sourcentdomain CONTAINS "restore-coinbase.com" OR sourcentdomain CONTAINS "return-coinbase.com" OR sourcentdomain CONTAINS "reverts-coinbase.com" OR sourcentdomain CONTAINS "secure-binance.us" OR sourcentdomain CONTAINS "secure-icloud.com" OR sourcentdomain CONTAINS "secure-nexo.com" OR sourcentdomain CONTAINS "secure-shakepay.com" OR sourcentdomain CONTAINS "security-umusic.com" OR sourcentdomain CONTAINS "server694590423.tech" OR sourcentdomain CONTAINS "session-coinbase.com" OR sourcentdomain CONTAINS "startrecovery-coinbase.com" OR sourcentdomain CONTAINS "signin-kraken.com" OR sourcentdomain CONTAINS "suite-trezor.io" OR sourcentdomain CONTAINS "supportportal-coinbase.com" OR sourcentdomain CONTAINS "tech-icloud.com" OR sourcentdomain CONTAINS "threat-coinbase.com" OR sourcentdomain CONTAINS "ticket-apple.com" OR sourcentdomain CONTAINS "ticket-coinbase.com" OR sourcentdomain CONTAINS "tickets-apple.com" OR sourcentdomain CONTAINS "tokens-coinbase.com" OR sourcentdomain CONTAINS "unblock-coinbase.com" OR sourcentdomain CONTAINS "unlink-coinbase.com" OR sourcentdomain CONTAINS "your-coinbase.com" OR sourcentdomain CONTAINS "welcome-coinbase.com" OR sourcentdomain CONTAINS "www-coinbasewallet.com" OR sourcentdomain CONTAINS "www-help-coinbase.com" OR sourcentdomain CONTAINS "www-help-gemini.com")
index=activity AND rg_functionality="Cloud Email / Email Security" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "helpdesk-apple.com" OR sourcehostname CONTAINS "helpdesk-gemini.com" OR sourcehostname CONTAINS "helpdesk-icloud.com" OR sourcehostname CONTAINS "identification-coinbase.com" OR sourcehostname CONTAINS "lockdown-coinbase.com" OR sourcehostname CONTAINS "login-nexo.com" OR sourcehostname CONTAINS "keys-coinbase.com" OR sourcehostname CONTAINS "messages-coinbase.com" OR sourcehostname CONTAINS "newpassword-coinbase.com" OR sourcehostname CONTAINS "prompt-coinbase.com" OR sourcehostname CONTAINS "protect-apple.com" OR sourcehostname CONTAINS "protect-coinbase.com" OR sourcehostname CONTAINS "protect-gmail.com" OR sourcehostname CONTAINS "protect-kraken.com" OR sourcehostname CONTAINS "recoverme-coinbase.com" OR sourcehostname CONTAINS "recoveryportal-coinbase.com" OR sourcehostname CONTAINS "refunds-coinbase.com" OR sourcehostname CONTAINS "reset-okta.com" OR sourcehostname CONTAINS "restore-coinbase.com" OR sourcehostname CONTAINS "return-coinbase.com" OR sourcehostname CONTAINS "reverts-coinbase.com" OR sourcehostname CONTAINS "secure-binance.us" OR sourcehostname CONTAINS "secure-icloud.com" OR sourcehostname CONTAINS "secure-nexo.com" OR sourcehostname CONTAINS "secure-shakepay.com" OR sourcehostname CONTAINS "security-umusic.com" OR sourcehostname CONTAINS "server694590423.tech" OR sourcehostname CONTAINS "session-coinbase.com" OR sourcehostname CONTAINS "startrecovery-coinbase.com" OR sourcehostname CONTAINS "signin-kraken.com" OR sourcehostname CONTAINS "suite-trezor.io" OR sourcehostname CONTAINS "supportportal-coinbase.com" OR sourcehostname CONTAINS "tech-icloud.com" OR sourcehostname CONTAINS "threat-coinbase.com" OR sourcehostname CONTAINS "ticket-apple.com" OR sourcehostname CONTAINS "ticket-coinbase.com" OR sourcehostname CONTAINS "tickets-apple.com" OR sourcehostname CONTAINS "tokens-coinbase.com" OR sourcehostname CONTAINS "unblock-coinbase.com" OR sourcehostname CONTAINS "unlink-coinbase.com" OR sourcehostname CONTAINS "your-coinbase.com" OR sourcehostname CONTAINS "welcome-coinbase.com" OR sourcehostname CONTAINS "www-coinbasewallet.com" OR sourcehostname CONTAINS "www-help-coinbase.com" OR sourcehostname CONTAINS "www-help-gemini.com")
index=activity AND rg_functionality="Cloud Email / Email Security" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "helpdesk-apple.com" OR destinationntdomain CONTAINS "helpdesk-gemini.com" OR destinationntdomain CONTAINS "helpdesk-icloud.com" OR destinationntdomain CONTAINS "identification-coinbase.com" OR destinationntdomain CONTAINS "lockdown-coinbase.com" OR destinationntdomain CONTAINS "login-nexo.com" OR destinationntdomain CONTAINS "keys-coinbase.com" OR destinationntdomain CONTAINS "messages-coinbase.com" OR destinationntdomain CONTAINS "newpassword-coinbase.com" OR destinationntdomain CONTAINS "prompt-coinbase.com" OR destinationntdomain CONTAINS "protect-apple.com" OR destinationntdomain CONTAINS "protect-coinbase.com" OR destinationntdomain CONTAINS "protect-gmail.com" OR destinationntdomain CONTAINS "protect-kraken.com" OR destinationntdomain CONTAINS "recoverme-coinbase.com" OR destinationntdomain CONTAINS "recoveryportal-coinbase.com" OR destinationntdomain CONTAINS "refunds-coinbase.com" OR destinationntdomain CONTAINS "reset-okta.com" OR destinationntdomain CONTAINS "restore-coinbase.com" OR destinationntdomain CONTAINS "return-coinbase.com" OR destinationntdomain CONTAINS "reverts-coinbase.com" OR destinationntdomain CONTAINS "secure-binance.us" OR destinationntdomain CONTAINS "secure-icloud.com" OR destinationntdomain CONTAINS "secure-nexo.com" OR destinationntdomain CONTAINS "secure-shakepay.com" OR destinationntdomain CONTAINS "security-umusic.com" OR destinationntdomain CONTAINS "server694590423.tech" OR destinationntdomain CONTAINS "session-coinbase.com" OR destinationntdomain CONTAINS "startrecovery-coinbase.com" OR destinationntdomain CONTAINS "signin-kraken.com" OR destinationntdomain CONTAINS "suite-trezor.io" OR destinationntdomain CONTAINS "supportportal-coinbase.com" OR destinationntdomain CONTAINS "tech-icloud.com" OR destinationntdomain CONTAINS "threat-coinbase.com" OR destinationntdomain CONTAINS "ticket-apple.com" OR destinationntdomain CONTAINS "ticket-coinbase.com" OR destinationntdomain CONTAINS "tickets-apple.com" OR destinationntdomain CONTAINS "tokens-coinbase.com" OR destinationntdomain CONTAINS "unblock-coinbase.com" OR destinationntdomain CONTAINS "unlink-coinbase.com" OR destinationntdomain CONTAINS "your-coinbase.com" OR destinationntdomain CONTAINS "welcome-coinbase.com" OR destinationntdomain CONTAINS "www-coinbasewallet.com" OR destinationntdomain CONTAINS "www-help-coinbase.com" OR destinationntdomain CONTAINS "www-help-gemini.com")
index=activity AND rg_functionality="Cloud Email / Email Security" AND requesturl NOT NULL AND (requesturl CONTAINS "helpdesk-apple.com" OR requesturl CONTAINS "helpdesk-gemini.com" OR requesturl CONTAINS "helpdesk-icloud.com" OR requesturl CONTAINS "identification-coinbase.com" OR requesturl CONTAINS "lockdown-coinbase.com" OR requesturl CONTAINS "login-nexo.com" OR requesturl CONTAINS "keys-coinbase.com" OR requesturl CONTAINS "messages-coinbase.com" OR requesturl CONTAINS "newpassword-coinbase.com" OR requesturl CONTAINS "prompt-coinbase.com" OR requesturl CONTAINS "protect-apple.com" OR requesturl CONTAINS "protect-coinbase.com" OR requesturl CONTAINS "protect-gmail.com" OR requesturl CONTAINS "protect-kraken.com" OR requesturl CONTAINS "recoverme-coinbase.com" OR requesturl CONTAINS "recoveryportal-coinbase.com" OR requesturl CONTAINS "refunds-coinbase.com" OR requesturl CONTAINS "reset-okta.com" OR requesturl CONTAINS "restore-coinbase.com" OR requesturl CONTAINS "return-coinbase.com" OR requesturl CONTAINS "reverts-coinbase.com" OR requesturl CONTAINS "secure-binance.us" OR requesturl CONTAINS "secure-icloud.com" OR requesturl CONTAINS "secure-nexo.com" OR requesturl CONTAINS "secure-shakepay.com" OR requesturl CONTAINS "security-umusic.com" OR requesturl CONTAINS "server694590423.tech" OR requesturl CONTAINS "session-coinbase.com" OR requesturl CONTAINS "startrecovery-coinbase.com" OR requesturl CONTAINS "signin-kraken.com" OR requesturl CONTAINS "suite-trezor.io" OR requesturl CONTAINS "supportportal-coinbase.com" OR requesturl CONTAINS "tech-icloud.com" OR requesturl CONTAINS "threat-coinbase.com" OR requesturl CONTAINS "ticket-apple.com" OR requesturl CONTAINS "ticket-coinbase.com" OR requesturl CONTAINS "tickets-apple.com" OR requesturl CONTAINS "tokens-coinbase.com" OR requesturl CONTAINS "unblock-coinbase.com" OR requesturl CONTAINS "unlink-coinbase.com" OR requesturl CONTAINS "your-coinbase.com" OR requesturl CONTAINS "welcome-coinbase.com" OR requesturl CONTAINS "www-coinbasewallet.com" OR requesturl CONTAINS "www-help-coinbase.com" OR requesturl CONTAINS "www-help-gemini.com")
index=activity AND rg_functionality="DNS / DHCP" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "official-server.com" OR destinationhostname CONTAINS "server694590423.tech" OR destinationhostname CONTAINS "island-placid-bromine.glitch.me" OR destinationhostname CONTAINS "circular-noon-farmhouse.glitch.me" OR destinationhostname CONTAINS "talented-friendly-price.glitch.me" OR destinationhostname CONTAINS "dflfmgsdokasdcpl.com" OR destinationhostname CONTAINS "original-backend.com" OR destinationhostname CONTAINS "07159889-coinbase.com" OR destinationhostname CONTAINS "10195-coinbase.com" OR destinationhostname CONTAINS "11246-coinbase.com" OR destinationhostname CONTAINS "11247-coinbase.com" OR destinationhostname CONTAINS "11248-coinbase.com" OR destinationhostname CONTAINS "11258-coinbase.com" OR destinationhostname CONTAINS "11259-coinbase.com" OR destinationhostname CONTAINS "113912-coinbase.com" OR destinationhostname CONTAINS "11472-coinbase.com" OR destinationhostname CONTAINS "11923-coinbase.com" OR destinationhostname CONTAINS "11957-coinbase.com" OR destinationhostname CONTAINS "128147-coinbase.com" OR destinationhostname CONTAINS "12958-coinbase.com" OR destinationhostname CONTAINS "12984-okta.com" OR destinationhostname CONTAINS "12985-coinbase.com" OR destinationhostname CONTAINS "13130-coinbase.com" OR destinationhostname CONTAINS "13247-coinbase.com" OR destinationhostname CONTAINS "13247-icloud.com" OR destinationhostname CONTAINS "13267-coinbase.com" OR destinationhostname CONTAINS "146271510-coinbase.com" OR destinationhostname CONTAINS "146282-coinbase.com" OR destinationhostname CONTAINS "146284-coinbase.com" OR destinationhostname CONTAINS "147260-coinbase.com" OR destinationhostname CONTAINS "14765-coinbase.com" OR destinationhostname CONTAINS "14817582-coinbase.com" OR destinationhostname CONTAINS "14871904-coinbase.com" OR destinationhostname CONTAINS "14891902-coinbase.com" OR destinationhostname CONTAINS "1492864-coinbase.com" OR destinationhostname CONTAINS "158312-coinbase.com" OR destinationhostname CONTAINS "158372-coinbase.com" OR destinationhostname CONTAINS "158702-coinbase.com" OR destinationhostname CONTAINS "16171675-coinbase.com" OR destinationhostname CONTAINS "16171832-coinbase.com" OR destinationhostname CONTAINS "16178234-coinbase.com" OR destinationhostname CONTAINS "16178237-coinbase.com" OR destinationhostname CONTAINS "16178434-coinbase.com" OR destinationhostname CONTAINS "162178-coinbase.com" OR destinationhostname CONTAINS "162478-coinbase.com" OR destinationhostname CONTAINS "162782-coinbase.com" OR destinationhostname CONTAINS "162812-coinbase.com" OR destinationhostname CONTAINS "162814-coinbase.com" OR destinationhostname CONTAINS "16442580-coinbase.com" OR destinationhostname CONTAINS "16450107-coinbase.com")
index=activity AND rg_functionality="DNS / DHCP" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "official-server.com" OR sourcentdomain CONTAINS "server694590423.tech" OR sourcentdomain CONTAINS "island-placid-bromine.glitch.me" OR sourcentdomain CONTAINS "circular-noon-farmhouse.glitch.me" OR sourcentdomain CONTAINS "talented-friendly-price.glitch.me" OR sourcentdomain CONTAINS "dflfmgsdokasdcpl.com" OR sourcentdomain CONTAINS "original-backend.com" OR sourcentdomain CONTAINS "07159889-coinbase.com" OR sourcentdomain CONTAINS "10195-coinbase.com" OR sourcentdomain CONTAINS "11246-coinbase.com" OR sourcentdomain CONTAINS "11247-coinbase.com" OR sourcentdomain CONTAINS "11248-coinbase.com" OR sourcentdomain CONTAINS "11258-coinbase.com" OR sourcentdomain CONTAINS "11259-coinbase.com" OR sourcentdomain CONTAINS "113912-coinbase.com" OR sourcentdomain CONTAINS "11472-coinbase.com" OR sourcentdomain CONTAINS "11923-coinbase.com" OR sourcentdomain CONTAINS "11957-coinbase.com" OR sourcentdomain CONTAINS "128147-coinbase.com" OR sourcentdomain CONTAINS "12958-coinbase.com" OR sourcentdomain CONTAINS "12984-okta.com" OR sourcentdomain CONTAINS "12985-coinbase.com" OR sourcentdomain CONTAINS "13130-coinbase.com" OR sourcentdomain CONTAINS "13247-coinbase.com" OR sourcentdomain CONTAINS "13247-icloud.com" OR sourcentdomain CONTAINS "13267-coinbase.com" OR sourcentdomain CONTAINS "146271510-coinbase.com" OR sourcentdomain CONTAINS "146282-coinbase.com" OR sourcentdomain CONTAINS "146284-coinbase.com" OR sourcentdomain CONTAINS "147260-coinbase.com" OR sourcentdomain CONTAINS "14765-coinbase.com" OR sourcentdomain CONTAINS "14817582-coinbase.com" OR sourcentdomain CONTAINS "14871904-coinbase.com" OR sourcentdomain CONTAINS "14891902-coinbase.com" OR sourcentdomain CONTAINS "1492864-coinbase.com" OR sourcentdomain CONTAINS "158312-coinbase.com" OR sourcentdomain CONTAINS "158372-coinbase.com" OR sourcentdomain CONTAINS "158702-coinbase.com" OR sourcentdomain CONTAINS "16171675-coinbase.com" OR sourcentdomain CONTAINS "16171832-coinbase.com" OR sourcentdomain CONTAINS "16178234-coinbase.com" OR sourcentdomain CONTAINS "16178237-coinbase.com" OR sourcentdomain CONTAINS "16178434-coinbase.com" OR sourcentdomain CONTAINS "162178-coinbase.com" OR sourcentdomain CONTAINS "162478-coinbase.com" OR sourcentdomain CONTAINS "162782-coinbase.com" OR sourcentdomain CONTAINS "162812-coinbase.com" OR sourcentdomain CONTAINS "162814-coinbase.com" OR sourcentdomain CONTAINS "16442580-coinbase.com" OR sourcentdomain CONTAINS "16450107-coinbase.com")
index=activity AND rg_functionality="DNS / DHCP" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "official-server.com" OR sourcehostname CONTAINS "server694590423.tech" OR sourcehostname CONTAINS "island-placid-bromine.glitch.me" OR sourcehostname CONTAINS "circular-noon-farmhouse.glitch.me" OR sourcehostname CONTAINS "talented-friendly-price.glitch.me" OR sourcehostname CONTAINS "dflfmgsdokasdcpl.com" OR sourcehostname CONTAINS "original-backend.com" OR sourcehostname CONTAINS "07159889-coinbase.com" OR sourcehostname CONTAINS "10195-coinbase.com" OR sourcehostname CONTAINS "11246-coinbase.com" OR sourcehostname CONTAINS "11247-coinbase.com" OR sourcehostname CONTAINS "11248-coinbase.com" OR sourcehostname CONTAINS "11258-coinbase.com" OR sourcehostname CONTAINS "11259-coinbase.com" OR sourcehostname CONTAINS "113912-coinbase.com" OR sourcehostname CONTAINS "11472-coinbase.com" OR sourcehostname CONTAINS "11923-coinbase.com" OR sourcehostname CONTAINS "11957-coinbase.com" OR sourcehostname CONTAINS "128147-coinbase.com" OR sourcehostname CONTAINS "12958-coinbase.com" OR sourcehostname CONTAINS "12984-okta.com" OR sourcehostname CONTAINS "12985-coinbase.com" OR sourcehostname CONTAINS "13130-coinbase.com" OR sourcehostname CONTAINS "13247-coinbase.com" OR sourcehostname CONTAINS "13247-icloud.com" OR sourcehostname CONTAINS "13267-coinbase.com" OR sourcehostname CONTAINS "146271510-coinbase.com" OR sourcehostname CONTAINS "146282-coinbase.com" OR sourcehostname CONTAINS "146284-coinbase.com" OR sourcehostname CONTAINS "147260-coinbase.com" OR sourcehostname CONTAINS "14765-coinbase.com" OR sourcehostname CONTAINS "14817582-coinbase.com" OR sourcehostname CONTAINS "14871904-coinbase.com" OR sourcehostname CONTAINS "14891902-coinbase.com" OR sourcehostname CONTAINS "1492864-coinbase.com" OR sourcehostname CONTAINS "158312-coinbase.com" OR sourcehostname CONTAINS "158372-coinbase.com" OR sourcehostname CONTAINS "158702-coinbase.com" OR sourcehostname CONTAINS "16171675-coinbase.com" OR sourcehostname CONTAINS "16171832-coinbase.com" OR sourcehostname CONTAINS "16178234-coinbase.com" OR sourcehostname CONTAINS "16178237-coinbase.com" OR sourcehostname CONTAINS "16178434-coinbase.com" OR sourcehostname CONTAINS "162178-coinbase.com" OR sourcehostname CONTAINS "162478-coinbase.com" OR sourcehostname CONTAINS "162782-coinbase.com" OR sourcehostname CONTAINS "162812-coinbase.com" OR sourcehostname CONTAINS "162814-coinbase.com" OR sourcehostname CONTAINS "16442580-coinbase.com" OR sourcehostname CONTAINS "16450107-coinbase.com")
index=activity AND rg_functionality="DNS / DHCP" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "official-server.com" OR destinationntdomain CONTAINS "server694590423.tech" OR destinationntdomain CONTAINS "island-placid-bromine.glitch.me" OR destinationntdomain CONTAINS "circular-noon-farmhouse.glitch.me" OR destinationntdomain CONTAINS "talented-friendly-price.glitch.me" OR destinationntdomain CONTAINS "dflfmgsdokasdcpl.com" OR destinationntdomain CONTAINS "original-backend.com" OR destinationntdomain CONTAINS "07159889-coinbase.com" OR destinationntdomain CONTAINS "10195-coinbase.com" OR destinationntdomain CONTAINS "11246-coinbase.com" OR destinationntdomain CONTAINS "11247-coinbase.com" OR destinationntdomain CONTAINS "11248-coinbase.com" OR destinationntdomain CONTAINS "11258-coinbase.com" OR destinationntdomain CONTAINS "11259-coinbase.com" OR destinationntdomain CONTAINS "113912-coinbase.com" OR destinationntdomain CONTAINS "11472-coinbase.com" OR destinationntdomain CONTAINS "11923-coinbase.com" OR destinationntdomain CONTAINS "11957-coinbase.com" OR destinationntdomain CONTAINS "128147-coinbase.com" OR destinationntdomain CONTAINS "12958-coinbase.com" OR destinationntdomain CONTAINS "12984-okta.com" OR destinationntdomain CONTAINS "12985-coinbase.com" OR destinationntdomain CONTAINS "13130-coinbase.com" OR destinationntdomain CONTAINS "13247-coinbase.com" OR destinationntdomain CONTAINS "13247-icloud.com" OR destinationntdomain CONTAINS "13267-coinbase.com" OR destinationntdomain CONTAINS "146271510-coinbase.com" OR destinationntdomain CONTAINS "146282-coinbase.com" OR destinationntdomain CONTAINS "146284-coinbase.com" OR destinationntdomain CONTAINS "147260-coinbase.com" OR destinationntdomain CONTAINS "14765-coinbase.com" OR destinationntdomain CONTAINS "14817582-coinbase.com" OR destinationntdomain CONTAINS "14871904-coinbase.com" OR destinationntdomain CONTAINS "14891902-coinbase.com" OR destinationntdomain CONTAINS "1492864-coinbase.com" OR destinationntdomain CONTAINS "158312-coinbase.com" OR destinationntdomain CONTAINS "158372-coinbase.com" OR destinationntdomain CONTAINS "158702-coinbase.com" OR destinationntdomain CONTAINS "16171675-coinbase.com" OR destinationntdomain CONTAINS "16171832-coinbase.com" OR destinationntdomain CONTAINS "16178234-coinbase.com" OR destinationntdomain CONTAINS "16178237-coinbase.com" OR destinationntdomain CONTAINS "16178434-coinbase.com" OR destinationntdomain CONTAINS "162178-coinbase.com" OR destinationntdomain CONTAINS "162478-coinbase.com" OR destinationntdomain CONTAINS "162782-coinbase.com" OR destinationntdomain CONTAINS "162812-coinbase.com" OR destinationntdomain CONTAINS "162814-coinbase.com" OR destinationntdomain CONTAINS "16442580-coinbase.com" OR destinationntdomain CONTAINS "16450107-coinbase.com")
