## hosts-blocklists ## blocklists-main ## alienlabs # https://cybersecurity.att.com/blogs/labs-research # https://cybersecurity.att.com/blogs/labs-research/lazarus-campaign-ttps-and-evolution allgraphicart.com shopweblive.com wicall.ir # https://cybersecurity.att.com/blogs/labs-research/darkside-raas-in-linux-version catsdegree.com securebestapp20.com temisleyes.com # https://cybersecurity.att.com/blogs/labs-research/malware-hosting-domain-cyberium-fanning-out-mirai-variants cyberium.cc # https://cybersecurity.att.com/blogs/labs-research/the-rise-of-qakbot 1.nvprivateoffice.info # https://cybersecurity.att.com/blogs/labs-research/teamtnt-delivers-malware-with-new-detection-evasion-tool kaiserfranz.cc ## avast # https://blog.avast.com/topic/threat-research # https://decoded.avast.io/ # https://github.com/avast/ioc # https://blog.avast.com/avast-finds-banking-trojan-cerberus-on-google-play-avast goldegrillz.top # https://blog.avast.com/apt-attack-targets-central-asian-companies-avast # https://decoded.avast.io/luigicamastra/apt-group-planted-backdoors-targeting-high-profile-networks-in-central-asia/ # https://github.com/avast/ioc/tree/master/Microcin 9hnvb8917gzr.com 612bb.sheetsbrandnewday.com ans.moutw.com app.obokay.com bestrongerlouder.com bzz.utakatarefrain.com future-hope2011.com heroisshit.com kliju.wulinon.com log.bestrongerlouder.com nan.thanhale.com offcialwrittencomplaint.com qrot.apjgtipty.com runtime.heroisshit.com update.heroisshit.com yuemt.zzux.com ## bitdefender # https://labs.bitdefender.com/blog/ # https://labs.bitdefender.com/2021/04/from-cracks-to-empty-wallets-how-popular-cracks-lead-to-digital-currency-and-data-theft/ 4wye25lxiiws2n2uh7gyftn7cnas45o7adf5jjmnkusmhevaortywsad.onion pya3iu6oldo62qn6yhimjztryxz3tqhb7bqkspfmdaqu5lqmspxxt5qd.onion qmev4br46su73tn7wco5yx3f5ckcljchmgwtm56nvxbzkzngt777uoqd.onion rxa3aqwxcz2sqthq5b4epmxjweaipq2phadfk6cmpvgdzqpyhfss4ryd.onion s5dthib3esbzbbp4v6txpd4al2ozfpitkqk72hsdontvcmig3qdfacad.onion wbjp5c5nfu6mnxb6pdtqgfhssdrzjf4756tj4bhhupnvqhv4sidfqgqd.onion yzffgdbyrci3zdgerrarmx6faadvmtmcxboj25qvjb334cfuemh5t4ad.onion cbjpyldwxfc5bzdszzbrcatrjlevjr5qsk44enytvkovkv2thzxmjhyd.onion snbrrmnu3j7awyxu.onion # https://labs.bitdefender.com/2021/03/golang-bot-starts-targeting-wordpress-websites/ daryinformtrand.com declarebusinessgroup.ga dontkinhooot.tw linetoadsactive.ga lovegreenpencils.ga lowerthenskyactive.ga strongcapitalads.ga talkingaboutfirms.ga transandfiestas.ga travelfornamewalking.ga # https://labs.bitdefender.com/2021/03/fin8-group-is-back-in-business-with-improved-badhatch-kit/ # https://www.bitdefender.com/files/News/CaseStudies/study/394/Bitdefender-PR-Whitepaper-BADHATCH-creat5237-en-EN.pdf us-west.com # https://labs.bitdefender.com/2021/01/remcos-rat-revisited-a-colombian-coronavirus-themed-campaign/ # https://www.bitdefender.com/files/News/CaseStudies/study/390/Bitdefender-PR-Whitepaper-Remcos-creat5080-en-EN-GenericUse.pdf chasefre.chasefre.pics # https://labs.bitdefender.com/2020/11/a-detailed-timeline-of-a-chinese-apt-espionage-attack-targeting-south-eastern-asian-government-institutions/ # https://labs.bitdefender.com/2020/11/a-detailed-timeline-of-a-chinese-apt-espionage-attack-targeting-south-eastern-asian-government-institutions/ bitupdating.com bkavutil.com cloud.wmiprvse.com eapconfig.com eofficeupdate.com eofficeupdating.com goog1eupdate.com iatupdate.com igfxpers.com igfxsrvc.com iumsvc.com ksdeui.com ksdeupdate.com lotus.wmiprvse.com mdnsresponder.com mfaupdate.com mfaupdating.com msdtcupdate.com msseces.com nissrv.com osppsvc.com realteke.com unikeyupdate.com unikeyupdating.com update.wmiprvse.com updateui.com winserverupdate.com wmiprvse.com ws2008update.com # https://labs.bitdefender.com/2020/10/theres-a-new-a-golang-written-rat-in-town/ box.conf1g.com log.conf1g.com # https://labs.bitdefender.com/2020/10/fake-users-rave-but-real-users-rant-as-apps-on-google-play-deal-aggressive-adware/ api.hdvideoplayer.top api.instragramvideodownload.top api.launcherfor.top api.privatemsg.top api.socialvideodownloader.top api.sportcounter.top api.supervideoplayer.top api.wallpaper4k.top t.lineranalysis.com # https://labs.bitdefender.com/2020/10/lemonduck-crypto-miner-a-kingminer-successor/ # https://www.bitdefender.com/files/News/CaseStudies/study/373/Bitdefender-PR-Whitepaper-LemonDuck-creat4826-en-EN-GenericUse.pdf d.ackng.com t.amynx.com t.zer9g.com t.zz3r0.com # https://labs.bitdefender.com/2020/09/apps-on-google-play-tainted-with-cerberus-banker-malware/ 2fapass.club androidradio.life downdating.club fitnessstrategy.xyz groovefitness.xyz loversfinder.xyz positivefitness.club safeyourdata.xyz sport4ever.club vipyoga.today weatherclub.club yoga4u.xyz # https://labs.bitdefender.com/2020/06/bitterapt-revisited-the-untold-evolution-of-an-android-espionage-tool/ # https://www.bitdefender.com/files/News/CaseStudies/study/352/Bitdefender-PR-Whitepaper-BitterAPT-creat4571-en-EN-GenericUse.pdf blitzchatlog.ddns.net flashnewsservice.org gandharaart.org mypicks4u.com phoneshieldnet.com playupdateapp.serveblog.net spiceworld.rf.gd techfront.com.cn # https://labs.bitdefender.com/2020/06/banking-trojan-metamorfo-hijacks-trusted-apps-to-run-malware/ # https://www.bitdefender.com/files/News/CaseStudies/study/333/Bitdefender-PR-Whitepaper-Metamorfo-creat4500-en-EN-GenericUse.pdf 1stsview.com 1024caoliu.tk 178227.com 233333.xyz 242423.com 532166.com 876221.com adoptatucerezo.es andymartinez.eu arteliceo.com.es bestshine-bag.com bufiro.com cerveceriaelpunto.com cescogdl.com chefriquezes.com.ve cmigrupoconsultor.com constantine32.xyz copifull.net d8vjork.tk d13es.tk deportesenelmundo.com drebco.com elrincondefon.com huizhanwenhua.com mica.ml # https://labs.bitdefender.com/2020/05/iranian-chafer-apt-targeted-air-transportation-and-government-in-kuwait-and-saudi-arabia/ # https://www.bitdefender.com/files/News/CaseStudies/study/332/Bitdefender-Whitepaper-Chafer-creat4491-en-EN-interactive.pdf apigoogle-accounts.biz dropboxengine.com redjewelry.biz update-microsoft.space # https://labs.bitdefender.com/2020/05/android-malware-in-covid-19-clothes-steals-sms-and-contacts/ flyrosebifr.webhop.me # https://labs.bitdefender.com/2020/05/mandrake-owning-android-devices-since-2016/ # https://www.bitdefender.com/files/News/CaseStudies/study/329/Bitdefender-PR-Whitepaper-Mandrake-creat4464-en-EN-interactive.pdf android-soft.top androidfirmware.ca androidfirmware.cc androidfirmware.ir androidfirmware.top androidfrimware.com livingstream.mobi nfmmlrkagflemt.top rendfiles.top xjkbhysexthnpl.top # https://labs.bitdefender.com/2020/04/new-dark_nexus-iot-botnet-puts-others-to-shame/ # https://www.bitdefender.com/files/News/CaseStudies/study/319/Bitdefender-PR-Whitepaper-DarkNexus-creat4349-en-EN-interactive.pdf greekhelios21.tk subby.xyz switchnets.net thiccnigga.me # https://labs.bitdefender.com/2020/03/infected-zoom-apps-for-android-target-work-from-home-users/ 1downloadss0ftware.xyz adsforapp1.com googleteamsupport.ddns.net sf3-ttcdn-tos.pstatp.com sweetman2020.no-ip.biz # https://labs.bitdefender.com/2020/03/netflix-phishing-campaign-spikes-in-brazil-with-account-update-suspended-tricks/ br-sec-series.joomla.com index1-atualizar-cadastro.joomla.com # https://labs.bitdefender.com/2020/03/android-apps-and-malware-capitalize-on-coronavirus/ api.jetrohe.pw contorl.okapk.website coronavirus.oss-accelerate.aliyuncs.com t.grtyb.com thepornstudy.com # https://labs.bitdefender.com/2020/03/new-router-dns-hijacking-attacks-abuse-bitbucket-to-host-infostealer/ emailonlinechase.com whoer-vpn.net # https://labs.bitdefender.com/2020/01/hold-my-beer-mirai-spinoff-named-liquorbot-incorporates-cryptomining/ ardp.hldns.ru bpsuck.hldns.ru systemservice.hldns.ru wpceservice.hldns.ru # https://labs.bitdefender.com/2019/12/rdp-abuse-and-swiss-army-knife-tool-used-to-pillage-encrypt-and-manipulate-data/ # https://www.bitdefender.com/files/News/CaseStudies/study/302/Bitdefender-WhitePaper-RDP-Abusers.pdf gpetrofig.beget.tech mandevelopm.or megabitcoin.life mytele.ga workpc.biz # https://labs.bitdefender.com/2019/12/revisiting-glupteba-still-relevant-five-years-after-debut/ # https://www.bitdefender.com/files/News/CaseStudies/study/301/Bitdefender-Glupteba-Old-Dog-New-Tricks-en-EN.pdf andreysharanov.info beguest.xyz bigtext.club cfpoweredcdn.com dp.fastandcoolest.com foxmusic.xyz fstyline.xyz gamedemo.xyz headbuild.info jeopath.club krokas.info monopeets.com nadequalif.club nevernews.club newscommer.com proactor.xyz roundworld.club seamonkey.club seasondjmusic.com singlemusic.club speedandmusic.com tfortytimes.com # https://labs.bitdefender.com/2019/10/dozens-of-apps-still-dodging-googles-vetting-system/ # https://www.bitdefender.com/files/News/CaseStudies/study/290/Bitdefender-WhitePaper-Android-Dozens-of-Apps-Still-Dodging-Googles-Vetting-System.pdf mobitracker.ml ter-3f29.kxcdn.com unlockedgames.fun # https://labs.bitdefender.com/2019/10/a-close-look-at-fallout-exploit-kit-and-raccoon-stealer/ # https://www.bitdefender.com/files/News/CaseStudies/study/289/Bitdefender-WhitePaper-Fallout.pdf comicsansfont.com gonzalesnotdie.com gorgantuaisastar.com yourfirmware.biz # https://labs.bitdefender.com/2019/09/who-iserik-a-resurface-of-an-advanced-persistent-adware/ # https://www.bitdefender.com/files/News/CaseStudies/study/284/Bitdefender-WhitePaper-Erik-CREA3910-en-EN-GenericUse.pdf busucak.com butapujo.com d1etigj2h443kd.cloudfront.net d1hpofzsaxmzog.cloudfront.net d2b46e7ax2atfi.cloudfront.net d2vut1jfnnygcg.cloudfront.net d2wv7denc1jx9z.cloudfront.net d2zyvlskj53q65.cloudfront.net d3s1tkg9f4254q.cloudfront.net d3tq9gtc0bxu1s.cloudfront.net d33wv995bk7lag.cloudfront.net d36lv9781gxp5z.cloudfront.net d274eq41c39r2n.cloudfront.net ddukmql.com dlrabaly59cp3.cloudfront.net dnodjoiz0vcnz.cloudfront.net gahuwa.com gujujoh.com hoduqoq.com hufunuk.co katunaq.comh lomokonu.com mogaf.com pugugu.com puloja.com qajolos.com rududulu.com sao.binkp.com sao.cspbint.com sao.exbint.com sao.jamreq.com sao.kanrq.com sao.reqdre.com sao.tabprt.com sao.vosgr.com tdfpa.com wagng.com wavbsly.com yxhpa.com zahirq.com # https://labs.bitdefender.com/2019/08/worm-cryptominer-combo-lets-you-game-while-using-nsa-exploits-to-move-laterally/ # https://www.bitdefender.com/files/News/CaseStudies/study/280/Bitdefender-WhitePaper-Worm-Cryptominer-Beapy-PCASTLE.pdf dl.haqo.net down.bddp.net i.haqo.net ii.ackng.com iim.ackng.com info.abbny.com info.ackng.com info.beahh.com info.haqo.net log.bddp.net lp.abbny.com lp.beahh.com lp.haqo.net lplp.abbny.com lplp.beahh.com lplp.haqo.net lpp.awcna.com lpp.zer2.com oo.beahh.com oom.beahh.com p.abbny.com pp.abbny.com ppm.abbny.com pull.update.ackng.com update.bddp.net v.bddp.net v.beahh.com v.y6h.net w.beahh.com # https://labs.bitdefender.com/2019/08/new-homograph-phishing-attack-impersonates-bank-of-valletta-leverages-valid-tls-certificate/ bank0fvalletta.com xn--bv-2ya.com xn--ov-blb.com # https://labs.bitdefender.com/2019/07/astaroth-trojan-resurfaces-targets-brazil-through-fileless-campaign/ # https://www.bitdefender.com/files/News/CaseStudies/study/272/Bitdefender-Whitepaper-Astaroth-en-EN.pdf 20farma.xyz 20hadji.website 20hitler.site 20pegar.space 20saddam.pw 20stalin.fun 30maxj.site 30maxk.website 30maxw.fun 30maxx.pw 30maxy.xyz 30maxz.space 77samsung01.website 77samsung02.pw 77samsung03.space 77samsung04.fun 77samsung05.site 77samsung06.xyz amconsultoria.site americanterrier01.website americanterrier02.pw americanterrier03.space americanterrier04.fun americanterrier05.site americanterrier06.xyz aprovadetudo1.website aprovadetudo2.pw aprovadetudo3.space aprovadetudo4.fun aprovadetudo5.site aprovadetudo6.xyz avancados2.site azuru.host.me bellinatiperez.xyz blackjoud.com blacklist01.website blacklist02.pw blacklist03.space blacklist04.fun blacklist05.site blacklist06.xyz bobmarley.space bobmarleyf1.website bobmarleyf2.pw boxcheap.site boxfree.club boxfree.fun boxfree.pw boxfree.site boxfree.xyz breakingbad1.website breakingbad2.pw breakingbad3.space breakingbad4.fun breakingbad5.site brocatorxb.xyz budweiser01.website budweiser02.pw budweiser03.space budweiser04.fun budweiser05.site budweiser06.xyz cablesystem.club cablexsystem.club cablexsystrse.me castlebravo03.space castlebravo06.xyz cavaleira1.website cavaleira2.pw cavaleira3.space cavaleira4.fun cavaleira5.site cavaleira6.xyz cavalodetroia01.website cavalodetroia05.site cavalodetroia06.xyz caveirao.fun caveiraov1.site caveiraov2.xyz chromiunxede.pw chromiunxewaa.website chromiunxjdkhy.fun chromiunxjst.site chromiunxkla.space chromiunxkla.work chromiunxma.xyz chromiunxvr.club cloudinha.website cloudona.xyz companhia2.site companhia3.site compress.to consulth.club davidguetta01.website davidguetta02.pw davidguetta03.space davidguetta04.fun davidguetta05.site ddns.info dindsranki.club dindsranko.site dns04.com dns05.com dodgetomahawk01.website dodgetomahawk02.pw dodgetomahawk03.space dodgetomahawk04.fun dodgetomahawk05.site dodgetomahawk06.xyz drinksreactiona.work drinksreactionc.xyz drinksreae.site dumb1.com dy2-nobody.com dynamic-dns.net eleconfia.icu eniacomputer01.website eniacomputer02.pw eniacomputer03.space eniacomputer04.fun eniacomputer05.site eniacomputer06.xyz epac.to eririxab.com essencialsrv.xyz farrapos01.website farrapos02.pw farrapos03.space farrapos04.fun farrapos05.site farrapos06.xyz firefenix01.website firefenix02.pw firefenix03.space firefenix05.site firefenix06.xyz fortelegal.website freebackup.fun freebackup.pw freebackup.site freebackup.space freebackup.xyz freehosted.club freehosted.pw freehosted.site freehosted.xyz frintzendx.xyz frintzendxb.website frintzenxc.site gameofthrones01.website gameofthrones02.pw gameofthrones03.space gameofthrones04.fun gameofthrones05.site gameofthrones06.xyz globalcob.xyz grupocobex.site hcosta.site hitsblack.club hitsblue.xyz hitsfree.pw hitsgreen.fun hitshits.space