Duplicate of the existing leaks.

Number of known duplicates.

When the leak has been accessible or seen for the first time.

When the leak has been accessible or seen for the last time.

The link where the leak is (or was) accessible at first-seen.

When the information available in the leak was created. It’s usually before the first-seen.

Raw data as received by the AIL sensor compressed and encoded in Base64.

The AIL sensor uuid where the leak was processed and analysed.

A description of the leak which could include the potential victim(s) or description of the leak.

AIS Administrative Area represented using ISO-3166-2.

AIS Country represented using ISO-3166-1_alpha-2.

AIS IndustryType. ['Chemical Sector', 'Commercial Facilities Sector', 'Communications Sector', 'Critical Manufacturing Sector', 'Dams Sector', 'Defense Industrial Base Sector', 'Emergency Services Sector', 'Energy Sector', 'Financial Services Sector', 'Food and Agriculture Sector', 'Government Facilities Sector', 'Healthcare and Public Health Sector', 'Information Technology Sector', 'Nuclear Reactors, Materials, and Waste Sector', 'Transportation Systems Sector', 'Water and Wastewater Systems Sector', 'Other']

AIS Organisation Name.

Application ID

Android certificate

Domain used by the app

Generic name of the application

SHA256 of the APK.

Comment about the set of android permission(s)