index=activity AND rg_functionality="DNS / DHCP" AND requesturl NOT NULL AND (requesturl CONTAINS "official-server.com" OR requesturl CONTAINS "server694590423.tech" OR requesturl CONTAINS "island-placid-bromine.glitch.me" OR requesturl CONTAINS "circular-noon-farmhouse.glitch.me" OR requesturl CONTAINS "talented-friendly-price.glitch.me" OR requesturl CONTAINS "dflfmgsdokasdcpl.com" OR requesturl CONTAINS "original-backend.com" OR requesturl CONTAINS "07159889-coinbase.com" OR requesturl CONTAINS "10195-coinbase.com" OR requesturl CONTAINS "11246-coinbase.com" OR requesturl CONTAINS "11247-coinbase.com" OR requesturl CONTAINS "11248-coinbase.com" OR requesturl CONTAINS "11258-coinbase.com" OR requesturl CONTAINS "11259-coinbase.com" OR requesturl CONTAINS "113912-coinbase.com" OR requesturl CONTAINS "11472-coinbase.com" OR requesturl CONTAINS "11923-coinbase.com" OR requesturl CONTAINS "11957-coinbase.com" OR requesturl CONTAINS "128147-coinbase.com" OR requesturl CONTAINS "12958-coinbase.com" OR requesturl CONTAINS "12984-okta.com" OR requesturl CONTAINS "12985-coinbase.com" OR requesturl CONTAINS "13130-coinbase.com" OR requesturl CONTAINS "13247-coinbase.com" OR requesturl CONTAINS "13247-icloud.com" OR requesturl CONTAINS "13267-coinbase.com" OR requesturl CONTAINS "146271510-coinbase.com" OR requesturl CONTAINS "146282-coinbase.com" OR requesturl CONTAINS "146284-coinbase.com" OR requesturl CONTAINS "147260-coinbase.com" OR requesturl CONTAINS "14765-coinbase.com" OR requesturl CONTAINS "14817582-coinbase.com" OR requesturl CONTAINS "14871904-coinbase.com" OR requesturl CONTAINS "14891902-coinbase.com" OR requesturl CONTAINS "1492864-coinbase.com" OR requesturl CONTAINS "158312-coinbase.com" OR requesturl CONTAINS "158372-coinbase.com" OR requesturl CONTAINS "158702-coinbase.com" OR requesturl CONTAINS "16171675-coinbase.com" OR requesturl CONTAINS "16171832-coinbase.com" OR requesturl CONTAINS "16178234-coinbase.com" OR requesturl CONTAINS "16178237-coinbase.com" OR requesturl CONTAINS "16178434-coinbase.com" OR requesturl CONTAINS "162178-coinbase.com" OR requesturl CONTAINS "162478-coinbase.com" OR requesturl CONTAINS "162782-coinbase.com" OR requesturl CONTAINS "162812-coinbase.com" OR requesturl CONTAINS "162814-coinbase.com" OR requesturl CONTAINS "16442580-coinbase.com" OR requesturl CONTAINS "16450107-coinbase.com")
index=activity AND rg_functionality="DNS / DHCP" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "16450207-coinbase.com" OR destinationhostname CONTAINS "16458207-coinbase.com" OR destinationhostname CONTAINS "16478202-coinbase.com" OR destinationhostname CONTAINS "164872942-coinbase.com" OR destinationhostname CONTAINS "16590-coinbase.com" OR destinationhostname CONTAINS "16594373-coinbase.com" OR destinationhostname CONTAINS "16624831-coinbase.com" OR destinationhostname CONTAINS "16642124-coinbase.com" OR destinationhostname CONTAINS "16642172-coinbase.com" OR destinationhostname CONTAINS "16642580-coinbase.com" OR destinationhostname CONTAINS "16642721-coinbase.com" OR destinationhostname CONTAINS "16642724-coinbase.com" OR destinationhostname CONTAINS "16642871-coinbase.com" OR destinationhostname CONTAINS "16642872-coinbase.com" OR destinationhostname CONTAINS "16712942-coinbase.com" OR destinationhostname CONTAINS "16718672-coinbase.com" OR destinationhostname CONTAINS "16728342-coinbase.com" OR destinationhostname CONTAINS "16728348-coinbase.com" OR destinationhostname CONTAINS "16728442-coinbase.com" OR destinationhostname CONTAINS "16728472-coinbase.com" OR destinationhostname CONTAINS "167285-coinbase.com" OR destinationhostname CONTAINS "16729042-coinbase.com" OR destinationhostname CONTAINS "16748272-coinbase.com" OR destinationhostname CONTAINS "16782942-coinbase.com" OR destinationhostname CONTAINS "16827420-coinbase.com" OR destinationhostname CONTAINS "16827423-coinbase.com" OR destinationhostname CONTAINS "16847145-coinbase.com" OR destinationhostname CONTAINS "16893924-coinbase.com" OR destinationhostname CONTAINS "17182-coinbase.com" OR destinationhostname CONTAINS "17255030-coinbase.com" OR destinationhostname CONTAINS "17259-kraken.com" OR destinationhostname CONTAINS "172486-coinbase.com" OR destinationhostname CONTAINS "17284652-coinbase.com" OR destinationhostname CONTAINS "17286-coinbase.com" OR destinationhostname CONTAINS "17334522-coinbase.com" OR destinationhostname CONTAINS "17334522-kraken.com" OR destinationhostname CONTAINS "17384522-coinbase.com" OR destinationhostname CONTAINS "173912-coinbase.com" OR destinationhostname CONTAINS "17494976-coinbase.com" OR destinationhostname CONTAINS "17512854-coinbase.com" OR destinationhostname CONTAINS "17512857-coinbase.com" OR destinationhostname CONTAINS "1751954-coinbase.com" OR destinationhostname CONTAINS "17525030-coinbase.com" OR destinationhostname CONTAINS "17529580-coinbase.com" OR destinationhostname CONTAINS "17614-coinbase.com" OR destinationhostname CONTAINS "17618412-coinbase.com" OR destinationhostname CONTAINS "17619-coinbase.com" OR destinationhostname CONTAINS "176284-coinbase.com" OR destinationhostname CONTAINS "17823920-coinbase.com" OR destinationhostname CONTAINS "178253-coinbase.com")
index=activity AND rg_functionality="DNS / DHCP" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "16450207-coinbase.com" OR sourcentdomain CONTAINS "16458207-coinbase.com" OR sourcentdomain CONTAINS "16478202-coinbase.com" OR sourcentdomain CONTAINS "164872942-coinbase.com" OR sourcentdomain CONTAINS "16590-coinbase.com" OR sourcentdomain CONTAINS "16594373-coinbase.com" OR sourcentdomain CONTAINS "16624831-coinbase.com" OR sourcentdomain CONTAINS "16642124-coinbase.com" OR sourcentdomain CONTAINS "16642172-coinbase.com" OR sourcentdomain CONTAINS "16642580-coinbase.com" OR sourcentdomain CONTAINS "16642721-coinbase.com" OR sourcentdomain CONTAINS "16642724-coinbase.com" OR sourcentdomain CONTAINS "16642871-coinbase.com" OR sourcentdomain CONTAINS "16642872-coinbase.com" OR sourcentdomain CONTAINS "16712942-coinbase.com" OR sourcentdomain CONTAINS "16718672-coinbase.com" OR sourcentdomain CONTAINS "16728342-coinbase.com" OR sourcentdomain CONTAINS "16728348-coinbase.com" OR sourcentdomain CONTAINS "16728442-coinbase.com" OR sourcentdomain CONTAINS "16728472-coinbase.com" OR sourcentdomain CONTAINS "167285-coinbase.com" OR sourcentdomain CONTAINS "16729042-coinbase.com" OR sourcentdomain CONTAINS "16748272-coinbase.com" OR sourcentdomain CONTAINS "16782942-coinbase.com" OR sourcentdomain CONTAINS "16827420-coinbase.com" OR sourcentdomain CONTAINS "16827423-coinbase.com" OR sourcentdomain CONTAINS "16847145-coinbase.com" OR sourcentdomain CONTAINS "16893924-coinbase.com" OR sourcentdomain CONTAINS "17182-coinbase.com" OR sourcentdomain CONTAINS "17255030-coinbase.com" OR sourcentdomain CONTAINS "17259-kraken.com" OR sourcentdomain CONTAINS "172486-coinbase.com" OR sourcentdomain CONTAINS "17284652-coinbase.com" OR sourcentdomain CONTAINS "17286-coinbase.com" OR sourcentdomain CONTAINS "17334522-coinbase.com" OR sourcentdomain CONTAINS "17334522-kraken.com" OR sourcentdomain CONTAINS "17384522-coinbase.com" OR sourcentdomain CONTAINS "173912-coinbase.com" OR sourcentdomain CONTAINS "17494976-coinbase.com" OR sourcentdomain CONTAINS "17512854-coinbase.com" OR sourcentdomain CONTAINS "17512857-coinbase.com" OR sourcentdomain CONTAINS "1751954-coinbase.com" OR sourcentdomain CONTAINS "17525030-coinbase.com" OR sourcentdomain CONTAINS "17529580-coinbase.com" OR sourcentdomain CONTAINS "17614-coinbase.com" OR sourcentdomain CONTAINS "17618412-coinbase.com" OR sourcentdomain CONTAINS "17619-coinbase.com" OR sourcentdomain CONTAINS "176284-coinbase.com" OR sourcentdomain CONTAINS "17823920-coinbase.com" OR sourcentdomain CONTAINS "178253-coinbase.com")
index=activity AND rg_functionality="DNS / DHCP" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "16450207-coinbase.com" OR sourcehostname CONTAINS "16458207-coinbase.com" OR sourcehostname CONTAINS "16478202-coinbase.com" OR sourcehostname CONTAINS "164872942-coinbase.com" OR sourcehostname CONTAINS "16590-coinbase.com" OR sourcehostname CONTAINS "16594373-coinbase.com" OR sourcehostname CONTAINS "16624831-coinbase.com" OR sourcehostname CONTAINS "16642124-coinbase.com" OR sourcehostname CONTAINS "16642172-coinbase.com" OR sourcehostname CONTAINS "16642580-coinbase.com" OR sourcehostname CONTAINS "16642721-coinbase.com" OR sourcehostname CONTAINS "16642724-coinbase.com" OR sourcehostname CONTAINS "16642871-coinbase.com" OR sourcehostname CONTAINS "16642872-coinbase.com" OR sourcehostname CONTAINS "16712942-coinbase.com" OR sourcehostname CONTAINS "16718672-coinbase.com" OR sourcehostname CONTAINS "16728342-coinbase.com" OR sourcehostname CONTAINS "16728348-coinbase.com" OR sourcehostname CONTAINS "16728442-coinbase.com" OR sourcehostname CONTAINS "16728472-coinbase.com" OR sourcehostname CONTAINS "167285-coinbase.com" OR sourcehostname CONTAINS "16729042-coinbase.com" OR sourcehostname CONTAINS "16748272-coinbase.com" OR sourcehostname CONTAINS "16782942-coinbase.com" OR sourcehostname CONTAINS "16827420-coinbase.com" OR sourcehostname CONTAINS "16827423-coinbase.com" OR sourcehostname CONTAINS "16847145-coinbase.com" OR sourcehostname CONTAINS "16893924-coinbase.com" OR sourcehostname CONTAINS "17182-coinbase.com" OR sourcehostname CONTAINS "17255030-coinbase.com" OR sourcehostname CONTAINS "17259-kraken.com" OR sourcehostname CONTAINS "172486-coinbase.com" OR sourcehostname CONTAINS "17284652-coinbase.com" OR sourcehostname CONTAINS "17286-coinbase.com" OR sourcehostname CONTAINS "17334522-coinbase.com" OR sourcehostname CONTAINS "17334522-kraken.com" OR sourcehostname CONTAINS "17384522-coinbase.com" OR sourcehostname CONTAINS "173912-coinbase.com" OR sourcehostname CONTAINS "17494976-coinbase.com" OR sourcehostname CONTAINS "17512854-coinbase.com" OR sourcehostname CONTAINS "17512857-coinbase.com" OR sourcehostname CONTAINS "1751954-coinbase.com" OR sourcehostname CONTAINS "17525030-coinbase.com" OR sourcehostname CONTAINS "17529580-coinbase.com" OR sourcehostname CONTAINS "17614-coinbase.com" OR sourcehostname CONTAINS "17618412-coinbase.com" OR sourcehostname CONTAINS "17619-coinbase.com" OR sourcehostname CONTAINS "176284-coinbase.com" OR sourcehostname CONTAINS "17823920-coinbase.com" OR sourcehostname CONTAINS "178253-coinbase.com")
index=activity AND rg_functionality="DNS / DHCP" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "16450207-coinbase.com" OR destinationntdomain CONTAINS "16458207-coinbase.com" OR destinationntdomain CONTAINS "16478202-coinbase.com" OR destinationntdomain CONTAINS "164872942-coinbase.com" OR destinationntdomain CONTAINS "16590-coinbase.com" OR destinationntdomain CONTAINS "16594373-coinbase.com" OR destinationntdomain CONTAINS "16624831-coinbase.com" OR destinationntdomain CONTAINS "16642124-coinbase.com" OR destinationntdomain CONTAINS "16642172-coinbase.com" OR destinationntdomain CONTAINS "16642580-coinbase.com" OR destinationntdomain CONTAINS "16642721-coinbase.com" OR destinationntdomain CONTAINS "16642724-coinbase.com" OR destinationntdomain CONTAINS "16642871-coinbase.com" OR destinationntdomain CONTAINS "16642872-coinbase.com" OR destinationntdomain CONTAINS "16712942-coinbase.com" OR destinationntdomain CONTAINS "16718672-coinbase.com" OR destinationntdomain CONTAINS "16728342-coinbase.com" OR destinationntdomain CONTAINS "16728348-coinbase.com" OR destinationntdomain CONTAINS "16728442-coinbase.com" OR destinationntdomain CONTAINS "16728472-coinbase.com" OR destinationntdomain CONTAINS "167285-coinbase.com" OR destinationntdomain CONTAINS "16729042-coinbase.com" OR destinationntdomain CONTAINS "16748272-coinbase.com" OR destinationntdomain CONTAINS "16782942-coinbase.com" OR destinationntdomain CONTAINS "16827420-coinbase.com" OR destinationntdomain CONTAINS "16827423-coinbase.com" OR destinationntdomain CONTAINS "16847145-coinbase.com" OR destinationntdomain CONTAINS "16893924-coinbase.com" OR destinationntdomain CONTAINS "17182-coinbase.com" OR destinationntdomain CONTAINS "17255030-coinbase.com" OR destinationntdomain CONTAINS "17259-kraken.com" OR destinationntdomain CONTAINS "172486-coinbase.com" OR destinationntdomain CONTAINS "17284652-coinbase.com" OR destinationntdomain CONTAINS "17286-coinbase.com" OR destinationntdomain CONTAINS "17334522-coinbase.com" OR destinationntdomain CONTAINS "17334522-kraken.com" OR destinationntdomain CONTAINS "17384522-coinbase.com" OR destinationntdomain CONTAINS "173912-coinbase.com" OR destinationntdomain CONTAINS "17494976-coinbase.com" OR destinationntdomain CONTAINS "17512854-coinbase.com" OR destinationntdomain CONTAINS "17512857-coinbase.com" OR destinationntdomain CONTAINS "1751954-coinbase.com" OR destinationntdomain CONTAINS "17525030-coinbase.com" OR destinationntdomain CONTAINS "17529580-coinbase.com" OR destinationntdomain CONTAINS "17614-coinbase.com" OR destinationntdomain CONTAINS "17618412-coinbase.com" OR destinationntdomain CONTAINS "17619-coinbase.com" OR destinationntdomain CONTAINS "176284-coinbase.com" OR destinationntdomain CONTAINS "17823920-coinbase.com" OR destinationntdomain CONTAINS "178253-coinbase.com")
index=activity AND rg_functionality="DNS / DHCP" AND requesturl NOT NULL AND (requesturl CONTAINS "16450207-coinbase.com" OR requesturl CONTAINS "16458207-coinbase.com" OR requesturl CONTAINS "16478202-coinbase.com" OR requesturl CONTAINS "164872942-coinbase.com" OR requesturl CONTAINS "16590-coinbase.com" OR requesturl CONTAINS "16594373-coinbase.com" OR requesturl CONTAINS "16624831-coinbase.com" OR requesturl CONTAINS "16642124-coinbase.com" OR requesturl CONTAINS "16642172-coinbase.com" OR requesturl CONTAINS "16642580-coinbase.com" OR requesturl CONTAINS "16642721-coinbase.com" OR requesturl CONTAINS "16642724-coinbase.com" OR requesturl CONTAINS "16642871-coinbase.com" OR requesturl CONTAINS "16642872-coinbase.com" OR requesturl CONTAINS "16712942-coinbase.com" OR requesturl CONTAINS "16718672-coinbase.com" OR requesturl CONTAINS "16728342-coinbase.com" OR requesturl CONTAINS "16728348-coinbase.com" OR requesturl CONTAINS "16728442-coinbase.com" OR requesturl CONTAINS "16728472-coinbase.com" OR requesturl CONTAINS "167285-coinbase.com" OR requesturl CONTAINS "16729042-coinbase.com" OR requesturl CONTAINS "16748272-coinbase.com" OR requesturl CONTAINS "16782942-coinbase.com" OR requesturl CONTAINS "16827420-coinbase.com" OR requesturl CONTAINS "16827423-coinbase.com" OR requesturl CONTAINS "16847145-coinbase.com" OR requesturl CONTAINS "16893924-coinbase.com" OR requesturl CONTAINS "17182-coinbase.com" OR requesturl CONTAINS "17255030-coinbase.com" OR requesturl CONTAINS "17259-kraken.com" OR requesturl CONTAINS "172486-coinbase.com" OR requesturl CONTAINS "17284652-coinbase.com" OR requesturl CONTAINS "17286-coinbase.com" OR requesturl CONTAINS "17334522-coinbase.com" OR requesturl CONTAINS "17334522-kraken.com" OR requesturl CONTAINS "17384522-coinbase.com" OR requesturl CONTAINS "173912-coinbase.com" OR requesturl CONTAINS "17494976-coinbase.com" OR requesturl CONTAINS "17512854-coinbase.com" OR requesturl CONTAINS "17512857-coinbase.com" OR requesturl CONTAINS "1751954-coinbase.com" OR requesturl CONTAINS "17525030-coinbase.com" OR requesturl CONTAINS "17529580-coinbase.com" OR requesturl CONTAINS "17614-coinbase.com" OR requesturl CONTAINS "17618412-coinbase.com" OR requesturl CONTAINS "17619-coinbase.com" OR requesturl CONTAINS "176284-coinbase.com" OR requesturl CONTAINS "17823920-coinbase.com" OR requesturl CONTAINS "178253-coinbase.com")
index=activity AND rg_functionality="DNS / DHCP" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "178294-coinbase.com" OR destinationhostname CONTAINS "17912-coinbase.com" OR destinationhostname CONTAINS "17914-coinbase.com" OR destinationhostname CONTAINS "17917-coinbase.com" OR destinationhostname CONTAINS "17954-coinbase.com" OR destinationhostname CONTAINS "17958-coinbase.com" OR destinationhostname CONTAINS "182043-coinbase.com" OR destinationhostname CONTAINS "18275-gemini.com" OR destinationhostname CONTAINS "18276-coinbase.com" OR destinationhostname CONTAINS "18290185-coinbase.com" OR destinationhostname CONTAINS "182967-coinbase.com" OR destinationhostname CONTAINS "18560-coinbase.com" OR destinationhostname CONTAINS "18571-coinbase.com" OR destinationhostname CONTAINS "185912-coinbase.com" OR destinationhostname CONTAINS "185914-coinbase.com" OR destinationhostname CONTAINS "18592176-coinbase.com" OR destinationhostname CONTAINS "18594162-coinbase.com" OR destinationhostname CONTAINS "18594962-coinbase.com" OR destinationhostname CONTAINS "18597162-coinbase.com" OR destinationhostname CONTAINS "18719562-coinbase.com" OR destinationhostname CONTAINS "1875290-coinbase.com" OR destinationhostname CONTAINS "1882730-coinbase.com" OR destinationhostname CONTAINS "18902-coinbase.com" OR destinationhostname CONTAINS "18903-coinbase.com" OR destinationhostname CONTAINS "189126-coinbase.com" OR destinationhostname CONTAINS "18952-coinbase.com" OR destinationhostname CONTAINS "192854-coinbase.com" OR destinationhostname CONTAINS "192856-coinbase.com" OR destinationhostname CONTAINS "19287-binance.com" OR destinationhostname CONTAINS "19572-coinbase.com" OR destinationhostname CONTAINS "195812-coinbase.com" OR destinationhostname CONTAINS "195826-coinbase.com" OR destinationhostname CONTAINS "1958262-coinbase.com" OR destinationhostname CONTAINS "195827-binance.com" OR destinationhostname CONTAINS "1958297-coinbase.com" OR destinationhostname CONTAINS "19582970-coinbase.com" OR destinationhostname CONTAINS "19582971-coinbase.com" OR destinationhostname CONTAINS "19583-coinbase.com" OR destinationhostname CONTAINS "19592653-coinbase.com" OR destinationhostname CONTAINS "197304-coinbase.com" OR destinationhostname CONTAINS "19730492-coinbase.com" OR destinationhostname CONTAINS "19764162-coinbase.com" OR destinationhostname CONTAINS "19803-coinbase.com" OR destinationhostname CONTAINS "201784289-coinbase.com" OR destinationhostname CONTAINS "210823644-coinbase.com" OR destinationhostname CONTAINS "21158-coinbase.com" OR destinationhostname CONTAINS "21509-coinbase.com" OR destinationhostname CONTAINS "25985-coinbase.com" OR destinationhostname CONTAINS "27699-coinbase.com" OR destinationhostname CONTAINS "28367-coinbase.com")
index=activity AND rg_functionality="DNS / DHCP" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "178294-coinbase.com" OR sourcentdomain CONTAINS "17912-coinbase.com" OR sourcentdomain CONTAINS "17914-coinbase.com" OR sourcentdomain CONTAINS "17917-coinbase.com" OR sourcentdomain CONTAINS "17954-coinbase.com" OR sourcentdomain CONTAINS "17958-coinbase.com" OR sourcentdomain CONTAINS "182043-coinbase.com" OR sourcentdomain CONTAINS "18275-gemini.com" OR sourcentdomain CONTAINS "18276-coinbase.com" OR sourcentdomain CONTAINS "18290185-coinbase.com" OR sourcentdomain CONTAINS "182967-coinbase.com" OR sourcentdomain CONTAINS "18560-coinbase.com" OR sourcentdomain CONTAINS "18571-coinbase.com" OR sourcentdomain CONTAINS "185912-coinbase.com" OR sourcentdomain CONTAINS "185914-coinbase.com" OR sourcentdomain CONTAINS "18592176-coinbase.com" OR sourcentdomain CONTAINS "18594162-coinbase.com" OR sourcentdomain CONTAINS "18594962-coinbase.com" OR sourcentdomain CONTAINS "18597162-coinbase.com" OR sourcentdomain CONTAINS "18719562-coinbase.com" OR sourcentdomain CONTAINS "1875290-coinbase.com" OR sourcentdomain CONTAINS "1882730-coinbase.com" OR sourcentdomain CONTAINS "18902-coinbase.com" OR sourcentdomain CONTAINS "18903-coinbase.com" OR sourcentdomain CONTAINS "189126-coinbase.com" OR sourcentdomain CONTAINS "18952-coinbase.com" OR sourcentdomain CONTAINS "192854-coinbase.com" OR sourcentdomain CONTAINS "192856-coinbase.com" OR sourcentdomain CONTAINS "19287-binance.com" OR sourcentdomain CONTAINS "19572-coinbase.com" OR sourcentdomain CONTAINS "195812-coinbase.com" OR sourcentdomain CONTAINS "195826-coinbase.com" OR sourcentdomain CONTAINS "1958262-coinbase.com" OR sourcentdomain CONTAINS "195827-binance.com" OR sourcentdomain CONTAINS "1958297-coinbase.com" OR sourcentdomain CONTAINS "19582970-coinbase.com" OR sourcentdomain CONTAINS "19582971-coinbase.com" OR sourcentdomain CONTAINS "19583-coinbase.com" OR sourcentdomain CONTAINS "19592653-coinbase.com" OR sourcentdomain CONTAINS "197304-coinbase.com" OR sourcentdomain CONTAINS "19730492-coinbase.com" OR sourcentdomain CONTAINS "19764162-coinbase.com" OR sourcentdomain CONTAINS "19803-coinbase.com" OR sourcentdomain CONTAINS "201784289-coinbase.com" OR sourcentdomain CONTAINS "210823644-coinbase.com" OR sourcentdomain CONTAINS "21158-coinbase.com" OR sourcentdomain CONTAINS "21509-coinbase.com" OR sourcentdomain CONTAINS "25985-coinbase.com" OR sourcentdomain CONTAINS "27699-coinbase.com" OR sourcentdomain CONTAINS "28367-coinbase.com")