hitsred.site hostwebfree.fun hostwebfree.pw hostwebfree.site hostwebfree.space hostwebfree.website hostwebfree.xyz iceyavod.com ikoxuhid.com impressoxpz598295.com info-id2.online instanthq.com intelcore-i2.pw intelcore-i3.space intelcore-i4.fun intelcore-i5.site intelcore-i6.xyz isasecret.com itemdb.com itsaol.com ivimalaf.com jetos.com juriassessoria.xyz justchotlo.com justchtt.com justchttb.com kawasakininja01.website kawasakininja02.pw kawasakininja03.space kawasakininja04.fun kawasakininja05.site kawasakininja06.xyz kloudghtlp.com ksegur.website ksegur.xyz lobosolitario1.website lobosolitario2.pw lobosolitario6.xyz longmusic.com madrigalisxs.club madrigalixxlske.site madrigalixxrfe.fun madrigalixxwefer.space madrigalixxweli.pw mclarenp1.website mclarenp2.pw mclarenp3.space mclarenp4.fun mclarenp5.site mclarenp6.xyz miamix.pw miamixix.fun miamixixi.xyz miamixixx.space miamixx.site mrbasic.com mrface.com my03.com mymom.info navegador04890.com navixx.club navixx.fun navixx.pw navixx.site navixx.space notafiscal05.com obosinal.com onedumb.com proxy1x-server.website proxy5x-server.website redbullenergy01.website redbullenergy03.space redbullenergy04.fun redbullenergy05.site residentevil01.website residentevil02.pw residentevil06.xyz salehosted.fun salehosted.xyz salteadores1.website salteadores2.pw salteadores3.space salteadores4.fun salteadores5.site salteadores6.xyz sellclassics.com senac0.pw sexxxy.biz sh-master02.com sh-master03.com shaokahn03.space shaokahn05.site sharkatack01.website sharkatack02.pw sharkatack03.space sharkatack05.site sharkatack06.xyz sismaistec01.shop sismaistec01.xyz sismaistec.club starksxmewez.today thevirtusc.work toythieves.com trctaborda.xyz ultrapower01.website ultrapower02.pw ultrapower03.space ultrapower04.fun ultrapower05.site ultrapower06.xyz vendasplus.club vendasplus.pw vendasplus.site vendasplus.website vendasplus.xyz veneratorb.info vitorianaguerra1.website vitorianaguerra3.space vitorianaguerra5.site vitorianaguerra6.xyz wikaba.com wilstonbrwlosk.club wilstonbrwlqoai.site wilstonbrwrgh.online wilstonbrwsaq.pw wlobrancas.xyz wsegur.space wshowbka.fun wshowkct.live wshowkdy.xyz wshowlw.club wshowr8.website wshowuk.pw wshowvik.work wshowxte.site wshowzki.space xsegur.pw youdontcare.com yourtrap.com ysegur.fun zsegur.site zyns.com zzux.com # https://labs.bitdefender.com/2019/06/scranos-revisited-rethinking-persistence-to-keep-established-network-alive/ # https://www.bitdefender.com/files/News/CaseStudies/study/271/Bitdefender-Whitepaper-Scranos-2.pdf 2D945B616D6FA1E537234277FB7395D8.online 15s0.com 838F57672A2B2B2C9041131351AB996C.online a1.dslllllnssss.club abc.aaaaabbbbbcccccddddd.net bounce-w.top C44E9AC1C39D6F01509088DEF3046C15.online down.klldddiso.xyz k1l4.club k.maidi888.com tk.maidi888.com v01.74AE36124716F613CB65D1C467749689.online v01.586B50FC7C8C0677239599562BBF4FEE.online v01.26119DAC2973F3B9BE66CEEA938DAEAE.online xx1.aaaaabbbbbcccccddddd.net xx2.aaaaabbbbbcccccddddd.net xx3.aaaaabbbbbcccccddddd.net xx4.aaaaabbbbbcccccddddd.net xx5.aaaaabbbbbcccccddddd.net xx6.aaaaabbbbbcccccddddd.net xxxxx.caocaocaocaocaocaocaocaocao.com xxxxx.gangangangangangangangangangangan.com xxxxx.nainainainainainainainainainainai.com xxxxx.ririririririririririririririririririri.com xxxxx.weoqieqwuishdwuygqw.com xxxxxx.ririririririririririririririririririri.com # https://labs.bitdefender.com/2019/06/an-apt-blueprint-gaining-new-visibility-into-financial-threats/ # https://www.bitdefender.com/files/News/CaseStudies/study/262/Bitdefender-WhitePaper-An-APT-Blueprint-Gaining-New-Visibility-into-Financial-Threats-interactive.pdf cloud.yourdocument.biz swift-fraud.com # https://labs.bitdefender.com/2019/04/inside-scranos-a-cross-platform-rootkit-enabled-spyware-operation/ # https://labs.bitdefender.com/wp-content/uploads/downloads/inside-scranos-a-cross-platform-rootkit-enabled-spyware-operation/ 9D3C13FAF748710EBB5A8E1232B43CA7.online 80FD4C6BAC35BAB54608B2F60A9A1759.online 898799673.rsc.cdn77.org 1898799673.rsc.cdn77.org A4E43EDE382B7613F03D2997C80E2DA9.online a12.fun ab12.fun b12.fun B453A3C474BE9C1BB54E927E99CA7CFA.online count.b12.fun d3pk.com D43AC96995C02E4A7CCECE3059730B95.online dl.ossdown.fun downmsdn.com EC33503163B5789F6786C0D82B479364.online fffffk.xyz hh1m.com info.d3pk.com ossdown.fun ## cert-agid # https://cert-agid.gov.it/ # https://cert-agid.gov.it/news/campagna-ursnif-veicolata-tramite-falsa-mail-brt/ claritymodules.nl flashgran.com jdkloooqppwopppp99.nl jkdoiloooooo1.nl kloooplooloaaa.nl nkdlooooalksloooo.nl # https://cert-agid.gov.it/news/campagna-malware-lokibot-in-atto-in-ambito-universitario/ alphastand.top alphastand.trade alphastand.win kbfvzoboss.bid # https://cert-agid.gov.it/news/riscontrata-e-contrastata-campagna-di-malware-sload-veicolata-via-pec/ hbfdtsc.eu opoietj.eu reetber.eu sertyty.eu # https://cert-agid.gov.it/news/brata-malware-per-dispositivi-android-spacciato-per-antispam/ verifica-web-clienti-isp.ltd # https://cert-agid.gov.it/news/in-atto-campagna-di-phishing-con-invito-ad-aggiornare-webmail-pro/ myanchormarketplace.com # https://cert-agid.gov.it/news/individuato-malware-fickerstealer-veicolato-tramite-campagna-hancitor/ anithedtatione.ru bahujansangam.org falan4zadron.ru pospvisis.com thervidolown.com wiltuslads.ru # https://cert-agid.gov.it/news/campagna-malspam-ateraagent-a-tema-dike/ dike_infocert.firstcloudit.com # https://cert-agid.gov.it/news/contrastata-nuova-campagna-sload-via-pec/ chinghsiang.com opoietj.eu sertyty.eu # https://cert-agid.gov.it/news/scoperta-massiva-campagna-scam-bitcoin-tramite-url-bit-ly/ 07n7n.workerhand.casa 2f5o3.workerhand.link 5kb5.commitrecord.world 6xaam.sundayreturn.casa 8f5we.sundayreturn.link 9lc8.increaseworker.world 9n1ni.giveeconomy.link 51c3.increaseworker.link 76rmj.giveeconomy.work a2m8.termcupboard.link alssr.workerhand.link b1jfr.momentexplain.casa client.platinex.co ctq07.moneyfat.link d07mw.momentexplain.world e7cu1.workerhand.world j4o8f.giveeconomy.work js0n.flyhead.world k91n0.giveeconomy.link n60b.termcupboard.link n94u0.sundayreturn.world nvjc.commitrecord.link ojyy7.sundayreturn.world qajcy.momentexplain.link ry6ej.giveeconomy.work s3x1.confirmplace.link sbn6.increaseworker.link scfrr.workerhand.casa sczj.sectorfriend.link url3276.platinex.co vip.gewinncodesystem.shownew.work xpayz.net z7fc9.momentexplain.link # https://cert-agid.gov.it/news/individuata-nuova-variante-delle-campagna-sload-veicolata-via-pec/https://cert-agid.gov.it/news/individuata-nuova-variante-delle-campagna-sload-veicolata-via-pec/ goldenwestway.com # https://cert-agid.gov.it/news/contrastata-campagna-sload-veicolata-via-pec/ imwithmark.com # https://cert-agid.gov.it/news/sms-maligni-che-contengono-flu-bot-cosa-ce-da-sapere-e-come-rimediare-al-contagio/ # https://cert-agid.gov.it/news/lattivita-del-malware-flu-bot-continua-a-crescere-potremmo-essere-solo-allinizio/ 3seconds.co.kr 4plomba.club 719faka.com 814.net.cn 2666film.com a1tuning.ru aaronharrisrealty.com abbysfabricsandaccessories.com abris-spa.info abris-spa.net adrianomedeiros.med.br adventure-outside.co.uk aktien-mentor.de alborzdates.ir all-chalisa.com amazingseniors.my amensagemdedeus.com amitay.co.il ankhflora.com antihipertriton.com arkkam.com.tr asemanproject.ir avanart.by avriodrone.it banglagensolution.com barkoturk.com bayarsini.id beautypoint.mk bestcoffee.it bgt666.com birizmir.com.tr bocahmlaku.com brainster.xyz bs015.rs builtinjersey.com bumbumdefinido.online buvago.my c96kart.co.in capokids.edu.vn caramelpleven.eu centrodealtosestudiosinmobiliarios.com ceredinhas.com.br cfcconsulting.it chaoqi.shop chengtouji.com clarionindiaventures.in clasesdetaichigenyo.es crypto-cloud.live dashcards.com dassicura.it datcomn.com delbandak.com deluxeprizes.co.uk dentallearning.net dhamen-group.com dicastec.tech dixonpestsolutions.com drivewords.com drswekshadermatology.com durajobs.in dxplorercakes.com.ng easymatchprediction.com elhamdolati.ir eminekoka.com envolve.adv.br epsychology.tech eriksdigital.co.il essaywritersforuk.org estudiodablio.com fairycandy.love falconfly.com.br fitnessforalle.dk fixmydeal.in fortsaude.com.br fourleafsocial.com friendsforlife.in game7373.com gavigudet.org genesis.mu giaygisa.com.vn gloriousbrideofchrist.org godinho-santotirso.pt goldingenarezidence.lv googpo.com grotifortepijonu.lt guideofantalya.com guttocosmetics.id habitatisolation.fr hahvn.com haina.store hcfairpods.com healthheartlife.co.uk hieptichxanh.com hiyang.com.tw hoerstel.de iceberg.at iglesiacristianasoldejusticia.org.co imanijatim.org imoneyq.com implementadigital.com.br impresario.co.in infinitehumanscx.com innovapos.xyz interieurarchitect-maasdam.nl iri-lj.si isakseries.com it5art.com its-globaltek.com ivylaneestate.ca iyouthleague.org jiukewang.com jliptv.com.br jmacsmedia.com joera.pk julianvilche.com jxtcbz.cn laloorna.com laus.club locnuocuytin.com lysj.shop maalhosonline.com maec.adv.br magicmirrorai.com maphandbook.com mediodonto.com mensagensdabiblia.com.br mental-neuro-training.be mercertrans.com meupiano.com.br miamiluxuryvacationrentals.com minhquankuche.com mose-group.com mostootriad58.by mounter.io muabannodanluat.com multiplaprotecao.com muniaa.ga nahvino.com naomiterner.com nasutki.click nationwidesurveyors.org.uk naturalbionics.eu naturewater.com.pk nawabintang.com negroniapplications.com netrikkan.com netslider.fr nicolyn.art niyplatform.com nkljubljana.si noibaivilinh.com noithatamigo.com nutrifitsaude.com odyoinciisitme.com.tr oguiasecreto.com oguzdoganay.com okaybaby.ie ombrapiatta.com omdebar.ir ong-fea.org onlinern.com.br onlinesteroidsatis.com oppsav.com optiboard.de oudiservice.com ourcheapstore.in ozi.im paolodavid.com parroquialalaguna.com partesyaccesorios.com.co pelouseetdeneigementcaron.com pikasho.com place2b.com planetdisinfect.com poledanceclothinguk.co.uk portaldonegocio.com propackwp.com qingdianyun.com questreams.com quickbrain.ml rafalhryniewicki.pl rbym.cc rciptv.com.br redprocesal.org respectmag.com rhinepro.vn risarcimentodaresponsabilita.it royallavan.ir rsfsr-tomsk.su ruanjianshi.cn safwetalex.com saltandwater.de sanbornmarketing.co service-fibre.fr shopbakula.in sirfjanpaksh.com sitedaclimb.com.br skpjatim.org slaapschool.com smartfarms.vn smsyoga.com soawr-test.org sodocasino.com sodocasino.in sodocasino.info sodocasino.net sodovip88.com sooryacricket.club sos-lock.net sp-centre.ml sspbluebox.com stevestudio.top sttarastamar-ngabang.ac.id subtletg.com sugarsmooth.nl supply-amazon.com suspro.vn swaddleblanket.co.uk tajabarta.com tbwysx.cn tengvy.com tennis-utzenaich.at tensideias.com tepo.my.id tervis.care thandiphotography.com thenewsadvocate.com therakshinproject.org thevicz.com thewellnessbridge.com thietbisukiengiare.vn thinkcreatecontent.com tomorrow-channel.com toropaire.com tqb.org.sa triedhealthsolutions.com tringotv.com trustu.cn twenoz.com unestgroup.com urbancare.tech valinus.ir vidasanar.com webkikstarter.com wikalp.in woodgrav.fr wpschoolpress.com wusleylk.com xiaokbk.com xiubie.com xq521.com yadaksiklet.ir yafa-coach.co.il yishuhuoban.com yourdigitalpeople.com youwecan.org yuanbiguo.com zakato.org zhshang.top zonamounderground.nl # https://cert-agid.gov.it/news/flu-bot-si-evolve-rilevata-in-italia-una-nuova-versione-4-0-veicolata-via-sms/ 719faka.com 2666film.com asemanproject.ir avriodrone.it bestcoffee.it builtinjersey.com centrodealtosestudiosinmobiliarios.com ceredinhas.com.br cfcconsulting.it dixonpestsolutions.com durajobs.in envolve.adv.br epsychology.tech essaywritersforuk.org estudiodablio.com falconfly.com.br friendsforlife.in gavigudet.org giaygisa.com.vn guttocosmetics.id haina.store hieptichxanh.com iri-lj.si its-globaltek.com joera.pk lysj.shop mediodonto.com minhquankuche.com naturewater.com.pk nutrifitsaude.com ombrapiatta.com ozi.im poledanceclothinguk.co.uk portaldonegocio.com smartfarms.vn smsyoga.com sp-centre.ml tqb.org.sa triedhealthsolutions.com xiubie.com xq521.com youwecan.org # https://cert-agid.gov.it/news/campagna-flubot-veicolata-anche-in-italia-via-sms-prende-di-mira-i-dispositivi-android/ 3seconds.co.kr 814.net.cn a1tuning.ru abbysfabricsandaccessories.com abris-spa.info abris-spa.net adrianomedeiros.med.br aktien-mentor.de amazingseniors.my amensagemdedeus.com amitay.co.il ankhflora.com arkkam.com.tr avanart.by barkoturk.com bayarsini.id beautypoint.mk bgt666.com birizmir.com.tr bocahmlaku.com brainster.xyz bs015.rs bumbumdefinido.online buvago.my c96kart.co.in caramelpleven.eu chaoqi.shop chengtouji.com clarionindiaventures.in crypto-cloud.live dashcards.com datcomn.com deluxeprizes.co.uk dentallearning.net dhamen-group.com dicastec.tech drivewords.com drswekshadermatology.com dxplorercakes.com.ng easymatchprediction.com eminekoka.com eriksdigital.co.il fairycandy.love fixmydeal.in fortsaude.com.br fourleafsocial.com game7373.com genesis.mu gloriousbrideofchrist.org goldingenarezidence.lv googpo.com grotifortepijonu.lt guideofantalya.com habitatisolation.fr hahvn.com hcfairpods.com healthheartlife.co.uk hiyang.com.tw hoerstel.de iglesiacristianasoldejusticia.org.co imanijatim.org imoneyq.com implementadigital.com.br impresario.co.in infinitehumanscx.com interieurarchitect-maasdam.nl isakseries.com ivylaneestate.ca iyouthleague.org jiukewang.com jliptv.com.br jmacsmedia.com julianvilche.com jxtcbz.cn laloorna.com laus.club maalhosonline.com maec.adv.br magicmirrorai.com maphandbook.com mensagensdabiblia.com.br mercertrans.com meupiano.com.br miamiluxuryvacationrentals.com mostootriad58.by mounter.io multiplaprotecao.com muniaa.ga naomiterner.com nasutki.click naturalbionics.eu negroniapplications.com netslider.fr nicolyn.art nkljubljana.si noibaivilinh.com noithatamigo.com oguiasecreto.com oguzdoganay.com okaybaby.ie omdebar.ir ong-fea.org onlinern.com.br onlinesteroidsatis.com optiboard.de ourcheapstore.in parroquialalaguna.com partesyaccesorios.com.co