Android permission ['ACCESS_CHECKIN_PROPERTIES', 'ACCESS_COARSE_LOCATION', 'ACCESS_FINE_LOCATION', 'ACCESS_LOCATION_EXTRA_COMMANDS', 'ACCESS_NETWORK_STATE', 'ACCESS_NOTIFICATION_POLICY', 'ACCESS_WIFI_STATE', 'ACCOUNT_MANAGER', 'ADD_VOICEMAIL', 'ANSWER_PHONE_CALLS', 'BATTERY_STATS', 'BIND_ACCESSIBILITY_SERVICE', 'BIND_APPWIDGET', 'BIND_AUTOFILL_SERVICE', 'BIND_CARRIER_MESSAGING_SERVICE', 'BIND_CHOOSER_TARGET_SERVICE', 'BIND_CONDITION_PROVIDER_SERVICE', 'BIND_DEVICE_ADMIN', 'BIND_DREAM_SERVICE', 'BIND_INCALL_SERVICE', 'BIND_INPUT_METHOD', 'BIND_MIDI_DEVICE_SERVICE', 'BIND_NFC_SERVICE', 'BIND_NOTIFICATION_LISTENER_SERVICE', 'BIND_PRINT_SERVICE', 'BIND_QUICK_SETTINGS_TILE', 'BIND_REMOTEVIEWS', 'BIND_SCREENING_SERVICE', 'BIND_TELECOM_CONNECTION_SERVICE', 'BIND_TEXT_SERVICE', 'BIND_TV_INPUT', 'BIND_VISUAL_VOICEMAIL_SERVICE', 'BIND_VOICE_INTERACTION', 'BIND_VPN_SERVICE', 'BIND_VR_LISTENER_SERVICE', 'BIND_WALLPAPER', 'BLUETOOTH', 'BLUETOOTH_ADMIN', 'BLUETOOTH_PRIVILEGED', 'BODY_SENSORS', 'BROADCAST_PACKAGE_REMOVED', 'BROADCAST_SMS', 'BROADCAST_STICKY', 'BROADCAST_WAP_PUSH', 'CALL_PHONE', 'CALL_PRIVILEGED', 'CAMERA', 'CAPTURE_AUDIO_OUTPUT', 'CAPTURE_SECURE_VIDEO_OUTPUT', 'CAPTURE_VIDEO_OUTPUT', 'CHANGE_COMPONENT_ENABLED_STATE', 'CHANGE_CONFIGURATION', 'CHANGE_NETWORK_STATE', 'CHANGE_WIFI_MULTICAST_STATE', 'CHANGE_WIFI_STATE', 'CLEAR_APP_CACHE', 'CONTROL_LOCATION_UPDATES', 'DELETE_CACHE_FILES', 'DELETE_PACKAGES', 'DIAGNOSTIC', 'DISABLE_KEYGUARD', 'DUMP', 'EXPAND_STATUS_BAR', 'FACTORY_TEST', 'GET_ACCOUNTS', 'GET_ACCOUNTS_PRIVILEGED', 'GET_PACKAGE_SIZE', 'GET_TASKS', 'GLOBAL_SEARCH', 'INSTALL_LOCATION_PROVIDER', 'INSTALL_PACKAGES', 'INSTALL_SHORTCUT', 'INSTANT_APP_FOREGROUND_SERVICE', 'INTERNET', 'KILL_BACKGROUND_PROCESSES', 'LOCATION_HARDWARE', 'MANAGE_DOCUMENTS', 'MANAGE_OWN_CALLS', 'MASTER_CLEAR', 'MEDIA_CONTENT_CONTROL', 'MODIFY_AUDIO_SETTINGS', 'MODIFY_PHONE_STATE', 'MOUNT_FORMAT_FILESYSTEMS', 'MOUNT_UNMOUNT_FILESYSTEMS', 'NFC', 'PACKAGE_USAGE_STATS', 'PERSISTENT_ACTIVITY', 'PROCESS_OUTGOING_CALLS', 'READ_CALENDAR', 'READ_CALL_LOG', 'READ_CONTACTS', 'READ_EXTERNAL_STORAGE', 'READ_FRAME_BUFFER', 'READ_INPUT_STATE', 'READ_LOGS', 'READ_PHONE_NUMBERS', 'READ_PHONE_STATE', 'READ_SMS', 'READ_SYNC_SETTINGS', 'READ_SYNC_STATS', 'READ_VOICEMAIL', 'REBOOT', 'RECEIVE_BOOT_COMPLETED', 'RECEIVE_MMS', 'RECEIVE_SMS', 'RECEIVE_WAP_PUSH', 'RECORD_AUDIO', 'REORDER_TASKS', 'REQUEST_COMPANION_RUN_IN_BACKGROUND', 'REQUEST_COMPANION_USE_DATA_IN_BACKGROUND', 'REQUEST_DELETE_PACKAGES', 'REQUEST_IGNORE_BATTERY_OPTIMIZATIONS', 'REQUEST_INSTALL_PACKAGES', 'RESTART_PACKAGES', 'SEND_RESPOND_VIA_MESSAGE', 'SEND_SMS', 'SET_ALARM', 'SET_ALWAYS_FINISH', 'SET_ANIMATION_SCALE', 'SET_DEBUG_APP', 'SET_PREFERRED_APPLICATIONS', 'SET_PROCESS_LIMIT', 'SET_TIME', 'SET_TIME_ZONE', 'SET_WALLPAPER', 'SET_WALLPAPER_HINTS', 'SIGNAL_PERSISTENT_PROCESSES', 'STATUS_BAR', 'SYSTEM_ALERT_WINDOW', 'TRANSMIT_IR', 'UNINSTALL_SHORTCUT', 'UPDATE_DEVICE_STATS', 'USE_FINGERPRINT', 'USE_SIP', 'VIBRATE', 'WAKE_LOCK', 'WRITE_APN_SETTINGS', 'WRITE_CALENDAR', 'WRITE_CALL_LOG', 'WRITE_CONTACTS', 'WRITE_EXTERNAL_STORAGE', 'WRITE_GSERVICES', 'WRITE_SECURE_SETTINGS', 'WRITE_SETTINGS', 'WRITE_SYNC_SETTINGS', 'WRITE_VOICEMAIL']

An attachment to support the annotation

Initial creation of the annotation

Format of the annotation ['text', 'markdown', 'asciidoctor', 'MultiMarkdown', 'GFM', 'pandoc', 'Fountain', 'CommonWork', 'kramdown-rfc2629', 'rfc7328', 'Extra']

Last update of the annotation

Reference(s) to the annotation

Raw text of the annotation

Type of the annotation ['Annotation', 'Executive Summary', 'Introduction', 'Conclusion', 'Disclaimer', 'Keywords', 'Acknowledgement', 'Other', 'Copyright', 'Authors', 'Logo', 'Full Report']

