From 5a54cf6505cd588f7ef559382d1ac1a750cf9c58 Mon Sep 17 00:00:00 2001
From: Alexandre Dulaunoy <a@foo.be>
Date: Tue, 25 Jun 2024 09:11:17 +0200
Subject: [PATCH] chg: [phishing] add an IP field for phishing website hosted
 on IP address or where the IP is important for the analytics

---
 objects/phishing/definition.json | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/objects/phishing/definition.json b/objects/phishing/definition.json
index d8b565e4..f870b062 100644
--- a/objects/phishing/definition.json
+++ b/objects/phishing/definition.json
@@ -14,6 +14,12 @@
       "misp-attribute": "text",
       "ui-priority": 1
     },
+    "ip": {
+      "description": "IP address of the phishing website",
+      "misp-attribute": "ip-dst",
+      "multiple": true,
+      "ui-priority": 1
+    },
     "online": {
       "description": "If the phishing is online and operational, by default is yes",
       "disable_correlation": true,
@@ -113,5 +119,5 @@
     "url"
   ],
   "uuid": "2dad6f9d-d425-4217-8fda-0b0a2d815307",
-  "version": 6
+  "version": 7
 }
\ No newline at end of file