index=activity AND rg_functionality="DNS / DHCP" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "178294-coinbase.com" OR sourcehostname CONTAINS "17912-coinbase.com" OR sourcehostname CONTAINS "17914-coinbase.com" OR sourcehostname CONTAINS "17917-coinbase.com" OR sourcehostname CONTAINS "17954-coinbase.com" OR sourcehostname CONTAINS "17958-coinbase.com" OR sourcehostname CONTAINS "182043-coinbase.com" OR sourcehostname CONTAINS "18275-gemini.com" OR sourcehostname CONTAINS "18276-coinbase.com" OR sourcehostname CONTAINS "18290185-coinbase.com" OR sourcehostname CONTAINS "182967-coinbase.com" OR sourcehostname CONTAINS "18560-coinbase.com" OR sourcehostname CONTAINS "18571-coinbase.com" OR sourcehostname CONTAINS "185912-coinbase.com" OR sourcehostname CONTAINS "185914-coinbase.com" OR sourcehostname CONTAINS "18592176-coinbase.com" OR sourcehostname CONTAINS "18594162-coinbase.com" OR sourcehostname CONTAINS "18594962-coinbase.com" OR sourcehostname CONTAINS "18597162-coinbase.com" OR sourcehostname CONTAINS "18719562-coinbase.com" OR sourcehostname CONTAINS "1875290-coinbase.com" OR sourcehostname CONTAINS "1882730-coinbase.com" OR sourcehostname CONTAINS "18902-coinbase.com" OR sourcehostname CONTAINS "18903-coinbase.com" OR sourcehostname CONTAINS "189126-coinbase.com" OR sourcehostname CONTAINS "18952-coinbase.com" OR sourcehostname CONTAINS "192854-coinbase.com" OR sourcehostname CONTAINS "192856-coinbase.com" OR sourcehostname CONTAINS "19287-binance.com" OR sourcehostname CONTAINS "19572-coinbase.com" OR sourcehostname CONTAINS "195812-coinbase.com" OR sourcehostname CONTAINS "195826-coinbase.com" OR sourcehostname CONTAINS "1958262-coinbase.com" OR sourcehostname CONTAINS "195827-binance.com" OR sourcehostname CONTAINS "1958297-coinbase.com" OR sourcehostname CONTAINS "19582970-coinbase.com" OR sourcehostname CONTAINS "19582971-coinbase.com" OR sourcehostname CONTAINS "19583-coinbase.com" OR sourcehostname CONTAINS "19592653-coinbase.com" OR sourcehostname CONTAINS "197304-coinbase.com" OR sourcehostname CONTAINS "19730492-coinbase.com" OR sourcehostname CONTAINS "19764162-coinbase.com" OR sourcehostname CONTAINS "19803-coinbase.com" OR sourcehostname CONTAINS "201784289-coinbase.com" OR sourcehostname CONTAINS "210823644-coinbase.com" OR sourcehostname CONTAINS "21158-coinbase.com" OR sourcehostname CONTAINS "21509-coinbase.com" OR sourcehostname CONTAINS "25985-coinbase.com" OR sourcehostname CONTAINS "27699-coinbase.com" OR sourcehostname CONTAINS "28367-coinbase.com")
index=activity AND rg_functionality="DNS / DHCP" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "178294-coinbase.com" OR destinationntdomain CONTAINS "17912-coinbase.com" OR destinationntdomain CONTAINS "17914-coinbase.com" OR destinationntdomain CONTAINS "17917-coinbase.com" OR destinationntdomain CONTAINS "17954-coinbase.com" OR destinationntdomain CONTAINS "17958-coinbase.com" OR destinationntdomain CONTAINS "182043-coinbase.com" OR destinationntdomain CONTAINS "18275-gemini.com" OR destinationntdomain CONTAINS "18276-coinbase.com" OR destinationntdomain CONTAINS "18290185-coinbase.com" OR destinationntdomain CONTAINS "182967-coinbase.com" OR destinationntdomain CONTAINS "18560-coinbase.com" OR destinationntdomain CONTAINS "18571-coinbase.com" OR destinationntdomain CONTAINS "185912-coinbase.com" OR destinationntdomain CONTAINS "185914-coinbase.com" OR destinationntdomain CONTAINS "18592176-coinbase.com" OR destinationntdomain CONTAINS "18594162-coinbase.com" OR destinationntdomain CONTAINS "18594962-coinbase.com" OR destinationntdomain CONTAINS "18597162-coinbase.com" OR destinationntdomain CONTAINS "18719562-coinbase.com" OR destinationntdomain CONTAINS "1875290-coinbase.com" OR destinationntdomain CONTAINS "1882730-coinbase.com" OR destinationntdomain CONTAINS "18902-coinbase.com" OR destinationntdomain CONTAINS "18903-coinbase.com" OR destinationntdomain CONTAINS "189126-coinbase.com" OR destinationntdomain CONTAINS "18952-coinbase.com" OR destinationntdomain CONTAINS "192854-coinbase.com" OR destinationntdomain CONTAINS "192856-coinbase.com" OR destinationntdomain CONTAINS "19287-binance.com" OR destinationntdomain CONTAINS "19572-coinbase.com" OR destinationntdomain CONTAINS "195812-coinbase.com" OR destinationntdomain CONTAINS "195826-coinbase.com" OR destinationntdomain CONTAINS "1958262-coinbase.com" OR destinationntdomain CONTAINS "195827-binance.com" OR destinationntdomain CONTAINS "1958297-coinbase.com" OR destinationntdomain CONTAINS "19582970-coinbase.com" OR destinationntdomain CONTAINS "19582971-coinbase.com" OR destinationntdomain CONTAINS "19583-coinbase.com" OR destinationntdomain CONTAINS "19592653-coinbase.com" OR destinationntdomain CONTAINS "197304-coinbase.com" OR destinationntdomain CONTAINS "19730492-coinbase.com" OR destinationntdomain CONTAINS "19764162-coinbase.com" OR destinationntdomain CONTAINS "19803-coinbase.com" OR destinationntdomain CONTAINS "201784289-coinbase.com" OR destinationntdomain CONTAINS "210823644-coinbase.com" OR destinationntdomain CONTAINS "21158-coinbase.com" OR destinationntdomain CONTAINS "21509-coinbase.com" OR destinationntdomain CONTAINS "25985-coinbase.com" OR destinationntdomain CONTAINS "27699-coinbase.com" OR destinationntdomain CONTAINS "28367-coinbase.com")
index=activity AND rg_functionality="DNS / DHCP" AND requesturl NOT NULL AND (requesturl CONTAINS "178294-coinbase.com" OR requesturl CONTAINS "17912-coinbase.com" OR requesturl CONTAINS "17914-coinbase.com" OR requesturl CONTAINS "17917-coinbase.com" OR requesturl CONTAINS "17954-coinbase.com" OR requesturl CONTAINS "17958-coinbase.com" OR requesturl CONTAINS "182043-coinbase.com" OR requesturl CONTAINS "18275-gemini.com" OR requesturl CONTAINS "18276-coinbase.com" OR requesturl CONTAINS "18290185-coinbase.com" OR requesturl CONTAINS "182967-coinbase.com" OR requesturl CONTAINS "18560-coinbase.com" OR requesturl CONTAINS "18571-coinbase.com" OR requesturl CONTAINS "185912-coinbase.com" OR requesturl CONTAINS "185914-coinbase.com" OR requesturl CONTAINS "18592176-coinbase.com" OR requesturl CONTAINS "18594162-coinbase.com" OR requesturl CONTAINS "18594962-coinbase.com" OR requesturl CONTAINS "18597162-coinbase.com" OR requesturl CONTAINS "18719562-coinbase.com" OR requesturl CONTAINS "1875290-coinbase.com" OR requesturl CONTAINS "1882730-coinbase.com" OR requesturl CONTAINS "18902-coinbase.com" OR requesturl CONTAINS "18903-coinbase.com" OR requesturl CONTAINS "189126-coinbase.com" OR requesturl CONTAINS "18952-coinbase.com" OR requesturl CONTAINS "192854-coinbase.com" OR requesturl CONTAINS "192856-coinbase.com" OR requesturl CONTAINS "19287-binance.com" OR requesturl CONTAINS "19572-coinbase.com" OR requesturl CONTAINS "195812-coinbase.com" OR requesturl CONTAINS "195826-coinbase.com" OR requesturl CONTAINS "1958262-coinbase.com" OR requesturl CONTAINS "195827-binance.com" OR requesturl CONTAINS "1958297-coinbase.com" OR requesturl CONTAINS "19582970-coinbase.com" OR requesturl CONTAINS "19582971-coinbase.com" OR requesturl CONTAINS "19583-coinbase.com" OR requesturl CONTAINS "19592653-coinbase.com" OR requesturl CONTAINS "197304-coinbase.com" OR requesturl CONTAINS "19730492-coinbase.com" OR requesturl CONTAINS "19764162-coinbase.com" OR requesturl CONTAINS "19803-coinbase.com" OR requesturl CONTAINS "201784289-coinbase.com" OR requesturl CONTAINS "210823644-coinbase.com" OR requesturl CONTAINS "21158-coinbase.com" OR requesturl CONTAINS "21509-coinbase.com" OR requesturl CONTAINS "25985-coinbase.com" OR requesturl CONTAINS "27699-coinbase.com" OR requesturl CONTAINS "28367-coinbase.com")
index=activity AND rg_functionality="DNS / DHCP" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "28676-coinbase.com" OR destinationhostname CONTAINS "29185-coinbase.com" OR destinationhostname CONTAINS "29195-coinbase.com" OR destinationhostname CONTAINS "2a-coinbase.com" OR destinationhostname CONTAINS "2b-coinbase.com" OR destinationhostname CONTAINS "2c-coinbase.com" OR destinationhostname CONTAINS "2f-coinbase.com" OR destinationhostname CONTAINS "2fas-coinbase.com" OR destinationhostname CONTAINS "2o-coinbase.com" OR destinationhostname CONTAINS "2r-coinbase.com" OR destinationhostname CONTAINS "2s-coinbase.com" OR destinationhostname CONTAINS "2sv-coinbase.com" OR destinationhostname CONTAINS "352134951-coinbase.com" OR destinationhostname CONTAINS "38468-coinbase.com" OR destinationhostname CONTAINS "39590-coinbase.com" OR destinationhostname CONTAINS "41260-coinbase.com" OR destinationhostname CONTAINS "427883-coinbase.com" OR destinationhostname CONTAINS "43017-coinbase.com" OR destinationhostname CONTAINS "47562-coinbase.com" OR destinationhostname CONTAINS "50195-coinbase.com" OR destinationhostname CONTAINS "5247-coinbase.com" OR destinationhostname CONTAINS "54765-coinbase.com" OR destinationhostname CONTAINS "57197-coinbase.com" OR destinationhostname CONTAINS "58176-coinbase.com" OR destinationhostname CONTAINS "58297-coinbase.com" OR destinationhostname CONTAINS "61250-coinbase.com" OR destinationhostname CONTAINS "61835-coinbase.com" OR destinationhostname CONTAINS "61851-coinbase.com" OR destinationhostname CONTAINS "61937-coinbase.com" OR destinationhostname CONTAINS "71925-coinbase.com" OR destinationhostname CONTAINS "72957-coinbase.com" OR destinationhostname CONTAINS "72985-coinbase.com" OR destinationhostname CONTAINS "74651-coinbase.com" OR destinationhostname CONTAINS "754668948-coinbase.com" OR destinationhostname CONTAINS "76159869-coinbase.com" OR destinationhostname CONTAINS "76153-coinbase.com" OR destinationhostname CONTAINS "81758-coinbase.com" OR destinationhostname CONTAINS "81920-coinbase.com" OR destinationhostname CONTAINS "81926-coinbase.com" OR destinationhostname CONTAINS "81958-coinbase.com" OR destinationhostname CONTAINS "826298-coinbase.com" OR destinationhostname CONTAINS "83216-coinbase.com" OR destinationhostname CONTAINS "837613-coinbase.com" OR destinationhostname CONTAINS "83956-coinbase.com" OR destinationhostname CONTAINS "87157-coinbase.com" OR destinationhostname CONTAINS "87312-coinbase.com" OR destinationhostname CONTAINS "89304-coinbase.com" OR destinationhostname CONTAINS "89375-coinbase.com" OR destinationhostname CONTAINS "91723-gemini.com" OR destinationhostname CONTAINS "91752-coinbase.com")
index=activity AND rg_functionality="DNS / DHCP" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "28676-coinbase.com" OR sourcentdomain CONTAINS "29185-coinbase.com" OR sourcentdomain CONTAINS "29195-coinbase.com" OR sourcentdomain CONTAINS "2a-coinbase.com" OR sourcentdomain CONTAINS "2b-coinbase.com" OR sourcentdomain CONTAINS "2c-coinbase.com" OR sourcentdomain CONTAINS "2f-coinbase.com" OR sourcentdomain CONTAINS "2fas-coinbase.com" OR sourcentdomain CONTAINS "2o-coinbase.com" OR sourcentdomain CONTAINS "2r-coinbase.com" OR sourcentdomain CONTAINS "2s-coinbase.com" OR sourcentdomain CONTAINS "2sv-coinbase.com" OR sourcentdomain CONTAINS "352134951-coinbase.com" OR sourcentdomain CONTAINS "38468-coinbase.com" OR sourcentdomain CONTAINS "39590-coinbase.com" OR sourcentdomain CONTAINS "41260-coinbase.com" OR sourcentdomain CONTAINS "427883-coinbase.com" OR sourcentdomain CONTAINS "43017-coinbase.com" OR sourcentdomain CONTAINS "47562-coinbase.com" OR sourcentdomain CONTAINS "50195-coinbase.com" OR sourcentdomain CONTAINS "5247-coinbase.com" OR sourcentdomain CONTAINS "54765-coinbase.com" OR sourcentdomain CONTAINS "57197-coinbase.com" OR sourcentdomain CONTAINS "58176-coinbase.com" OR sourcentdomain CONTAINS "58297-coinbase.com" OR sourcentdomain CONTAINS "61250-coinbase.com" OR sourcentdomain CONTAINS "61835-coinbase.com" OR sourcentdomain CONTAINS "61851-coinbase.com" OR sourcentdomain CONTAINS "61937-coinbase.com" OR sourcentdomain CONTAINS "71925-coinbase.com" OR sourcentdomain CONTAINS "72957-coinbase.com" OR sourcentdomain CONTAINS "72985-coinbase.com" OR sourcentdomain CONTAINS "74651-coinbase.com" OR sourcentdomain CONTAINS "754668948-coinbase.com" OR sourcentdomain CONTAINS "76159869-coinbase.com" OR sourcentdomain CONTAINS "76153-coinbase.com" OR sourcentdomain CONTAINS "81758-coinbase.com" OR sourcentdomain CONTAINS "81920-coinbase.com" OR sourcentdomain CONTAINS "81926-coinbase.com" OR sourcentdomain CONTAINS "81958-coinbase.com" OR sourcentdomain CONTAINS "826298-coinbase.com" OR sourcentdomain CONTAINS "83216-coinbase.com" OR sourcentdomain CONTAINS "837613-coinbase.com" OR sourcentdomain CONTAINS "83956-coinbase.com" OR sourcentdomain CONTAINS "87157-coinbase.com" OR sourcentdomain CONTAINS "87312-coinbase.com" OR sourcentdomain CONTAINS "89304-coinbase.com" OR sourcentdomain CONTAINS "89375-coinbase.com" OR sourcentdomain CONTAINS "91723-gemini.com" OR sourcentdomain CONTAINS "91752-coinbase.com")
index=activity AND rg_functionality="DNS / DHCP" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "28676-coinbase.com" OR sourcehostname CONTAINS "29185-coinbase.com" OR sourcehostname CONTAINS "29195-coinbase.com" OR sourcehostname CONTAINS "2a-coinbase.com" OR sourcehostname CONTAINS "2b-coinbase.com" OR sourcehostname CONTAINS "2c-coinbase.com" OR sourcehostname CONTAINS "2f-coinbase.com" OR sourcehostname CONTAINS "2fas-coinbase.com" OR sourcehostname CONTAINS "2o-coinbase.com" OR sourcehostname CONTAINS "2r-coinbase.com" OR sourcehostname CONTAINS "2s-coinbase.com" OR sourcehostname CONTAINS "2sv-coinbase.com" OR sourcehostname CONTAINS "352134951-coinbase.com" OR sourcehostname CONTAINS "38468-coinbase.com" OR sourcehostname CONTAINS "39590-coinbase.com" OR sourcehostname CONTAINS "41260-coinbase.com" OR sourcehostname CONTAINS "427883-coinbase.com" OR sourcehostname CONTAINS "43017-coinbase.com" OR sourcehostname CONTAINS "47562-coinbase.com" OR sourcehostname CONTAINS "50195-coinbase.com" OR sourcehostname CONTAINS "5247-coinbase.com" OR sourcehostname CONTAINS "54765-coinbase.com" OR sourcehostname CONTAINS "57197-coinbase.com" OR sourcehostname CONTAINS "58176-coinbase.com" OR sourcehostname CONTAINS "58297-coinbase.com" OR sourcehostname CONTAINS "61250-coinbase.com" OR sourcehostname CONTAINS "61835-coinbase.com" OR sourcehostname CONTAINS "61851-coinbase.com" OR sourcehostname CONTAINS "61937-coinbase.com" OR sourcehostname CONTAINS "71925-coinbase.com" OR sourcehostname CONTAINS "72957-coinbase.com" OR sourcehostname CONTAINS "72985-coinbase.com" OR sourcehostname CONTAINS "74651-coinbase.com" OR sourcehostname CONTAINS "754668948-coinbase.com" OR sourcehostname CONTAINS "76159869-coinbase.com" OR sourcehostname CONTAINS "76153-coinbase.com" OR sourcehostname CONTAINS "81758-coinbase.com" OR sourcehostname CONTAINS "81920-coinbase.com" OR sourcehostname CONTAINS "81926-coinbase.com" OR sourcehostname CONTAINS "81958-coinbase.com" OR sourcehostname CONTAINS "826298-coinbase.com" OR sourcehostname CONTAINS "83216-coinbase.com" OR sourcehostname CONTAINS "837613-coinbase.com" OR sourcehostname CONTAINS "83956-coinbase.com" OR sourcehostname CONTAINS "87157-coinbase.com" OR sourcehostname CONTAINS "87312-coinbase.com" OR sourcehostname CONTAINS "89304-coinbase.com" OR sourcehostname CONTAINS "89375-coinbase.com" OR sourcehostname CONTAINS "91723-gemini.com" OR sourcehostname CONTAINS "91752-coinbase.com")
index=activity AND rg_functionality="DNS / DHCP" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "28676-coinbase.com" OR destinationntdomain CONTAINS "29185-coinbase.com" OR destinationntdomain CONTAINS "29195-coinbase.com" OR destinationntdomain CONTAINS "2a-coinbase.com" OR destinationntdomain CONTAINS "2b-coinbase.com" OR destinationntdomain CONTAINS "2c-coinbase.com" OR destinationntdomain CONTAINS "2f-coinbase.com" OR destinationntdomain CONTAINS "2fas-coinbase.com" OR destinationntdomain CONTAINS "2o-coinbase.com" OR destinationntdomain CONTAINS "2r-coinbase.com" OR destinationntdomain CONTAINS "2s-coinbase.com" OR destinationntdomain CONTAINS "2sv-coinbase.com" OR destinationntdomain CONTAINS "352134951-coinbase.com" OR destinationntdomain CONTAINS "38468-coinbase.com" OR destinationntdomain CONTAINS "39590-coinbase.com" OR destinationntdomain CONTAINS "41260-coinbase.com" OR destinationntdomain CONTAINS "427883-coinbase.com" OR destinationntdomain CONTAINS "43017-coinbase.com" OR destinationntdomain CONTAINS "47562-coinbase.com" OR destinationntdomain CONTAINS "50195-coinbase.com" OR destinationntdomain CONTAINS "5247-coinbase.com" OR destinationntdomain CONTAINS "54765-coinbase.com" OR destinationntdomain CONTAINS "57197-coinbase.com" OR destinationntdomain CONTAINS "58176-coinbase.com" OR destinationntdomain CONTAINS "58297-coinbase.com" OR destinationntdomain CONTAINS "61250-coinbase.com" OR destinationntdomain CONTAINS "61835-coinbase.com" OR destinationntdomain CONTAINS "61851-coinbase.com" OR destinationntdomain CONTAINS "61937-coinbase.com" OR destinationntdomain CONTAINS "71925-coinbase.com" OR destinationntdomain CONTAINS "72957-coinbase.com" OR destinationntdomain CONTAINS "72985-coinbase.com" OR destinationntdomain CONTAINS "74651-coinbase.com" OR destinationntdomain CONTAINS "754668948-coinbase.com" OR destinationntdomain CONTAINS "76159869-coinbase.com" OR destinationntdomain CONTAINS "76153-coinbase.com" OR destinationntdomain CONTAINS "81758-coinbase.com" OR destinationntdomain CONTAINS "81920-coinbase.com" OR destinationntdomain CONTAINS "81926-coinbase.com" OR destinationntdomain CONTAINS "81958-coinbase.com" OR destinationntdomain CONTAINS "826298-coinbase.com" OR destinationntdomain CONTAINS "83216-coinbase.com" OR destinationntdomain CONTAINS "837613-coinbase.com" OR destinationntdomain CONTAINS "83956-coinbase.com" OR destinationntdomain CONTAINS "87157-coinbase.com" OR destinationntdomain CONTAINS "87312-coinbase.com" OR destinationntdomain CONTAINS "89304-coinbase.com" OR destinationntdomain CONTAINS "89375-coinbase.com" OR destinationntdomain CONTAINS "91723-gemini.com" OR destinationntdomain CONTAINS "91752-coinbase.com")
index=activity AND rg_functionality="DNS / DHCP" AND requesturl NOT NULL AND (requesturl CONTAINS "28676-coinbase.com" OR requesturl CONTAINS "29185-coinbase.com" OR requesturl CONTAINS "29195-coinbase.com" OR requesturl CONTAINS "2a-coinbase.com" OR requesturl CONTAINS "2b-coinbase.com" OR requesturl CONTAINS "2c-coinbase.com" OR requesturl CONTAINS "2f-coinbase.com" OR requesturl CONTAINS "2fas-coinbase.com" OR requesturl CONTAINS "2o-coinbase.com" OR requesturl CONTAINS "2r-coinbase.com" OR requesturl CONTAINS "2s-coinbase.com" OR requesturl CONTAINS "2sv-coinbase.com" OR requesturl CONTAINS "352134951-coinbase.com" OR requesturl CONTAINS "38468-coinbase.com" OR requesturl CONTAINS "39590-coinbase.com" OR requesturl CONTAINS "41260-coinbase.com" OR requesturl CONTAINS "427883-coinbase.com" OR requesturl CONTAINS "43017-coinbase.com" OR requesturl CONTAINS "47562-coinbase.com" OR requesturl CONTAINS "50195-coinbase.com" OR requesturl CONTAINS "5247-coinbase.com" OR requesturl CONTAINS "54765-coinbase.com" OR requesturl CONTAINS "57197-coinbase.com" OR requesturl CONTAINS "58176-coinbase.com" OR requesturl CONTAINS "58297-coinbase.com" OR requesturl CONTAINS "61250-coinbase.com" OR requesturl CONTAINS "61835-coinbase.com" OR requesturl CONTAINS "61851-coinbase.com" OR requesturl CONTAINS "61937-coinbase.com" OR requesturl CONTAINS "71925-coinbase.com" OR requesturl CONTAINS "72957-coinbase.com" OR requesturl CONTAINS "72985-coinbase.com" OR requesturl CONTAINS "74651-coinbase.com" OR requesturl CONTAINS "754668948-coinbase.com" OR requesturl CONTAINS "76159869-coinbase.com" OR requesturl CONTAINS "76153-coinbase.com" OR requesturl CONTAINS "81758-coinbase.com" OR requesturl CONTAINS "81920-coinbase.com" OR requesturl CONTAINS "81926-coinbase.com" OR requesturl CONTAINS "81958-coinbase.com" OR requesturl CONTAINS "826298-coinbase.com" OR requesturl CONTAINS "83216-coinbase.com" OR requesturl CONTAINS "837613-coinbase.com" OR requesturl CONTAINS "83956-coinbase.com" OR requesturl CONTAINS "87157-coinbase.com" OR requesturl CONTAINS "87312-coinbase.com" OR requesturl CONTAINS "89304-coinbase.com" OR requesturl CONTAINS "89375-coinbase.com" OR requesturl CONTAINS "91723-gemini.com" OR requesturl CONTAINS "91752-coinbase.com")