pelouseetdeneigementcaron.com pikasho.com place2b.com planetdisinfect.com propackwp.com questreams.com quickbrain.ml rafalhryniewicki.pl rbym.cc rciptv.com.br redprocesal.org risarcimentodaresponsabilita.it rsfsr-tomsk.su ruanjianshi.cn safwetalex.com saltandwater.de sanbornmarketing.co service-fibre.fr shopbakula.in sitedaclimb.com.br skpjatim.org slaapschool.com soawr-test.org sodocasino.com sodocasino.in sodocasino.info sodocasino.net sodovip88.com sos-lock.net sspbluebox.com stevestudio.top sttarastamar-ngabang.ac.id subtletg.com sugarsmooth.nl supply-amazon.com suspro.vn swaddleblanket.co.uk tajabarta.com tbwysx.cn tennis-utzenaich.at tensideias.com tepo.my.id thandiphotography.com thenewsadvocate.com therakshinproject.org thevicz.com thietbisukiengiare.vn thinkcreatecontent.com tomorrow-channel.com tringotv.com trustu.cn unestgroup.com urbancare.tech valinus.ir vidasanar.com webkikstarter.com wikalp.in woodgrav.fr wusleylk.com xiaokbk.com yadaksiklet.ir yafa-coach.co.il yishuhuoban.com yuanbiguo.com zakato.org zhshang.top # https://cert-agid.gov.it/news/campagna-formbook-con-allegato-malevole-html-attualmente-attiva-in-italia/ rewardap.com tulwueke.com linuxrecovery.com mindyabusinesspopup.com delanonnala.com xiaobusiness.com defiquiz.com eagleautomobilerepair.com camillabortolotti.com/lmp # https://cert-agid.gov.it/news/nuova-campagna-sload-via-pec-sfrutta-ancora-la-tecnica-del-doppio-allegato-zip/ bleuetsetcie.com bottlerocketfx.com cousinlamp.com erthgyrteh1.eu erthgyrteh2.eu erthgyrteh3.eu erthgyrteh4.eu erthgyrteh5.eu erthgyrteh6.eu erthgyrteh7.eu erthgyrteh8.eu erthgyrteh9.eu erthgyrteh10.eu erthgyrteh11.eu erthgyrteh12.eu erthgyrteh13.eu erthgyrteh14.eu erthgyrteh15.eu erthgyrteh16.eu erthgyrteh17.eu erthgyrteh18.eu erthgyrteh19.eu erthgyrteh20.eu erthgyrteh21.eu erthgyrteh22.eu erthgyrteh23.eu erthgyrteh24.eu erthgyrteh25.eu erthgyrteh26.eu erthgyrteh27.eu erthgyrteh28.eu erthgyrteh29.eu erthgyrteh30.eu erthgyrteh.eu kuyikryf1.eu kuyikryf2.eu kuyikryf3.eu kuyikryf4.eu kuyikryf5.eu kuyikryf6.eu kuyikryf7.eu kuyikryf8.eu kuyikryf9.eu kuyikryf10.eu kuyikryf11.eu kuyikryf12.eu kuyikryf13.eu kuyikryf14.eu kuyikryf15.eu kuyikryf16.eu kuyikryf17.eu kuyikryf18.eu kuyikryf19.eu kuyikryf20.eu kuyikryf21.eu kuyikryf22.eu kuyikryf23.eu kuyikryf24.eu kuyikryf25.eu kuyikryf26.eu kuyikryf27.eu kuyikryf28.eu kuyikryf29.eu kuyikryf30.eu kuyikryf.eu pesterbdd.com # https://cert-agid.gov.it/news/nuova-campagna-ransomware-lockthesystem/ lmvirtualbookkeeping.com # https://cert-agid.gov.it/news/lokibot-veicolato-con-falsa-email-intesasanpaolo/ gilardoni-it.xyz # https://cert-agid.gov.it/news/campagna-ursnif-con-falsa-mail-inps/ gstat.kangweid.com gstat.premiamo.com gstat.premiamo.eu gstat.secundamo.com gstat.secundato.com gstat.secundato.net gstat.securanto.com gstat.securanto.net gstat.securezal.com gstat.securezal.xyz gstat.securezzas.com gstat.securezzis.net gstat.sloleaks.com web.coryriley.com # https://cert-agid.gov.it/wp-content/uploads/2020/08/IoC_Ursnif_13-08-2020.txt gstat.americansreachingmanyservices.com gstat.farmlifesupplements.com gstat.rayzacastillo.com gstat.sloleaks.com line.campdiy.com social.farfetchedproductions.com social.interactivegood.com # https://cert-agid.gov.it/news/campagna-sload-v-2-9-3-veicolata-via-pec/ lwyhef.eu mzgotech.com peliculadeestreno.com ponmer.eu sheyenneweber.com sirisms.com # https://cert-agid.gov.it/news/finta-comunicazione-dellagenzia-delle-entrate-veicola-il-malware-ursnif/ gstat.262productions.com gstat.peshtigodental.com # https://cert-agid.gov.it/news/campagna-massiva-jasperloader-veicola-ftcode-via-pec/ documento.haileywilkinson.com documento.jescy.com documento.mialeeka.com documento.noothercouncil.com documento.selltokengarffhonda.com z2uymda1mtk.top # https://cert-agid.gov.it/news/indennita-covid-19-distribuito-malware-apk-tramite-falso-sito-inps/ greedyduck.top inps-it.top # https://cert-agid.gov.it/news/campagna-di-phishing-ai-danni-di-clienti-aruba/ aruba-di.blogspot.com aruba-di.com # https://cert-agid.gov.it/news/campagna-ransomware-fuckunicorn-sfrutta-emergenza-covid-19/ fofl.it ## cert-pa # https://www.cert-pa.it/ # https://www.cert-pa.it/notizie/campagna-malspam-con-target-italia-per-diffondere-ursnif/ gstat.dondyablo.com line.mackmclain.com line.monalisapizzeriasi.com link.sustainableworkplacewellness.com securezza.at # https://www.cert-pa.it/notizie/campagna-malspam-sload-veicolata-in-italia-via-pec/ joplock.eu nephemp.com oomovers.com woodlandislamiccenter.com zarwrite.eu # https://www.cert-pa.it/notizie/campagna-di-phishing-ai-danni-di-utenti-outlook/ b1z.org fleingt.c1.biz # https://www.cert-pa.it/notizie/campagna-malware-android-con-riferimenti-a-inps-e-covid-19/ connectadsense.monster inps-forma.online inps-iforma.online inps-informa.online # https://www.cert-pa.it/notizie/campanga-malspam-ursnif-veicolata-in-italia-sfrutta-emergenza-coronavirus/ 9ureyowuher9b.xyz loadkaklokja.xyz newitpagamentofor.xyz # https://www.cert-pa.it/notizie/campagne-di-phishing-ai-danni-di-utenti-di-supermercati-e-corrieri/ se.cheapeducations.com tack-er.atessera.com tack-er.makingeffort.com tack-er.pinnatam.com tack-er.reignstumble.com tack-er.vakantiekusadasi.com tack-er.yascommunication.com track-beta.cokpujwan.com track-beta.kkalnew.com track-beta.woainvren.com track-earth.catechu.info track-er.nerdsfromspace.com track-gr.gznabier.com track-gr.miawidlake.com track-gr.sunsflowed.com track-gr.yunbaoye.com track.pizzacorneli.com trak.qiqisy.com trak.sgthinksmart.com trck-ayu.chrenee.com trck-ayu.hnsuike.com trck-ayu.suplatabak.com trck-ayu.zhangcongsheng.com trck-beta.mmarg.com trck-beta.ucuztadilat.com trck-earth.aquaglidesaws.com trck-earth.dasreal.com trck-earth.duyphamblog.com trck-earth.flaskbelts.com trck-earth.monavocatparis.com trck-earth.osirusband.com trck-earth.teochnologist.com trck-er.aspensunset.com trck-erth.armorwebhost.com trck-erth.cnzysp.com trck-erth.winpousa.com trck.graider.com trcky.publishingdot.com trk-ert.crocpeus.com # https://www.cert-pa.it/notizie/phishing-ai-danni-di-istruzione-it/ miur.gov.it.skelego.com # https://www.cert-pa.it/notizie/possibile-campagna-di-malspam-italiana-zaratustra/ 195123a6.ngrok.io # https://www.cert-pa.it/notizie/campagna-sload-star-wars-edition-veicolata-via-pec/ merth.eu rachellubell.com stefannibecker.com taobookings.com utywrg.eu # https://www.cert-pa.it/notizie/il-rat-proclient-con-funzionalita-avanzate-per-lo-spionaggio-2/ bc.iensar.com srv1.cn-uinquetex.com # https://www.cert-pa.it/notizie/campagna-ursnif-tramite-e-mail-di-rimborso-dhl/ appbaripagamento.pw atooioplap.xyz atooioplapatooioplap.xyz fatturanewpagamentodiversi.pw pagamentodimilanotobari.fun # https://www.cert-pa.it/notizie/nuova-campagna-veicola-il-ransomware-dharma/ mengather.com # https://www.cert-pa.it/notizie/phishing-ai-danni-di-utenti-tim/ pick-me-reach.com promosurvey1.info # https://www.cert-pa.it/notizie/phishing-ai-danni-di-clienti-amazon/ c.giardinoinfestato.it c.minatoreditrofei.it mtp.capitalrtv.com trck-beta.basicnerf.com # https://www.cert-pa.it/notizie/campagna-malspam-sload-veicolata-via-pec/ blueproductionscr.com cramelcorp.com delight-plus.com hnerert1.eu hnerert3.eu oilkjhg.eu turthgr.eu tuyukj.eu uybwer.eu uyikjtn2.eu # https://www.cert-pa.it/notizie/nuova-campagna-sload-veicolata-tramite-pec/ cafebellissimo.com clubdeajedrezmatamoros.com drmikelim.com hnerert.eu nweryh.eu # https://www.cert-pa.it/notizie/exploit-su-android-installa-un-malware-senza-interazione-utente/ ap1-acl.net aws-check.net deb-cn.net ms-db.net ms-ethics.net reawk.net # https://www.cert-pa.it/notizie/recente-evento-di-malspam-diffonde-trickbot-in-italia/ aguilarygarces.com # https://www.cert-pa.it/notizie/malspam-consegna-formati-legati-ad-immagini-disco-per-diffondere-malware-rat/ aasthavruddhashram.org abokijob.hopto.org baiksan-kr.com boki0419.duckdns.org corpcougar.in daivena.com dressmoon.cl johnsonmullaly.ddns.net klavze28.com kyant4.com mariquita.anpiss.org pitchstak.ga shahbaz-associate.com xrilzv.tk xrt4tr.com # https://www.cert-pa.it/notizie/campagna-di-malspam-tenta-di-veicolare-emotet-invitando-a-sostenere-lattivita-di-greta-thunberg/ helenelagnieu.fr lubinco.co.il ondesignstudio.in pakspaservices.com textilesunrise.com # https://www.cert-pa.it/notizie/malspam-per-diffondere-il-malware-emotet-con-riferimenti-del-mef/ bar-ola.com fullheartsromance.com nhomkinhthienbinh.com oneofakindcm.com rinani.com stephporn.com wowmotions.com # https://www.cert-pa.it/notizie/campagna-ftcode-del-13-12-2019/ men.unifiedthreatmanagementutm.com noe.aurelianoelle.com way.securewebgateway.com # https://www.cert-pa.it/notizie/campagna-di-ricognizione-vittime-tramite-false-email-sda-poste-italiane/ expresscourier.icu expresscourier.xyz sda-express.icu sda-express.xyz sdacourier.xyz sdaexpress.icu sdaexpress.xyz sdaexpresscourier.xyz # https://www.cert-pa.it/notizie/campagna-emotet/ acaciapremier.com baoho.zweb.xyz betaoptimexfreze.com cdn.investaweb.com gessuofk.net greencrosscc.com gunnertalk.com hasbrew.com mapascolectivos.com minhvinh.xyz norikkon.com rampbay.com superlifenig.com vhdogaru-001-site11.btempurl.com # https://www.cert-pa.it/notizie/riparte-la-campagna-ursnif-tramite-false-fatture-dhl/ abrakam.site hiteronak.icu jogodo.duckdns.org laddloanalao.xyz makretplaise.xyz marvellstudio.online sdkscontrol.pw sutsyiekha.casa ublaznze.online udatapost.red # https://www.cert-pa.it/notizie/campagna-ftcode/ agvlmtkxmjuw.top ahmwmtkxmjuw.top amq1mtkxmjuw.top box.mcorea.com bxfmmtkxmjuw.top ehuxmtkxmjuw.top ese.emarv.com fly.blumenstock.com pups.pupusas.net # https://www.cert-pa.it/notizie/pyxie-rat-nuovo-trojan-di-accesso-remoto/ athery.bit babloom.bit benreat.com c1oudflare.com dopearos.com fearlesslyhuman.org floppys.bit foods-pro.com hwartless.bit ololo.space planlamaison.com sarymar.com teamchuan.com tedxns.com # https://www.cert-pa.it/notizie/nuova-campagna-ursnif-colpisce-utenze-italiane-e-pp-aa/ agenziadelleentr.pw armanidesk.xyz asistenzaonliine.com asistenzaonline.pw asistenzaonlinu.red genzleentr.host helpabout.pw newsitalybiz.club readmebook.fun redxyzred.xyz # https://www.cert-pa.it/notizie/campagna-ursnif-indirizzata-ai-comuni-italiani/ ljh34t.com ni96lyric.com rmabellebaileeamelia.com # https://www.cert-pa.it/notizie/possibile-nuova-campagna-ftcode/ ceal.embracealegacy.com chas.chasingredford.com city.giveono.com dbi.willjohnson.net dhol.rkeindustries.net home.aphistoryonline.com indu.rkeindustries.com info.rancholacolina.info info.rkeindustries.info jays.meganjohnson.net john.jzinky.com just.justabunchofjeeps.com justabunchofjeeps.top ken.kenworthreevesjr.com ketw.chesapeaketw.com kind.its1ofakind.net more.moreyogatx.com next.nextuptravel.com print.impress-screen-printing.com print.impresscreenprinting.com ride.rideswithoutsaddle.com wenwens.top # https://www.cert-pa.it/notizie/nuova-campagna-di-diffusione-sload-veicolata-tramite-pec/ military-colors.com obawom.eu pcera.eu # https://www.cert-pa.it/notizie/scoperta-una-nuova-variante-di-adwind-jrat/ leopardcoat.live rootsec.publicvm.com smiles4turner.ddns.net # https://www.cert-pa.it/notizie/massiva-campagna-via-pec-diffonde-ftcode-con-nuove-funzionalita/ agvlmtkxmdq0.top ahmwmtkxmdq0.top amq1mtkxmdq0.top anna.annacarian.com aspire.choose-aspire-inspire.com band.positivelifeology.com bss.cruisecouns bsspta.com bsspta.org bxfmmtkxmdq0.top caral.caralondonthomas.com ch.catherineschepise.com cruisecounsel.com denni.drkko.com denni.livingonpurposeplanner.com denni.positiveparentology.com ehuxmtkxmdq0.top etatic.nexilia.it food.foodforthoughtkids.com food.kkphd.com jestersofnewyork.com life.thegoodlifeplanner.com live.investtoimpressclub.com live.positiveparentingpath.com mobi.confessyoursins.mobi mobi.slipacard.com resp.respectandacceptdiversity.com stats.thomasmargiotti.com surv.surviveandthriveparenting.com thomasmargiotti.com whoi.whoisyourhero.com # https://www.cert-pa.it/notizie/campagna-malevola-riferimenti-agenzia-delle-entrate/ agenziaentrate.icu agenziaentrateinformazioni.icu agenziainformazioni.icu # https://www.cert-pa.it/notizie/continua-la-campagna-ransomware-ftcode-in-italia/ abs.jestersofnewyork.com bss.bsspta.org pta.bsspta.com # https://www.cert-pa.it/notizie/massiva-campagna-di-phishing-veicolata-su-pec-con-finti-riferimenti-a-fatture-firmate-p7m/ a1ablerooter.com bottlecaprecording.com dreambabyyorkies.com pattayajcb.com # https://www.cert-pa.it/notizie/rilevata-variante-del-ransomware-ftcode/ abby.abbyehughes.com bill.billfergerson.com cdn.secure357.com cdn.unitycareers.com ceco.heritageins.co ceco.heritageinsuranceagencies.com ceco.jasonrsheldon.com ceco.jestersofny.com ceco.myheritageins.com connect.heritageagencies.com kati.katieebecker.com power.cnyboypower.com power.hagertyquote.com # https://www.cert-pa.it/notizie/campagna-ransomware-ftcode-veicolata-in-italia/ aweb.theshotboard.info cofee.theshotboard.net connect.hairsalonlongmont.com connect.simplebutmatters.com connect.southerntransitions.com donald.tilmonday.com geer.longmonthairsalon.com getpdfreader.13stripesbrewery.com getpdfreader.lilupicks.com home.artdietfitness.com home.goteamrob.com home.healthiestu.com home.hopedaybook.com home.isdes.com home.ktxhome.com home.mmaut.com home.parkandhome.com home.selltokengarff.com home.southerntransitions.net home.tith.in my.mylifeamongthewomen.com twitter.crtcostruzionisrl.com # https://www.cert-pa.it/notizie/botnet-smominru-continua-la-diffusione/ bee12.bumblebeeservers.com csrs.exe down.1226bye.pw fra.gamesoxalic.com ftp.0603bye.info garrafa8.itaucredicard.tk grinknowledge.com item.dat js.1226bye.xyz lsmm.exe max.exe msief.exe msinfo.exe ok.exe pc.pc0416.xyz server.triangleww.com u.exe ups.exe upsupx.exe wmi.1217bye.host.d20.xtrmserver.com worldsender.info wpd.jpg # https://www.cert-pa.it/notizie/emotet-riprende-le-operazioni-di-malspam/ 86passion.vn