Description of the anonymisation technique or tool used

Encryption function or algorithm used to anonymise the attribute ['aes128', 'aes-128-cbc', 'aes-128-cfb', 'aes-128-cfb1', 'aes-128-cfb8', 'aes-128-ctr', 'aes-128-ecb', 'aes-128-ofb', 'aes192', 'aes-192-cbc', 'aes-192-cfb', 'aes-192-cfb1', 'aes-192-cfb8', 'aes-192-ctr', 'aes-192-ecb', 'aes-192-ofb', 'aes-256-cfb', 'aes-256-cfb1', 'aes-256-cfb8', 'aes-256-ctr', 'aes-256-ecb', 'aes-256-ofb', 'bf', 'bf-cbc', 'bf-cfb', 'bf-ecb', 'bf-ofb', 'blowfish', 'camellia128', 'camellia-128-cbc', 'camellia-128-cfb', 'camellia-128-cfb1', 'camellia-128-cfb8', 'camellia-128-ctr', 'camellia-128-ecb', 'camellia-128-ofb', 'camellia192', 'camellia-192-cbc', 'camellia-192-cfb', 'camellia-192-cfb1', 'camellia-192-cfb8', 'camellia-192-ctr', 'camellia-192-ecb', 'camellia-192-ofb', 'camellia256', 'camellia-256-cbc', 'camellia-256-cfb', 'camellia-256-cfb1', 'camellia-256-cfb8', 'camellia-256-ctr', 'camellia-256-ecb', 'camellia-256-ofb', 'cast', 'cast5-cbc', 'cast5-cfb', 'cast5-ecb', 'cast5-ofb', 'cast-cbc', 'des', 'des3', 'des-cbc', 'des-cfb', 'des-ecb', 'des-ede', 'des-ede3', 'des-ede3-cbc', 'des-ede3-cfb', 'des-ede3-ofb', 'des-ede-cbc', 'des-ede-cfb', 'des-ede-ofb', 'des-ofb', 'desx', 'gost89', 'gost89-cnt', 'idea', 'idea-cbc', 'idea-cfb', 'idea-ecb', 'idea-ofb', 'rc2', 'rc2-40-cbc', 'rc2-64-cbc', 'rc2-cbc', 'rc2-cfb', 'rc2-ecb', 'rc2-ofb', 'rc4', 'rc4-40', 'rc4-64', 'rc5', 'rc5-cbc', 'rc5-cfb', 'rc5-ecb', 'rc5-ofb', 'seed', 'seed-cbc', 'seed-cfb', 'seed-ecb', 'seed-ofb', 'sm4', 'sm4-cbc', 'sm4-cfb', 'sm4-ctr', 'sm4-ecb', 'sm4-ofb']

Initialisation vector for the encryption function used to anonymise the attribute

Key (such as a PSK in a keyed-hash-function) used to anonymise the attribute

Keyed-hash function used to anonymise the attribute ['hmac-sha1', 'hmac-md5', 'hmac-sha256', 'hmac-sha384', 'hmac-sha512']

Level of knowledge of the organisation who created this object ['Only the anonymised data is known', 'Deanonymised data is known']

Anonymisation (or pseudo-anonymisation) method(s) used ["hiding - Attribute is replaced with a constant value (typically 0) of the same size. Sometimes called 'black marker'.", 'hash - A hash function maps each attribute to a new (not necessarily unique) attribute.', 'permutation - Maps each original value to a unique new value.', "prefix-preserving - Any two values that had the same n-bit prefix before anonymisation will still have the same n-bit prefix as each other after anonymization. (Would be more accurately called 'prefix-relationship-preserving', because the actual prefix values are not preserved.) ", 'shift - Adds a fixed offset to each value/attribute.', 'enumeration - Map each original value to a new value such that their ordering is preserved.', 'partitioning - Possible values are partitioned into meaningful sets; actual values are replaced with a fixed value from the same set. E.g., TCP port numbers 0 to 1023 are replaced with 0, and 1024 to 65535 replaced with 65535.', 'updated - Checksums are recalculated to reflect changes made to other fields.', 'truncation - Field is shortened, losing data at the end.', 'encryption - Attribute is encrypted.']

Regular expression to perfom the anonymisation (reversible or not)

Autonomous System Number

Country code of the main location of the autonomous system

Description of the autonomous system

The outbound routing policy of the AS in RFC 2622 – Routing Policy Specification Language (RPSL) format

First time the ASN was seen

The inbound IPv4 routing policy of the AS in RFC 2622 – Routing Policy Specification Language (RPSL) format

Last time the ASN was seen

This attribute performs the same function as the export attribute above. The difference is that mp-export allows both IPv4 and IPv6 address families to be specified. The export is described in RFC 4012 – Routing Policy Specification Language next generation (RPSLng), section 4.5. format

The inbound IPv4 or IPv6 routing policy of the AS in RFC 4012 – Routing Policy Specification Language next generation (RPSLng), section 4.5. format

Subnet announced

CAPEC ID.