index=activity AND rg_functionality="DNS / DHCP" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "91756-coinbase.com" OR destinationhostname CONTAINS "91782-coinbase.com" OR destinationhostname CONTAINS "91835-coinbase.com" OR destinationhostname CONTAINS "91845-coinbase.com" OR destinationhostname CONTAINS "91923-coinbase.com" OR destinationhostname CONTAINS "92758-coinbase.com" OR destinationhostname CONTAINS "948122061-coinbase.com" OR destinationhostname CONTAINS "978941-coinbase.com" OR destinationhostname CONTAINS "accountrecovery-coinbase.com" OR destinationhostname CONTAINS "action-shakepay.com" OR destinationhostname CONTAINS "adjust-coinbase.com" OR destinationhostname CONTAINS "admin-kraken.com" OR destinationhostname CONTAINS "applechargebacks.com" OR destinationhostname CONTAINS "authenticate-gemini.com" OR destinationhostname CONTAINS "authorize-gmail.com" OR destinationhostname CONTAINS "binance-okta.com" OR destinationhostname CONTAINS "captcha-coinbase.com" OR destinationhostname CONTAINS "cd-coinbase.com" OR destinationhostname CONTAINS "coinbase-heip.com" OR destinationhostname CONTAINS "coinbase-live.support" OR destinationhostname CONTAINS "coinbase-reject.com" OR destinationhostname CONTAINS "coinbase-ticket.com" OR destinationhostname CONTAINS "coinbaseheip.com" OR destinationhostname CONTAINS "com-2fa.help" OR destinationhostname CONTAINS "com-2fa.support" OR destinationhostname CONTAINS "com-3845.support" OR destinationhostname CONTAINS "com-connect.help" OR destinationhostname CONTAINS "com-fraud.support" OR destinationhostname CONTAINS "com-help.support" OR destinationhostname CONTAINS "com-reset.help" OR destinationhostname CONTAINS "com-reset.net" OR destinationhostname CONTAINS "com-ticket.live" OR destinationhostname CONTAINS "com-ticket.support" OR destinationhostname CONTAINS "contact-nexo.com" OR destinationhostname CONTAINS "convert-coinbase.com" OR destinationhostname CONTAINS "customerservice-coinbase.com" OR destinationhostname CONTAINS "default-coinbase.com" OR destinationhostname CONTAINS "defend-coinbase.com" OR destinationhostname CONTAINS "deny-coinbase.com" OR destinationhostname CONTAINS "disconnect-coinbase.com" OR destinationhostname CONTAINS "escalate-coinbase.com" OR destinationhostname CONTAINS "establish-coinbase.com" OR destinationhostname CONTAINS "fcc-okta.com" OR destinationhostname CONTAINS "fraudulent-coinbase.com" OR destinationhostname CONTAINS "guard-apple.com" OR destinationhostname CONTAINS "guard-icloud.com" OR destinationhostname CONTAINS "guardian-coinbase.com" OR destinationhostname CONTAINS "guide-gemini.com" OR destinationhostname CONTAINS "help-bitfinex.com" OR destinationhostname CONTAINS "help-shakepay.com")
index=activity AND rg_functionality="DNS / DHCP" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "91756-coinbase.com" OR sourcentdomain CONTAINS "91782-coinbase.com" OR sourcentdomain CONTAINS "91835-coinbase.com" OR sourcentdomain CONTAINS "91845-coinbase.com" OR sourcentdomain CONTAINS "91923-coinbase.com" OR sourcentdomain CONTAINS "92758-coinbase.com" OR sourcentdomain CONTAINS "948122061-coinbase.com" OR sourcentdomain CONTAINS "978941-coinbase.com" OR sourcentdomain CONTAINS "accountrecovery-coinbase.com" OR sourcentdomain CONTAINS "action-shakepay.com" OR sourcentdomain CONTAINS "adjust-coinbase.com" OR sourcentdomain CONTAINS "admin-kraken.com" OR sourcentdomain CONTAINS "applechargebacks.com" OR sourcentdomain CONTAINS "authenticate-gemini.com" OR sourcentdomain CONTAINS "authorize-gmail.com" OR sourcentdomain CONTAINS "binance-okta.com" OR sourcentdomain CONTAINS "captcha-coinbase.com" OR sourcentdomain CONTAINS "cd-coinbase.com" OR sourcentdomain CONTAINS "coinbase-heip.com" OR sourcentdomain CONTAINS "coinbase-live.support" OR sourcentdomain CONTAINS "coinbase-reject.com" OR sourcentdomain CONTAINS "coinbase-ticket.com" OR sourcentdomain CONTAINS "coinbaseheip.com" OR sourcentdomain CONTAINS "com-2fa.help" OR sourcentdomain CONTAINS "com-2fa.support" OR sourcentdomain CONTAINS "com-3845.support" OR sourcentdomain CONTAINS "com-connect.help" OR sourcentdomain CONTAINS "com-fraud.support" OR sourcentdomain CONTAINS "com-help.support" OR sourcentdomain CONTAINS "com-reset.help" OR sourcentdomain CONTAINS "com-reset.net" OR sourcentdomain CONTAINS "com-ticket.live" OR sourcentdomain CONTAINS "com-ticket.support" OR sourcentdomain CONTAINS "contact-nexo.com" OR sourcentdomain CONTAINS "convert-coinbase.com" OR sourcentdomain CONTAINS "customerservice-coinbase.com" OR sourcentdomain CONTAINS "default-coinbase.com" OR sourcentdomain CONTAINS "defend-coinbase.com" OR sourcentdomain CONTAINS "deny-coinbase.com" OR sourcentdomain CONTAINS "disconnect-coinbase.com" OR sourcentdomain CONTAINS "escalate-coinbase.com" OR sourcentdomain CONTAINS "establish-coinbase.com" OR sourcentdomain CONTAINS "fcc-okta.com" OR sourcentdomain CONTAINS "fraudulent-coinbase.com" OR sourcentdomain CONTAINS "guard-apple.com" OR sourcentdomain CONTAINS "guard-icloud.com" OR sourcentdomain CONTAINS "guardian-coinbase.com" OR sourcentdomain CONTAINS "guide-gemini.com" OR sourcentdomain CONTAINS "help-bitfinex.com" OR sourcentdomain CONTAINS "help-shakepay.com")
index=activity AND rg_functionality="DNS / DHCP" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "91756-coinbase.com" OR sourcehostname CONTAINS "91782-coinbase.com" OR sourcehostname CONTAINS "91835-coinbase.com" OR sourcehostname CONTAINS "91845-coinbase.com" OR sourcehostname CONTAINS "91923-coinbase.com" OR sourcehostname CONTAINS "92758-coinbase.com" OR sourcehostname CONTAINS "948122061-coinbase.com" OR sourcehostname CONTAINS "978941-coinbase.com" OR sourcehostname CONTAINS "accountrecovery-coinbase.com" OR sourcehostname CONTAINS "action-shakepay.com" OR sourcehostname CONTAINS "adjust-coinbase.com" OR sourcehostname CONTAINS "admin-kraken.com" OR sourcehostname CONTAINS "applechargebacks.com" OR sourcehostname CONTAINS "authenticate-gemini.com" OR sourcehostname CONTAINS "authorize-gmail.com" OR sourcehostname CONTAINS "binance-okta.com" OR sourcehostname CONTAINS "captcha-coinbase.com" OR sourcehostname CONTAINS "cd-coinbase.com" OR sourcehostname CONTAINS "coinbase-heip.com" OR sourcehostname CONTAINS "coinbase-live.support" OR sourcehostname CONTAINS "coinbase-reject.com" OR sourcehostname CONTAINS "coinbase-ticket.com" OR sourcehostname CONTAINS "coinbaseheip.com" OR sourcehostname CONTAINS "com-2fa.help" OR sourcehostname CONTAINS "com-2fa.support" OR sourcehostname CONTAINS "com-3845.support" OR sourcehostname CONTAINS "com-connect.help" OR sourcehostname CONTAINS "com-fraud.support" OR sourcehostname CONTAINS "com-help.support" OR sourcehostname CONTAINS "com-reset.help" OR sourcehostname CONTAINS "com-reset.net" OR sourcehostname CONTAINS "com-ticket.live" OR sourcehostname CONTAINS "com-ticket.support" OR sourcehostname CONTAINS "contact-nexo.com" OR sourcehostname CONTAINS "convert-coinbase.com" OR sourcehostname CONTAINS "customerservice-coinbase.com" OR sourcehostname CONTAINS "default-coinbase.com" OR sourcehostname CONTAINS "defend-coinbase.com" OR sourcehostname CONTAINS "deny-coinbase.com" OR sourcehostname CONTAINS "disconnect-coinbase.com" OR sourcehostname CONTAINS "escalate-coinbase.com" OR sourcehostname CONTAINS "establish-coinbase.com" OR sourcehostname CONTAINS "fcc-okta.com" OR sourcehostname CONTAINS "fraudulent-coinbase.com" OR sourcehostname CONTAINS "guard-apple.com" OR sourcehostname CONTAINS "guard-icloud.com" OR sourcehostname CONTAINS "guardian-coinbase.com" OR sourcehostname CONTAINS "guide-gemini.com" OR sourcehostname CONTAINS "help-bitfinex.com" OR sourcehostname CONTAINS "help-shakepay.com")
index=activity AND rg_functionality="DNS / DHCP" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "91756-coinbase.com" OR destinationntdomain CONTAINS "91782-coinbase.com" OR destinationntdomain CONTAINS "91835-coinbase.com" OR destinationntdomain CONTAINS "91845-coinbase.com" OR destinationntdomain CONTAINS "91923-coinbase.com" OR destinationntdomain CONTAINS "92758-coinbase.com" OR destinationntdomain CONTAINS "948122061-coinbase.com" OR destinationntdomain CONTAINS "978941-coinbase.com" OR destinationntdomain CONTAINS "accountrecovery-coinbase.com" OR destinationntdomain CONTAINS "action-shakepay.com" OR destinationntdomain CONTAINS "adjust-coinbase.com" OR destinationntdomain CONTAINS "admin-kraken.com" OR destinationntdomain CONTAINS "applechargebacks.com" OR destinationntdomain CONTAINS "authenticate-gemini.com" OR destinationntdomain CONTAINS "authorize-gmail.com" OR destinationntdomain CONTAINS "binance-okta.com" OR destinationntdomain CONTAINS "captcha-coinbase.com" OR destinationntdomain CONTAINS "cd-coinbase.com" OR destinationntdomain CONTAINS "coinbase-heip.com" OR destinationntdomain CONTAINS "coinbase-live.support" OR destinationntdomain CONTAINS "coinbase-reject.com" OR destinationntdomain CONTAINS "coinbase-ticket.com" OR destinationntdomain CONTAINS "coinbaseheip.com" OR destinationntdomain CONTAINS "com-2fa.help" OR destinationntdomain CONTAINS "com-2fa.support" OR destinationntdomain CONTAINS "com-3845.support" OR destinationntdomain CONTAINS "com-connect.help" OR destinationntdomain CONTAINS "com-fraud.support" OR destinationntdomain CONTAINS "com-help.support" OR destinationntdomain CONTAINS "com-reset.help" OR destinationntdomain CONTAINS "com-reset.net" OR destinationntdomain CONTAINS "com-ticket.live" OR destinationntdomain CONTAINS "com-ticket.support" OR destinationntdomain CONTAINS "contact-nexo.com" OR destinationntdomain CONTAINS "convert-coinbase.com" OR destinationntdomain CONTAINS "customerservice-coinbase.com" OR destinationntdomain CONTAINS "default-coinbase.com" OR destinationntdomain CONTAINS "defend-coinbase.com" OR destinationntdomain CONTAINS "deny-coinbase.com" OR destinationntdomain CONTAINS "disconnect-coinbase.com" OR destinationntdomain CONTAINS "escalate-coinbase.com" OR destinationntdomain CONTAINS "establish-coinbase.com" OR destinationntdomain CONTAINS "fcc-okta.com" OR destinationntdomain CONTAINS "fraudulent-coinbase.com" OR destinationntdomain CONTAINS "guard-apple.com" OR destinationntdomain CONTAINS "guard-icloud.com" OR destinationntdomain CONTAINS "guardian-coinbase.com" OR destinationntdomain CONTAINS "guide-gemini.com" OR destinationntdomain CONTAINS "help-bitfinex.com" OR destinationntdomain CONTAINS "help-shakepay.com")
index=activity AND rg_functionality="DNS / DHCP" AND requesturl NOT NULL AND (requesturl CONTAINS "91756-coinbase.com" OR requesturl CONTAINS "91782-coinbase.com" OR requesturl CONTAINS "91835-coinbase.com" OR requesturl CONTAINS "91845-coinbase.com" OR requesturl CONTAINS "91923-coinbase.com" OR requesturl CONTAINS "92758-coinbase.com" OR requesturl CONTAINS "948122061-coinbase.com" OR requesturl CONTAINS "978941-coinbase.com" OR requesturl CONTAINS "accountrecovery-coinbase.com" OR requesturl CONTAINS "action-shakepay.com" OR requesturl CONTAINS "adjust-coinbase.com" OR requesturl CONTAINS "admin-kraken.com" OR requesturl CONTAINS "applechargebacks.com" OR requesturl CONTAINS "authenticate-gemini.com" OR requesturl CONTAINS "authorize-gmail.com" OR requesturl CONTAINS "binance-okta.com" OR requesturl CONTAINS "captcha-coinbase.com" OR requesturl CONTAINS "cd-coinbase.com" OR requesturl CONTAINS "coinbase-heip.com" OR requesturl CONTAINS "coinbase-live.support" OR requesturl CONTAINS "coinbase-reject.com" OR requesturl CONTAINS "coinbase-ticket.com" OR requesturl CONTAINS "coinbaseheip.com" OR requesturl CONTAINS "com-2fa.help" OR requesturl CONTAINS "com-2fa.support" OR requesturl CONTAINS "com-3845.support" OR requesturl CONTAINS "com-connect.help" OR requesturl CONTAINS "com-fraud.support" OR requesturl CONTAINS "com-help.support" OR requesturl CONTAINS "com-reset.help" OR requesturl CONTAINS "com-reset.net" OR requesturl CONTAINS "com-ticket.live" OR requesturl CONTAINS "com-ticket.support" OR requesturl CONTAINS "contact-nexo.com" OR requesturl CONTAINS "convert-coinbase.com" OR requesturl CONTAINS "customerservice-coinbase.com" OR requesturl CONTAINS "default-coinbase.com" OR requesturl CONTAINS "defend-coinbase.com" OR requesturl CONTAINS "deny-coinbase.com" OR requesturl CONTAINS "disconnect-coinbase.com" OR requesturl CONTAINS "escalate-coinbase.com" OR requesturl CONTAINS "establish-coinbase.com" OR requesturl CONTAINS "fcc-okta.com" OR requesturl CONTAINS "fraudulent-coinbase.com" OR requesturl CONTAINS "guard-apple.com" OR requesturl CONTAINS "guard-icloud.com" OR requesturl CONTAINS "guardian-coinbase.com" OR requesturl CONTAINS "guide-gemini.com" OR requesturl CONTAINS "help-bitfinex.com" OR requesturl CONTAINS "help-shakepay.com")
index=activity AND rg_functionality="DNS / DHCP" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "helpdesk-apple.com" OR destinationhostname CONTAINS "helpdesk-gemini.com" OR destinationhostname CONTAINS "helpdesk-icloud.com" OR destinationhostname CONTAINS "identification-coinbase.com" OR destinationhostname CONTAINS "lockdown-coinbase.com" OR destinationhostname CONTAINS "login-nexo.com" OR destinationhostname CONTAINS "keys-coinbase.com" OR destinationhostname CONTAINS "messages-coinbase.com" OR destinationhostname CONTAINS "newpassword-coinbase.com" OR destinationhostname CONTAINS "prompt-coinbase.com" OR destinationhostname CONTAINS "protect-apple.com" OR destinationhostname CONTAINS "protect-coinbase.com" OR destinationhostname CONTAINS "protect-gmail.com" OR destinationhostname CONTAINS "protect-kraken.com" OR destinationhostname CONTAINS "recoverme-coinbase.com" OR destinationhostname CONTAINS "recoveryportal-coinbase.com" OR destinationhostname CONTAINS "refunds-coinbase.com" OR destinationhostname CONTAINS "reset-okta.com" OR destinationhostname CONTAINS "restore-coinbase.com" OR destinationhostname CONTAINS "return-coinbase.com" OR destinationhostname CONTAINS "reverts-coinbase.com" OR destinationhostname CONTAINS "secure-binance.us" OR destinationhostname CONTAINS "secure-icloud.com" OR destinationhostname CONTAINS "secure-nexo.com" OR destinationhostname CONTAINS "secure-shakepay.com" OR destinationhostname CONTAINS "security-umusic.com" OR destinationhostname CONTAINS "server694590423.tech" OR destinationhostname CONTAINS "session-coinbase.com" OR destinationhostname CONTAINS "startrecovery-coinbase.com" OR destinationhostname CONTAINS "signin-kraken.com" OR destinationhostname CONTAINS "suite-trezor.io" OR destinationhostname CONTAINS "supportportal-coinbase.com" OR destinationhostname CONTAINS "tech-icloud.com" OR destinationhostname CONTAINS "threat-coinbase.com" OR destinationhostname CONTAINS "ticket-apple.com" OR destinationhostname CONTAINS "ticket-coinbase.com" OR destinationhostname CONTAINS "tickets-apple.com" OR destinationhostname CONTAINS "tokens-coinbase.com" OR destinationhostname CONTAINS "unblock-coinbase.com" OR destinationhostname CONTAINS "unlink-coinbase.com" OR destinationhostname CONTAINS "your-coinbase.com" OR destinationhostname CONTAINS "welcome-coinbase.com" OR destinationhostname CONTAINS "www-coinbasewallet.com" OR destinationhostname CONTAINS "www-help-coinbase.com" OR destinationhostname CONTAINS "www-help-gemini.com")
index=activity AND rg_functionality="DNS / DHCP" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "helpdesk-apple.com" OR sourcentdomain CONTAINS "helpdesk-gemini.com" OR sourcentdomain CONTAINS "helpdesk-icloud.com" OR sourcentdomain CONTAINS "identification-coinbase.com" OR sourcentdomain CONTAINS "lockdown-coinbase.com" OR sourcentdomain CONTAINS "login-nexo.com" OR sourcentdomain CONTAINS "keys-coinbase.com" OR sourcentdomain CONTAINS "messages-coinbase.com" OR sourcentdomain CONTAINS "newpassword-coinbase.com" OR sourcentdomain CONTAINS "prompt-coinbase.com" OR sourcentdomain CONTAINS "protect-apple.com" OR sourcentdomain CONTAINS "protect-coinbase.com" OR sourcentdomain CONTAINS "protect-gmail.com" OR sourcentdomain CONTAINS "protect-kraken.com" OR sourcentdomain CONTAINS "recoverme-coinbase.com" OR sourcentdomain CONTAINS "recoveryportal-coinbase.com" OR sourcentdomain CONTAINS "refunds-coinbase.com" OR sourcentdomain CONTAINS "reset-okta.com" OR sourcentdomain CONTAINS "restore-coinbase.com" OR sourcentdomain CONTAINS "return-coinbase.com" OR sourcentdomain CONTAINS "reverts-coinbase.com" OR sourcentdomain CONTAINS "secure-binance.us" OR sourcentdomain CONTAINS "secure-icloud.com" OR sourcentdomain CONTAINS "secure-nexo.com" OR sourcentdomain CONTAINS "secure-shakepay.com" OR sourcentdomain CONTAINS "security-umusic.com" OR sourcentdomain CONTAINS "server694590423.tech" OR sourcentdomain CONTAINS "session-coinbase.com" OR sourcentdomain CONTAINS "startrecovery-coinbase.com" OR sourcentdomain CONTAINS "signin-kraken.com" OR sourcentdomain CONTAINS "suite-trezor.io" OR sourcentdomain CONTAINS "supportportal-coinbase.com" OR sourcentdomain CONTAINS "tech-icloud.com" OR sourcentdomain CONTAINS "threat-coinbase.com" OR sourcentdomain CONTAINS "ticket-apple.com" OR sourcentdomain CONTAINS "ticket-coinbase.com" OR sourcentdomain CONTAINS "tickets-apple.com" OR sourcentdomain CONTAINS "tokens-coinbase.com" OR sourcentdomain CONTAINS "unblock-coinbase.com" OR sourcentdomain CONTAINS "unlink-coinbase.com" OR sourcentdomain CONTAINS "your-coinbase.com" OR sourcentdomain CONTAINS "welcome-coinbase.com" OR sourcentdomain CONTAINS "www-coinbasewallet.com" OR sourcentdomain CONTAINS "www-help-coinbase.com" OR sourcentdomain CONTAINS "www-help-gemini.com")
index=activity AND rg_functionality="DNS / DHCP" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "helpdesk-apple.com" OR sourcehostname CONTAINS "helpdesk-gemini.com" OR sourcehostname CONTAINS "helpdesk-icloud.com" OR sourcehostname CONTAINS "identification-coinbase.com" OR sourcehostname CONTAINS "lockdown-coinbase.com" OR sourcehostname CONTAINS "login-nexo.com" OR sourcehostname CONTAINS "keys-coinbase.com" OR sourcehostname CONTAINS "messages-coinbase.com" OR sourcehostname CONTAINS "newpassword-coinbase.com" OR sourcehostname CONTAINS "prompt-coinbase.com" OR sourcehostname CONTAINS "protect-apple.com" OR sourcehostname CONTAINS "protect-coinbase.com" OR sourcehostname CONTAINS "protect-gmail.com" OR sourcehostname CONTAINS "protect-kraken.com" OR sourcehostname CONTAINS "recoverme-coinbase.com" OR sourcehostname CONTAINS "recoveryportal-coinbase.com" OR sourcehostname CONTAINS "refunds-coinbase.com" OR sourcehostname CONTAINS "reset-okta.com" OR sourcehostname CONTAINS "restore-coinbase.com" OR sourcehostname CONTAINS "return-coinbase.com" OR sourcehostname CONTAINS "reverts-coinbase.com" OR sourcehostname CONTAINS "secure-binance.us" OR sourcehostname CONTAINS "secure-icloud.com" OR sourcehostname CONTAINS "secure-nexo.com" OR sourcehostname CONTAINS "secure-shakepay.com" OR sourcehostname CONTAINS "security-umusic.com" OR sourcehostname CONTAINS "server694590423.tech" OR sourcehostname CONTAINS "session-coinbase.com" OR sourcehostname CONTAINS "startrecovery-coinbase.com" OR sourcehostname CONTAINS "signin-kraken.com" OR sourcehostname CONTAINS "suite-trezor.io" OR sourcehostname CONTAINS "supportportal-coinbase.com" OR sourcehostname CONTAINS "tech-icloud.com" OR sourcehostname CONTAINS "threat-coinbase.com" OR sourcehostname CONTAINS "ticket-apple.com" OR sourcehostname CONTAINS "ticket-coinbase.com" OR sourcehostname CONTAINS "tickets-apple.com" OR sourcehostname CONTAINS "tokens-coinbase.com" OR sourcehostname CONTAINS "unblock-coinbase.com" OR sourcehostname CONTAINS "unlink-coinbase.com" OR sourcehostname CONTAINS "your-coinbase.com" OR sourcehostname CONTAINS "welcome-coinbase.com" OR sourcehostname CONTAINS "www-coinbasewallet.com" OR sourcehostname CONTAINS "www-help-coinbase.com" OR sourcehostname CONTAINS "www-help-gemini.com")