aardathdelivery.co.zw abidjanboutik.com aboyehia.com agungwaluyaproperty.com aisect.org albintosworld.com alertaempresarial.com.br alldc.pw ametiseclinic.com animex.global armstrongfieldconsulting.com atnimanvilla.com autorepuestosdml.com avaagriculture.com aydin-transfer.biz.tr azure-team.com behlenjoiner.com bestrip.telkomuniversity.ac.id biyunhui.com blnautoclub.ro blockchainjoblist.com blog.batalk.fun blog.haseemajaz.com blog.kobisi.com blog.lasoy.net bondagetrip.com bonvies.com broadpeakdefense.com canvas.printageous.com careervsjob.com chinapacific.co.nz chuquanla.com customernoble.com danangluxury.com datasoft-sa.com dateandoando.com datvensaigon.com ddhf.in dedicado02.tchile.com deepikarai.com dentalsearchsolutions.com dewibebaris.com dialogchelm.pl digsneil.info duckiesplumbing.com.au dunlopillo.com.vn dywanypers.pl efobf.net emmabeaulieu.com emranweb.net enticapilates.co.uk entrevisionarysolutions.com etechnepal.com ethecal.com examsnap.io farnamh.ir floydology.online gardenandmore.co.il gcesab.com globaltimesnigerianewsmag.com gongdu.xin greenedus.com hanifbaba.com haosanwang.com.tw hierba-buena.com hippbeta.000webhostapp.com hisnherunisexsalon.co.in holyurbanhotel.com hotline2heaven.com i-conglomerates.com icbchins.com iewa.sk iib123.com ilyalisi.com indieconnectads.com inwil.com jackalopesoftware.com joshgeneralremodeling.us jumpman.com.tw kattegattcenter.se keikomimura.com keqiang.pro kisharzoni.ir kolaysigorta.co kursusdigitalmarketingmalang.com lecairtravels.com levarudevich.ru life-consulting.org limkon.com lindasamson.com lmntriximinds.000webhostapp.com m-r2.th.seeweb.it maxtraderpro.com mobiextend.com modireit.com mohsinsaeedulhaq.com mumbaifever.com mutlukadinlarakademisi.com nautcoins.com navenpsicologosgetafe.es organizersondemand.com ortambu.net osim-heshbon.co.il ostriwin.com parishadtoday.com parsafanco.com pep-egypt.com perfume-dubai.com pklgroup.pl playasrivieramaya.com profexsystem.com purnamahotel.id purplekushop.com ragulars.com richhouse.com.vn rockstareats.com rpaconsultores.cl sachoob.com safarnavade.ir sazehatv.com schultecattlequip.com shu.cneee.net solivagantfoodie.com sotelo.cl souzaeletronicos.com.br sp2secenter.com standstrongbuilders.co.nz starbolt.eu studiovista.fr sunchipaint.com.vn sunnypalour.com tabxolabs.com techcitybd.xyz think1.com thinktobehappy.com thousandideaz.com tootco.ir unitypestcontrolandservices.com vaner.com.sg vemalandsafaris.com vip.muabannhanh.com vpdv.cn wallsorts.co.nz webuycellular-radio-rf-testers.com whatansu.lt whichwaymind.com womenempowermentpakistan.com xn--9y2b19kb1eutan3r1zggxaw2wfxc.net yardcommunity.org yeuquynhnhai.com # https://www.cert-pa.it/notizie/ursnif-veicolato-tramite-false-fatture-dhl/ bateshkeeutgv.best fileouya.xyz # https://www.cert-pa.it/notizie/nuove-feature-e-nuovi-target-per-purple-fox/ jeitacave.org nw.brownsine.com zopso.org # https://www.cert-pa.it/notizie/diffusione-sload-via-pec-rivolta-a-privati-e-professionisti/ butchscorpion.com carpediem123.com clutchmagazine.com dreamacinc.com famebite.com fanaaru.com ghettoaffiliatemarketing.com interloc-tp.com iumju1.eu jonwilliam.com kd5ndz.com memoriesmadelb.com rdtber.eu uilomiku.eu # https://www.cert-pa.it/notizie/campagna-di-malspam-per-la-diffusione-del-malware-astaroth/ 2d2f292edab1628d5ca24f4df9f2279c.cloudflareworkers.com 48jy84235198b21f7873078899cf5b.cloudflareworkers.com 13023071da82751cf504af85aa406cd0.cloudflareworkers.com xsw2525f447788e131469.cloudflareworkers.com # https://www.cert-pa.it/notizie/campagna-di-malspam-per-veicolare-trickbot/ jaquetas01.cordenadorltda.org services.halapar.org # https://www.cert-pa.it/notizie/orcus-rat-e-revenge-rat-codice-aperto-e-feature-anti-analysis/ qstorm.chickenkiller.com skymast231-001-site1.htempurl.com # https://www.cert-pa.it/notizie/rilevate-evidenze-di-nuova-variante-nanocore-rat-disponibile-gratuitamente-sul-dark-web/ alburgas.hopto.org donpanch1965.duckdns.org emanichikli.duckdns.org # https://www.cert-pa.it/notizie/quasar-rat-nuova-campagna-phishing/ 0x21.in 1xv4.com falconhackers.no-ip.org microhost.hopto.org sockartek.icu toptoptop1.online toptoptop1.site # https://www.cert-pa.it/notizie/nordvpn-gli-hacker-utilizzano-un-sito-web-fake-per-veicolare-trojan-bancari/ android-power.space clipoffice.xyz dns-master.club invoicesoftware360.xyz juster.icu munsys.icu nord-vpn.club normpost.club sync-time.info # https://www.cert-pa.it/notizie/ondata-di-malspam-con-finte-sentenze-legali/ asksuze.com doctorsoffice4u.net gastrogirlresearch.com gastrogirlstudios.info gastrogirlstudios.net gastrogirlstudios.org gihealthrecord.net gihealthrecord.org gihealthrecords.com gihealthrecords.info gihealthrecords.net telecareteam.com vregbqeg.com # https://www.cert-pa.it/notizie/clipsa-il-malware-che-tenta-di-carpire-le-credenziali-amministrative-di-wordpress/ besttipsfor.com chila.store globaleventscrc.com ionix.co.d mahmya.com mohanchandran.com mutolarahsap.com northkabbadi.com poly.ufxtools.com raiz.ec rhsgroup.ma robinhurtnamibia.com sloneczna10tka.pl stepinwatchcenter.se topfinsignals.com tripindiabycar.com videotroisquart.net wbbministries.org # https://www.cert-pa.it/notizie/nuova-campagna-gootkit-tramite-jasperloader-verso-le-pp-aa/ deescreationstore.com deessolutionsdemo.com drive.deescreationstore.com fattura.recsinc.com kope.deessolutionsdemo.com # https://www.cert-pa.it/notizie/campagne-di-malspam-con-varianti-di-trickbot-ai-danni-della-pa/ altxcode.com amaritshop.com bluesky.press brothersoflondon.com eventwedding.dp.ua moissanitevietnam.vn nebula-business.com penpilot.net smartcell.co.in telkom.online tesiasquad.eu thequickreply.in u2215874.ct.sendgrid.net # https://www.cert-pa.it/notizie/nuova-campagna-di-diffusione-sload-via-pec-rivolta-a-privati-e-professionisti/ duratryamtrd.com mnn333.com uertw.eu weqevrt.eu # https://www.cert-pa.it/notizie/campagna-gootkit-tramite-jasperloader-verso-pubbliche-amministrazioni/ calc.1407cty13pec.com fattura.directionalforcedrive.com koh.191northfront.com lucky.majorleaguepub.com me.karysmarie.me otnhmtkwnz.top # https://www.cert-pa.it/notizie/variante-dropper-ursnif/ 1298367542.xyz outlowupdt.info # https://www.cert-pa.it/bollettini/dropper-ursnif-con-form-vba-e-limitato-al-mese-di-giugno/ 48727711.xyz fundoluyr.fund # https://www.cert-pa.it/notizie/malspam-sfrutta-falla-in-equation-editor-per-colpire-target-europei/ bathandbedlinen.com begurtyut.info bobbyworld.top chunan-cn.co delegatesinrwanda.com deserv.ie foreverprecious.org infos-acouy.net josephalavi.com modestworld.top tfvn.com.vn timelinetravel.co.za # https://www.cert-pa.it/bollettini/campagna-sload-indirizzata-a-pec-dellordine-degli-ingegneri-di-roma/ awrvip.eu berkeleytaylorconsultants.com condosforrentinorlando.com consciousrevolutionist.com easthamorg.com firstchoicebarhire.com implantrefer.com invicta-osrs.com jhkfhbfr.eu kofeservis.com larvooper.me moresaleswithai.com mtgrush.com myvahine.com nvshenye.com nycloot.com olxtree.com petperksandstuff.com phunctions.com safariarmy.com sharkfuckers.com ta-meyer.com techlobby.com thecannabismarketer.com thetomatokitchen.com webberwebsites.com webshops-linux.com worker.compemployersolutions.com # https://www.cert-pa.it/notizie/nuova-campagna-gootkit-veicolata-sulle-pec-italiane/ it.goodvibeskicking.com tru.cheersportacademy.com # https://www.cert-pa.it/notizie/campagna-phishing-rimborso-canone-rai/ area-inviotelematico.info richieste-telematiche.info # https://www.cert-pa.it/bollettini/campagna-di-malspam-ursnif-con-steganografia-verso-pec-italiane/ eloiyus.site nuovalo.icu # https://www.cert-pa.it/notizie/false-comunicazioni-inail-veicolano-il-malware-gootkit-via-pec/ adm.esurf.info sad.childrensliving.com skofirm.biz space.4fallingstar.info # https://www.cert-pa.it/notizie/campagna-di-ransomware-gandcrab-5-2/ kakaocorp.link # https://www.cert-pa.it/notizie/massiccia-campagna-gootkit-con-target-italia-veicolato-via-pec-e-peo/ ami.regroups.net call.diminishedvalueutah.com cash.andreachiocca.com cloud.chachobills.com cloud.diminishedvaluecalifornia.com salsa.recluta.in # https://www.cert-pa.it/bollettini/campagna-di-malspam-gootkit-indirizzata-verso-pec-italiane/ cdn.zaczvk.pl cloud.kokoheadattorney.com meenwae.top ws.diminishedvalueoregon.com # https://www.cert-pa.it/notizie/variante-del-dropper-vba-e-powershell-che-utilizza-steganografia/ okkolitalia.info # https://www.cert-pa.it/notizie/packer-vb6-usato-per-veicolare-il-malware-pony/ king-businesssell.top # https://www.cert-pa.it/notizie/analisi-del-malware-remcos-veicolato-tramite-packer-delphi/ billionaires.hopto.org pekniecza.hopto.org # https://www.cert-pa.it/notizie/massiva-campagna-ursnif-il-dropper-esclude-12-paesi-dallinfezione/ ollol.pro slfpagto.info # https://www.cert-pa.it/notizie/analisi-gootkit-nel-mirino-60-domini-italiani/ it.bikescout24.cloud villa.villamaremma.it # https://www.cert-pa.it/notizie/ursnif-nuova-ondata-di-malspam-colpisce-utenze-italiane-e-pp-aa/ delegirato.pro lilipili.xyz # https://www.cert-pa.it/notizie/phishing-ai-danni-di-clienti-aruba-indirizzato-alle-pubbliche-amministrazioni/ courriel.patinfoservices.info #https://www.cert-pa.it/notizie/pagine-di-phishing-ospitate-su-cloud-microsoft/ s4egy.com ## checkpoint # https://research.checkpoint.com # https://research.checkpoint.com/2021/indigozebra-apt-continues-to-attack-central-asia-with-evolving-tools/ 6z98os.id597.link cdn.muincxoil.com dcc.ungov.org help.2019mfa.com hwyigd.laccessal.org index.google-upgrade.com infodocs.kginfocom.com m.usascd.com mofa.ungov.org ns01-mfa.ungov.org ousync.kginfocom.com post.mfa-uz.com tm.2019mfa.com update.ictdp.com uslugi.mahallafond.com # https://research.checkpoint.com/2021/uyghurs-a-Turkic-ethnic-minority-in-china-targeted-via-fake-foundations/ icislieri.com malaysiatcahf.org officemodel.org tcahf.org unohcr.org # https://research.checkpoint.com/2021/melting-ice-tracking-icedid-servers-with-a-few-simple-steps/ aswenedo.space formgotobig.top ponduroviga.top tranmigrust.club # https://research.checkpoint.com/2021/irans-apt34-returns-with-an-updated-arsenal/ sarmsoftware.com # https://research.checkpoint.com/2021/clast82-a-new-dropper-on-google-play-dropping-the-alienbot-banker-and-mrat/ balabanga90.online blakarda.site boloklava87.club dsfikj2dsfmolds.top enegal-23.net sponkisn.site # https://research.checkpoint.com/2021/going-rogue-a-mastermind-behind-android-malware-returns-with-a-new-rat/ bald-panel.firebaseio.com hawkshaw-cae48.firebaseio.com phoenix-panel.firebaseio.com spitfirepanel.firebaseio.com # https://research.checkpoint.com/2020/bandook-signed-delivered/ 2ndprog.monster branchesv.com d1.p2020.club d2.p2020.club ec2.mbcde.net ercuc.com ewsdocs.com horizongb.com htname.info idcmht.com jtoolbox.org mainsrv.top mxtms.com nopejohn.com ntsclouds.com olex.live p2020.xyz pronews.icu raysdoor.com s1.fikofiko.top s1.megawoc.com s2.fikofiko.top s2.megawoc.com s3.fikofiko.top s3.megawoc.com styleco.me tancredis.com vdscloud.net vsimperial.com # https://research.checkpoint.com/2020/rampant-kitten-an-iranian-espionage-campaign/ afalr-onedrive.com afalr-sharepoint.com alarabiye.net cpuconfig.com developerchrome.com endupload.com exemplifiable-taps.000webhostapp.com firefox-addons.com gradleservice.info mailgoogle.info picfile.net tbackup.000webhostapp.com telegrambackups.com telegrambots.me telegramco.org telegramdesktop.com telegramreport.me telegramup.com update-help.com vareangold.de winchecking.com # https://research.checkpoint.com/2020/exploring-qbots-latest-attack-methods/ asn.crs.com.pa backup.justthebooks.com callunaconycatcher.com centr-toshiba.by cersomab.com chs.zarifbarbari.com factory-hot.com fortinet-cloud.com frankiptv.com kiesow-auto.de klubnika-malina.by marokeconstruction.com.au requirejscdn.com test.africanamericangolfersdigest.com # https://research.checkpoint.com/2020/new-joker-variant-hits-google-play-with-an-old-trick/ gd-1301476296.cos.na-toronto.myqcloud.com # https://research.checkpoint.com/2020/the-return-of-the-bot-shop-crew/ pkalexeivic.com # https://research.checkpoint.com/2020/phishing-campaign-exploits-samsung-adobe-and-oxford-servers/ absoluteaesthetics.co.uk acornmagic.club activedomain53.com ankit-gupta.co.in beatanyinvestment.club bloggingthenews.com cbcvietnam.org codewithjustin.com cosmos.org.in dalelaganj.com espinozaweb.net flycloud.co.il getfasternews.com ghassociates.co.in heaccountabilitycollective.com iamkongu.com istern.co.il iyak.org.tr junestore.club kwentongnoypi.com learndigitalseo.com legaltax.in mrdigitalduniya.com popskill.net pretrendy.com rumahcendekiaunj.com t-email1.instantytpresence.com t-email1.ottawashowers.ca t.email1.samsung.ca tremplinedu.com vrpublicnews.com wpbasket.co.il ww.indoxxi.pl yourhindinews.com yournewstv.com zeriio.com # https://research.checkpoint.com/2020/naikon-apt-cyber-espionage-reloaded/ ajtkgygth.com bbs.forcejoyt.com blog.toptogear.com cpc.mashresearchb.com dathktdga.com dns.jmrmfitym.com dns.seekvibega.com kyawtun119.com kyemtyjah.com mon-enews.com n91t78dxr3.com news.nyhedmgtxck.com qisxnikm.com rad.geewkmy.com realteks.gjdredj.com rrgwmmwgk.com spool.jtjewifyn.com sugano.trictalmk.com wdrfjkg129.com # https://research.checkpoint.com/2020/lucys-back-ransomware-goes-mobile/ gapsoinasj.in ja0h12p14k.in jqeoq0r1hgf03ds.in q9120qwpsa.in # https://research.checkpoint.com/2020/threat-actors-migrating-to-the-cloud/ alaziz.in biendaoco.com raacts.in taxagent.gr # https://research.checkpoint.com/2020/covid-19-goes-mobile-coronavirus-malicious-applications-discovered/ app.spnewsource.com corona-apps.com coronaviruscovid19-information.com # https://research.checkpoint.com/2020/breaking-through-windows-defenses-analysing-mlnk-builder/ native-one.com s-c.live # https://research.checkpoint.com/2020/google-play-store-played-again-tekya-clicker-hides-in-24-childrens-games-and-32-utility-apps/ api.banzinc.xyz