Name of the attack pattern.

Prerequisites for the attack pattern to succeed.

External references

Weakness related to the attack pattern.

Solutions for the attack pattern to be countered.

Summary description of the attack pattern.

Destination IP.

IP address originating the authentication failure.

the number of authentication failures reported.

the type of authentication failure. ['ssh']

the username used.

Content type

Signature created by the signing certificate’s private key

Algorithm used to hash the file.

Algorithm used to encrypt the digest

Issuer of the certificate

Program name

Serial number of the certificate

Signature algorithm ['SHA1_WITH_RSA_ENCRYPTION', 'SHA256_WITH_RSA_ENCRYPTION']

Free text description of the signer info

Url

Version of the certificate

Datetime

Name of detection signature

Name of antivirus software

Free text value to attach to the file

ABA routing transit number

Account number

A field to freely describe the bank account details.

The balance of the account after the suspicious transaction was processed.

Final beneficiary of the bank account.

Comment about the final beneficiary.

Branch code or name

Client number as seen by the bank.

When the account was closed.

Comments about the bank account.

Currency of the account. ['USD', 'EUR']

When the balance was reported.

IBAN of the bank account.

Institution code of the bank.

Name of the bank or financial organisation.

A flag to define if this account belong to a non-banking organisation. If set to true, it’s a non-banking organisation.

When the account was opened.

Account type. ['A - Business', 'B - Personal Current', 'C - Savings', 'D - Trust Account', 'E - Trading Account', 'O - Other']

Report code of the bank account. ['CTR Cash Transaction Report', 'STR Suspicious Transaction Report', 'EFT Electronic Funds Transfer', 'IFT International Funds Transfer', 'TFR Terror Financing Report', 'BCR Border Cash Report', 'UTR Unusual Transaction Report', 'AIF Additional Information File – Can be used for example to get full disclosure of transactions of an account for a period of time without reporting it as a CTR.', 'IRI Incoming Request for Information – International', 'ORI Outgoing Request for Information – International', 'IRD Incoming Request for Information – Domestic', 'ORD Outgoing Request for Information – Domestic']

Account status at the time of the transaction processed. ['A - Active', 'B - Inactive', 'C - Dormant']

SWIFT or BIC as defined in ISO 9362.

A description of the bank account.

Country code of the main location of the attacking autonomous system

BGP Hijack details

Detected Autonomous System Number

Last time the Prefix hijack was seen

Expected Autonomous System Number

First time the Prefix hijack was seen

Subnet announced

The IP address family concerned by the ranking. ['v4', 'v6']

Date fo the ranking.

Position of the ASN for a given day.

Ranking of the Autonomous System number.

Archive of the original document (Internet Archive, Archive.is, etc).

Initial creation of the blog post.

Site linked by the blog post.

Safe site linked by the blog post.

Original link into the blog post (Supposed harmless).

Last update of the blog post.

Raw post.

When the blog post was removed.

Title of blog post.

Type of blog post. ['Medium', 'WordPress', 'Blogger', 'Tumbler', 'LiveJournal', 'Forum', 'Other']

Original URL location of the blog post (potentially malicious).

Username who posted the blog post.

Username who are quoted into the blog post.

Is the username account verified by the operator of the blog platform. ['Verified', 'Unverified', 'Unknown']

Final beneficiary of the boleto.

Recipient bank account number

Recipient bank agency number

Boleto code numbers

Date the boleto was created

Financial institution code in Brazil that created the boleto.

Name of the bank or financial organisation that created the boleto.

Boleto payment date

Inform if boleto was as paid or not ['Not Paid', 'Paid']

The payment boleto value in Brazilian Reais

Organisation, service or affiliated person that requested creation of the boleto.