index=activity AND rg_functionality="DNS / DHCP" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "helpdesk-apple.com" OR destinationntdomain CONTAINS "helpdesk-gemini.com" OR destinationntdomain CONTAINS "helpdesk-icloud.com" OR destinationntdomain CONTAINS "identification-coinbase.com" OR destinationntdomain CONTAINS "lockdown-coinbase.com" OR destinationntdomain CONTAINS "login-nexo.com" OR destinationntdomain CONTAINS "keys-coinbase.com" OR destinationntdomain CONTAINS "messages-coinbase.com" OR destinationntdomain CONTAINS "newpassword-coinbase.com" OR destinationntdomain CONTAINS "prompt-coinbase.com" OR destinationntdomain CONTAINS "protect-apple.com" OR destinationntdomain CONTAINS "protect-coinbase.com" OR destinationntdomain CONTAINS "protect-gmail.com" OR destinationntdomain CONTAINS "protect-kraken.com" OR destinationntdomain CONTAINS "recoverme-coinbase.com" OR destinationntdomain CONTAINS "recoveryportal-coinbase.com" OR destinationntdomain CONTAINS "refunds-coinbase.com" OR destinationntdomain CONTAINS "reset-okta.com" OR destinationntdomain CONTAINS "restore-coinbase.com" OR destinationntdomain CONTAINS "return-coinbase.com" OR destinationntdomain CONTAINS "reverts-coinbase.com" OR destinationntdomain CONTAINS "secure-binance.us" OR destinationntdomain CONTAINS "secure-icloud.com" OR destinationntdomain CONTAINS "secure-nexo.com" OR destinationntdomain CONTAINS "secure-shakepay.com" OR destinationntdomain CONTAINS "security-umusic.com" OR destinationntdomain CONTAINS "server694590423.tech" OR destinationntdomain CONTAINS "session-coinbase.com" OR destinationntdomain CONTAINS "startrecovery-coinbase.com" OR destinationntdomain CONTAINS "signin-kraken.com" OR destinationntdomain CONTAINS "suite-trezor.io" OR destinationntdomain CONTAINS "supportportal-coinbase.com" OR destinationntdomain CONTAINS "tech-icloud.com" OR destinationntdomain CONTAINS "threat-coinbase.com" OR destinationntdomain CONTAINS "ticket-apple.com" OR destinationntdomain CONTAINS "ticket-coinbase.com" OR destinationntdomain CONTAINS "tickets-apple.com" OR destinationntdomain CONTAINS "tokens-coinbase.com" OR destinationntdomain CONTAINS "unblock-coinbase.com" OR destinationntdomain CONTAINS "unlink-coinbase.com" OR destinationntdomain CONTAINS "your-coinbase.com" OR destinationntdomain CONTAINS "welcome-coinbase.com" OR destinationntdomain CONTAINS "www-coinbasewallet.com" OR destinationntdomain CONTAINS "www-help-coinbase.com" OR destinationntdomain CONTAINS "www-help-gemini.com")
index=activity AND rg_functionality="DNS / DHCP" AND requesturl NOT NULL AND (requesturl CONTAINS "helpdesk-apple.com" OR requesturl CONTAINS "helpdesk-gemini.com" OR requesturl CONTAINS "helpdesk-icloud.com" OR requesturl CONTAINS "identification-coinbase.com" OR requesturl CONTAINS "lockdown-coinbase.com" OR requesturl CONTAINS "login-nexo.com" OR requesturl CONTAINS "keys-coinbase.com" OR requesturl CONTAINS "messages-coinbase.com" OR requesturl CONTAINS "newpassword-coinbase.com" OR requesturl CONTAINS "prompt-coinbase.com" OR requesturl CONTAINS "protect-apple.com" OR requesturl CONTAINS "protect-coinbase.com" OR requesturl CONTAINS "protect-gmail.com" OR requesturl CONTAINS "protect-kraken.com" OR requesturl CONTAINS "recoverme-coinbase.com" OR requesturl CONTAINS "recoveryportal-coinbase.com" OR requesturl CONTAINS "refunds-coinbase.com" OR requesturl CONTAINS "reset-okta.com" OR requesturl CONTAINS "restore-coinbase.com" OR requesturl CONTAINS "return-coinbase.com" OR requesturl CONTAINS "reverts-coinbase.com" OR requesturl CONTAINS "secure-binance.us" OR requesturl CONTAINS "secure-icloud.com" OR requesturl CONTAINS "secure-nexo.com" OR requesturl CONTAINS "secure-shakepay.com" OR requesturl CONTAINS "security-umusic.com" OR requesturl CONTAINS "server694590423.tech" OR requesturl CONTAINS "session-coinbase.com" OR requesturl CONTAINS "startrecovery-coinbase.com" OR requesturl CONTAINS "signin-kraken.com" OR requesturl CONTAINS "suite-trezor.io" OR requesturl CONTAINS "supportportal-coinbase.com" OR requesturl CONTAINS "tech-icloud.com" OR requesturl CONTAINS "threat-coinbase.com" OR requesturl CONTAINS "ticket-apple.com" OR requesturl CONTAINS "ticket-coinbase.com" OR requesturl CONTAINS "tickets-apple.com" OR requesturl CONTAINS "tokens-coinbase.com" OR requesturl CONTAINS "unblock-coinbase.com" OR requesturl CONTAINS "unlink-coinbase.com" OR requesturl CONTAINS "your-coinbase.com" OR requesturl CONTAINS "welcome-coinbase.com" OR requesturl CONTAINS "www-coinbasewallet.com" OR requesturl CONTAINS "www-help-coinbase.com" OR requesturl CONTAINS "www-help-gemini.com")
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "official-server.com" OR destinationhostname CONTAINS "server694590423.tech" OR destinationhostname CONTAINS "island-placid-bromine.glitch.me" OR destinationhostname CONTAINS "circular-noon-farmhouse.glitch.me" OR destinationhostname CONTAINS "talented-friendly-price.glitch.me" OR destinationhostname CONTAINS "dflfmgsdokasdcpl.com" OR destinationhostname CONTAINS "original-backend.com" OR destinationhostname CONTAINS "07159889-coinbase.com" OR destinationhostname CONTAINS "10195-coinbase.com" OR destinationhostname CONTAINS "11246-coinbase.com" OR destinationhostname CONTAINS "11247-coinbase.com" OR destinationhostname CONTAINS "11248-coinbase.com" OR destinationhostname CONTAINS "11258-coinbase.com" OR destinationhostname CONTAINS "11259-coinbase.com" OR destinationhostname CONTAINS "113912-coinbase.com" OR destinationhostname CONTAINS "11472-coinbase.com" OR destinationhostname CONTAINS "11923-coinbase.com" OR destinationhostname CONTAINS "11957-coinbase.com" OR destinationhostname CONTAINS "128147-coinbase.com" OR destinationhostname CONTAINS "12958-coinbase.com" OR destinationhostname CONTAINS "12984-okta.com" OR destinationhostname CONTAINS "12985-coinbase.com" OR destinationhostname CONTAINS "13130-coinbase.com" OR destinationhostname CONTAINS "13247-coinbase.com" OR destinationhostname CONTAINS "13247-icloud.com" OR destinationhostname CONTAINS "13267-coinbase.com" OR destinationhostname CONTAINS "146271510-coinbase.com" OR destinationhostname CONTAINS "146282-coinbase.com" OR destinationhostname CONTAINS "146284-coinbase.com" OR destinationhostname CONTAINS "147260-coinbase.com" OR destinationhostname CONTAINS "14765-coinbase.com" OR destinationhostname CONTAINS "14817582-coinbase.com" OR destinationhostname CONTAINS "14871904-coinbase.com" OR destinationhostname CONTAINS "14891902-coinbase.com" OR destinationhostname CONTAINS "1492864-coinbase.com" OR destinationhostname CONTAINS "158312-coinbase.com" OR destinationhostname CONTAINS "158372-coinbase.com" OR destinationhostname CONTAINS "158702-coinbase.com" OR destinationhostname CONTAINS "16171675-coinbase.com" OR destinationhostname CONTAINS "16171832-coinbase.com" OR destinationhostname CONTAINS "16178234-coinbase.com" OR destinationhostname CONTAINS "16178237-coinbase.com" OR destinationhostname CONTAINS "16178434-coinbase.com" OR destinationhostname CONTAINS "162178-coinbase.com" OR destinationhostname CONTAINS "162478-coinbase.com" OR destinationhostname CONTAINS "162782-coinbase.com" OR destinationhostname CONTAINS "162812-coinbase.com" OR destinationhostname CONTAINS "162814-coinbase.com" OR destinationhostname CONTAINS "16442580-coinbase.com" OR destinationhostname CONTAINS "16450107-coinbase.com")
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "official-server.com" OR sourcentdomain CONTAINS "server694590423.tech" OR sourcentdomain CONTAINS "island-placid-bromine.glitch.me" OR sourcentdomain CONTAINS "circular-noon-farmhouse.glitch.me" OR sourcentdomain CONTAINS "talented-friendly-price.glitch.me" OR sourcentdomain CONTAINS "dflfmgsdokasdcpl.com" OR sourcentdomain CONTAINS "original-backend.com" OR sourcentdomain CONTAINS "07159889-coinbase.com" OR sourcentdomain CONTAINS "10195-coinbase.com" OR sourcentdomain CONTAINS "11246-coinbase.com" OR sourcentdomain CONTAINS "11247-coinbase.com" OR sourcentdomain CONTAINS "11248-coinbase.com" OR sourcentdomain CONTAINS "11258-coinbase.com" OR sourcentdomain CONTAINS "11259-coinbase.com" OR sourcentdomain CONTAINS "113912-coinbase.com" OR sourcentdomain CONTAINS "11472-coinbase.com" OR sourcentdomain CONTAINS "11923-coinbase.com" OR sourcentdomain CONTAINS "11957-coinbase.com" OR sourcentdomain CONTAINS "128147-coinbase.com" OR sourcentdomain CONTAINS "12958-coinbase.com" OR sourcentdomain CONTAINS "12984-okta.com" OR sourcentdomain CONTAINS "12985-coinbase.com" OR sourcentdomain CONTAINS "13130-coinbase.com" OR sourcentdomain CONTAINS "13247-coinbase.com" OR sourcentdomain CONTAINS "13247-icloud.com" OR sourcentdomain CONTAINS "13267-coinbase.com" OR sourcentdomain CONTAINS "146271510-coinbase.com" OR sourcentdomain CONTAINS "146282-coinbase.com" OR sourcentdomain CONTAINS "146284-coinbase.com" OR sourcentdomain CONTAINS "147260-coinbase.com" OR sourcentdomain CONTAINS "14765-coinbase.com" OR sourcentdomain CONTAINS "14817582-coinbase.com" OR sourcentdomain CONTAINS "14871904-coinbase.com" OR sourcentdomain CONTAINS "14891902-coinbase.com" OR sourcentdomain CONTAINS "1492864-coinbase.com" OR sourcentdomain CONTAINS "158312-coinbase.com" OR sourcentdomain CONTAINS "158372-coinbase.com" OR sourcentdomain CONTAINS "158702-coinbase.com" OR sourcentdomain CONTAINS "16171675-coinbase.com" OR sourcentdomain CONTAINS "16171832-coinbase.com" OR sourcentdomain CONTAINS "16178234-coinbase.com" OR sourcentdomain CONTAINS "16178237-coinbase.com" OR sourcentdomain CONTAINS "16178434-coinbase.com" OR sourcentdomain CONTAINS "162178-coinbase.com" OR sourcentdomain CONTAINS "162478-coinbase.com" OR sourcentdomain CONTAINS "162782-coinbase.com" OR sourcentdomain CONTAINS "162812-coinbase.com" OR sourcentdomain CONTAINS "162814-coinbase.com" OR sourcentdomain CONTAINS "16442580-coinbase.com" OR sourcentdomain CONTAINS "16450107-coinbase.com")
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "official-server.com" OR sourcehostname CONTAINS "server694590423.tech" OR sourcehostname CONTAINS "island-placid-bromine.glitch.me" OR sourcehostname CONTAINS "circular-noon-farmhouse.glitch.me" OR sourcehostname CONTAINS "talented-friendly-price.glitch.me" OR sourcehostname CONTAINS "dflfmgsdokasdcpl.com" OR sourcehostname CONTAINS "original-backend.com" OR sourcehostname CONTAINS "07159889-coinbase.com" OR sourcehostname CONTAINS "10195-coinbase.com" OR sourcehostname CONTAINS "11246-coinbase.com" OR sourcehostname CONTAINS "11247-coinbase.com" OR sourcehostname CONTAINS "11248-coinbase.com" OR sourcehostname CONTAINS "11258-coinbase.com" OR sourcehostname CONTAINS "11259-coinbase.com" OR sourcehostname CONTAINS "113912-coinbase.com" OR sourcehostname CONTAINS "11472-coinbase.com" OR sourcehostname CONTAINS "11923-coinbase.com" OR sourcehostname CONTAINS "11957-coinbase.com" OR sourcehostname CONTAINS "128147-coinbase.com" OR sourcehostname CONTAINS "12958-coinbase.com" OR sourcehostname CONTAINS "12984-okta.com" OR sourcehostname CONTAINS "12985-coinbase.com" OR sourcehostname CONTAINS "13130-coinbase.com" OR sourcehostname CONTAINS "13247-coinbase.com" OR sourcehostname CONTAINS "13247-icloud.com" OR sourcehostname CONTAINS "13267-coinbase.com" OR sourcehostname CONTAINS "146271510-coinbase.com" OR sourcehostname CONTAINS "146282-coinbase.com" OR sourcehostname CONTAINS "146284-coinbase.com" OR sourcehostname CONTAINS "147260-coinbase.com" OR sourcehostname CONTAINS "14765-coinbase.com" OR sourcehostname CONTAINS "14817582-coinbase.com" OR sourcehostname CONTAINS "14871904-coinbase.com" OR sourcehostname CONTAINS "14891902-coinbase.com" OR sourcehostname CONTAINS "1492864-coinbase.com" OR sourcehostname CONTAINS "158312-coinbase.com" OR sourcehostname CONTAINS "158372-coinbase.com" OR sourcehostname CONTAINS "158702-coinbase.com" OR sourcehostname CONTAINS "16171675-coinbase.com" OR sourcehostname CONTAINS "16171832-coinbase.com" OR sourcehostname CONTAINS "16178234-coinbase.com" OR sourcehostname CONTAINS "16178237-coinbase.com" OR sourcehostname CONTAINS "16178434-coinbase.com" OR sourcehostname CONTAINS "162178-coinbase.com" OR sourcehostname CONTAINS "162478-coinbase.com" OR sourcehostname CONTAINS "162782-coinbase.com" OR sourcehostname CONTAINS "162812-coinbase.com" OR sourcehostname CONTAINS "162814-coinbase.com" OR sourcehostname CONTAINS "16442580-coinbase.com" OR sourcehostname CONTAINS "16450107-coinbase.com")
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "official-server.com" OR destinationntdomain CONTAINS "server694590423.tech" OR destinationntdomain CONTAINS "island-placid-bromine.glitch.me" OR destinationntdomain CONTAINS "circular-noon-farmhouse.glitch.me" OR destinationntdomain CONTAINS "talented-friendly-price.glitch.me" OR destinationntdomain CONTAINS "dflfmgsdokasdcpl.com" OR destinationntdomain CONTAINS "original-backend.com" OR destinationntdomain CONTAINS "07159889-coinbase.com" OR destinationntdomain CONTAINS "10195-coinbase.com" OR destinationntdomain CONTAINS "11246-coinbase.com" OR destinationntdomain CONTAINS "11247-coinbase.com" OR destinationntdomain CONTAINS "11248-coinbase.com" OR destinationntdomain CONTAINS "11258-coinbase.com" OR destinationntdomain CONTAINS "11259-coinbase.com" OR destinationntdomain CONTAINS "113912-coinbase.com" OR destinationntdomain CONTAINS "11472-coinbase.com" OR destinationntdomain CONTAINS "11923-coinbase.com" OR destinationntdomain CONTAINS "11957-coinbase.com" OR destinationntdomain CONTAINS "128147-coinbase.com" OR destinationntdomain CONTAINS "12958-coinbase.com" OR destinationntdomain CONTAINS "12984-okta.com" OR destinationntdomain CONTAINS "12985-coinbase.com" OR destinationntdomain CONTAINS "13130-coinbase.com" OR destinationntdomain CONTAINS "13247-coinbase.com" OR destinationntdomain CONTAINS "13247-icloud.com" OR destinationntdomain CONTAINS "13267-coinbase.com" OR destinationntdomain CONTAINS "146271510-coinbase.com" OR destinationntdomain CONTAINS "146282-coinbase.com" OR destinationntdomain CONTAINS "146284-coinbase.com" OR destinationntdomain CONTAINS "147260-coinbase.com" OR destinationntdomain CONTAINS "14765-coinbase.com" OR destinationntdomain CONTAINS "14817582-coinbase.com" OR destinationntdomain CONTAINS "14871904-coinbase.com" OR destinationntdomain CONTAINS "14891902-coinbase.com" OR destinationntdomain CONTAINS "1492864-coinbase.com" OR destinationntdomain CONTAINS "158312-coinbase.com" OR destinationntdomain CONTAINS "158372-coinbase.com" OR destinationntdomain CONTAINS "158702-coinbase.com" OR destinationntdomain CONTAINS "16171675-coinbase.com" OR destinationntdomain CONTAINS "16171832-coinbase.com" OR destinationntdomain CONTAINS "16178234-coinbase.com" OR destinationntdomain CONTAINS "16178237-coinbase.com" OR destinationntdomain CONTAINS "16178434-coinbase.com" OR destinationntdomain CONTAINS "162178-coinbase.com" OR destinationntdomain CONTAINS "162478-coinbase.com" OR destinationntdomain CONTAINS "162782-coinbase.com" OR destinationntdomain CONTAINS "162812-coinbase.com" OR destinationntdomain CONTAINS "162814-coinbase.com" OR destinationntdomain CONTAINS "16442580-coinbase.com" OR destinationntdomain CONTAINS "16450107-coinbase.com")
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND requesturl NOT NULL AND (requesturl CONTAINS "official-server.com" OR requesturl CONTAINS "server694590423.tech" OR requesturl CONTAINS "island-placid-bromine.glitch.me" OR requesturl CONTAINS "circular-noon-farmhouse.glitch.me" OR requesturl CONTAINS "talented-friendly-price.glitch.me" OR requesturl CONTAINS "dflfmgsdokasdcpl.com" OR requesturl CONTAINS "original-backend.com" OR requesturl CONTAINS "07159889-coinbase.com" OR requesturl CONTAINS "10195-coinbase.com" OR requesturl CONTAINS "11246-coinbase.com" OR requesturl CONTAINS "11247-coinbase.com" OR requesturl CONTAINS "11248-coinbase.com" OR requesturl CONTAINS "11258-coinbase.com" OR requesturl CONTAINS "11259-coinbase.com" OR requesturl CONTAINS "113912-coinbase.com" OR requesturl CONTAINS "11472-coinbase.com" OR requesturl CONTAINS "11923-coinbase.com" OR requesturl CONTAINS "11957-coinbase.com" OR requesturl CONTAINS "128147-coinbase.com" OR requesturl CONTAINS "12958-coinbase.com" OR requesturl CONTAINS "12984-okta.com" OR requesturl CONTAINS "12985-coinbase.com" OR requesturl CONTAINS "13130-coinbase.com" OR requesturl CONTAINS "13247-coinbase.com" OR requesturl CONTAINS "13247-icloud.com" OR requesturl CONTAINS "13267-coinbase.com" OR requesturl CONTAINS "146271510-coinbase.com" OR requesturl CONTAINS "146282-coinbase.com" OR requesturl CONTAINS "146284-coinbase.com" OR requesturl CONTAINS "147260-coinbase.com" OR requesturl CONTAINS "14765-coinbase.com" OR requesturl CONTAINS "14817582-coinbase.com" OR requesturl CONTAINS "14871904-coinbase.com" OR requesturl CONTAINS "14891902-coinbase.com" OR requesturl CONTAINS "1492864-coinbase.com" OR requesturl CONTAINS "158312-coinbase.com" OR requesturl CONTAINS "158372-coinbase.com" OR requesturl CONTAINS "158702-coinbase.com" OR requesturl CONTAINS "16171675-coinbase.com" OR requesturl CONTAINS "16171832-coinbase.com" OR requesturl CONTAINS "16178234-coinbase.com" OR requesturl CONTAINS "16178237-coinbase.com" OR requesturl CONTAINS "16178434-coinbase.com" OR requesturl CONTAINS "162178-coinbase.com" OR requesturl CONTAINS "162478-coinbase.com" OR requesturl CONTAINS "162782-coinbase.com" OR requesturl CONTAINS "162812-coinbase.com" OR requesturl CONTAINS "162814-coinbase.com" OR requesturl CONTAINS "16442580-coinbase.com" OR requesturl CONTAINS "16450107-coinbase.com")
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "16450207-coinbase.com" OR destinationhostname CONTAINS "16458207-coinbase.com" OR destinationhostname CONTAINS "16478202-coinbase.com" OR destinationhostname CONTAINS "164872942-coinbase.com" OR destinationhostname CONTAINS "16590-coinbase.com" OR destinationhostname CONTAINS "16594373-coinbase.com" OR destinationhostname CONTAINS "16624831-coinbase.com" OR destinationhostname CONTAINS "16642124-coinbase.com" OR destinationhostname CONTAINS "16642172-coinbase.com" OR destinationhostname CONTAINS "16642580-coinbase.com" OR destinationhostname CONTAINS "16642721-coinbase.com" OR destinationhostname CONTAINS "16642724-coinbase.com" OR destinationhostname CONTAINS "16642871-coinbase.com" OR destinationhostname CONTAINS "16642872-coinbase.com" OR destinationhostname CONTAINS "16712942-coinbase.com" OR destinationhostname CONTAINS "16718672-coinbase.com" OR destinationhostname CONTAINS "16728342-coinbase.com" OR destinationhostname CONTAINS "16728348-coinbase.com" OR destinationhostname CONTAINS "16728442-coinbase.com" OR destinationhostname CONTAINS "16728472-coinbase.com" OR destinationhostname CONTAINS "167285-coinbase.com" OR destinationhostname CONTAINS "16729042-coinbase.com" OR destinationhostname CONTAINS "16748272-coinbase.com" OR destinationhostname CONTAINS "16782942-coinbase.com" OR destinationhostname CONTAINS "16827420-coinbase.com" OR destinationhostname CONTAINS "16827423-coinbase.com" OR destinationhostname CONTAINS "16847145-coinbase.com" OR destinationhostname CONTAINS "16893924-coinbase.com" OR destinationhostname CONTAINS "17182-coinbase.com" OR destinationhostname CONTAINS "17255030-coinbase.com" OR destinationhostname CONTAINS "17259-kraken.com" OR destinationhostname CONTAINS "172486-coinbase.com" OR destinationhostname CONTAINS "17284652-coinbase.com" OR destinationhostname CONTAINS "17286-coinbase.com" OR destinationhostname CONTAINS "17334522-coinbase.com" OR destinationhostname CONTAINS "17334522-kraken.com" OR destinationhostname CONTAINS "17384522-coinbase.com" OR destinationhostname CONTAINS "173912-coinbase.com" OR destinationhostname CONTAINS "17494976-coinbase.com" OR destinationhostname CONTAINS "17512854-coinbase.com" OR destinationhostname CONTAINS "17512857-coinbase.com" OR destinationhostname CONTAINS "1751954-coinbase.com" OR destinationhostname CONTAINS "17525030-coinbase.com" OR destinationhostname CONTAINS "17529580-coinbase.com" OR destinationhostname CONTAINS "17614-coinbase.com" OR destinationhostname CONTAINS "17618412-coinbase.com" OR destinationhostname CONTAINS "17619-coinbase.com" OR destinationhostname CONTAINS "176284-coinbase.com" OR destinationhostname CONTAINS "17823920-coinbase.com" OR destinationhostname CONTAINS "178253-coinbase.com")