api.chauxincaidomainnua.icu api.felinae.icu api.kaluga.xyz api.leopardus.xyz api.lulquid.xyz api.mantaalfredi.icu api.maygaiproduct.icu api.megapelagios.site api.molatecta.icu api.namekitchen9.xyz api.nhudomainuong.xyz api.pantanal.xyz api.royalchowstudio.xyz api.somniosus.xyz api.sundaclouded.host api.whitewhalestudio.host app.slardar.icu waws-prod-dm1-033.cloudapp.net # https://research.checkpoint.com/2020/vicious-panda-the-covid-campaign/ bmy.hqoohoa.com bur.vueleslie.com compdate.my03.com dw.adyboh.com feb.kkooppt.com jocoly.esvnpe.com wind.windmilldrops.com wy.adyboh.com # https://research.checkpoint.com/2020/android-app-fraud-haken-clicker-and-joker-premium-dialer/ bearclod.com # https://research.checkpoint.com/2020/the-turkish-rat-distributes-evolved-adwind-in-a-massive-ongoing-phishing-campaign/ 12724.xyz 15438.xyz 21736.xyz # https://research.checkpoint.com/2020/warzone-behind-the-enemy-lines/ warzone.io warzone.pw warzonedns.com # https://research.checkpoint.com/2020/predator-the-thief/ 15charliescene15.myjino.ru axixaxaxu1337.us btcinvest.company denbaliberdin.myjino.ru haijiangfriut.com j946104.myjino.ru kent-adam.myjino.ru kristihack46.myjino.ru madoko.jhfree.net sayhello.host u96191l2.beget.tech # https://research.checkpoint.com/2020/phorpiex-arsenal-part-i/ aiiaiafrzrueuedur.ru b0t.to fafhoafouehfuh.su ffoeefsheuesihfo.ru ouhfuosuoosrhzfzr.ru slpsrgpsrhojifdij.ru thaus.to thaus.top unokaoeojoejfghr.ru # https://research.checkpoint.com/2019/in-the-footsteps-of-a-sextortion-campaign/ osheoufhusheoghuesd.ru ouhfuosuoosrhfzr.su # https://research.checkpoint.com/2019/the-eye-on-the-nile/ arabindex.info drivebackup.co el7rkaelsha3bea.ddns.net indexmasr.com indexy.org maillogin.live mailsecure.live servegates.com txtips.com weblogin.live # https://research.checkpoint.com/2019/cobalt-group-returns-to-kazakhstan/ kassanova.kz # https://research.checkpoint.com/2019/2019-resurgence-of-smokeloader/ alltest-service012505.ru babolgum.icu besttest-service012505.ru biotest-service012505.ru clubtest-service012505.ru domtest-service012505.ru esupdate.icu fileboard.live infotest-service012505.ru kupitest-service012505.ru megatest-service012505.ru mirtest-service012505.ru mostest-service012505.ru mypromo.online mytest-service01242505.ru mytest-service012505.ru newtest-service012505.ru proftest-service012505.ru protest-01242505.tk protest-01252505.ml protest-01262505.ga protest-01272505.cf protest-01282505.gq protest-01292505.com protest-01302505.net protest-01312505.org protest-01322505.biz protest-01332505.info protest-01342505.eu protest-01352505.nl protest-01362505.mobi protest-01372505.name protest-01382505.me protest-01392505.garden protest-01402505.art protest-01412505.band protest-01422505.bargains protest-01432505.bet protest-01442505.blue protest-01452505.business protest-01462505.casa protest-01472505.city protest-01482505.click protest-01492505.company protest-01502505.futbol protest-01512505.gallery protest-01522505.game protest-01532505.games protest-01542505.graphics protest-01552505.group protest-02252505.ml protest-02262505.ga protest-02272505.cf protest-02282505.gq protest-03252505.ml protest-03262505.ga protest-03272505.cf protest-03282505.gq protest-05242505.tk protest-06242505.tk protest-service01242505.ru protest-service012505.ru rustest-service012505.ru rutest-service01242505.ru rutest-service012505.ru shoptest-service012505.ru skcalladhellormi.xyz supertest-service012505.ru test-service01blog2505.ru test-service01club2505.ru test-service01dom2505.ru test-service01forum2505.ru test-service01info2505.ru test-service01land2505.ru test-service01life2505.ru test-service01plus2505.ru test-service01pro2505.ru test-service01rus2505.ru test-service01shop2505.ru test-service01stroy2505.ru test-service01torg2505.ru test-service01242505.ru test-service012505.com test-service012505.eu test-service012505.fun test-service012505.host test-service012505.info test-service012505.net test-service012505.net2505.ru test-service012505.online test-service012505.org2505.ru test-service012505.pp2505.ru test-service012505.press test-service012505.pro test-service012505.pw test-service012505.ru.com test-service012505.site test-service012505.space test-service012505.store test-service012505.su test-service012505.tech test-service012505.website test-service012505.xyz toptest-service012505.ru vinomag.pw vsetest-service012505.ru # https://research.checkpoint.com/2019/operation-tripoli/ aarasid.com clientstats.epss.org.ly drpc.duckdns.org kalifhaftar.blogspot.com libya-10.com.ly libyanews111.blogspot.com sirtggp.com # https://research.checkpoint.com/2019/danabot-demands-a-ransom-payment/ braksiolsa.top brekwinarew.site brukaisloap.club brukiloapos.xyz bruksialopws.icu demo.maintrump.org goskilindad.site gousikolka.space guksuoiew.top gustemiaksa.icu gustokiloe.xyz jklfsdkfjhwefjosdf.top jklfsdkfjhwefjosdf.xyz kadosjdoaaf6.pw kadosjdoaf6.pw kadosjdoafa.pw kadosjdoiafa.pw kaosjdoaaf6.pw kaosutdoaaf6.pw kaosutdoaaf.pw kdguwoewpew.pw kdosjdoiafa.pw kduwouewpew.pw kipokahynr.top kipokahynr.xyz lidaskiheg.site lidaskiheg.space lindakiski.top lnet4-data.com mon-sta.com muabolksae.club muoklaiow.xyz nautorern.xyz net4-data.com okjauwbueiws.top okjauwbueiws.xyz oneuisopeweh.icu onueilsndsuywe.xyz sfjskdjfwoiewwegroup.tech thegiksjoute.online thenautorern.tech # https://research.checkpoint.com/2019/finteam-trojanized-teamviewer-against-government-targets/ 1c-ru.net intersys32.com # https://research.checkpoint.com/2019/preamo-a-clicker-campaign-found-on-google-play/ res.mnexuscdn.com # https://research.checkpoint.com/2019/speakup-a-new-undetected-backdoor-linux-trojan/ Linuxservers.000webhostapp.com linuxsrv134.xp3.biz Speakupomaha.com # https://research.checkpoint.com/2018/kingminer-the-new-and-improved-cryptojacker/ a.1b051fdae.tk a.869d4fdae.tk a.qwerr.ga q.112adfdae.tk w.homewrt.com # https://research.checkpoint.com/2018/new-ramnit-campaign-spreads-azorult-malware/ 0959tg.dagestan.su 4b053f3c6a98.net ijoljjk.adygeya.su kioxixu.abkhazia.su net-info.info # https://research.checkpoint.com/2018/zooming-in-on-domestic-kitten/ appdevelopment-co.com appsoftupdate.com cartoonize-co.com cofe-clip.com hinews24.com mobileupdateapp.com nevisa-co.com updateprocesses.com wgtray.com wprmi.com # https://research.checkpoint.com/2018/the-emergence-of-the-new-azorult-3-3/ certipin.top infolocalip.com tohertgopening.com # https://research.checkpoint.com/2018/domestic-kitten-an-iranian-surveillance-operation/ Firmwaresystemupdate.com Georgethompson.space Ronaldlubbers.site Stevenwentz.com # https://research.checkpoint.com/2018/ceidpagelock-a-chinese-rootkit/ tj999.top # https://research.checkpoint.com/2018/vbetaly/ pagamentofattura.com # https://research.checkpoint.com/2018/apt-attack-middle-east-big-bang/ exvsnomy.club ezofiezo.website hitmesanjjoy.pro lindamullins.info namybotter.info namyyeatop.club sanjynono.website spgbotup.club # https://research.checkpoint.com/2018/de-anonymizing-monero-mining-operation/ flash2update.xyz flashdownload.club flashdownloadonline.xyz flashplay.club flashplayerr.club flashplayers.club osdsoft.com xtracker.club ztracker.club ztracker.gq ztracker.ml ztracker.xyz # https://research.checkpoint.com/2018/return-festi-rootkit/ 5cm.co.za ## cleafy # https://www.cleafy.com/resources/documents # https://www.cleafy.com/documents/teabot kopozkapalo.xyz sepoloskotop.xyz ## csirt-it # https://csirt.gov.it/contenuti # https://csirt.gov.it/contenuti/campagna-di-smishing-traccia-il-tuo-pacco-al01-210818-csirt-ita g62z.com hatonia.com l.linklyhq.com parcel-tracking-263273453452342x.ru v39c.com # https://csirt.gov.it/contenuti/campagna-di-phishing-a-tema-wetransfer-al01-210625-csirt-ita-2 auth-confirmation.austinbroadland.repl.co gethukshop.com orderlistconfimation.us-south.cf.appdomain.cloud tandcn.com # https://csirt.gov.it/contenuti/campagna-malevola-diffonde-agenttesla-sfruttando-una-nota-vulnerabilita-di-office-al01-210624-csirt-ita ck-t-hr.com # https://csirt.gov.it/contenuti/aggiornamento-campagna-lokibot-al03-210623-csirt-ita ctp1.xyz # https://csirt.gov.it/contenuti/email-di-phishing-invio-fattura-doc_-veicola-lokibot-al03-210618-csirt-ita it0b.xyz # https://csirt.gov.it/contenuti/botnet-moobot-sfrutta-vecchia-vulnerabilita-al02-210617-csirt-ita cyberium.cc # https://csirt.gov.it/contenuti/cryptbot-diffuso-tramite-siti-di-phishing-al01-210611-csirt-ita augalai.info morjgs02.top rarpc.co remexl25.top sulsxq03.top # https://csirt.gov.it/contenuti/nuova-versione-del-malware-freakout-al02-210609-csirt-ita 3og7wipgh3ruavi7gd6y3uzhcurazasln55hb6hboiavyk6pugkcdpqd.onion bp65pce2vsk7wpvy2fyehel25ovw4v7nve3lknwzta7gtiuy6jm7l4yd.onion.ws can6dodp.servepics.com cloud-miner.de ngiwge486ln9daoo.hopto.org o4hlcckwlbcy7qhhohqswpqla6wx7c5xmsvk3k4rohknng4nofvgz5id.onion p2l44qilgm433bad5gbszb4mluxuejwkjaaon767m5dzuuc7mjqhcead.onion q2p4b6pprex5mvzxm2xdqgo4q3hy2p4if2ljq7fcoavxvab7mpk232id.onion ublock-referer.dev # https://csirt.gov.it/contenuti/campagna-di-phishing-a-tema-agenzia-entrate-al01-210601-csirt-ita jules-castelao.fr # https://csirt.gov.it/contenuti/individuata-una-nuova-versione-del-ransomware-zeppelin-al02-210525-csirt-ita btcxchange.online # https://csirt.gov.it/contenuti/infostealer-raccoon-diffuso-tramite-versioni-compromesse-di-software-vpn-al01-210525-csirt-ita nordsecure.click nordsfreevpn.com vpn-nord.net vpnnords.com # https://csirt.gov.it/contenuti/campagna-malevola-impatta-le-utenze-di-banca-mediolanum-al01-210518-csirt-ita domande-controllo.com # https://csirt.gov.it/contenuti/nuove-campagne-diffondono-formbook-al01-20201023-csirt-ita 4006789517.com bchselfdrive.com chifaencalada.digital click2hr.com colonialtireandautomotive.com defigravity.finance globalescrowauto.com hotcountrystars.com hous12.com lmz.xyz reneebyzoe.com shgskit.com votecameltoe.com # https://csirt.gov.it/contenuti/campagna-di-malspam-invia-dridex-a-nome-di-intuit-al03-201022-csirt-ita 4code.se alcoa.fairwayconcierge.com ampcourses.com bangah.com bardenpumps.com.au camilanvanessa.memangbeda.website capek.buffaloonlinetest.co.uk cosmetic1.4code.se cygnilux.com dandaroadsideservicellc.com datarecoverservice.com davidakademia.hu davie.iservelendingconcierge.com demos.fairewebhost.com derek4333.com dev.connect865.com divey.com elranchomarkets.com eneosdemo.digitalcanali.com fashionatingworld.cn fastestnetwork.info fbomate.com fitnessserved.com helpingcause.com hokkaidoizakaya.id hotel72.com housenboldlaw.com hrroadlines.com ivanevtushenko.com.ua jgphotoart.com jphtrading.hu kimmiandco.tiemens.com.au malegazette.com manniondrilling.com.au minishp.com onlinebusinesspure.com onlinebusinessup.com opendigital.ru parkettbau-freyenstein.de propashop.mykedai2u.com ptfcatpal.com qualitycontaccenter.com radiosinus.hu refinanceworth.com renttoowncare.com saffronhotelalrigga.com shop1.4code.se speckauto.com stfcshop.com studentathlete.in tbcseguros.com.br toppedtravel.com twinpeak.iservelendingconcierge.com viihelp.com workedhome.com # https://csirt.gov.it/contenuti/nuove-evidenze-sulla-campagna-malspam-a-tema-inps-al01-201022-csirt-ita blogicompany.com linksystems.bar linksystems.casa log.technosolarsystems.net service.technosolarsystems.com systemlinks.casa windowclient.com # https://csirt.gov.it/contenuti/nuove-tecniche-per-diffondere-emotet-al01-201021-csirt-ita arifulhuq.com baltische-rundschau.eu bespokebysumitgrover.com beta.osjusa.org comercialadvance.com concrecasa.cl dailypharmajobs.com envirohubconsulting.co.za gapuragamapersada.com geoportal.rivasciudad.es grandages.org.my gymmuscle.tk leboutique-store.com myanmarlegalservices.com newtabletmall.com rossie.in royalnight.in static.rivasciudad.es sweet-diet.com techsama.com thedailysmile.com venompremiumshop.com wh-sh59.csloxinfo.com # https://csirt.gov.it/contenuti/campagne-phishing-rimborso-enel-al01-201020-csirt-ita enelrimborsoit.it # https://csirt.gov.it/contenuti/mirai-identificate-4-nuove-varianti-al01-201019-csirt-ita dotheneedfull.xyz lol.thezone.vip xyz.hxarasxg.xyz # https://csirt.gov.it/contenuti/nuove-evidenze-sulla-campagna-malspam-a-tema-inps-al01-201016-csirt-ita line.seemimigo.com link.tomshobbies.com # https://csirt.gov.it/contenuti/campagna-di-phishing-con-riferimento-a-istituto-di-credito-al04-201015-csirt-ita my-bnl-online-ssl-index-9876543.kozow.com mypanel.https443.org # https://csirt.gov.it/contenuti/aggiornamento-sulla-campagna-malspam-che-diffonde-ursnif-attraverso-una-finta-email-dellinps-al02-201014-csirt-ita log.lenssexy.com service.987images.com stats.wadadliphoto.com windowsclassic.co # https://csirt.gov.it/contenuti/nuove-evidenze-di-campagna-lokibot-al01-201013-csirt-ita pkl.xyz # https://csirt.gov.it/contenuti/13-applicazioni-malevole-nel-play-store-di-google-al03-201012-csirt-ita api.hdvideoplayer.top api.instragramvideodownload.top api.launcherfor.top api.privatemsg.top api.socialvideodownloader.top api.sportcounter.top api.supervideoplayer.top api.wallpaper4k.top t.lineranalysis.com # https://csirt.gov.it/contenuti/nuova-campagna-diffonde-lokibot-attraverso-una-falsa-copia-di-bonifico-al06-201009-csirt-ita pklz.xyz # https://csirt.gov.it/contenuti/campagna-di-phishing-con-riferimento-un-istituto-di-credito-italiano-al05-201009-csirt-ita skylarstetten.com # https://csirt.gov.it/contenuti/campagna-di-phishing-con-riferimento-a-microsoft-outlook-al04-201009-csirt-ita iko23.mw.lt # https://csirt.gov.it/contenuti/campagna-malspam-diffonde-emotet-tramite-falsi-certificati-medici-al02-201009-csirt-ita albasisgroup.com amongproject.it asmaraloka.com brycebrumley.com datvietquan.com famousdiagnosticcenter.com jubilantenterprise.com karlagaray.com thanhthatbadinh.com voguefitz.com # https://csirt.gov.it/contenuti/malware-veicolato-tramite-servizio-di-segnalazione-errori-di-windows-al01-201009-csirt-ita asia-kotoba.net yourrighttocompensation.com # https://csirt.gov.it/contenuti/aggiornamento-sulla-campagna-malspam-che-diffonde-ursnif-attraverso-una-finta-email-dellinps-al04-201008-csirt-ita line.republicpracticesolutions.com link.fixuppropertysolutions.com link.hybridcorehomescc.com link.republichealthresources.com service.eftformotherissues.com # https://csirt.gov.it/contenuti/il-miner-black-t-sfrutta-api-docker-esposte-al03-201008-csirt-ita teamtnt.red # https://csirt.gov.it/contenuti/campagna-malspam-diffonde-iceid-al02-201008-csirt-ita o7s3dv4.com # https://csirt.gov.it/contenuti/malware-distribuiti-tramite-un-servizio-web-lecito-al02-201007-csirt-ita italake.com ol.thezone.vip paste.nrecom.net # https://csirt.gov.it/contenuti/campagna-di-phishing-con-riferimento-ad-aruba-al01-201007-csirt-ita aruba-ordine43.de.cool brabra-dd.blogspot.com # https://csirt.gov.it/contenuti/slothfulmedia-un-nuovo-malware-al02-201006-csirt-ita qnglsmc.com sdvro.net # https://csirt.gov.it/contenuti/ttint-la-variante-di-mirai-sfrutta-due-0-day-dei-router-tenda-al02-201005-csirt-ita back.notepod2.com cnc.notepod2.com q9uvveypiB.notepod2.com uhyg8v.notepod2.com # https://csirt.gov.it/contenuti/nuova-campagna-malspam-distribuisce-il-malware-masslogger-al01-201005-csirt-ita akinitaviotias.gr kbolias.gr milebgd.mycpanel.rs suite.kpechios.gr # https://csirt.gov.it/contenuti/malspam-diffonde-ursnif-attraverso-una-finta-email-dellinps-al02-201002-csirt-ita gstat.securezal.com gstat.sloleaks.com line.hotelcabosanlorenzo.com link.fixuppropertysolutions.com log.whateverittakesdoc.org service.21stcenturyleadersawards.org stats.21stcentury-leadership.org web.plainfielddentalcare.com # https://csirt.gov.it/contenuti/individuate-nuove-versioni-del-malware-loda-rat-al01-201002-csirt-ita roodan888tools.atwebpages.com # https://csirt.gov.it/contenuti/identificate-e-analizzate-diverse-varianti-di-joker-malware-per-android-al01-200929-csirt-ita 2j1i9uqw.oss-eu-central-1.aliyuncs.com blackdragon03.oss-ap-southeast-5.aliyuncs.com blackdragon.oss-ap-southeast-5.aliyuncs.com fgcxweasqw.oss-eu-central-1.aliyuncs.com jk8681oy.oss-eu-central-1.aliyuncs.com laodaoo.oss-ap-southeast-5.aliyuncs.com n47n.oss-ap-southeast-5.aliyuncs.com nineth03.oss-ap-southeast-5.aliyuncs.com proxy48.oss-eu-central-1.aliyuncs.com rinimae.oss-ap-southeast-5.aliyuncs.com sahar.oss-us-east-1.aliyuncs.com # https://csirt.gov.it/contenuti/installer-windscribe-vpn-sfruttati-per-diffondere-njrat-bladabindi-al03-200928-csirt-ita gamezer1hack.sytes.net # https://csirt.gov.it/contenuti/attacco-fileless-veicolato-tramite-malspam-diffonde-modi-rat-al01-200928-csirt-ita mondns.myftp.org phix.es vanesaescribano.com # https://csirt.gov.it/contenuti/campagna-malspam-sfrutta-il-nome-dellorganizzazione-mondiale-della-sanita-per-veicolare-ursnif-al02-200925-csirt-ita gstat.sloleaks.com line.queensfurnitureoutlet.com link.giantfurnitureoutlet.com log.idealfurnituredirect.com sertificatkey.com service.idealfurnitureoutlet.com stats.idealfurnituregalleryny.com web.cindycrawfordgroup.com # https://csirt.gov.it/contenuti/nuove-campagne-malspam-che-distribuiscono-emotet-al01-200925-csirt-ita aahnaturals.net armahouse.com bitbenderz.com coolcomputers.info geisterhouse.com haniyyacrafts.com kanbonim.com konican.com ladsbarbearia.com lagera.com msmartyford.com namwasports.com safiullah.com tulyboutiquehouse.com # https://csirt.gov.it/contenuti/aggiornamento-sulla-campagna-malspam-a-tema-agenzia-delle-entrate-al02-200924-csirt-ita 1933peizi.com agenziaentrate.digital gestiondecorreo.info # https://csirt.gov.it/contenuti/emotet-individuati-nuovi-ioc-al01-200923-csirt-ita averyair.com drippglobal.com hulianwang114.com ixirhost.xyz priyamcollection.com querofornecedores.com weneedyourhelpnow.org # https://csirt.gov.it/contenuti/campagna-malspam-diffonde-ursnif-attraverso-una-finta-comunicazione-di-agenzia-delle-entrate-al01-200922-csirt-ita line.stopcollectionharassment.com link.stopcollectionlawsuits.com log.rstempler.com service.mymindmap.net stats.stopthecase.com # https://csirt.gov.it/contenuti/lucifer-il-cryptominer-espande-le-proprie-funzionalita-al02-200921-csirt-ita guyeyuyu.com qf2020.top qianduoduo.pw tyz2020.top # https://csirt.gov.it/contenuti/campagna-malspam-per-veicolare-emotet-a-utenti-italiani-al01-200921-csirt-ita girlgeekdinners.com marblingmagpie.com veccino56.com # https://csirt.gov.it/contenuti/mrbminer-nuovo-malware-infetta-database-mssql-al01-200918-csirt-ita mrbfile.xyz vihansoft.ir # https://csirt.gov.it/contenuti/nuova-campagna-malspam-diffonde-ursnif-attraverso-una-finta-email-dellinps-al04-200914-csirt-ita line.wedowindowsplus.com log.theziongroup.com service.eftformotherissues.com stat.healingwithtapping.com web.alicegrange.com web.fromtheeast.org # https://csirt.gov.it/contenuti/campagna-agent-tesla-nuove-evidenze-al01-200912-csirt-ita mail.hybridgroupco.com mail.mlibano.com.br # https://csirt.gov.it/contenuti/campagna-malspam-di-masslogger-sfrutta-fedex-come-esca-al02-200910-csirt-ita ftp.ayudasaudiovisuales.com # https://csirt.gov.it/contenuti/campagna-malspam-distribuisce-il-malware-dridex-al01-200910-csirt-ita pharmacy.binarybizz.com sweepegy.com # https://csirt.gov.it/contenuti/nuova-campagna-malspam-distribuisce-malware-mekotio-sfruttando-il-dominio-mef-gov-it-al01-200904-csirt-ita comprenderebbefiscale.eastus.cloudapp.azure.com sarebbeprovafiscale.southcentralus.cloudapp.azure.com sicurezza.southcentralus.cloudapp.azure.com tassacomprenderebbe.eastus.cloudapp.azure.com # https://csirt.gov.it/contenuti/catena-di-infezione-di-masslogger-bl01-200903-csirt-ita paninoteka.si # https://csirt.gov.it/contenuti/nuovi-ioc-della-campagna-di-phishing-che-sfrutta-il-nome-del-ministero-delle-infrastrutture-e-dei-trasporti-al02-200903-csirt-ita elanstudio.hu googlchrm.online # https://csirt.gov.it/contenuti/campagna-malspam-di-masslogger-usa-istituti-bancari-come-esca-al03-200901-csirt-ita milebgd.mycpanel.rs paninoteka.si # https://csirt.gov.it/contenuti/aggiornamento-sulla-campagna-di-trickbot-tramite-emotet-al04-200831-csirt-ita grzegorzkucharski.com karaz-sd.com king61tours.com # https://csirt.gov.it/contenuti/nuova-campagna-malspam-veicola-malware-lokibot-al03-200831-csirt-ita espaciointeriores.com.ar # https://csirt.gov.it/contenuti/nuova-campagna-diffonde-lemon-duck-sfruttando-lemergenza-covid-19-al03-200828-csirt-ita d.ackng.com lplp.ackng.com p.b69kq.com p.k3qh4.com t.amynx.com t.jdjdcjq.top t.zer9g.com t.zz3r0.com # https://csirt.gov.it/contenuti/nuova-campagna-malspam-diffonde-ursnif-attraverso-una-finta-email-dellinps-al01-200828-csirt-ita gstat.kangweid.com gstat.premiamo.com gstat.premiamo.eu gstat.secundamo.com gstat.secundato.com gstat.secundato.net gstat.securanto.com gstat.securanto.net gstat.securezal.com gstat.securezal.xyz gstat.securezzas.com gstat.securezzis.net gstat.sloleaks.com web.coryriley.com # https://csirt.gov.it/contenuti/nuova-campagna-diffonde-ursnif-sfruttando-lemergenza-covid-19-al03-200824-csirt-ita houunolu1.xyz # https://csirt.gov.it/contenuti/nuovi-riscontri-relativi-al-malware-emotet-ioc-aggiornati-20-08-al01-200820-csirt-ita digitalmarketingbloggers.com drshekharbiswas.com laibray.com logoonthego.com moinbariatrics.com pakgreenenterprise.com panaglobalschool.com proyectobayacu.com recuperaatupareja.com sac-serv.com srivenkateswarainfratech.com sungvalopkhongsam.com thichdirung.com zmgmedia.com # https://csirt.gov.it/contenuti/nuova-campagna-emotet-con-riferimenti-allambito-sanitario-al05-200813-csirt-ita cnoenc.com multiesfera.com nickkind.com nikolovmedia.com phrachudadhuj.com # https://csirt.gov.it/contenuti/false-email-dal-ministero-delle-infrastrutture-e-dei-trasporti-al01-200812-csirt-ita mitgovit.online # https://csirt.gov.it/contenuti/campagna-crime-che-fa-uso-di-allegati-rtf-malevoli-bl01-200811-csirt-ita officelog.org # https://csirt.gov.it/contenuti/individuate-295-estensioni-malevole-nel-web-store-di-chrome-al01-200810-csirt-ita fly-analytics.com # https://csirt.gov.it/contenuti/ursa-loader-contro-utenti-italiani-al01-200808-csirt-ita hse.com.bn # https://csirt.gov.it/contenuti/nuovi-riscontri-relativi-al-malware-emotet-al03-200807-csirt-ita aeroasia-interior.com # https://csirt.gov.it/contenuti/nuova-campagna-diffonde-ursnif-attraverso-un-finto-rimborso-di-pagamento-brt-al03-200805-csirt-ita fattnumdelordine.com statoffbal.com # https://csirt.gov.it/contenuti/nuova-campagna-di-malspam-distribuisce-jasperloader-e-ftcode-al02-200805-csirt-ita dropbox.lightsculpters.com files.lauragoes.com nmgymda2mjc.top z2uymda1mtk.top z2uymda2mjc.top # https://csirt.gov.it/contenuti/nuove-evidenze-di-campagna-agenttesla-al01-200805-csirt-ita mail.solivera.com # https://csirt.gov.it/contenuti/malware-pony-distribuito-ad-utenti-italiani-tramite-campagna-malspam-al01-200804-csirt-ita kboyud.com # https://csirt.gov.it/contenuti/finte-email-di-rimborso-finalizzate-al-furto-di-credenziali-al04-200731-csirt-ita ni4377260-1.web17.nitrado.hosting ni4377884-1.web13.nitrado.hosting # https://csirt.gov.it/contenuti/nuova-ondata-di-campagne-guloader-distribuisce-formbook-sfruttando-brand-dhl-al03-200731-csirt-ita fbdoskitryupanel.webredirect.org # https://csirt.gov.it/contenuti/nuovi-riscontri-relativi-al-malware-emotet-al02-200731-csirt-ita aci.serabd.com acinutrilife.com aeroasia-interior.com agacenter.ro agtrade.hu aistidafa.com alaksir.com alarmnet.ph alfaltda.cl almgaard.nl alpena.com.tr altimira.es ammonhair.nl anprax.com aperfectimage.pl arcapps.org ariefsetiawan.com arizonaonsale.com armadalecfc.com arpaco.com.pk artephatun.com.br asomevenar.org asrijeweler.com atelierbrasilia.com ative.nl atsyemek.com autohausgrund.de avitech.net.au backroom.co.nz badabadabingo.com basheijns.nl bdub.net beenakker.eu behnasan.com bendys.com.au bigblue.com.tr binaghetta.it bioklinika.lv biotunes.org birosthalittc.in blaha.pl bloodcreative.co.uk bloodink.com bloomncare.com blswlaw.com bluepulse.co.za bmfestas.com.br bodenstein.co.za boincathull.net bonstock.com booyamedia.com bosco.ch bosisio.net botamotocross.site boulderinn.com bouwer.cc brainora.com brandfish.co.uk brandsstudio.pk bratecbrt.com breedenandsilver.com bremessi.com.br briffe.com.br brightmega.com brightonrooms.co.uk brownshotelgroup.com bruset.no bryanbuchan.com bumirubber.com busesworldwide.org businsurance.nl byrdits.com byteresa.com c0140529.ferozo.com cabelectrical.com.au cagev.org cairocad.com cali.de cameronandswan.co.uk campanus.cz campdevanol.com camponovo.it campsbayviews.com cankofte.com carinebelzon.nl carlosmartins.ca casadorothea.com catamountcenter.org cathelest.com caygri.com cbi.com.eg ccsau.com cddvd.kz cebucoolstuff.com ceda.com.tr ceelen.nl centeklabs.com centreforitexcellence.com.au cgemtalent.com cghmedia.com chairsdirect.eu champlain1715.com chcquimica.com.br chmiola.net choweng.com chrisdior.com.au chrisgreenhalgh.co.uk chrisrambo.com chunkagency.com cimsjr.com cistilniservis-t530.com cittadivita.it cityplanter.co.uk clanwatson.co.uk classic-recipes.com classicpaint.net cleanbydesignllc.com clearcall.com cliftonsecurities.co.uk clinicavitalefsa.com.br closhlab.com clubyourlife.ca colemanco.com.au colfincas.com comars.sk comitware.de commercedusud.com compednet.com comprof.com.au compustate.com confricami.eu conilizate.com controll.cl controllchile.cl convert.gr copavflex.com.br coresite.ne.jp coruia.ro coulsongraphics.com cpmred.com crazymut.com creatrix.co.za criesagirl.com criminal23.de cryptosistem.hr cryser.com csds.ca cuadros.pe currantmedia.com cushionsandumbrellas.com cushman.net cwpfencing.co.uk cyberneticservices.in cybertech-it.co.za cygnuslabs.com dagda.es dailynetworks.com danaldea.ro dandbtrucking.com dandyair.com danirvinphotography.com daoisthealing.com darknova.eu databeuro.com davethompson.me.uk davidfetherston.com davidnemeth.com davidsgreen.net dealio.com.au defiteqazerbaycan.com deltacraft.ro demonesia.net demonpaintball.co.uk demu.hu denizyahci.com derksenwebid.nl designworx.co.nz detorre.es devaux.ch diecieventi.com digitalmind.pl dii.com.pk diprotelco.com directresponsegroup.com dishnchips.com ditec.com.my djeffries.com djhavoc.net docecreativo.com dockerydesign.com dogbluemedia.com dot2dot.com.my dotbenstar.co.uk dotmarket.rs doubledog.nl dralcalde.es drewmaughan.com dualstudio.com.mx duhallow.com duncanllc.com dunnriteplumbing.ca e-motiva.com eagleserver.org easywork.com.br eatspam.co.uk ebcsb.net eclosion.jp edandtrish.com edylawson.com.br efetiva.net.br ejder.com.tr ekramco.ir eldridgelondon.com elementalburn.com elevationadvertising.com elifmakina.net elisent.com eliteseobusiness.com elook.com.tw eltallerartistico.com emena.org empmtg.com empoderacomunicacion.pe engeserv.com.br enhancementtechnology.co.uk enkphilipsen.nl eno.si ensource.co.uk entouchgraphics.com eof.cat epicurius.com.br eragrup.ro err0r.dk especialdesign.hu espiraltravel.com essand.com etawala.com evaddesign.com ewingconsulting.com excelsiorlawpllc.com exeo.com exilum.com exprimidor.cl extelcon.com extremcopy.hu ezratisrael.org.il faccomputer.com faks.nl famaval.pt famaweb.ir fanatlanta.org fanction.jp fanda.co.ke faroholidays.in fashiondenver.com faulidi.com fenlabenergy.com ferafera.com ferienwohnung-malcesine.de fernandez-ulrich.cat fhcigars.com fiberdyneqatar.com fili.es filipesantos.com.br findesign.nl findio.co.ke finestones.dk finnigans.org.uk firman.com.au firstaid-redliv.dk fitsystems.com fizion.nl flamesofrichmond.co.uk flexitravel.com flgmedia.nl floow.co foodphotography.in foredeckmarine.com.au forestanalytics.net forexshifu.com francescoarzeni.it franelessac.com freelancerland.com frenchiesballooncreations.com.au fresu.ch frontlyeadinternationalschools.com fuertecaja.com function5.com.au galaenterprises.com.au gammapower.com.au gammatron.com.au gazedice.com geisterhouse.com geivoip.com genek.com geoav.cl geotechnic.co.uk gersonbranco.com.br giardinosullamaremma.it gironynavarro.com gjoweb.it global-ark.co.jp