A Bitcoin transactional address

Date and time of transaction

A Bitcoin transaction number in a sequence of transactions

Value in BTC at date/time displayed in field 'time'

Value in EUR with conversion rate as of date/time displayed in field 'time'

Value in USD with conversion rate as of date/time displayed in field 'time'

Value of received BTC

Value of sent BTC

Value in BTC at date/time displayed in field 'time'

Date and time of lookup/conversion

A Bitcoin wallet address

The group listing of intended recipients of the alert message. (1) Required when <scope> is “Private”, optional when <scope> is “Public” or “Restricted”. (2) Each recipient SHALL be identified by an identifier or an address. (3) Multiple space-delimited addresses MAY be included. Addresses including whitespace MUST be enclosed in double-quotes.

The code denoting the special handling of the alert message.

The identifier of the alert message in a number or string uniquely identifying this message, assigned by the sender.

The group listing naming the referent incident(s) of the alert message. (1) Used to collate multiple messages referring to different aspects of the same incident. (2) If multiple incident identifiers are referenced, they SHALL be separated by whitespace. Incident names including whitespace SHALL be surrounded by double-quotes.

The code denoting the nature of the alert message. ['Alert', 'Update', 'Cancel', 'Ack', 'Error']

The text describing the purpose or significance of the alert message.

The group listing identifying earlier message(s) referenced by the alert message. (1) The extended message identifier(s) (in the form sender,identifier,sent) of an earlier CAP message or messages referenced by this one. (2) If multiple messages are referenced, they SHALL be separated by whitespace.

The text describing the rule for limiting distribution of the restricted alert message.

The code denoting the intended distribution of the alert message. ['Public', 'Restricted', 'Private']

The identifier of the sender of the alert message which identifies the originator of this alert. Guaranteed by assigner to be unique globally; e.g., may be based on an Internet domain name.

The time and date of the origination of the alert message.

The text identifying the source of the alert message. The particular source of this alert; e.g., an operator or a specific device.

The code denoting the appropriate handling of the alert message. ['Actual', 'Exercise', 'System', 'Test', 'Draft']

The text describing the intended audience of the alert message.

The code denoting the category of the subject event of the alert message. ['Geo', 'Met', 'Safety', 'Security', 'Rescue', 'Fire', 'Health', 'Env', 'Transport', 'Infra', 'CBRNE', 'Other']

The code denoting the certainty of the subject event of the alert message. For backward compatibility with CAP 1.0, the deprecated value of “Very Likely” SHOULD be treated as equivalent to “Likely”. ['Likely', 'Possible', 'Unlikely', 'Unknown']

The text describing the contact for follow-up and confirmation of the alert message.

The text describing the subject event of the alert message.

The effective time of the information of the alert message.

The text denoting the type of the subject event of the alert message.

A system-specific code identifying the event type of the alert message.

The expiry time of the information of the alert message.

The text headline of the alert message.

The text describing the recommended action to be taken by recipients of the alert message.

The code denoting the language of the info sub-element of the alert message.

The expected time of the beginning of the subject event of the alert message.

A system-specific additional parameter associated with the alert message.

The code denoting the type of action recommended for the target audience. ['Shelter', 'Evacuate', 'Prepare', 'Execute', 'Avoid', 'Monitor', 'Assess', 'AllClear', 'None']

The text naming the originator of the alert message.

The code denoting the severity of the subject event of the alert message. ['Extreme', 'Severe', 'Moderate', 'Minor', 'Unknown']

The code denoting the urgency of the subject event of the alert message. ['Immediate', 'Expected', 'Future', 'Past', 'Unknown']

The identifier of the hyperlink associating additional information with the alert message.

The base-64 encoded data content of the resource file.

The code representing the digital digest (“hash”) computed from the resource file (OPTIONAL).

The identifier of the MIME content type and sub-type describing the resource file.

The text describing the type and content of the resource file.

The integer indicating the size of the resource file.

The identifier of the hyperlink for the resource file.

Bitcoin address used as a payment destination in a cryptocurrency

Monero address used as a payment destination in a cryptocurrency

Current balance of address

First time this payment destination address has been seen

Last time this payment destination address has been seen

Last time the balances and totals have been updated

The (uppercase) symbol of the cryptocurrency used. Symbol should be from https://coinmarketcap.com/all/views/all/ ['BTC', 'ETH', 'BCH', 'XRP', 'MIOTA', 'DASH', 'BTG', 'LTC', 'ADA', 'XMR', 'ETC', 'NEO', 'NEM', 'EOS', 'XLM', 'BCC', 'LSK', 'OMG', 'QTUM', 'ZEC', 'USDT', 'HSR', 'STRAT', 'WAVES', 'PPT', 'ETN']

Free text value

Total balance received

Total balance sent

Total transactions performed

Description of the command functionalities

Location of the command functionality ['Bundled', 'Module', 'Libraries', 'Unknown']

How the commands are triggered ['Local', 'Network', 'Unknown']

description of the command

command code

Full cookie

Name of the cookie (if splitted)

Value of the cookie (if splitted)

Expiration date/time of the cookie

True if send only through HTTP

Path defined in the cookie

True if cookie is sent over TLS

A description of the cookie.

