#domain,ioc,uri_path
1.win-faw.win,Possible Cobalt Strike C2 Domain,/js/assets/CmtImgPreview.mmbxv64dbecec011.js
178-128-196-79.sslip.io,Possible Cobalt Strike C2 Domain,/push
3se9ewodke339f0e83.connectivitytests.com,Possible Cobalt Strike C2 Fronted Domain,/jquery-3.3.1.min.js
agent.cloudfiledisk.com,Possible Cobalt Strike C2 Domain,/jquery-3.3.1.min.js
api.imageprovidjs.shop,Possible Cobalt Strike C2 Fronted Domain,/jquery-3.3.1.min.js
api.zhimawithyou.top,Possible Cobalt Strike C2 Fronting Domain,/api/v1/node/check
asusupdateserver.asuscomm.com,Possible Cobalt Strike C2 Domain,/jquery-3.3.1.min.js
at1.227api.com,Possible Cobalt Strike C2 Domain,/ga.js
at2.227api.com,Possible Cobalt Strike C2 Domain,/dpixel
at3.227api.com,Possible Cobalt Strike C2 Domain,/dpixel
bbb.0101011010010111001.com,Possible Cobalt Strike C2 Domain,/jquery-3.3.1.min.js
bgfi-groupe.com,Possible Cobalt Strike C2 Fronted Domain,/jquery-3.3.1.min.js
cf.lala1.lat,Possible Cobalt Strike C2 Domain,/api/v1/get
check.judicical.ml,Possible Cobalt Strike C2 Domain,/jquery-3.3.1.min.js
check1.judicical.ml,Possible Cobalt Strike C2 Domain,/jquery-3.3.1.min.js
ck.erloro.com,Possible Cobalt Strike C2 Domain,/__utm.gif
complianceportals.com,Possible Cobalt Strike C2 Domain,/IE9CompatViewList.xml
cs.tpedu2metricstw.dpdns.org,Possible Cobalt Strike C2 Domain,/api/v1/get
cstest.mucfc.store,Possible Cobalt Strike C2 Domain,/jquery-3.3.1.min.js
d14hh3kwt0vf8s.cloudfront.net,Possible Cobalt Strike C2 Fronting Domain,/jquery-3.3.1.min.js
dev.useimage.sbs,Possible Cobalt Strike C2 Domain,/jquery-3.3.1.min.js
dianqi1.dianqi2.jiayongdianqi.xyz,Possible Cobalt Strike C2 Domain,/home/
dianqi1.jiayongdianqi.xyz,Possible Cobalt Strike C2 Domain,/home/
dianqi2.dianqi1.jiayongdianqi.xyz,Possible Cobalt Strike C2 Domain,/home/
dianqi2.jiayongdianqi.xyz,Possible Cobalt Strike C2 Domain,/home/
dns1.dreamls.com,Possible Cobalt Strike C2 Domain,/updates
dns2.dreamls.com,Possible Cobalt Strike C2 Domain,/updates
file.sangfor.com.cn,Possible Cobalt Strike C2 Fronted Domain,/dist/css/bootstrap.min.css
financiales-groupe.com,Possible Cobalt Strike C2 Domain,/jquery-3.3.1.min.js
hsjs.net,Possible Cobalt Strike C2 Fronting Domain,/api/v2/telemetry/config.js
i.gckni.com,Possible Cobalt Strike C2 Domain,/activity
imageprovidjs.shop,Possible Cobalt Strike C2 Fronting Domain,/jquery-3.3.1.min.js
index.searchchinas.top,Possible Cobalt Strike C2 Domain,/jquery-3.3.1.min.js
jkzprb4y.yuncdn.site,Possible Cobalt Strike C2 Fronted Domain,/api/v1/get
jnceabyk.yuncdn.site,Possible Cobalt Strike C2 Fronted Domain,/api/v1/get
lab.google-analytcis.com,Possible Cobalt Strike C2 Domain,/assets/i18n/js/jquery-3.3.1.min.js
meritphilips.fans,Possible Cobalt Strike C2 Domain,/cdn/assets/app.min.js
miss.singinas.com,Possible Cobalt Strike C2 Fronted Domain,/sugrec
missmovie.lol,Possible Cobalt Strike C2 Domain,/api/3
n1.google-analytcis.com,Possible Cobalt Strike C2 Domain,/assets/i18n/js/jquery-3.3.1.min.js
n2.google-analytcis.com,Possible Cobalt Strike C2 Domain,/assets/i18n/js/jquery-3.3.1.min.js
n3.google-analytcis.com,Possible Cobalt Strike C2 Domain,/assets/i18n/js/jquery-3.3.1.min.js