globaliaespacios.com goldenstatetow.com goldilockstraining.com goodbad.co.uk gooddogrescue.com gorestruly.com gptimers.com.au graduasi.com grafikos.com.ar grandautosalon.pl gravelrecords.com greatfxmedia.com greaudstudio.com grecoson.com greenvalleyschool.com gregemerson.com gregemmerth.com gregladen.com grieta.net groncrete.com groovability.nl groovyboove.co.uk grupoleferas.com gsiquick.com gtdesign.ch gtsouth.com guarany.net guariz.com.br gunesoluk.com gunesulkesi.com guppon.com guyn3.com gvits.co.uk haek.net hafder.com hamiltonslive.com hapaistanbul.com hatchdogs.com hazelfranks.me.uk hcfoods.com.au hcsnet.com.br hdsr.net healinghandsonthemove.com heartssetfree.org heemaalnews.com hegelito.de hellojohnwebb.com helpmegrowutah.org henkphilipsen.nl henseldesign.de herbanarts.com hercinovic.com herms.com hesa.co.id heyfoxcomic.com hguk.net hirken.com.au hitisland.com hitstation.nl hoelscher1.com hofhuistechniek.nl holhaug.com hollam.com hollowmoon.net homecables.net hoogveld-service.nl hostech.com.br hostmelodia.com.br houdevelt.com houseci.com howie23.org hshub.org huffpuff.com.au hwalek.com ibda.adv.br iberfoods.com icisa.cl iclebyte.com ico6.com idealli.com.br iensenada.cl ifcingenieria.cl ijselrijders.nl ikasp.se ikbenpink.be ikexpert.com illumin.org imaimax.com imammaliktetouan.com imaspro.com imdavidlee.com immediax.com immocop.ch inch.net incluschile.cl infohost.net.au infohub.com.pk ingelse.net inkarainbow.com interdentclean.com intere.com.br ipirangaonline.com.br irenicinternational.in irishcarsagadir.net itcnt.com.np jamarhomecareinc.com jawara.pro jetfuelcreative.com johnbrussel.nl jojofun.co.uk kaleembrothers.com kanchpurcity.com keasocial.com kecsfila.hu kellogic.com kellymorganscience.com kennol.pk kewcorp.ca kibrit.com.tr kiismedia.com konican.com kosses.nl kriomed.uz kustens.com kyesgroups.com labonni.com.br lakallehn.net laminingraphics.co.za lddb.org.pk leavell-photography.com ledvinaphotography.net lf-hj.cz librero.xyz likonifreighters.com lillethun.com limpio.ba logisafe.com.mx lojajosemar.com.br lokeshullamkecskemet.hu ltrybus.com luckybit.jp lupusalimentos.com.br macserwis.pl madlychic.com marisqueiraobarqueiro.pt mcgrafica.it mcomlhr.com mcsgroup.co mdk-physio.info meettheharrells.com meinhaarzauber.de meuambientedecoracoes.com.br mewolters.nl mifaingenieros.com misenar.com mitrausahacontrucion.com mjhl.com.mx modbecloset.com molco.cl monom.si mossfs.com.au muebleslostroncos.cl myhms.id najcosmetics.com nasim.hostlin.com netcorp.ec nettmart.com nevhangunduz.biz ngcdfkibra.go.ke niaayuningimandari.com nsds.hr nuwagi.com nypthealing.com omeryener.com.tr omkarcreative.co.in onourstyle.com optimus.com.sg originalone.ma orionexpresso.com.br orohass.com oshop.es ourplace.com.br overonedjs.com.br oxahaus.com paco.co.th palestina.gob.ec parvamusic.ir pastaciyiz.biz pattyprado.com.br paulancheta.com pck.ostrowiec.pl perfectprint.gr performanceactive.com perlahuelva.es pfuse.net philosopherswheel.com poskorea.kr puertosalsa.cl pushupimpex.com radiacaoweb.com.br rafamora.net ramirezllc.com ranking-site.de ravenproductionsltd.com redsolution.com.br renergyholdings.com renkegitim.com revistajanelavip.com.br rhinoplas.co.id riserproperty.com robotics.kinex11.info roshnijewellery.com rsplot.com.br rtisistemas.com.br ruateresaonline.com.br sacredscentsonline.com sagnosys.com saimission.org santyago.org sathobby.com scmasabacus.com scoenuganda.org sehahealth.com sertcom.net servicebras.com.br sfiromilos.gr sggogreenbags.com shadarabia.com sheilasteinfeld.com shivakunwar.com.np signworld.nl simulations.org sirthinks.com skeptic.za.org skpsoft.com slanacom.si slbqms.co.ls slideit.co.il slservicebd.com smarthub.ws smartlogo.com.br smashingcake.com smmboster.com softwarestore24.de sokouganda.net sourcetechno.com speakerrepairs.co.za spiidgas.com.br spindelaar.nl spitzertech.net stageone.dk standardcolours.com starrpromotions.co.uk stolkie.net streefkerk.be subforsanta.org sugarcoatedspider.co.uk suinfotech.net szoboszlorhinos.hu tarjetasas.com tcenteronline.com techhampton.com tecnofrota.net teploservis.info terichmir.com.pk tewoerd.eu tfosgroup.com tgmobile.es theebeautyspot.co.uk thesterlinggroup.org thoseweekendgolfguys.com tomjoosten.nl toprakmedia.com topsmartmobile.com torqueandtalk.com toutdoor.com.my trainingbodies.com tyronescleancredit.com uniaoabc.com.br uniteddatabase.net urbaneden.net urog.co.uk vaap.us valleyinsurancepro.com valorpresente.cl vandermade.eu vasinfo.com.br vemax.sk vidiantec.cl vipmein.com viportal.co vizpoets.com vizyonpr.com vonunger-representaciones.cl vpinversiones.cl vtff.ca w1glv.com w4icw.com wagls.com wak.co.ke waxtoncctv.com wedif.com werkhanden.nl whateverest.ch whenua.cl wind-dreams.co.uk wishesconcierge.com withdrake.com witje.be wormann.dk wtechsolution.com wwpayday.com yeichner.com yeumoitruong.vn ymdc786.com yumiwong.com yusufpaintings.com zakahlife.com zebracolor.fi zurfluh.net # https://csirt.gov.it/contenuti/nuova-campagna-ursnif-attraverso-finto-sollecito-di-pagamento-brt-al04-200728-csirt-ita gestioneinbizzotutto.com inviatotutoneladon.com # https://csirt.gov.it/contenuti/nuovi-riscontri-relativi-al-malware-emotet-ioc-aggiornati-28-07-al02-200728-csirt-ita arrd.ro artewebestudio.com azjones.info ballooneo.com bartboutens.nl bazarot.com bcpcircle.com bendys.com.au benluckman.com biglaughs.org billandroger.com biomayest.com shablingo.com ximboo.com yeichner.com # https://csirt.gov.it/contenuti/individuata-nuova-versione-del-ransomware-phobos-al01-200728-csirt-ita aaron.ug aleaiasko.ug alexliasko.co.ug alexliasko.ug backgrounds.pk band.pk bnixons.ug boundertime.ru dailyvideos.pk dgdfasddfs.ru evanhopping.com imobiles.pk jamshed.pk kanorkanor23.ru leatherlites.ug levitt.ug levitts.ug marcakass.ug marckapiksa.ug marketprice.pk micozup.ru myhostest.ug myhostiger.ug nvbcdfsvxcs.ug qd34g34ewdfsf23.ru qd34gf23.ru shopandpop.su skdjgfbsdkjbfns3423.ru sprakitiktitkitik2322225431.ru tarssdsfdfsdr23.ru time234wa234rper346465432.ug timebound.ug timekeeper.ug triathlethe.ug tribunal.ug uytgvhdfsdxc.ug vcxxzazxc.ug zaragoza.co.ug zaragozsa.ug # https://csirt.gov.it/contenuti/identificato-nuovo-framework-per-la-distribuzione-di-mata-bl01-200728-csirt-ita Mobielbankierenbetaalverzoek.live # https://csirt.gov.it/contenuti/formbook-contro-utenze-italiane 855v.net arbgh.com cookfrenzy.com didunmenye.com dinosaurlanddaily.com jrgqbs.com mailetcinc.com nuraniqq.com swankitty.com # https://csirt.gov.it/contenuti/nuovi-ioc-per-jasperloader-al02-200723-csirt-ita files.backroadboutique.com files.backroadboutique.info files.backroadboutique.net files.backroadboutique.us files.lauragoes.com files.orinb.com files.truxtunroad.com files.weeklywakeup.com mobile-refund.ca mobile-refund.fund new-grant-premium-accreditation.icu reality.relevelled.com webiiite.org wws.saltwatercrew.com # https://csirt.gov.it/contenuti/nuovi-riscontri-relativi-al-malware-emotet-bl01-200721-csirt-ita addahealingmusic.com beeba.io bnemati.ir dainiksomoy24.com metanor.gr musei.basilicata.beniculturali.it oraripersonale.metodoinforma.it postpolicy.it techyhint.com zahran-eg.com # https://csirt.gov.it/contenuti/nuova-campagna-di-lokibot-colpisce-utenze-italiane-al02-200717-csirt-ita colorlux.ro # https://csirt.gov.it/contenuti/attivita-di-scanning-per-sfruttare-vulnerabilita-citrix-al02-200714-csirt-ita hostwindsdns.com # https://csirt.gov.it/contenuti/compromissione-di-domini-su-infrastruttura-azure-al01-200712-csirt-ita 360stage.stahls.com a.eage.org aauw-ampostdoc.scholarsapply.org accessderm.aad.org acdadmin-tng.aia.org acsdonateadmintrain.cancer.org advanced.core.freeflow.xerox.com aem.herbalife.com ahbeardweb.microsoftcrmportals.com aicpasccm.aicpa.org am.us.rothschildandco.com analytics.donorperfect.net analytics.glamst.com api.elfcosmetics.com api.longbow.bonusxp.com apimcustomapi-dev.azure.chevron.com app.ahvoila.com applications.wirralccg.nhs.uk apps.fullertonhealth.com apps.invictusgames2017.com apps.technologydev.ihs.com architectuur.cibg.nl associate.myfortisonline.com autoattendantservicesqa.incontact.com automation.pg.com b2b.absoluteboardco.com b2bapi-service-acc.snelstart.nl b2btdc.pandora.net b2bws.julian-fashion.com beta-invited.slh.com beta.auic.org beta.pksinvest.com blog.codercamps.com blog.washingtonstem.org bmsazure.elas.uk.com booking.ramadadowntowndubai.com candidate.responsivehr.com cart.perseusacademic.com cb.us.stg.cloud.im ccc.blockshipping.io cdn02.empiretoday.com champions-d-content.generalmills.com chat.celcom.com.my chat.fnv.nl cine.naturgy.es cityofcalgarycmg.calgary.ca clouddp01.lamresearch.com cloudpilotsg.cloudatlasinc.com cloudsolvportal.synnex.com cmclouddpsgsin.autodesk.com cms.answersmediainc.com cms.facilitiessurvey.com connect.atslab.com connected.virginaustralia.com costwell.chevron.com create.cakesbyron.com dailysales.brownjordan.com dashboard.adsninja.com dashboard.boostup.com demo06.mediusflow.com demo.booktrack.com detectionapp.3m.com dev1.mdlive.com dev-cd-infocenter.ryder.com dev-oms-logistics.pvh.com dev.connectedservices.emerson.com dev.forsyteit.com dev.salesforce.integration.plex.com devagileblog.acuitybrandslighting.net devoddsapi.wallstreetenglish.com devpmforecaster.cbre.com doc.bootes.co docs.cms.orckestra.com drweb.commscope.com dvsm-uat.gsk.com dynamicsac.perficient.com easishare.bruker.com ecmcmg.broadinstitute.org ecom-qa-nl.bambonature.com elevate17.bittitan.com emergencyresponse.bristowgroup.com eperfectlaunchdev.optum.com es-stgics-avm.jll.com farmtoschoolmap.georgiaorganics.org findyourstyle.fisherpaykel.com fnmaxcmgdp.fanniemae.com football.swisslife.ch full-service-suite.ch game.autoshow.ca geaux.lsufoundation.org gettyclouddp1.gettyimages.com gifts-uat.unrefugees.org.au go.daymarksi.com greathallcontacts.flydenver.com hatchery.entrepreneurial-spark.com hippotalk.total.com icqa.skillsinsight.honeywell.com iknow.dr.cch.com.au inflightentertainment.sas.no inhabit-portal.arkadium.com innovapulse.innovasi.com internationalservicesstage.rrd.com iot-accelerator-dev2.ddm.iot-accelerator.ericsson.net iq.aecom.com itpolicies.ycp.edu leprdsccmdistpteuwest.lincolnelectric.com library.inthehand.com linode.hki.org login.ec.co loveisajourney.proflowers.com lti.intelequia.com m.macaronigrill.com mail.somersetcm.com map.carlgross.com maps.foundationcenter.org mclambda-devtest.cpsextsandbox.mayo.edu media.antenna.gr members.dotnetfoundation.org members.i.playboy.com members.ussvi.org microsoft.icertis.com mitanorifusa.com mobile-beacons.clearchannel.co.uk mobile.apply4housing.com mobile.hullcitytigers.com mobile.stratasys.com mossupport.mcd.com my.disciplesmade.com myaccount.scottish-enterprise.com myob-multi-dc-sit-singapo-cfs-v1.myob.com myusa.veinteractive.com nexarc1service.kemin.com nlgsccmconnect1.nationallife.com nucleus.robomateplus.com nw-b.ecolab.com ohmy.disneylatino.com old.deleteagency.com oneanalytics.capita-one.co.uk onesiteportal-stage.rrd.com onespie.spie.de op.elfcosmetics.com partners.honeygroup.co.uk pay.willassociates.co.uk peerwatch.complianceweek.com pfp-int.az-bots-gre-projets.viseo.com poc9.icertis.com portfolio.theglobalfund.org ppkpi.cbre.com prdmarep.udtrucks.com prepd-sitecore.solr.arm.com press.desigual.com prixmnbawards.musicnb.org prod.vallen.ca production.go-dove.com pspapimgmt-test.premera.com pwcs-grants.pwcs.edu qa.api.sapaccess.warnerbros.com qa.boh.com qaappcenterng.deloitteresources.com qcsampler.genpact.com quantumleap.pason.com quote.model.healthmarkets.com recommendations.govx.com referencement.levio.ca remote.packtech.dk returns.americas.pandora.net rldp.redlobster.com rmspecialstamps.com rss-prototype.bd.com s-sccmdp-cloud01.loandepot.com satisfaction.darty.com sccm-dp.acuitybrands.com sccmclouddp.providence.org scm.ordermanagement-test.maersk.com search.us.epg.toshiba.com secure.openenergymarket.com secure.web.powerapps.com seminario.iipe.unesco.org sensformer.cloud.siemens.com sessions.digitalwpc.com sfgateway-prod-east-api.carmax.com site.chopup.me sitgbapi.globalblue.com smartusw-sts.gep.com smoke1.remix3d.com spaspera.cloud.jci.com sportsfirstaid.redcross.org.uk sso-api-poc.mybswhealth.com stage.cleanwithkeystone.com staging-consulting-covid19.euromonitor.com staging.auth.idahopower.com staging.capturetech.com staging.ecofastensolar.com stagingcms.johnsoncontrols.com stgwww.ispeedyloans.com storelocator.dtc.newbalance.com storetool2.albertsons.com storetool.albertsons.com stpaul.partnerinhousing.com sts.hgem.com summary.batransfer.com survive.infocomm.org tastings.neudesic.com test-cbreitp.intrepid.cbre.com test.lark-it.com test.scandichotels.de testazure.drivetime.com testwebservices.hawaiianairlines.com tevatogostgrw.tevapharm.com tge.tradeglobal.com thevillagesatpinevalley.com thor.mdlive.com thweb-azure.teknikhuset.se tibco-service-dev.usga.org ticari.mercedes-benz.com.tr timesheets.cfed.org tra.g4s.com trace.accenthealth.com training.iverson.com.my training.trin.net tuap.teamusa.org uat.ovhq.msc.com uatstandby-www.cushmanwakefield.com uk.ziraat.turkline.com un1cdp01.uno.adt.bms.com uoncmgtst.newcastle.edu.au uopxcmg2.phoenix.edu usersapipre.vertele.eldiario.es v2.basic.net ve-service.genecards.org voar-tracking.volvo.com voyager-dev.kindred.com wiki.gibson.com wine.mydexrewards.com wisent.mitt.ru wisent.mosbuild.com wordpress-itec.azurewebsites.net xlcatlin.leopard-np.swissre.com zew-api.travelport.com # https://csirt.gov.it/contenuti/ursnif-veicolato-anche-tramite-file-word-al02-200708-csirt-ita 9ygw2.com 35lvt.com amehota2gfgh.com e9bja.com gofast22gfor.com ioyyf.com lets-drink.ru lha-sa.ru nix4e.com qumogtromb2a.com softson.ru vpsrating.top # https://csirt.gov.it/contenuti/phishing-per-la-diffusione-di-avaddon-al02-200707-csirt-ita tldrnet.top # https://csirt.gov.it/contenuti/nuova-email-di-phishing-dellagenzia-delle-entrate-veicola-ursnif-al02-200708-csirt-ita gstat.careinmexico.com