Type of cookie and how it’s used in this specific object. ['Session management', 'Personalization', 'Tracking', 'Exfiltration', 'Malicious Payload', 'Beaconing']

Cortex report object (full report) in JSON

Cortex analyser/worker name

Name of the cortex server

When the Cortex analyser was started

Result of the cortex job

Cortex summary object (summary) in JSON

URL to the Cortex job

Cortex Taxonomy Level ['info', 'safe', 'suspicious', 'malicious']

Cortex Taxonomy Namespace

Cortex Taxonomy Predicate

Cortex Taxonomy Value

The estimated cost of applying the course of action. ['High', 'Medium', 'Low', 'None', 'Unknown']

A description of the course of action.

The estimated efficacy of applying the course of action. ['High', 'Medium', 'Low', 'None', 'Unknown']

The estimated impact of applying the course of action. ['High', 'Medium', 'Low', 'None', 'Unknown']

The name used to identify the course of action.

The objective of the course of action.

The stage of the threat management lifecycle that the course of action is applicable to. ['Remedy', 'Response', 'Further Analysis Required']

The type of the course of action. ['Perimeter Blocking', 'Internal Blocking', 'Redirection', 'Redirection (Honey Pot)', 'Hardening', 'Patching', 'Eradication', 'Rebuilding', 'Training', 'Monitoring', 'Physical Access Restrictions', 'Logical Access Restrictions', 'Public Disclosure', 'Diplomatic Actions', 'Policy Actions', 'Other']

the number of active cases.

the number of confirmed cases. For Hubei Province: from Feb 13 (GMT +8), we report both clinically diagnosed and lab-confirmed cases. For lab-confirmed cases only (Before Feb 17), please refer to https://github.com/CSSEGISandData/COVID-19/tree/master/who_covid_19_situation_reports.

country/region name conforming to WHO (will be updated).

US County (US Only)

the number of deaths.

Federal Information Processing Standard county code (US Only)

Approximate latitude of the entry

Approximate longitude of the entry

province name; US/Canada/Australia/ - city name, state/province name; Others - name of the event (e.g., "Diamond Princess" cruise ship); other countries - blank.

the number of recovered cases.

Time of the last update that day (UTC)

Name of the Chinese city, in Chinese.

Current number of confirmed cases

Total number of confirmed cases.

Total number of cured cases.

Total number of deaths.

Approximate time of the update (~hour)

Comment, in chinese

Current number of confirmed cases

Name of the Chinese province, in Chinese.

Total number of confirmed cases.

Total number of cured cases.

Total number of deaths.

Approximate time of the update (~hour)

SSH compression algorithm supported in the session

Destination IP address of the session

Destination port of the session

SSH symmetric encryption algorithm supported in the session

Eventid of the session in the cowrie honeypot

HASSH of the client SSH session following Salesforce algorithm

Input of the session

isError

SSH public-key algorithm supported in the session

SSH MAC supported in the sesssion

Message of the cowrie honeypot

Password

Protocol used in the cowrie honeypot

Cowrie sensor name

Session id

Source IP address of the session

Source port of the session

System origin in cowrie honeypot

When the event happened

Username related to the password(s)

CPE—the well-formed CPE name(WFN). WFNs can be used to describe a set of products or to identify an individual product.

Complementary description of the asset

The edition attribute is considered deprecated in this specification, and it SHOULD be assigned the logical value ANY except where required for backward compatibility with version 2.2 of the CPE specification.This attribute is referred to as the “legacyedition”attribute.If this attribute is used,values for this attribute SHOULD capture edition-related terms applied by the vendor to the product. Values for this attribute SHOULD be selected from an attribute-specific valid-values list, which MAYbe defined by other specifications that utilize this specification. Any character string meeting the requirements for WFNs (cf. 5.3.2) MAY be specified as the value of the attribute.