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "16450207-coinbase.com" OR sourcentdomain CONTAINS "16458207-coinbase.com" OR sourcentdomain CONTAINS "16478202-coinbase.com" OR sourcentdomain CONTAINS "164872942-coinbase.com" OR sourcentdomain CONTAINS "16590-coinbase.com" OR sourcentdomain CONTAINS "16594373-coinbase.com" OR sourcentdomain CONTAINS "16624831-coinbase.com" OR sourcentdomain CONTAINS "16642124-coinbase.com" OR sourcentdomain CONTAINS "16642172-coinbase.com" OR sourcentdomain CONTAINS "16642580-coinbase.com" OR sourcentdomain CONTAINS "16642721-coinbase.com" OR sourcentdomain CONTAINS "16642724-coinbase.com" OR sourcentdomain CONTAINS "16642871-coinbase.com" OR sourcentdomain CONTAINS "16642872-coinbase.com" OR sourcentdomain CONTAINS "16712942-coinbase.com" OR sourcentdomain CONTAINS "16718672-coinbase.com" OR sourcentdomain CONTAINS "16728342-coinbase.com" OR sourcentdomain CONTAINS "16728348-coinbase.com" OR sourcentdomain CONTAINS "16728442-coinbase.com" OR sourcentdomain CONTAINS "16728472-coinbase.com" OR sourcentdomain CONTAINS "167285-coinbase.com" OR sourcentdomain CONTAINS "16729042-coinbase.com" OR sourcentdomain CONTAINS "16748272-coinbase.com" OR sourcentdomain CONTAINS "16782942-coinbase.com" OR sourcentdomain CONTAINS "16827420-coinbase.com" OR sourcentdomain CONTAINS "16827423-coinbase.com" OR sourcentdomain CONTAINS "16847145-coinbase.com" OR sourcentdomain CONTAINS "16893924-coinbase.com" OR sourcentdomain CONTAINS "17182-coinbase.com" OR sourcentdomain CONTAINS "17255030-coinbase.com" OR sourcentdomain CONTAINS "17259-kraken.com" OR sourcentdomain CONTAINS "172486-coinbase.com" OR sourcentdomain CONTAINS "17284652-coinbase.com" OR sourcentdomain CONTAINS "17286-coinbase.com" OR sourcentdomain CONTAINS "17334522-coinbase.com" OR sourcentdomain CONTAINS "17334522-kraken.com" OR sourcentdomain CONTAINS "17384522-coinbase.com" OR sourcentdomain CONTAINS "173912-coinbase.com" OR sourcentdomain CONTAINS "17494976-coinbase.com" OR sourcentdomain CONTAINS "17512854-coinbase.com" OR sourcentdomain CONTAINS "17512857-coinbase.com" OR sourcentdomain CONTAINS "1751954-coinbase.com" OR sourcentdomain CONTAINS "17525030-coinbase.com" OR sourcentdomain CONTAINS "17529580-coinbase.com" OR sourcentdomain CONTAINS "17614-coinbase.com" OR sourcentdomain CONTAINS "17618412-coinbase.com" OR sourcentdomain CONTAINS "17619-coinbase.com" OR sourcentdomain CONTAINS "176284-coinbase.com" OR sourcentdomain CONTAINS "17823920-coinbase.com" OR sourcentdomain CONTAINS "178253-coinbase.com")
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "16450207-coinbase.com" OR sourcehostname CONTAINS "16458207-coinbase.com" OR sourcehostname CONTAINS "16478202-coinbase.com" OR sourcehostname CONTAINS "164872942-coinbase.com" OR sourcehostname CONTAINS "16590-coinbase.com" OR sourcehostname CONTAINS "16594373-coinbase.com" OR sourcehostname CONTAINS "16624831-coinbase.com" OR sourcehostname CONTAINS "16642124-coinbase.com" OR sourcehostname CONTAINS "16642172-coinbase.com" OR sourcehostname CONTAINS "16642580-coinbase.com" OR sourcehostname CONTAINS "16642721-coinbase.com" OR sourcehostname CONTAINS "16642724-coinbase.com" OR sourcehostname CONTAINS "16642871-coinbase.com" OR sourcehostname CONTAINS "16642872-coinbase.com" OR sourcehostname CONTAINS "16712942-coinbase.com" OR sourcehostname CONTAINS "16718672-coinbase.com" OR sourcehostname CONTAINS "16728342-coinbase.com" OR sourcehostname CONTAINS "16728348-coinbase.com" OR sourcehostname CONTAINS "16728442-coinbase.com" OR sourcehostname CONTAINS "16728472-coinbase.com" OR sourcehostname CONTAINS "167285-coinbase.com" OR sourcehostname CONTAINS "16729042-coinbase.com" OR sourcehostname CONTAINS "16748272-coinbase.com" OR sourcehostname CONTAINS "16782942-coinbase.com" OR sourcehostname CONTAINS "16827420-coinbase.com" OR sourcehostname CONTAINS "16827423-coinbase.com" OR sourcehostname CONTAINS "16847145-coinbase.com" OR sourcehostname CONTAINS "16893924-coinbase.com" OR sourcehostname CONTAINS "17182-coinbase.com" OR sourcehostname CONTAINS "17255030-coinbase.com" OR sourcehostname CONTAINS "17259-kraken.com" OR sourcehostname CONTAINS "172486-coinbase.com" OR sourcehostname CONTAINS "17284652-coinbase.com" OR sourcehostname CONTAINS "17286-coinbase.com" OR sourcehostname CONTAINS "17334522-coinbase.com" OR sourcehostname CONTAINS "17334522-kraken.com" OR sourcehostname CONTAINS "17384522-coinbase.com" OR sourcehostname CONTAINS "173912-coinbase.com" OR sourcehostname CONTAINS "17494976-coinbase.com" OR sourcehostname CONTAINS "17512854-coinbase.com" OR sourcehostname CONTAINS "17512857-coinbase.com" OR sourcehostname CONTAINS "1751954-coinbase.com" OR sourcehostname CONTAINS "17525030-coinbase.com" OR sourcehostname CONTAINS "17529580-coinbase.com" OR sourcehostname CONTAINS "17614-coinbase.com" OR sourcehostname CONTAINS "17618412-coinbase.com" OR sourcehostname CONTAINS "17619-coinbase.com" OR sourcehostname CONTAINS "176284-coinbase.com" OR sourcehostname CONTAINS "17823920-coinbase.com" OR sourcehostname CONTAINS "178253-coinbase.com")
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "16450207-coinbase.com" OR destinationntdomain CONTAINS "16458207-coinbase.com" OR destinationntdomain CONTAINS "16478202-coinbase.com" OR destinationntdomain CONTAINS "164872942-coinbase.com" OR destinationntdomain CONTAINS "16590-coinbase.com" OR destinationntdomain CONTAINS "16594373-coinbase.com" OR destinationntdomain CONTAINS "16624831-coinbase.com" OR destinationntdomain CONTAINS "16642124-coinbase.com" OR destinationntdomain CONTAINS "16642172-coinbase.com" OR destinationntdomain CONTAINS "16642580-coinbase.com" OR destinationntdomain CONTAINS "16642721-coinbase.com" OR destinationntdomain CONTAINS "16642724-coinbase.com" OR destinationntdomain CONTAINS "16642871-coinbase.com" OR destinationntdomain CONTAINS "16642872-coinbase.com" OR destinationntdomain CONTAINS "16712942-coinbase.com" OR destinationntdomain CONTAINS "16718672-coinbase.com" OR destinationntdomain CONTAINS "16728342-coinbase.com" OR destinationntdomain CONTAINS "16728348-coinbase.com" OR destinationntdomain CONTAINS "16728442-coinbase.com" OR destinationntdomain CONTAINS "16728472-coinbase.com" OR destinationntdomain CONTAINS "167285-coinbase.com" OR destinationntdomain CONTAINS "16729042-coinbase.com" OR destinationntdomain CONTAINS "16748272-coinbase.com" OR destinationntdomain CONTAINS "16782942-coinbase.com" OR destinationntdomain CONTAINS "16827420-coinbase.com" OR destinationntdomain CONTAINS "16827423-coinbase.com" OR destinationntdomain CONTAINS "16847145-coinbase.com" OR destinationntdomain CONTAINS "16893924-coinbase.com" OR destinationntdomain CONTAINS "17182-coinbase.com" OR destinationntdomain CONTAINS "17255030-coinbase.com" OR destinationntdomain CONTAINS "17259-kraken.com" OR destinationntdomain CONTAINS "172486-coinbase.com" OR destinationntdomain CONTAINS "17284652-coinbase.com" OR destinationntdomain CONTAINS "17286-coinbase.com" OR destinationntdomain CONTAINS "17334522-coinbase.com" OR destinationntdomain CONTAINS "17334522-kraken.com" OR destinationntdomain CONTAINS "17384522-coinbase.com" OR destinationntdomain CONTAINS "173912-coinbase.com" OR destinationntdomain CONTAINS "17494976-coinbase.com" OR destinationntdomain CONTAINS "17512854-coinbase.com" OR destinationntdomain CONTAINS "17512857-coinbase.com" OR destinationntdomain CONTAINS "1751954-coinbase.com" OR destinationntdomain CONTAINS "17525030-coinbase.com" OR destinationntdomain CONTAINS "17529580-coinbase.com" OR destinationntdomain CONTAINS "17614-coinbase.com" OR destinationntdomain CONTAINS "17618412-coinbase.com" OR destinationntdomain CONTAINS "17619-coinbase.com" OR destinationntdomain CONTAINS "176284-coinbase.com" OR destinationntdomain CONTAINS "17823920-coinbase.com" OR destinationntdomain CONTAINS "178253-coinbase.com")
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND requesturl NOT NULL AND (requesturl CONTAINS "16450207-coinbase.com" OR requesturl CONTAINS "16458207-coinbase.com" OR requesturl CONTAINS "16478202-coinbase.com" OR requesturl CONTAINS "164872942-coinbase.com" OR requesturl CONTAINS "16590-coinbase.com" OR requesturl CONTAINS "16594373-coinbase.com" OR requesturl CONTAINS "16624831-coinbase.com" OR requesturl CONTAINS "16642124-coinbase.com" OR requesturl CONTAINS "16642172-coinbase.com" OR requesturl CONTAINS "16642580-coinbase.com" OR requesturl CONTAINS "16642721-coinbase.com" OR requesturl CONTAINS "16642724-coinbase.com" OR requesturl CONTAINS "16642871-coinbase.com" OR requesturl CONTAINS "16642872-coinbase.com" OR requesturl CONTAINS "16712942-coinbase.com" OR requesturl CONTAINS "16718672-coinbase.com" OR requesturl CONTAINS "16728342-coinbase.com" OR requesturl CONTAINS "16728348-coinbase.com" OR requesturl CONTAINS "16728442-coinbase.com" OR requesturl CONTAINS "16728472-coinbase.com" OR requesturl CONTAINS "167285-coinbase.com" OR requesturl CONTAINS "16729042-coinbase.com" OR requesturl CONTAINS "16748272-coinbase.com" OR requesturl CONTAINS "16782942-coinbase.com" OR requesturl CONTAINS "16827420-coinbase.com" OR requesturl CONTAINS "16827423-coinbase.com" OR requesturl CONTAINS "16847145-coinbase.com" OR requesturl CONTAINS "16893924-coinbase.com" OR requesturl CONTAINS "17182-coinbase.com" OR requesturl CONTAINS "17255030-coinbase.com" OR requesturl CONTAINS "17259-kraken.com" OR requesturl CONTAINS "172486-coinbase.com" OR requesturl CONTAINS "17284652-coinbase.com" OR requesturl CONTAINS "17286-coinbase.com" OR requesturl CONTAINS "17334522-coinbase.com" OR requesturl CONTAINS "17334522-kraken.com" OR requesturl CONTAINS "17384522-coinbase.com" OR requesturl CONTAINS "173912-coinbase.com" OR requesturl CONTAINS "17494976-coinbase.com" OR requesturl CONTAINS "17512854-coinbase.com" OR requesturl CONTAINS "17512857-coinbase.com" OR requesturl CONTAINS "1751954-coinbase.com" OR requesturl CONTAINS "17525030-coinbase.com" OR requesturl CONTAINS "17529580-coinbase.com" OR requesturl CONTAINS "17614-coinbase.com" OR requesturl CONTAINS "17618412-coinbase.com" OR requesturl CONTAINS "17619-coinbase.com" OR requesturl CONTAINS "176284-coinbase.com" OR requesturl CONTAINS "17823920-coinbase.com" OR requesturl CONTAINS "178253-coinbase.com")
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "178294-coinbase.com" OR destinationhostname CONTAINS "17912-coinbase.com" OR destinationhostname CONTAINS "17914-coinbase.com" OR destinationhostname CONTAINS "17917-coinbase.com" OR destinationhostname CONTAINS "17954-coinbase.com" OR destinationhostname CONTAINS "17958-coinbase.com" OR destinationhostname CONTAINS "182043-coinbase.com" OR destinationhostname CONTAINS "18275-gemini.com" OR destinationhostname CONTAINS "18276-coinbase.com" OR destinationhostname CONTAINS "18290185-coinbase.com" OR destinationhostname CONTAINS "182967-coinbase.com" OR destinationhostname CONTAINS "18560-coinbase.com" OR destinationhostname CONTAINS "18571-coinbase.com" OR destinationhostname CONTAINS "185912-coinbase.com" OR destinationhostname CONTAINS "185914-coinbase.com" OR destinationhostname CONTAINS "18592176-coinbase.com" OR destinationhostname CONTAINS "18594162-coinbase.com" OR destinationhostname CONTAINS "18594962-coinbase.com" OR destinationhostname CONTAINS "18597162-coinbase.com" OR destinationhostname CONTAINS "18719562-coinbase.com" OR destinationhostname CONTAINS "1875290-coinbase.com" OR destinationhostname CONTAINS "1882730-coinbase.com" OR destinationhostname CONTAINS "18902-coinbase.com" OR destinationhostname CONTAINS "18903-coinbase.com" OR destinationhostname CONTAINS "189126-coinbase.com" OR destinationhostname CONTAINS "18952-coinbase.com" OR destinationhostname CONTAINS "192854-coinbase.com" OR destinationhostname CONTAINS "192856-coinbase.com" OR destinationhostname CONTAINS "19287-binance.com" OR destinationhostname CONTAINS "19572-coinbase.com" OR destinationhostname CONTAINS "195812-coinbase.com" OR destinationhostname CONTAINS "195826-coinbase.com" OR destinationhostname CONTAINS "1958262-coinbase.com" OR destinationhostname CONTAINS "195827-binance.com" OR destinationhostname CONTAINS "1958297-coinbase.com" OR destinationhostname CONTAINS "19582970-coinbase.com" OR destinationhostname CONTAINS "19582971-coinbase.com" OR destinationhostname CONTAINS "19583-coinbase.com" OR destinationhostname CONTAINS "19592653-coinbase.com" OR destinationhostname CONTAINS "197304-coinbase.com" OR destinationhostname CONTAINS "19730492-coinbase.com" OR destinationhostname CONTAINS "19764162-coinbase.com" OR destinationhostname CONTAINS "19803-coinbase.com" OR destinationhostname CONTAINS "201784289-coinbase.com" OR destinationhostname CONTAINS "210823644-coinbase.com" OR destinationhostname CONTAINS "21158-coinbase.com" OR destinationhostname CONTAINS "21509-coinbase.com" OR destinationhostname CONTAINS "25985-coinbase.com" OR destinationhostname CONTAINS "27699-coinbase.com" OR destinationhostname CONTAINS "28367-coinbase.com")
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "178294-coinbase.com" OR sourcentdomain CONTAINS "17912-coinbase.com" OR sourcentdomain CONTAINS "17914-coinbase.com" OR sourcentdomain CONTAINS "17917-coinbase.com" OR sourcentdomain CONTAINS "17954-coinbase.com" OR sourcentdomain CONTAINS "17958-coinbase.com" OR sourcentdomain CONTAINS "182043-coinbase.com" OR sourcentdomain CONTAINS "18275-gemini.com" OR sourcentdomain CONTAINS "18276-coinbase.com" OR sourcentdomain CONTAINS "18290185-coinbase.com" OR sourcentdomain CONTAINS "182967-coinbase.com" OR sourcentdomain CONTAINS "18560-coinbase.com" OR sourcentdomain CONTAINS "18571-coinbase.com" OR sourcentdomain CONTAINS "185912-coinbase.com" OR sourcentdomain CONTAINS "185914-coinbase.com" OR sourcentdomain CONTAINS "18592176-coinbase.com" OR sourcentdomain CONTAINS "18594162-coinbase.com" OR sourcentdomain CONTAINS "18594962-coinbase.com" OR sourcentdomain CONTAINS "18597162-coinbase.com" OR sourcentdomain CONTAINS "18719562-coinbase.com" OR sourcentdomain CONTAINS "1875290-coinbase.com" OR sourcentdomain CONTAINS "1882730-coinbase.com" OR sourcentdomain CONTAINS "18902-coinbase.com" OR sourcentdomain CONTAINS "18903-coinbase.com" OR sourcentdomain CONTAINS "189126-coinbase.com" OR sourcentdomain CONTAINS "18952-coinbase.com" OR sourcentdomain CONTAINS "192854-coinbase.com" OR sourcentdomain CONTAINS "192856-coinbase.com" OR sourcentdomain CONTAINS "19287-binance.com" OR sourcentdomain CONTAINS "19572-coinbase.com" OR sourcentdomain CONTAINS "195812-coinbase.com" OR sourcentdomain CONTAINS "195826-coinbase.com" OR sourcentdomain CONTAINS "1958262-coinbase.com" OR sourcentdomain CONTAINS "195827-binance.com" OR sourcentdomain CONTAINS "1958297-coinbase.com" OR sourcentdomain CONTAINS "19582970-coinbase.com" OR sourcentdomain CONTAINS "19582971-coinbase.com" OR sourcentdomain CONTAINS "19583-coinbase.com" OR sourcentdomain CONTAINS "19592653-coinbase.com" OR sourcentdomain CONTAINS "197304-coinbase.com" OR sourcentdomain CONTAINS "19730492-coinbase.com" OR sourcentdomain CONTAINS "19764162-coinbase.com" OR sourcentdomain CONTAINS "19803-coinbase.com" OR sourcentdomain CONTAINS "201784289-coinbase.com" OR sourcentdomain CONTAINS "210823644-coinbase.com" OR sourcentdomain CONTAINS "21158-coinbase.com" OR sourcentdomain CONTAINS "21509-coinbase.com" OR sourcentdomain CONTAINS "25985-coinbase.com" OR sourcentdomain CONTAINS "27699-coinbase.com" OR sourcentdomain CONTAINS "28367-coinbase.com")
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "178294-coinbase.com" OR sourcehostname CONTAINS "17912-coinbase.com" OR sourcehostname CONTAINS "17914-coinbase.com" OR sourcehostname CONTAINS "17917-coinbase.com" OR sourcehostname CONTAINS "17954-coinbase.com" OR sourcehostname CONTAINS "17958-coinbase.com" OR sourcehostname CONTAINS "182043-coinbase.com" OR sourcehostname CONTAINS "18275-gemini.com" OR sourcehostname CONTAINS "18276-coinbase.com" OR sourcehostname CONTAINS "18290185-coinbase.com" OR sourcehostname CONTAINS "182967-coinbase.com" OR sourcehostname CONTAINS "18560-coinbase.com" OR sourcehostname CONTAINS "18571-coinbase.com" OR sourcehostname CONTAINS "185912-coinbase.com" OR sourcehostname CONTAINS "185914-coinbase.com" OR sourcehostname CONTAINS "18592176-coinbase.com" OR sourcehostname CONTAINS "18594162-coinbase.com" OR sourcehostname CONTAINS "18594962-coinbase.com" OR sourcehostname CONTAINS "18597162-coinbase.com" OR sourcehostname CONTAINS "18719562-coinbase.com" OR sourcehostname CONTAINS "1875290-coinbase.com" OR sourcehostname CONTAINS "1882730-coinbase.com" OR sourcehostname CONTAINS "18902-coinbase.com" OR sourcehostname CONTAINS "18903-coinbase.com" OR sourcehostname CONTAINS "189126-coinbase.com" OR sourcehostname CONTAINS "18952-coinbase.com" OR sourcehostname CONTAINS "192854-coinbase.com" OR sourcehostname CONTAINS "192856-coinbase.com" OR sourcehostname CONTAINS "19287-binance.com" OR sourcehostname CONTAINS "19572-coinbase.com" OR sourcehostname CONTAINS "195812-coinbase.com" OR sourcehostname CONTAINS "195826-coinbase.com" OR sourcehostname CONTAINS "1958262-coinbase.com" OR sourcehostname CONTAINS "195827-binance.com" OR sourcehostname CONTAINS "1958297-coinbase.com" OR sourcehostname CONTAINS "19582970-coinbase.com" OR sourcehostname CONTAINS "19582971-coinbase.com" OR sourcehostname CONTAINS "19583-coinbase.com" OR sourcehostname CONTAINS "19592653-coinbase.com" OR sourcehostname CONTAINS "197304-coinbase.com" OR sourcehostname CONTAINS "19730492-coinbase.com" OR sourcehostname CONTAINS "19764162-coinbase.com" OR sourcehostname CONTAINS "19803-coinbase.com" OR sourcehostname CONTAINS "201784289-coinbase.com" OR sourcehostname CONTAINS "210823644-coinbase.com" OR sourcehostname CONTAINS "21158-coinbase.com" OR sourcehostname CONTAINS "21509-coinbase.com" OR sourcehostname CONTAINS "25985-coinbase.com" OR sourcehostname CONTAINS "27699-coinbase.com" OR sourcehostname CONTAINS "28367-coinbase.com")
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "178294-coinbase.com" OR destinationntdomain CONTAINS "17912-coinbase.com" OR destinationntdomain CONTAINS "17914-coinbase.com" OR destinationntdomain CONTAINS "17917-coinbase.com" OR destinationntdomain CONTAINS "17954-coinbase.com" OR destinationntdomain CONTAINS "17958-coinbase.com" OR destinationntdomain CONTAINS "182043-coinbase.com" OR destinationntdomain CONTAINS "18275-gemini.com" OR destinationntdomain CONTAINS "18276-coinbase.com" OR destinationntdomain CONTAINS "18290185-coinbase.com" OR destinationntdomain CONTAINS "182967-coinbase.com" OR destinationntdomain CONTAINS "18560-coinbase.com" OR destinationntdomain CONTAINS "18571-coinbase.com" OR destinationntdomain CONTAINS "185912-coinbase.com" OR destinationntdomain CONTAINS "185914-coinbase.com" OR destinationntdomain CONTAINS "18592176-coinbase.com" OR destinationntdomain CONTAINS "18594162-coinbase.com" OR destinationntdomain CONTAINS "18594962-coinbase.com" OR destinationntdomain CONTAINS "18597162-coinbase.com" OR destinationntdomain CONTAINS "18719562-coinbase.com" OR destinationntdomain CONTAINS "1875290-coinbase.com" OR destinationntdomain CONTAINS "1882730-coinbase.com" OR destinationntdomain CONTAINS "18902-coinbase.com" OR destinationntdomain CONTAINS "18903-coinbase.com" OR destinationntdomain CONTAINS "189126-coinbase.com" OR destinationntdomain CONTAINS "18952-coinbase.com" OR destinationntdomain CONTAINS "192854-coinbase.com" OR destinationntdomain CONTAINS "192856-coinbase.com" OR destinationntdomain CONTAINS "19287-binance.com" OR destinationntdomain CONTAINS "19572-coinbase.com" OR destinationntdomain CONTAINS "195812-coinbase.com" OR destinationntdomain CONTAINS "195826-coinbase.com" OR destinationntdomain CONTAINS "1958262-coinbase.com" OR destinationntdomain CONTAINS "195827-binance.com" OR destinationntdomain CONTAINS "1958297-coinbase.com" OR destinationntdomain CONTAINS "19582970-coinbase.com" OR destinationntdomain CONTAINS "19582971-coinbase.com" OR destinationntdomain CONTAINS "19583-coinbase.com" OR destinationntdomain CONTAINS "19592653-coinbase.com" OR destinationntdomain CONTAINS "197304-coinbase.com" OR destinationntdomain CONTAINS "19730492-coinbase.com" OR destinationntdomain CONTAINS "19764162-coinbase.com" OR destinationntdomain CONTAINS "19803-coinbase.com" OR destinationntdomain CONTAINS "201784289-coinbase.com" OR destinationntdomain CONTAINS "210823644-coinbase.com" OR destinationntdomain CONTAINS "21158-coinbase.com" OR destinationntdomain CONTAINS "21509-coinbase.com" OR destinationntdomain CONTAINS "25985-coinbase.com" OR destinationntdomain CONTAINS "27699-coinbase.com" OR destinationntdomain CONTAINS "28367-coinbase.com")