ns.1.3.0o0.foo,Possible Cobalt Strike C2 Domain,/g.pixel
ns.1.4.0o0.foo,Possible Cobalt Strike C2 Domain,/updates.rss
ns1.akawowfast.com,Possible Cobalt Strike C2 Domain,/jquery-3.3.1.min.js
ns1.cmbchina.top,Possible Cobalt Strike C2 Domain,/jquery-3.3.1.min.js
ns1.cryptwechat.com,Possible Cobalt Strike C2 Domain,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
ns1.gygiuh.online,Possible Cobalt Strike C2 Domain,/jquery-3.3.1.min.js
ns1.kcsc.tf,Possible Cobalt Strike C2 Domain,/load
ns1.microoosoft.com,Possible Cobalt Strike C2 Domain,/Manag_backend/jquery-3.3.1.min.js
ns1.nsebseshop.cloud,Possible Cobalt Strike C2 Domain,/v/741823546921
ns1.yukklzwo.vip,Possible Cobalt Strike C2 Domain,/en_US/all.js
ns2.akawowfast.com,Possible Cobalt Strike C2 Domain,/jquery-3.3.1.min.js
ns2.cmbchina.top,Possible Cobalt Strike C2 Domain,/jquery-3.3.1.min.js
ns2.cryptwechat.com,Possible Cobalt Strike C2 Domain,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
ns2.kcsc.tf,Possible Cobalt Strike C2 Domain,/en_US/all.js
ns2.microoosoft.com,Possible Cobalt Strike C2 Domain,/Manag_backend/jquery-3.3.1.min.js
ns2.nsebseshop.cloud,Possible Cobalt Strike C2 Domain,/v/741823546921
ns2.yukklzwo.vip,Possible Cobalt Strike C2 Domain,/j.ad
ns3.akawowfast.com,Possible Cobalt Strike C2 Domain,/jquery-3.3.1.min.js
ns3.nsebseshop.cloud,Possible Cobalt Strike C2 Domain,/ms/625478102395
osce12-0-sc.url.asiainfo-sec.com,Possible Cobalt Strike C2 Fronted Domain,/dist/css/bootstrap.min.css
ossb6.oss-cn-beijing.aliyuncs.com,Possible Cobalt Strike C2 Domain,/images/logo.png
p7xcq2yw.yuncdn.site,Possible Cobalt Strike C2 Fronted Domain,/api/v1/get
pull.portal.10086.cn,Possible Cobalt Strike C2 Fronted Domain,/jquery-3.3.1.min.js
skynet-i.asuscomm.com,Possible Cobalt Strike C2 Domain,/zOMGAPT
test.officeplustool.top,Possible Cobalt Strike C2 Domain,/ca
update.inteldrives.com,Possible Cobalt Strike C2 Domain,/jquery-3.3.1.min.js
update.microsoftapply.com,Possible Cobalt Strike C2 Domain,/en_US/all.js
update.microsofthk.com,Possible Cobalt Strike C2 Domain,/dot.gif
update.microsoftkernel.com,Possible Cobalt Strike C2 Domain,/ca
update.mloadspring.com,Possible Cobalt Strike C2 Domain,/jquery-3.3.1.min.js
updatesrv.net,Possible Cobalt Strike C2 Domain,/___utm.gif
upgrade.mloadspring.com,Possible Cobalt Strike C2 Domain,/jquery-3.3.1.min.js
ux85qfba.yuncdn.site,Possible Cobalt Strike C2 Fronted Domain,/api/v1/get
vs.exactcloud.info,Possible Cobalt Strike C2 Domain,/jquery-3.3.1.min.js
web-analyzer-serv32.com,Possible Cobalt Strike C2 Domain,/___utm.gif
www.chinagasholdings.space,Possible Cobalt Strike C2 Domain,/cm
www.dyshop.online,Possible Cobalt Strike C2 Domain,/login.js
www.eurocommerce.top,Possible Cobalt Strike C2 Fronted Domain,/jquery-3.3.1.easing.min.js
www.mfmni.shop,Possible Cobalt Strike C2 Fronting Domain,/jquery-3.3.1.min.js
www.microsslcheck.com,Possible Cobalt Strike C2 Domain,/load/main.js
www.qkshhdjrbd.work,Possible Cobalt Strike C2 Domain,/jquery-3.3.1.min.js
zhimawithyou.top,Possible Cobalt Strike C2 Fronted Domain,/api/v1/node/check