Values for thisattribute SHALL be valid language tags as defined by [RFC5646], and SHOULD be used to define the language supported in the user interface of the product being described.Although any valid language tag MAY be used, only tags containing language and region codesSHOULD be used.

Values for this attribute SHOULD capture any other general descriptive or identifying information which is vendor-or product-specific and which does not logically fit in any other attribute value. Values SHOULD NOT be used for storing instance-specific data (e.g., globally-unique identifiers or Internet Protocol addresses).Values for this attribute SHOULD be selected from a valid-values list that is refined over time; this list MAYbe defined by other specifications that utilize this specification. Any character string meeting the requirements for WFNs (cf. 5.3.2) MAYbe specified as the value of the attribute.

Part - application, operating systems or hardware devices ['a', 'o', 'h']

Values for this attribute SHOULD describe or identify the most common and recognizable title or name of the product. Values for this attribute SHOULD be selected from an attribute-specific valid-values list, which MAYbe defined by other specifications that utilize this specification. Any character string meeting the requirements for WFNs(cf. 5.3.2) MAY be specified as the value of the attribute.

Values for this attribute SHOULD characterize how the product is tailored to a particular market or class of end users. Values for this attribute SHOULD be selected from an attribute-specific valid-values list, which MAYbe defined by other specifications that utilize this specification. Any character string meeting the requirements for WFNs(cf. 5.3.2) MAYbe specified as the value of the attribute.

Values for this attribute SHOULD characterize the instruction set architecture (e.g., x86) on which the product being described or identified by the WFN operates. Bytecode-intermediate languages, such as Java bytecode for the Java Virtual Machine or Microsoft Common Intermediate Language for the Common Language Runtime virtual machine, SHALL be considered instruction set architectures. Values for this attribute SHOULD be selected from an attribute-specific valid-values list, which MAYbe defined by other specifications that utilize this specification. Any character string meeting the requirements for WFNs(cf. 5.3.2) MAYbe specified as the value of the attribute.

Values for this attribute SHOULDi characterize the software computing environment within which the product operates.Values for this attribute SHOULD be selected from an attribute-specific valid-values list, which MAYbe defined by other specifications that utilize this specification. Any character string meeting the requirements for WFNs(cf. 5.3.2) MAYbe specified as the value of the attribute.

Values for this attribute SHOULD be vendor-specific alphanumeric strings characterizing the particular update, service pack, or point release of the product.Values for this attribute SHOULD be selected from an attribute-specific valid-values list, which MAYbe defined by other specifications that utilize this specification. Any character string meeting the requirements for WFNs (cf. 5.3.2) MAYbe specified as the value of the attribute.

Values for this attribute SHOULD describe or identify the person or organization that manufactured or created the product. Values for this attribute SHOULD be selected from an attribute-specific valid-values list, which MAYbe defined by other specifications that utilize this specification. Any character string meeting the requirements for WFNs (cf. 5.3.2) MAY be specified as the value of the attribute

Values for this attribute SHOULD be vendor-specific alphanumeric strings characterizing the particular release version of the product.Version information SHOULD be copied directly (with escaping of printable non-alphanumeric characters as required) from discoverable data and SHOULD NOTbe truncated or otherwise modified. Any character string meeting the requirements for WFNs (cf. 5.3.2) MAYbe specified as the value of the attribute.

Format of the password(s) ['clear-text', 'hashed', 'encrypted', 'unknown']

Mention of any notification(s) towards the potential owner(s) of the credential(s) ['victim-notified', 'service-notified', 'none']

Origin of the credential(s) ['bruteforce-scanning', 'malware-analysis', 'memory-analysis', 'network-analysis', 'leak', 'unknown']

Password

A description of the credential(s)

Type of password(s) ['password', 'api-key', 'encryption-key', 'unknown']

Username related to the password(s)

Name of the bank which have issued the card

Card security code (CSC, CVD, CVV, CVC and SPC) as embossed or printed on the card.

credit-card number as encoded on the card.

A description of the card.

Maximum date of validity

International Issuer Number (First eight digits of the credit card number

Initial date of validity or issued date.

Name of the card owner.

Version of the card.

Curve Parameter - Gx in decimal

Curve Parameter - Gy in decimal

Curve Parameter - B in decimal