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND requesturl NOT NULL AND (requesturl CONTAINS "178294-coinbase.com" OR requesturl CONTAINS "17912-coinbase.com" OR requesturl CONTAINS "17914-coinbase.com" OR requesturl CONTAINS "17917-coinbase.com" OR requesturl CONTAINS "17954-coinbase.com" OR requesturl CONTAINS "17958-coinbase.com" OR requesturl CONTAINS "182043-coinbase.com" OR requesturl CONTAINS "18275-gemini.com" OR requesturl CONTAINS "18276-coinbase.com" OR requesturl CONTAINS "18290185-coinbase.com" OR requesturl CONTAINS "182967-coinbase.com" OR requesturl CONTAINS "18560-coinbase.com" OR requesturl CONTAINS "18571-coinbase.com" OR requesturl CONTAINS "185912-coinbase.com" OR requesturl CONTAINS "185914-coinbase.com" OR requesturl CONTAINS "18592176-coinbase.com" OR requesturl CONTAINS "18594162-coinbase.com" OR requesturl CONTAINS "18594962-coinbase.com" OR requesturl CONTAINS "18597162-coinbase.com" OR requesturl CONTAINS "18719562-coinbase.com" OR requesturl CONTAINS "1875290-coinbase.com" OR requesturl CONTAINS "1882730-coinbase.com" OR requesturl CONTAINS "18902-coinbase.com" OR requesturl CONTAINS "18903-coinbase.com" OR requesturl CONTAINS "189126-coinbase.com" OR requesturl CONTAINS "18952-coinbase.com" OR requesturl CONTAINS "192854-coinbase.com" OR requesturl CONTAINS "192856-coinbase.com" OR requesturl CONTAINS "19287-binance.com" OR requesturl CONTAINS "19572-coinbase.com" OR requesturl CONTAINS "195812-coinbase.com" OR requesturl CONTAINS "195826-coinbase.com" OR requesturl CONTAINS "1958262-coinbase.com" OR requesturl CONTAINS "195827-binance.com" OR requesturl CONTAINS "1958297-coinbase.com" OR requesturl CONTAINS "19582970-coinbase.com" OR requesturl CONTAINS "19582971-coinbase.com" OR requesturl CONTAINS "19583-coinbase.com" OR requesturl CONTAINS "19592653-coinbase.com" OR requesturl CONTAINS "197304-coinbase.com" OR requesturl CONTAINS "19730492-coinbase.com" OR requesturl CONTAINS "19764162-coinbase.com" OR requesturl CONTAINS "19803-coinbase.com" OR requesturl CONTAINS "201784289-coinbase.com" OR requesturl CONTAINS "210823644-coinbase.com" OR requesturl CONTAINS "21158-coinbase.com" OR requesturl CONTAINS "21509-coinbase.com" OR requesturl CONTAINS "25985-coinbase.com" OR requesturl CONTAINS "27699-coinbase.com" OR requesturl CONTAINS "28367-coinbase.com")
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "28676-coinbase.com" OR destinationhostname CONTAINS "29185-coinbase.com" OR destinationhostname CONTAINS "29195-coinbase.com" OR destinationhostname CONTAINS "2a-coinbase.com" OR destinationhostname CONTAINS "2b-coinbase.com" OR destinationhostname CONTAINS "2c-coinbase.com" OR destinationhostname CONTAINS "2f-coinbase.com" OR destinationhostname CONTAINS "2fas-coinbase.com" OR destinationhostname CONTAINS "2o-coinbase.com" OR destinationhostname CONTAINS "2r-coinbase.com" OR destinationhostname CONTAINS "2s-coinbase.com" OR destinationhostname CONTAINS "2sv-coinbase.com" OR destinationhostname CONTAINS "352134951-coinbase.com" OR destinationhostname CONTAINS "38468-coinbase.com" OR destinationhostname CONTAINS "39590-coinbase.com" OR destinationhostname CONTAINS "41260-coinbase.com" OR destinationhostname CONTAINS "427883-coinbase.com" OR destinationhostname CONTAINS "43017-coinbase.com" OR destinationhostname CONTAINS "47562-coinbase.com" OR destinationhostname CONTAINS "50195-coinbase.com" OR destinationhostname CONTAINS "5247-coinbase.com" OR destinationhostname CONTAINS "54765-coinbase.com" OR destinationhostname CONTAINS "57197-coinbase.com" OR destinationhostname CONTAINS "58176-coinbase.com" OR destinationhostname CONTAINS "58297-coinbase.com" OR destinationhostname CONTAINS "61250-coinbase.com" OR destinationhostname CONTAINS "61835-coinbase.com" OR destinationhostname CONTAINS "61851-coinbase.com" OR destinationhostname CONTAINS "61937-coinbase.com" OR destinationhostname CONTAINS "71925-coinbase.com" OR destinationhostname CONTAINS "72957-coinbase.com" OR destinationhostname CONTAINS "72985-coinbase.com" OR destinationhostname CONTAINS "74651-coinbase.com" OR destinationhostname CONTAINS "754668948-coinbase.com" OR destinationhostname CONTAINS "76159869-coinbase.com" OR destinationhostname CONTAINS "76153-coinbase.com" OR destinationhostname CONTAINS "81758-coinbase.com" OR destinationhostname CONTAINS "81920-coinbase.com" OR destinationhostname CONTAINS "81926-coinbase.com" OR destinationhostname CONTAINS "81958-coinbase.com" OR destinationhostname CONTAINS "826298-coinbase.com" OR destinationhostname CONTAINS "83216-coinbase.com" OR destinationhostname CONTAINS "837613-coinbase.com" OR destinationhostname CONTAINS "83956-coinbase.com" OR destinationhostname CONTAINS "87157-coinbase.com" OR destinationhostname CONTAINS "87312-coinbase.com" OR destinationhostname CONTAINS "89304-coinbase.com" OR destinationhostname CONTAINS "89375-coinbase.com" OR destinationhostname CONTAINS "91723-gemini.com" OR destinationhostname CONTAINS "91752-coinbase.com")
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "28676-coinbase.com" OR sourcentdomain CONTAINS "29185-coinbase.com" OR sourcentdomain CONTAINS "29195-coinbase.com" OR sourcentdomain CONTAINS "2a-coinbase.com" OR sourcentdomain CONTAINS "2b-coinbase.com" OR sourcentdomain CONTAINS "2c-coinbase.com" OR sourcentdomain CONTAINS "2f-coinbase.com" OR sourcentdomain CONTAINS "2fas-coinbase.com" OR sourcentdomain CONTAINS "2o-coinbase.com" OR sourcentdomain CONTAINS "2r-coinbase.com" OR sourcentdomain CONTAINS "2s-coinbase.com" OR sourcentdomain CONTAINS "2sv-coinbase.com" OR sourcentdomain CONTAINS "352134951-coinbase.com" OR sourcentdomain CONTAINS "38468-coinbase.com" OR sourcentdomain CONTAINS "39590-coinbase.com" OR sourcentdomain CONTAINS "41260-coinbase.com" OR sourcentdomain CONTAINS "427883-coinbase.com" OR sourcentdomain CONTAINS "43017-coinbase.com" OR sourcentdomain CONTAINS "47562-coinbase.com" OR sourcentdomain CONTAINS "50195-coinbase.com" OR sourcentdomain CONTAINS "5247-coinbase.com" OR sourcentdomain CONTAINS "54765-coinbase.com" OR sourcentdomain CONTAINS "57197-coinbase.com" OR sourcentdomain CONTAINS "58176-coinbase.com" OR sourcentdomain CONTAINS "58297-coinbase.com" OR sourcentdomain CONTAINS "61250-coinbase.com" OR sourcentdomain CONTAINS "61835-coinbase.com" OR sourcentdomain CONTAINS "61851-coinbase.com" OR sourcentdomain CONTAINS "61937-coinbase.com" OR sourcentdomain CONTAINS "71925-coinbase.com" OR sourcentdomain CONTAINS "72957-coinbase.com" OR sourcentdomain CONTAINS "72985-coinbase.com" OR sourcentdomain CONTAINS "74651-coinbase.com" OR sourcentdomain CONTAINS "754668948-coinbase.com" OR sourcentdomain CONTAINS "76159869-coinbase.com" OR sourcentdomain CONTAINS "76153-coinbase.com" OR sourcentdomain CONTAINS "81758-coinbase.com" OR sourcentdomain CONTAINS "81920-coinbase.com" OR sourcentdomain CONTAINS "81926-coinbase.com" OR sourcentdomain CONTAINS "81958-coinbase.com" OR sourcentdomain CONTAINS "826298-coinbase.com" OR sourcentdomain CONTAINS "83216-coinbase.com" OR sourcentdomain CONTAINS "837613-coinbase.com" OR sourcentdomain CONTAINS "83956-coinbase.com" OR sourcentdomain CONTAINS "87157-coinbase.com" OR sourcentdomain CONTAINS "87312-coinbase.com" OR sourcentdomain CONTAINS "89304-coinbase.com" OR sourcentdomain CONTAINS "89375-coinbase.com" OR sourcentdomain CONTAINS "91723-gemini.com" OR sourcentdomain CONTAINS "91752-coinbase.com")
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "28676-coinbase.com" OR sourcehostname CONTAINS "29185-coinbase.com" OR sourcehostname CONTAINS "29195-coinbase.com" OR sourcehostname CONTAINS "2a-coinbase.com" OR sourcehostname CONTAINS "2b-coinbase.com" OR sourcehostname CONTAINS "2c-coinbase.com" OR sourcehostname CONTAINS "2f-coinbase.com" OR sourcehostname CONTAINS "2fas-coinbase.com" OR sourcehostname CONTAINS "2o-coinbase.com" OR sourcehostname CONTAINS "2r-coinbase.com" OR sourcehostname CONTAINS "2s-coinbase.com" OR sourcehostname CONTAINS "2sv-coinbase.com" OR sourcehostname CONTAINS "352134951-coinbase.com" OR sourcehostname CONTAINS "38468-coinbase.com" OR sourcehostname CONTAINS "39590-coinbase.com" OR sourcehostname CONTAINS "41260-coinbase.com" OR sourcehostname CONTAINS "427883-coinbase.com" OR sourcehostname CONTAINS "43017-coinbase.com" OR sourcehostname CONTAINS "47562-coinbase.com" OR sourcehostname CONTAINS "50195-coinbase.com" OR sourcehostname CONTAINS "5247-coinbase.com" OR sourcehostname CONTAINS "54765-coinbase.com" OR sourcehostname CONTAINS "57197-coinbase.com" OR sourcehostname CONTAINS "58176-coinbase.com" OR sourcehostname CONTAINS "58297-coinbase.com" OR sourcehostname CONTAINS "61250-coinbase.com" OR sourcehostname CONTAINS "61835-coinbase.com" OR sourcehostname CONTAINS "61851-coinbase.com" OR sourcehostname CONTAINS "61937-coinbase.com" OR sourcehostname CONTAINS "71925-coinbase.com" OR sourcehostname CONTAINS "72957-coinbase.com" OR sourcehostname CONTAINS "72985-coinbase.com" OR sourcehostname CONTAINS "74651-coinbase.com" OR sourcehostname CONTAINS "754668948-coinbase.com" OR sourcehostname CONTAINS "76159869-coinbase.com" OR sourcehostname CONTAINS "76153-coinbase.com" OR sourcehostname CONTAINS "81758-coinbase.com" OR sourcehostname CONTAINS "81920-coinbase.com" OR sourcehostname CONTAINS "81926-coinbase.com" OR sourcehostname CONTAINS "81958-coinbase.com" OR sourcehostname CONTAINS "826298-coinbase.com" OR sourcehostname CONTAINS "83216-coinbase.com" OR sourcehostname CONTAINS "837613-coinbase.com" OR sourcehostname CONTAINS "83956-coinbase.com" OR sourcehostname CONTAINS "87157-coinbase.com" OR sourcehostname CONTAINS "87312-coinbase.com" OR sourcehostname CONTAINS "89304-coinbase.com" OR sourcehostname CONTAINS "89375-coinbase.com" OR sourcehostname CONTAINS "91723-gemini.com" OR sourcehostname CONTAINS "91752-coinbase.com")
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "28676-coinbase.com" OR destinationntdomain CONTAINS "29185-coinbase.com" OR destinationntdomain CONTAINS "29195-coinbase.com" OR destinationntdomain CONTAINS "2a-coinbase.com" OR destinationntdomain CONTAINS "2b-coinbase.com" OR destinationntdomain CONTAINS "2c-coinbase.com" OR destinationntdomain CONTAINS "2f-coinbase.com" OR destinationntdomain CONTAINS "2fas-coinbase.com" OR destinationntdomain CONTAINS "2o-coinbase.com" OR destinationntdomain CONTAINS "2r-coinbase.com" OR destinationntdomain CONTAINS "2s-coinbase.com" OR destinationntdomain CONTAINS "2sv-coinbase.com" OR destinationntdomain CONTAINS "352134951-coinbase.com" OR destinationntdomain CONTAINS "38468-coinbase.com" OR destinationntdomain CONTAINS "39590-coinbase.com" OR destinationntdomain CONTAINS "41260-coinbase.com" OR destinationntdomain CONTAINS "427883-coinbase.com" OR destinationntdomain CONTAINS "43017-coinbase.com" OR destinationntdomain CONTAINS "47562-coinbase.com" OR destinationntdomain CONTAINS "50195-coinbase.com" OR destinationntdomain CONTAINS "5247-coinbase.com" OR destinationntdomain CONTAINS "54765-coinbase.com" OR destinationntdomain CONTAINS "57197-coinbase.com" OR destinationntdomain CONTAINS "58176-coinbase.com" OR destinationntdomain CONTAINS "58297-coinbase.com" OR destinationntdomain CONTAINS "61250-coinbase.com" OR destinationntdomain CONTAINS "61835-coinbase.com" OR destinationntdomain CONTAINS "61851-coinbase.com" OR destinationntdomain CONTAINS "61937-coinbase.com" OR destinationntdomain CONTAINS "71925-coinbase.com" OR destinationntdomain CONTAINS "72957-coinbase.com" OR destinationntdomain CONTAINS "72985-coinbase.com" OR destinationntdomain CONTAINS "74651-coinbase.com" OR destinationntdomain CONTAINS "754668948-coinbase.com" OR destinationntdomain CONTAINS "76159869-coinbase.com" OR destinationntdomain CONTAINS "76153-coinbase.com" OR destinationntdomain CONTAINS "81758-coinbase.com" OR destinationntdomain CONTAINS "81920-coinbase.com" OR destinationntdomain CONTAINS "81926-coinbase.com" OR destinationntdomain CONTAINS "81958-coinbase.com" OR destinationntdomain CONTAINS "826298-coinbase.com" OR destinationntdomain CONTAINS "83216-coinbase.com" OR destinationntdomain CONTAINS "837613-coinbase.com" OR destinationntdomain CONTAINS "83956-coinbase.com" OR destinationntdomain CONTAINS "87157-coinbase.com" OR destinationntdomain CONTAINS "87312-coinbase.com" OR destinationntdomain CONTAINS "89304-coinbase.com" OR destinationntdomain CONTAINS "89375-coinbase.com" OR destinationntdomain CONTAINS "91723-gemini.com" OR destinationntdomain CONTAINS "91752-coinbase.com")
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND requesturl NOT NULL AND (requesturl CONTAINS "28676-coinbase.com" OR requesturl CONTAINS "29185-coinbase.com" OR requesturl CONTAINS "29195-coinbase.com" OR requesturl CONTAINS "2a-coinbase.com" OR requesturl CONTAINS "2b-coinbase.com" OR requesturl CONTAINS "2c-coinbase.com" OR requesturl CONTAINS "2f-coinbase.com" OR requesturl CONTAINS "2fas-coinbase.com" OR requesturl CONTAINS "2o-coinbase.com" OR requesturl CONTAINS "2r-coinbase.com" OR requesturl CONTAINS "2s-coinbase.com" OR requesturl CONTAINS "2sv-coinbase.com" OR requesturl CONTAINS "352134951-coinbase.com" OR requesturl CONTAINS "38468-coinbase.com" OR requesturl CONTAINS "39590-coinbase.com" OR requesturl CONTAINS "41260-coinbase.com" OR requesturl CONTAINS "427883-coinbase.com" OR requesturl CONTAINS "43017-coinbase.com" OR requesturl CONTAINS "47562-coinbase.com" OR requesturl CONTAINS "50195-coinbase.com" OR requesturl CONTAINS "5247-coinbase.com" OR requesturl CONTAINS "54765-coinbase.com" OR requesturl CONTAINS "57197-coinbase.com" OR requesturl CONTAINS "58176-coinbase.com" OR requesturl CONTAINS "58297-coinbase.com" OR requesturl CONTAINS "61250-coinbase.com" OR requesturl CONTAINS "61835-coinbase.com" OR requesturl CONTAINS "61851-coinbase.com" OR requesturl CONTAINS "61937-coinbase.com" OR requesturl CONTAINS "71925-coinbase.com" OR requesturl CONTAINS "72957-coinbase.com" OR requesturl CONTAINS "72985-coinbase.com" OR requesturl CONTAINS "74651-coinbase.com" OR requesturl CONTAINS "754668948-coinbase.com" OR requesturl CONTAINS "76159869-coinbase.com" OR requesturl CONTAINS "76153-coinbase.com" OR requesturl CONTAINS "81758-coinbase.com" OR requesturl CONTAINS "81920-coinbase.com" OR requesturl CONTAINS "81926-coinbase.com" OR requesturl CONTAINS "81958-coinbase.com" OR requesturl CONTAINS "826298-coinbase.com" OR requesturl CONTAINS "83216-coinbase.com" OR requesturl CONTAINS "837613-coinbase.com" OR requesturl CONTAINS "83956-coinbase.com" OR requesturl CONTAINS "87157-coinbase.com" OR requesturl CONTAINS "87312-coinbase.com" OR requesturl CONTAINS "89304-coinbase.com" OR requesturl CONTAINS "89375-coinbase.com" OR requesturl CONTAINS "91723-gemini.com" OR requesturl CONTAINS "91752-coinbase.com")
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "91756-coinbase.com" OR destinationhostname CONTAINS "91782-coinbase.com" OR destinationhostname CONTAINS "91835-coinbase.com" OR destinationhostname CONTAINS "91845-coinbase.com" OR destinationhostname CONTAINS "91923-coinbase.com" OR destinationhostname CONTAINS "92758-coinbase.com" OR destinationhostname CONTAINS "948122061-coinbase.com" OR destinationhostname CONTAINS "978941-coinbase.com" OR destinationhostname CONTAINS "accountrecovery-coinbase.com" OR destinationhostname CONTAINS "action-shakepay.com" OR destinationhostname CONTAINS "adjust-coinbase.com" OR destinationhostname CONTAINS "admin-kraken.com" OR destinationhostname CONTAINS "applechargebacks.com" OR destinationhostname CONTAINS "authenticate-gemini.com" OR destinationhostname CONTAINS "authorize-gmail.com" OR destinationhostname CONTAINS "binance-okta.com" OR destinationhostname CONTAINS "captcha-coinbase.com" OR destinationhostname CONTAINS "cd-coinbase.com" OR destinationhostname CONTAINS "coinbase-heip.com" OR destinationhostname CONTAINS "coinbase-live.support" OR destinationhostname CONTAINS "coinbase-reject.com" OR destinationhostname CONTAINS "coinbase-ticket.com" OR destinationhostname CONTAINS "coinbaseheip.com" OR destinationhostname CONTAINS "com-2fa.help" OR destinationhostname CONTAINS "com-2fa.support" OR destinationhostname CONTAINS "com-3845.support" OR destinationhostname CONTAINS "com-connect.help" OR destinationhostname CONTAINS "com-fraud.support" OR destinationhostname CONTAINS "com-help.support" OR destinationhostname CONTAINS "com-reset.help" OR destinationhostname CONTAINS "com-reset.net" OR destinationhostname CONTAINS "com-ticket.live" OR destinationhostname CONTAINS "com-ticket.support" OR destinationhostname CONTAINS "contact-nexo.com" OR destinationhostname CONTAINS "convert-coinbase.com" OR destinationhostname CONTAINS "customerservice-coinbase.com" OR destinationhostname CONTAINS "default-coinbase.com" OR destinationhostname CONTAINS "defend-coinbase.com" OR destinationhostname CONTAINS "deny-coinbase.com" OR destinationhostname CONTAINS "disconnect-coinbase.com" OR destinationhostname CONTAINS "escalate-coinbase.com" OR destinationhostname CONTAINS "establish-coinbase.com" OR destinationhostname CONTAINS "fcc-okta.com" OR destinationhostname CONTAINS "fraudulent-coinbase.com" OR destinationhostname CONTAINS "guard-apple.com" OR destinationhostname CONTAINS "guard-icloud.com" OR destinationhostname CONTAINS "guardian-coinbase.com" OR destinationhostname CONTAINS "guide-gemini.com" OR destinationhostname CONTAINS "help-bitfinex.com" OR destinationhostname CONTAINS "help-shakepay.com")
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "91756-coinbase.com" OR sourcentdomain CONTAINS "91782-coinbase.com" OR sourcentdomain CONTAINS "91835-coinbase.com" OR sourcentdomain CONTAINS "91845-coinbase.com" OR sourcentdomain CONTAINS "91923-coinbase.com" OR sourcentdomain CONTAINS "92758-coinbase.com" OR sourcentdomain CONTAINS "948122061-coinbase.com" OR sourcentdomain CONTAINS "978941-coinbase.com" OR sourcentdomain CONTAINS "accountrecovery-coinbase.com" OR sourcentdomain CONTAINS "action-shakepay.com" OR sourcentdomain CONTAINS "adjust-coinbase.com" OR sourcentdomain CONTAINS "admin-kraken.com" OR sourcentdomain CONTAINS "applechargebacks.com" OR sourcentdomain CONTAINS "authenticate-gemini.com" OR sourcentdomain CONTAINS "authorize-gmail.com" OR sourcentdomain CONTAINS "binance-okta.com" OR sourcentdomain CONTAINS "captcha-coinbase.com" OR sourcentdomain CONTAINS "cd-coinbase.com" OR sourcentdomain CONTAINS "coinbase-heip.com" OR sourcentdomain CONTAINS "coinbase-live.support" OR sourcentdomain CONTAINS "coinbase-reject.com" OR sourcentdomain CONTAINS "coinbase-ticket.com" OR sourcentdomain CONTAINS "coinbaseheip.com" OR sourcentdomain CONTAINS "com-2fa.help" OR sourcentdomain CONTAINS "com-2fa.support" OR sourcentdomain CONTAINS "com-3845.support" OR sourcentdomain CONTAINS "com-connect.help" OR sourcentdomain CONTAINS "com-fraud.support" OR sourcentdomain CONTAINS "com-help.support" OR sourcentdomain CONTAINS "com-reset.help" OR sourcentdomain CONTAINS "com-reset.net" OR sourcentdomain CONTAINS "com-ticket.live" OR sourcentdomain CONTAINS "com-ticket.support" OR sourcentdomain CONTAINS "contact-nexo.com" OR sourcentdomain CONTAINS "convert-coinbase.com" OR sourcentdomain CONTAINS "customerservice-coinbase.com" OR sourcentdomain CONTAINS "default-coinbase.com" OR sourcentdomain CONTAINS "defend-coinbase.com" OR sourcentdomain CONTAINS "deny-coinbase.com" OR sourcentdomain CONTAINS "disconnect-coinbase.com" OR sourcentdomain CONTAINS "escalate-coinbase.com" OR sourcentdomain CONTAINS "establish-coinbase.com" OR sourcentdomain CONTAINS "fcc-okta.com" OR sourcentdomain CONTAINS "fraudulent-coinbase.com" OR sourcentdomain CONTAINS "guard-apple.com" OR sourcentdomain CONTAINS "guard-icloud.com" OR sourcentdomain CONTAINS "guardian-coinbase.com" OR sourcentdomain CONTAINS "guide-gemini.com" OR sourcentdomain CONTAINS "help-bitfinex.com" OR sourcentdomain CONTAINS "help-shakepay.com")
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "91756-coinbase.com" OR sourcehostname CONTAINS "91782-coinbase.com" OR sourcehostname CONTAINS "91835-coinbase.com" OR sourcehostname CONTAINS "91845-coinbase.com" OR sourcehostname CONTAINS "91923-coinbase.com" OR sourcehostname CONTAINS "92758-coinbase.com" OR sourcehostname CONTAINS "948122061-coinbase.com" OR sourcehostname CONTAINS "978941-coinbase.com" OR sourcehostname CONTAINS "accountrecovery-coinbase.com" OR sourcehostname CONTAINS "action-shakepay.com" OR sourcehostname CONTAINS "adjust-coinbase.com" OR sourcehostname CONTAINS "admin-kraken.com" OR sourcehostname CONTAINS "applechargebacks.com" OR sourcehostname CONTAINS "authenticate-gemini.com" OR sourcehostname CONTAINS "authorize-gmail.com" OR sourcehostname CONTAINS "binance-okta.com" OR sourcehostname CONTAINS "captcha-coinbase.com" OR sourcehostname CONTAINS "cd-coinbase.com" OR sourcehostname CONTAINS "coinbase-heip.com" OR sourcehostname CONTAINS "coinbase-live.support" OR sourcehostname CONTAINS "coinbase-reject.com" OR sourcehostname CONTAINS "coinbase-ticket.com" OR sourcehostname CONTAINS "coinbaseheip.com" OR sourcehostname CONTAINS "com-2fa.help" OR sourcehostname CONTAINS "com-2fa.support" OR sourcehostname CONTAINS "com-3845.support" OR sourcehostname CONTAINS "com-connect.help" OR sourcehostname CONTAINS "com-fraud.support" OR sourcehostname CONTAINS "com-help.support" OR sourcehostname CONTAINS "com-reset.help" OR sourcehostname CONTAINS "com-reset.net" OR sourcehostname CONTAINS "com-ticket.live" OR sourcehostname CONTAINS "com-ticket.support" OR sourcehostname CONTAINS "contact-nexo.com" OR sourcehostname CONTAINS "convert-coinbase.com" OR sourcehostname CONTAINS "customerservice-coinbase.com" OR sourcehostname CONTAINS "default-coinbase.com" OR sourcehostname CONTAINS "defend-coinbase.com" OR sourcehostname CONTAINS "deny-coinbase.com" OR sourcehostname CONTAINS "disconnect-coinbase.com" OR sourcehostname CONTAINS "escalate-coinbase.com" OR sourcehostname CONTAINS "establish-coinbase.com" OR sourcehostname CONTAINS "fcc-okta.com" OR sourcehostname CONTAINS "fraudulent-coinbase.com" OR sourcehostname CONTAINS "guard-apple.com" OR sourcehostname CONTAINS "guard-icloud.com" OR sourcehostname CONTAINS "guardian-coinbase.com" OR sourcehostname CONTAINS "guide-gemini.com" OR sourcehostname CONTAINS "help-bitfinex.com" OR sourcehostname CONTAINS "help-shakepay.com")
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "91756-coinbase.com" OR destinationntdomain CONTAINS "91782-coinbase.com" OR destinationntdomain CONTAINS "91835-coinbase.com" OR destinationntdomain CONTAINS "91845-coinbase.com" OR destinationntdomain CONTAINS "91923-coinbase.com" OR destinationntdomain CONTAINS "92758-coinbase.com" OR destinationntdomain CONTAINS "948122061-coinbase.com" OR destinationntdomain CONTAINS "978941-coinbase.com" OR destinationntdomain CONTAINS "accountrecovery-coinbase.com" OR destinationntdomain CONTAINS "action-shakepay.com" OR destinationntdomain CONTAINS "adjust-coinbase.com" OR destinationntdomain CONTAINS "admin-kraken.com" OR destinationntdomain CONTAINS "applechargebacks.com" OR destinationntdomain CONTAINS "authenticate-gemini.com" OR destinationntdomain CONTAINS "authorize-gmail.com" OR destinationntdomain CONTAINS "binance-okta.com" OR destinationntdomain CONTAINS "captcha-coinbase.com" OR destinationntdomain CONTAINS "cd-coinbase.com" OR destinationntdomain CONTAINS "coinbase-heip.com" OR destinationntdomain CONTAINS "coinbase-live.support" OR destinationntdomain CONTAINS "coinbase-reject.com" OR destinationntdomain CONTAINS "coinbase-ticket.com" OR destinationntdomain CONTAINS "coinbaseheip.com" OR destinationntdomain CONTAINS "com-2fa.help" OR destinationntdomain CONTAINS "com-2fa.support" OR destinationntdomain CONTAINS "com-3845.support" OR destinationntdomain CONTAINS "com-connect.help" OR destinationntdomain CONTAINS "com-fraud.support" OR destinationntdomain CONTAINS "com-help.support" OR destinationntdomain CONTAINS "com-reset.help" OR destinationntdomain CONTAINS "com-reset.net" OR destinationntdomain CONTAINS "com-ticket.live" OR destinationntdomain CONTAINS "com-ticket.support" OR destinationntdomain CONTAINS "contact-nexo.com" OR destinationntdomain CONTAINS "convert-coinbase.com" OR destinationntdomain CONTAINS "customerservice-coinbase.com" OR destinationntdomain CONTAINS "default-coinbase.com" OR destinationntdomain CONTAINS "defend-coinbase.com" OR destinationntdomain CONTAINS "deny-coinbase.com" OR destinationntdomain CONTAINS "disconnect-coinbase.com" OR destinationntdomain CONTAINS "escalate-coinbase.com" OR destinationntdomain CONTAINS "establish-coinbase.com" OR destinationntdomain CONTAINS "fcc-okta.com" OR destinationntdomain CONTAINS "fraudulent-coinbase.com" OR destinationntdomain CONTAINS "guard-apple.com" OR destinationntdomain CONTAINS "guard-icloud.com" OR destinationntdomain CONTAINS "guardian-coinbase.com" OR destinationntdomain CONTAINS "guide-gemini.com" OR destinationntdomain CONTAINS "help-bitfinex.com" OR destinationntdomain CONTAINS "help-shakepay.com")
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND requesturl NOT NULL AND (requesturl CONTAINS "91756-coinbase.com" OR requesturl CONTAINS "91782-coinbase.com" OR requesturl CONTAINS "91835-coinbase.com" OR requesturl CONTAINS "91845-coinbase.com" OR requesturl CONTAINS "91923-coinbase.com" OR requesturl CONTAINS "92758-coinbase.com" OR requesturl CONTAINS "948122061-coinbase.com" OR requesturl CONTAINS "978941-coinbase.com" OR requesturl CONTAINS "accountrecovery-coinbase.com" OR requesturl CONTAINS "action-shakepay.com" OR requesturl CONTAINS "adjust-coinbase.com" OR requesturl CONTAINS "admin-kraken.com" OR requesturl CONTAINS "applechargebacks.com" OR requesturl CONTAINS "authenticate-gemini.com" OR requesturl CONTAINS "authorize-gmail.com" OR requesturl CONTAINS "binance-okta.com" OR requesturl CONTAINS "captcha-coinbase.com" OR requesturl CONTAINS "cd-coinbase.com" OR requesturl CONTAINS "coinbase-heip.com" OR requesturl CONTAINS "coinbase-live.support" OR requesturl CONTAINS "coinbase-reject.com" OR requesturl CONTAINS "coinbase-ticket.com" OR requesturl CONTAINS "coinbaseheip.com" OR requesturl CONTAINS "com-2fa.help" OR requesturl CONTAINS "com-2fa.support" OR requesturl CONTAINS "com-3845.support" OR requesturl CONTAINS "com-connect.help" OR requesturl CONTAINS "com-fraud.support" OR requesturl CONTAINS "com-help.support" OR requesturl CONTAINS "com-reset.help" OR requesturl CONTAINS "com-reset.net" OR requesturl CONTAINS "com-ticket.live" OR requesturl CONTAINS "com-ticket.support" OR requesturl CONTAINS "contact-nexo.com" OR requesturl CONTAINS "convert-coinbase.com" OR requesturl CONTAINS "customerservice-coinbase.com" OR requesturl CONTAINS "default-coinbase.com" OR requesturl CONTAINS "defend-coinbase.com" OR requesturl CONTAINS "deny-coinbase.com" OR requesturl CONTAINS "disconnect-coinbase.com" OR requesturl CONTAINS "escalate-coinbase.com" OR requesturl CONTAINS "establish-coinbase.com" OR requesturl CONTAINS "fcc-okta.com" OR requesturl CONTAINS "fraudulent-coinbase.com" OR requesturl CONTAINS "guard-apple.com" OR requesturl CONTAINS "guard-icloud.com" OR requesturl CONTAINS "guardian-coinbase.com" OR requesturl CONTAINS "guide-gemini.com" OR requesturl CONTAINS "help-bitfinex.com" OR requesturl CONTAINS "help-shakepay.com")
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "helpdesk-apple.com" OR destinationhostname CONTAINS "helpdesk-gemini.com" OR destinationhostname CONTAINS "helpdesk-icloud.com" OR destinationhostname CONTAINS "identification-coinbase.com" OR destinationhostname CONTAINS "lockdown-coinbase.com" OR destinationhostname CONTAINS "login-nexo.com" OR destinationhostname CONTAINS "keys-coinbase.com" OR destinationhostname CONTAINS "messages-coinbase.com" OR destinationhostname CONTAINS "newpassword-coinbase.com" OR destinationhostname CONTAINS "prompt-coinbase.com" OR destinationhostname CONTAINS "protect-apple.com" OR destinationhostname CONTAINS "protect-coinbase.com" OR destinationhostname CONTAINS "protect-gmail.com" OR destinationhostname CONTAINS "protect-kraken.com" OR destinationhostname CONTAINS "recoverme-coinbase.com" OR destinationhostname CONTAINS "recoveryportal-coinbase.com" OR destinationhostname CONTAINS "refunds-coinbase.com" OR destinationhostname CONTAINS "reset-okta.com" OR destinationhostname CONTAINS "restore-coinbase.com" OR destinationhostname CONTAINS "return-coinbase.com" OR destinationhostname CONTAINS "reverts-coinbase.com" OR destinationhostname CONTAINS "secure-binance.us" OR destinationhostname CONTAINS "secure-icloud.com" OR destinationhostname CONTAINS "secure-nexo.com" OR destinationhostname CONTAINS "secure-shakepay.com" OR destinationhostname CONTAINS "security-umusic.com" OR destinationhostname CONTAINS "server694590423.tech" OR destinationhostname CONTAINS "session-coinbase.com" OR destinationhostname CONTAINS "startrecovery-coinbase.com" OR destinationhostname CONTAINS "signin-kraken.com" OR destinationhostname CONTAINS "suite-trezor.io" OR destinationhostname CONTAINS "supportportal-coinbase.com" OR destinationhostname CONTAINS "tech-icloud.com" OR destinationhostname CONTAINS "threat-coinbase.com" OR destinationhostname CONTAINS "ticket-apple.com" OR destinationhostname CONTAINS "ticket-coinbase.com" OR destinationhostname CONTAINS "tickets-apple.com" OR destinationhostname CONTAINS "tokens-coinbase.com" OR destinationhostname CONTAINS "unblock-coinbase.com" OR destinationhostname CONTAINS "unlink-coinbase.com" OR destinationhostname CONTAINS "your-coinbase.com" OR destinationhostname CONTAINS "welcome-coinbase.com" OR destinationhostname CONTAINS "www-coinbasewallet.com" OR destinationhostname CONTAINS "www-help-coinbase.com" OR destinationhostname CONTAINS "www-help-gemini.com")
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "helpdesk-apple.com" OR sourcentdomain CONTAINS "helpdesk-gemini.com" OR sourcentdomain CONTAINS "helpdesk-icloud.com" OR sourcentdomain CONTAINS "identification-coinbase.com" OR sourcentdomain CONTAINS "lockdown-coinbase.com" OR sourcentdomain CONTAINS "login-nexo.com" OR sourcentdomain CONTAINS "keys-coinbase.com" OR sourcentdomain CONTAINS "messages-coinbase.com" OR sourcentdomain CONTAINS "newpassword-coinbase.com" OR sourcentdomain CONTAINS "prompt-coinbase.com" OR sourcentdomain CONTAINS "protect-apple.com" OR sourcentdomain CONTAINS "protect-coinbase.com" OR sourcentdomain CONTAINS "protect-gmail.com" OR sourcentdomain CONTAINS "protect-kraken.com" OR sourcentdomain CONTAINS "recoverme-coinbase.com" OR sourcentdomain CONTAINS "recoveryportal-coinbase.com" OR sourcentdomain CONTAINS "refunds-coinbase.com" OR sourcentdomain CONTAINS "reset-okta.com" OR sourcentdomain CONTAINS "restore-coinbase.com" OR sourcentdomain CONTAINS "return-coinbase.com" OR sourcentdomain CONTAINS "reverts-coinbase.com" OR sourcentdomain CONTAINS "secure-binance.us" OR sourcentdomain CONTAINS "secure-icloud.com" OR sourcentdomain CONTAINS "secure-nexo.com" OR sourcentdomain CONTAINS "secure-shakepay.com" OR sourcentdomain CONTAINS "security-umusic.com" OR sourcentdomain CONTAINS "server694590423.tech" OR sourcentdomain CONTAINS "session-coinbase.com" OR sourcentdomain CONTAINS "startrecovery-coinbase.com" OR sourcentdomain CONTAINS "signin-kraken.com" OR sourcentdomain CONTAINS "suite-trezor.io" OR sourcentdomain CONTAINS "supportportal-coinbase.com" OR sourcentdomain CONTAINS "tech-icloud.com" OR sourcentdomain CONTAINS "threat-coinbase.com" OR sourcentdomain CONTAINS "ticket-apple.com" OR sourcentdomain CONTAINS "ticket-coinbase.com" OR sourcentdomain CONTAINS "tickets-apple.com" OR sourcentdomain CONTAINS "tokens-coinbase.com" OR sourcentdomain CONTAINS "unblock-coinbase.com" OR sourcentdomain CONTAINS "unlink-coinbase.com" OR sourcentdomain CONTAINS "your-coinbase.com" OR sourcentdomain CONTAINS "welcome-coinbase.com" OR sourcentdomain CONTAINS "www-coinbasewallet.com" OR sourcentdomain CONTAINS "www-help-coinbase.com" OR sourcentdomain CONTAINS "www-help-gemini.com")
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "helpdesk-apple.com" OR sourcehostname CONTAINS "helpdesk-gemini.com" OR sourcehostname CONTAINS "helpdesk-icloud.com" OR sourcehostname CONTAINS "identification-coinbase.com" OR sourcehostname CONTAINS "lockdown-coinbase.com" OR sourcehostname CONTAINS "login-nexo.com" OR sourcehostname CONTAINS "keys-coinbase.com" OR sourcehostname CONTAINS "messages-coinbase.com" OR sourcehostname CONTAINS "newpassword-coinbase.com" OR sourcehostname CONTAINS "prompt-coinbase.com" OR sourcehostname CONTAINS "protect-apple.com" OR sourcehostname CONTAINS "protect-coinbase.com" OR sourcehostname CONTAINS "protect-gmail.com" OR sourcehostname CONTAINS "protect-kraken.com" OR sourcehostname CONTAINS "recoverme-coinbase.com" OR sourcehostname CONTAINS "recoveryportal-coinbase.com" OR sourcehostname CONTAINS "refunds-coinbase.com" OR sourcehostname CONTAINS "reset-okta.com" OR sourcehostname CONTAINS "restore-coinbase.com" OR sourcehostname CONTAINS "return-coinbase.com" OR sourcehostname CONTAINS "reverts-coinbase.com" OR sourcehostname CONTAINS "secure-binance.us" OR sourcehostname CONTAINS "secure-icloud.com" OR sourcehostname CONTAINS "secure-nexo.com" OR sourcehostname CONTAINS "secure-shakepay.com" OR sourcehostname CONTAINS "security-umusic.com" OR sourcehostname CONTAINS "server694590423.tech" OR sourcehostname CONTAINS "session-coinbase.com" OR sourcehostname CONTAINS "startrecovery-coinbase.com" OR sourcehostname CONTAINS "signin-kraken.com" OR sourcehostname CONTAINS "suite-trezor.io" OR sourcehostname CONTAINS "supportportal-coinbase.com" OR sourcehostname CONTAINS "tech-icloud.com" OR sourcehostname CONTAINS "threat-coinbase.com" OR sourcehostname CONTAINS "ticket-apple.com" OR sourcehostname CONTAINS "ticket-coinbase.com" OR sourcehostname CONTAINS "tickets-apple.com" OR sourcehostname CONTAINS "tokens-coinbase.com" OR sourcehostname CONTAINS "unblock-coinbase.com" OR sourcehostname CONTAINS "unlink-coinbase.com" OR sourcehostname CONTAINS "your-coinbase.com" OR sourcehostname CONTAINS "welcome-coinbase.com" OR sourcehostname CONTAINS "www-coinbasewallet.com" OR sourcehostname CONTAINS "www-help-coinbase.com" OR sourcehostname CONTAINS "www-help-gemini.com")
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "helpdesk-apple.com" OR destinationntdomain CONTAINS "helpdesk-gemini.com" OR destinationntdomain CONTAINS "helpdesk-icloud.com" OR destinationntdomain CONTAINS "identification-coinbase.com" OR destinationntdomain CONTAINS "lockdown-coinbase.com" OR destinationntdomain CONTAINS "login-nexo.com" OR destinationntdomain CONTAINS "keys-coinbase.com" OR destinationntdomain CONTAINS "messages-coinbase.com" OR destinationntdomain CONTAINS "newpassword-coinbase.com" OR destinationntdomain CONTAINS "prompt-coinbase.com" OR destinationntdomain CONTAINS "protect-apple.com" OR destinationntdomain CONTAINS "protect-coinbase.com" OR destinationntdomain CONTAINS "protect-gmail.com" OR destinationntdomain CONTAINS "protect-kraken.com" OR destinationntdomain CONTAINS "recoverme-coinbase.com" OR destinationntdomain CONTAINS "recoveryportal-coinbase.com" OR destinationntdomain CONTAINS "refunds-coinbase.com" OR destinationntdomain CONTAINS "reset-okta.com" OR destinationntdomain CONTAINS "restore-coinbase.com" OR destinationntdomain CONTAINS "return-coinbase.com" OR destinationntdomain CONTAINS "reverts-coinbase.com" OR destinationntdomain CONTAINS "secure-binance.us" OR destinationntdomain CONTAINS "secure-icloud.com" OR destinationntdomain CONTAINS "secure-nexo.com" OR destinationntdomain CONTAINS "secure-shakepay.com" OR destinationntdomain CONTAINS "security-umusic.com" OR destinationntdomain CONTAINS "server694590423.tech" OR destinationntdomain CONTAINS "session-coinbase.com" OR destinationntdomain CONTAINS "startrecovery-coinbase.com" OR destinationntdomain CONTAINS "signin-kraken.com" OR destinationntdomain CONTAINS "suite-trezor.io" OR destinationntdomain CONTAINS "supportportal-coinbase.com" OR destinationntdomain CONTAINS "tech-icloud.com" OR destinationntdomain CONTAINS "threat-coinbase.com" OR destinationntdomain CONTAINS "ticket-apple.com" OR destinationntdomain CONTAINS "ticket-coinbase.com" OR destinationntdomain CONTAINS "tickets-apple.com" OR destinationntdomain CONTAINS "tokens-coinbase.com" OR destinationntdomain CONTAINS "unblock-coinbase.com" OR destinationntdomain CONTAINS "unlink-coinbase.com" OR destinationntdomain CONTAINS "your-coinbase.com" OR destinationntdomain CONTAINS "welcome-coinbase.com" OR destinationntdomain CONTAINS "www-coinbasewallet.com" OR destinationntdomain CONTAINS "www-help-coinbase.com" OR destinationntdomain CONTAINS "www-help-gemini.com")
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND requesturl NOT NULL AND (requesturl CONTAINS "helpdesk-apple.com" OR requesturl CONTAINS "helpdesk-gemini.com" OR requesturl CONTAINS "helpdesk-icloud.com" OR requesturl CONTAINS "identification-coinbase.com" OR requesturl CONTAINS "lockdown-coinbase.com" OR requesturl CONTAINS "login-nexo.com" OR requesturl CONTAINS "keys-coinbase.com" OR requesturl CONTAINS "messages-coinbase.com" OR requesturl CONTAINS "newpassword-coinbase.com" OR requesturl CONTAINS "prompt-coinbase.com" OR requesturl CONTAINS "protect-apple.com" OR requesturl CONTAINS "protect-coinbase.com" OR requesturl CONTAINS "protect-gmail.com" OR requesturl CONTAINS "protect-kraken.com" OR requesturl CONTAINS "recoverme-coinbase.com" OR requesturl CONTAINS "recoveryportal-coinbase.com" OR requesturl CONTAINS "refunds-coinbase.com" OR requesturl CONTAINS "reset-okta.com" OR requesturl CONTAINS "restore-coinbase.com" OR requesturl CONTAINS "return-coinbase.com" OR requesturl CONTAINS "reverts-coinbase.com" OR requesturl CONTAINS "secure-binance.us" OR requesturl CONTAINS "secure-icloud.com" OR requesturl CONTAINS "secure-nexo.com" OR requesturl CONTAINS "secure-shakepay.com" OR requesturl CONTAINS "security-umusic.com" OR requesturl CONTAINS "server694590423.tech" OR requesturl CONTAINS "session-coinbase.com" OR requesturl CONTAINS "startrecovery-coinbase.com" OR requesturl CONTAINS "signin-kraken.com" OR requesturl CONTAINS "suite-trezor.io" OR requesturl CONTAINS "supportportal-coinbase.com" OR requesturl CONTAINS "tech-icloud.com" OR requesturl CONTAINS "threat-coinbase.com" OR requesturl CONTAINS "ticket-apple.com" OR requesturl CONTAINS "ticket-coinbase.com" OR requesturl CONTAINS "tickets-apple.com" OR requesturl CONTAINS "tokens-coinbase.com" OR requesturl CONTAINS "unblock-coinbase.com" OR requesturl CONTAINS "unlink-coinbase.com" OR requesturl CONTAINS "your-coinbase.com" OR requesturl CONTAINS "welcome-coinbase.com" OR requesturl CONTAINS "www-coinbasewallet.com" OR requesturl CONTAINS "www-help-coinbase.com" OR requesturl CONTAINS "www-help-gemini.com")