gstat.peshtigodental.com gstat.sloleaks.com zdesigns-studio.net # https://csirt.gov.it/contenuti/campagna-ursnif-veicolata-attraverso-finto-messaggio-dhl-impatta-utenze-italiane-al01-200708-csirt-ita casevacenze2020top.com uncomfermed.com # https://csirt.gov.it/contenuti/nuovi-ioc-della-campagna-ursnif-agenzia-delle-entrate-al02-200707-csirt-ita gstat.sergiocilli.com line.winneratlaw.com # https://csirt.gov.it/contenuti/strongpity3-utilizzato-per-il-furto-di-dati app-system2-update.com apt5-secure3-state.com awe232-service-app.com cdn2-system3-secrv.com file3-netwk-system.com fileservingpro.com hostoperationsystems.com inhousesoftwaredevelopment.com mailtransfersagents.com mentiononecommon.com ms6-upload-serv3.com ms21-app3-upload.com ms-sys-security.com mx3-rewc-state.com network-msx-system33.com safecopydisk.com secure-upd21-app2.com service-net2-file.com state-awe3-apt.com syse-update-app4.com system2-access-sec43.com system2-cdn5-mx8.com upd3-srv-system-app.com upd8-sys2-apt.com upd32-secure-serv4.com upd-ncx4-server.com update5-sec3-system.com updt-servc-app2.com # https://csirt.gov.it/contenuti/campagna-di-malspam-distribuisce-formbook-al01-200705-csirt-ita cifcolorado.com easterncarryoutva.com kungwsdycommunicationtariffsuplier30mgh.duckdns.org yofdyk.com # https://csirt.gov.it/contenuti/finta-fattura-brt-veicola-il-malware-ursnif-al01-200703-csirt-ita lavorosubordinatosmartw.org # https://csirt.gov.it/contenuti/aggiornamento-campagna-di-malspam-che-veicola-avaddon-al01-200701-csirt-ita transip.digital # https://csirt.gov.it/contenuti/codice-malevolo-per-sottrarre-dati-di-pagamento-nei-metadati-di-immagini-al02-200701-csirt-ita ads-fbstatistic.com apilivechat.com bestcdnforbusiness.com bizrateservices.com cddn.site cxizi.net j-queries.com jquery-analitycs.com jqueryanalise.xyz koinweb.site lebs.site magentorates.com pixasbay.com sonol.site teamsystems.info towbarchat.com undecoveria.com webtrans.site wosus.site xciy.net xoet.site yxxi.net yzxi.net # https://csirt.gov.it/contenuti/aggiornamento-sulla-campagna-di-malspam-che-veicola-jasperloader-nuovi-ioc-01-07-al01-200701-csirt-ita documents.catherineschepise.com documents.cfmontessori.com documents.hopedaletech.com documents.olivasmarket.com mamontenius.club z2uymda1mtk.top # https://csirt.gov.it/contenuti/aggiornamento-sulla-campagna-di-malspam-di-ursnif-nuovi-ioc-30-06-al02-200630-csirt-ita 222.222.67.208.in-addr.arpa gstat.peshtigodental.com gstat.premiamo.com gstat.premiamo.eu gstat.secundamo.com gstat.secundato.com gstat.secundato.net gstat.securanto.com gstat.securanto.net gstat.securezal.com gstat.securezal.xyz gstat.securezzas.com gstat.securezzis.net gstat.securityguardlisting.com gstat.sloleaks.com line.ehrlum.com # https://csirt.gov.it/contenuti/malware-lucifer-sfrutta-vulnerabilita-critiche-per-impattare-i-sistemi-windows-al01-200628-csirt-ita gulf.moneroocean.stream pool.supportxmr.com qf2020.top yzzswt.com # https://csirt.gov.it/contenuti/campagna-sfrutta-tema-del-coronavirus-per-veicolare-bootkit-rovnix-al02-200626-csirt-ita 0077.x24hr.com alex.dnset.com bamo.ocry.com edge.microft.dynssl.com loge.otzo.com microft.dynssl.com ruclient.dns04.com # https://csirt.gov.it/contenuti/nuovi-ioc-relativi-alla-campagna-malspam-di-trickbot-al02-200625-csirt-ita memberlogin.cloud # https://csirt.gov.it/contenuti/campagna-malspam-di-masslogger-al02-200624-csirt-ita geohydroconsult.com klisa.com.tr opticaoptigral.cl # https://csirt.gov.it/contenuti/campagna-di-lokibot-colpisce-utenze-italiane-al01-200624-csirt-ita nnasout.com # https://csirt.gov.it/contenuti/nuova-campagna-agent-tesla-al02-200623-csirt-ita mail.protege.com.mx # https://csirt.gov.it/contenuti/campagna-massiva-jasperloader-veicola-ftcode-via-pec-al02-200618-csirt-ita documento.haileywilkinson.com documento.jescy.com documento.mialeeka.com documento.noothercouncil.com documento.selltokengarffhonda.com z2uymda1mtk.top # https://csirt.gov.it/contenuti/exploit-sfrutta-la-vulnerabilita-remote-code-execution-in-exim-mta-al01-200618-csirt-ita hostapp.be # https://csirt.gov.it/contenuti/campagna-spam-di-trickbot-sfrutta-il-tema-black-lives-matter-al01-200617-csirt-ita copsbiau.monster mnjcszrh.monster shmbidgp.monster vmrriktf.monster ygzggxeh.monster # https://csirt.gov.it/contenuti/attacchi-a-pulse-secure-vpn-al02-200615-csirt-ita anno1119.com host.cutestboty.com keepass.cutestboty.com # https://csirt.gov.it/contenuti/aggiornamento-sulla-campagna-di-malspam-di-ursnif-nuovi-ioc-17-06-al01-200615-csirt-ita gstat.peshtigodental.com gstat.sloleaks.com gstat.vmf216.com line.harpbyrequest.com line.monalisapizzeriasi.com line.orangetheorymb.com link.icloudcowboy.com # https://csirt.gov.it/contenuti/campagna-di-phishing-ai-danni-di-utenti-amazon-al03-200612-csirt-ita earnmoney.lk # https://csirt.gov.it/contenuti/identificata-apk-malevola-che-sfrutta-lemergenza-covid19-al04-200611-csirt-ita inps-forma.online inps-informa.website # https://csirt.gov.it/contenuti/aggiornamento-sulla-campagna-di-malspam-di-agent-tesla-al02-200611-csirt-ita mail.ductoslimpios.com.mx # https://csirt.gov.it/contenuti/campagna-di-malspam-distribuisce-agent-tesla-al01-200609-csirt-ita dextrotrading.com # https://csirt.gov.it/contenuti/continua-la-campagna-di-distribuzione-di-apk-malevoli-tramite-finti-siti-inps-al01-200608-csirt-ita comunicazioneinps.top # https://csirt.gov.it/contenuti/siti-di-phishing-ai-danni-di-istituti-bancari-italiani-al04-200604-csirt-ita aggiarnamentointesasanpaolo.com aggiorna-dati.info aggiornamento-updt.com aggiornamento.info appintesa.com assistenza-gruppoisp.com auitoaccessomail.com bpolsbloccare5333.com direttivasicurezza.online gruppointesaisp.info info-dati-020.com infodati-020.com infosecurepsd2mps.com intesa-sicura-cliente.com intesasanpaolo-it-login.com it-authentication-fcc-job-fcc.com it-jod-fcc-fcc-authentication.com m-cartablocco-unicreditonline-verificare.com nexi-aggiorna.com poste-it-pay-fcc-html.com poste-it-pay-fcc-jod-html.com poste-it-pay-fcc-jod.com poste-it-pay-fcc.com protocollo-poste-l1taliane.com protocollo-poste-ltaliane.com psd2intesaweb.com remissione-carta-isp.com riemissione-carta-isp.com security-fineco.com sicurezza-bancobpm.com sicurezza-web.cloud sicurezza-web.site sicurezzaaggiornamentiintesa.com sicuro-accesso.com stabilisci-nuova-sicurezza.com verificaisp.online web-dati2020.online # https://csirt.gov.it/contenuti/campagne-di-diffusione-del-trojan-bancario-ursnif-al01-200601-csirt-ita attenzione.hazlotumismapr.com client.seamospracticas.com gstat.couturefloor.com gstat.peshtigodental.com gstat.premiamo.eu gstat.secundamo.com gstat.secundato.com gstat.secundato.net gstat.securezal.com gstat.securezal.xyz gstat.sloleaks.com gstat.ylonnsalonchicago.com line.mbclegacyllc.net line.starlightgroupllc.com # https://csirt.gov.it/contenuti/nuova-versione-comrat-al01-200528-csirt-ita anger.scieron.com arinas.tk bedrost.com branter.tk bronerg.tk callsoft.mrbasic.com celestyna.tk ceremon.2waky.com crusider.tk davilta.tk deme.ml dixito.ml duke6.tk elizabi.tk eu-travellyta.dns-report.com foods.jkub.com ftp.callsoft.mrbasic.com ftp.ceremon.2waky.com ftp.fueldust.compress.to ftp.geraldic.zzux.com ftp.linear.wikaba.com ftp.mysterysoft.epac.to ftp.onlineshop.sellclassics.com ftp.robot.wikaba.com ftp.tower7.epac.to ftp.zebra.wikaba.com fueldust.compress.to geraldic.zzux.com hofa.tk hunvin.tk lakify.ml lindaztert.net linear.wikaba.com misters.ml mouses.strangled.net mysterysoft.epac.to nexus.x24hr.com onlineshop.sellclassics.com pewyth.ga pneumo.mooo.com progress.zyns.com razory.mooo.com robot.wikaba.com robotech.lflink.com sameera.gq sanitar.ml scrabble.ikwb.com showme.twilightparadox.com stager.ignorelist.com sumefu.gq tellmemore.4irc.com tower7.epac.to umefu.gq vefogy.cf vylys.com wekanda.tk zebra.wikaba.com # https://csirt.gov.it/contenuti/scansioni-massive-a-danno-di-siti-wordpress-e-vulnerabilita-individuata-nel-plug-in-ninja-forms-al02-200508-csirt-ita count.trackstatisticsss.com ws.stivenfernando.com ## darktrace https://www.darktrace.com/en/blog/ # https://www.darktrace.com/en/blog/crypto-botnets-moving-laterally/ lplp.ackng.com t.amynx.com # https://www.darktrace.com/en/blog/egregor-ransomware-gone-but-not-forgotten/ amajai-technologies.network drive.metallic.io # https://www.darktrace.com/en/blog/post-mortem-of-a-sql-server-exploit/ dropbox16.com # https://www.darktrace.com/en/blog/crypto-mining-on-a-dns-server/ Pool-hk.supportxmr.com # https://www.darktrace.com/en/blog/how-a-soc-team-neutralized-the-qak-bot-banking-trojan/ nerotimethod.com mywebscrap.com # https://www.darktrace.com/en/blog/apt-35-charming-kitten-discovered-in-a-pre-infected-environment/ apply-jobs.com cortanaservice.com ## eset # https://www.welivesecurity.com # https://github.com/eset/malware-ioc # https://www.welivesecurity.com/2021/06/10/backdoordiplomacy-upgrading-quarian-turian/ bill.microsoftbuys.com buffetfactory.oicp.io dnsupdate.dns2.us dynsystem.imbbs.in icta.worldmessg.com Infoafrica.top officeupdate.ns01.us officeupdates.cleansite.us pmdskm.top systeminfo.cleansite.info systeminfo.myftp.name systeminfo.oicp.net szsz.pmdskm.top updateip.onmypc.net web.vpnkerio.com winupdate.ns02.us freedns02.dns2.us intelupdate.dns1.us # https://www.welivesecurity.com/2020/09/30/aptc23-group-evolves-its-android-spyware/ cecilia-gilbert.com david-gardiner.website digital-apps.store javan-demsky.website linda-gaytan.website # https://www.welivesecurity.com/2020/09/10/who-callin-cdrthief-linux-voip-softswitches/ update.callercore.com # https://www.welivesecurity.com/2020/09/02/kryptocibule-multitasking-multicurrency-cryptostealer/ # https://github.com/eset/malware-ioc/tree/master/kryptocibule/ 2x6w4a4rpkc4im62qrsomw5cz7sh6xfwue6o2taasnzpj24emp2ytryd.onion 4awm6qxdepo4eezambtqy37glf3yfsqmffahdrftap52vnft7w6qjrqd.onion 4d5sfoijltk6ymy56zxn5kibkev2bqrtvofpgej5q5td3y23sa7ot6id.onion 4dtu3lxrpx6nn7snjovoc3ldiy4x67k7qsrgzftvkrttoqbwnsuirhqd.onion 4lb3ggyyldqrovgjn5muidit7lly26qysmhsvdvm7uxxor43r3trzeqd.onion 6m4ujiinnntagmvcr5xlrhprwo4ogynx5ermkb5g2tmogqmvl4jqg2qd.onion 6u7fbyoeztemm2x3eqqqmxdjnwcwr774omb357v575rdw6fbs6dsocid.onion 7qggtksfcrk67dhxf34ywqf5442cuitztvmpaufhu6mfi4vemid4ayid.onion 36ptmdeoog6cb7qga5mvg67xxsvjcztppvexzv7v3nh3v5ysrqpdoqqd.onion 372dwco4guzmbsxuzojpxu5szfonkxe5itnbscrq2j42rab2t2ncahyd.onion a3ejbleqwu5fyiwvjk5bgqtezpmun6j52bgutf7dhlnxb6k5oq4wycyd.onion a3345hiuizvtfyiyu7rrj7oz4rn5pams42sawmtznuvlxjdqlhfutoad.onion awmszp3t3zuni6f6stanp3zesiwdco4nekn34wauxxqbcztz74jxjgad.onion aydy72vlk4b43t6wqkrg2sijerykz5a7xpu3twpavurtfy6cr5yjnnad.onion braiqjhcq2by5ederrdm6phl5ibgaslr3whrwsiqjzqz2sopp4nixvid.onion eeg3ww3gtsq7ul7ovgrelurhahjtnuo5h6k7yivdbiab36qxhxuguvqd.onion eq4sd25kaavyspif2a72sa7zmdvwg7zzzwjxcfougqonrkcsd4gounyd.onion ev2awfjn4tsmeae3oiwiu2lndgxisnt66cclszqaiogymiwawebcvzid.onion ewecmdrizt7cbwi6d5lqdp2flm4xaxymhjfbfszay6zlwwmudsognhqd.onion fafo3thvdd74ogafpu6dqn6icsvyiphjda4kcspqkiiv2n76droolzqd.onion fyksdinxkx6k3wflss2smzpnfjmlj3xuy2sdfd5ardr6xaahkhtkxpyd.onion g67rpe6ii3fp2kcwsts5yfaiiprsa4kqfhycr2p3dsjqonwhhob3rnqd.onion geigbmqp356zfjfnc554dp4fs47x5wvyijhyqx27harlfpu42vrlprad.onion gg5nf65ygz7xlz4qjokmadu4lz6kykm7siuzmxv2dw36ft5oowizxyid.onion gjgdw2l7pup7ld3zkz3bftscffrmztsti2d355ekdc63f4bn27imohqd.onion gmfkr2hophk7quuedy2xtlydxo7wduofmpi3nbf7gzmg4cv3xuvgtyad.onion h3onjkbx25yjhvplvovqzp2tefp6hce3fo3cnakkxz3so2knvn6s6rad.onion iggd7l4zis6nypic7acmxtdoryc5laolmudcgiwtpzsg62v4vkxt6fid.onion ihki5r4vy5rhvhcjc6a2luebw7l3m5ahuxiail6wtsm5hrikbppdy5id.onion ixviwydgphadlbitfs3inizpeg674qycqlvnanoky7xpukrwtbafejyd.onion j3bp2a2ftceusjmsd2qz6htisf6uzcj4ngrx2exffur5wqe7mndtreqd.onion jay2ewakkvwfqhst3ug5q5fua5d7kcu5ecyrk4d5gbfhqlidmtiackqd.onion jhlkmmq4bvg5lncsllwfurwbymdtzdvkzpw7ruwdhyp4uadpwyz7yryd.onion jokcwtvo6t25g2oejfnmgztu6b6u2p3gmo2vgmc6vcewfsr2hlxwomad.onion k5fvnoaorhjem2yjoperd6lcdzev4y5xvz4nnc3x5tk2acyek56mamad.onion kiugtgblevzdc2srnvt7ldp2reuzdmjwkxwjugcofrpopsavqnynd7qd.onion klh6kylzhkerfgnosy3veygej3r7xrkwxpnzvfhjihc5hpz7oylaq4qd.onion kvekkvllgj35kmaa6oa63z6cexlqswtp2bfhddgupql3h4xlpj3mufqd.onion kw5z4ogvnhjxp2xllnset4iouho34romb5wsanoekwgzcem3uahoh3id.onion l6fio2skcgirpjnnwjyfw7i5b3lfvozkwnynrijutu5bergs4o7sgfad.onion loafhlyog55jtww2eqldflasnti7me64w4zoztqmik5oe4xyfiravxyd.onion mjevfcggupyf6o4tj3fgig7m6vf2xetsdev7rzjbxttwhl3uouar2kyd.onion mnuqin25leqrmfypizsieyo2h2ndegol5cmkdyqj7rkv7yv5uknlzmid.onion mtrwz36vndoar7iadv3qowefod5zmo3wz5iq2i63rpg266ysvo6frbid.onion ofsg5sib4xcikcczk7n73ypkd5uvzki57jiuj72ttg2hlrhpnwhaknqd.onion p32ug5tz2cgkk3sbclm7i6luoespolqq6v7dzldjwdpgxtm4h76zclyd.onion pckttjjykdykdk2os5smy4jk3t46nyqvqruch5xnnlh52yrt35wx5cad.onion pdsaqpznzqjy5t5myudk7odo37mu7g2olswaswhogrwglzk3iscbb2ad.onion pgejmpol56kkaa6xjjg3pkztkvwjoucqqdldrkka4ndaj467fr7jrgqd.onion ppbgauyt2evbm5xltxvmokoi4g5uh3wjdumudwlh2roxcodbl6ezzwqd.onion q5zwtdfoe2xr57jfik7pwmns3crjpx2ge6ibmrafjhqld64qyyk7tvyd.onion qdwmp4bjzvotdsyz326szvk4q3ftgtwyeoqsjyzywxw24y27n3z7mrqd.onion rlwryismmgjijryr55u5rqlbqghqvrwxe5qgxupuviyysxkky5wah6yd.onion sow4wrmh5xpwkdq775fouugrlizxjsmn4yyyoa7hckkyol4kjudhrwyd.onion svwwrxksrmg4ea5ndfrzurtixogdckqkx4bhodf2tkqpxnpmujggooyd.onion tkovkg2j6pigb6vnxfhfpg3n4w2fpegjnlrhgzwfvlt4wfspqiuqkxad.onion udnxk4aprzds7khgjsllgmo6hluicn2hibbhfih72csmoktksf3ky7qd.onion ufxmwdan67ml3t4637l6tgor7jdxxhm7xvdk2b2jexuu5unqvc3okbqd.onion uye4vspplkdvqlw3rjb7kvjwtwqictc5pepfxpdy3kifpxlwqhuhnaad.onion v6lajszeqfkt3h2nptorindpf3mow5p3thrx2vuqbqzbv3tjrcqmgdqd.onion vrfq4keuh6cx6hccue76emofi7ciitip3eqpe44mbnywamoi42wocsad.onion w2zvw33dab2vhk3pnyy5cmmybsvdwp7hgjwta4qoot57lsfxqpdbqpid.onion wsagl5qz3haptofnxyxayxxiyuomj6yqe4wruya6hyolohi7dux3ujqd.onion xouenzgjpkf6cfan5rrkbn27xe3shfnubchvnuztv2s2nnw4lpa2egqd.onion ysz2dvpvygiweaymzatzukaccvlhidkyw774ub2d77ibavelfoifgmqd.onion zcohozbt4gcrtbojiyukiza6q3gv4owz7sxrqmpvhd4bpczbnijlfnyd.onion znbyrqe4zrktft2kpwzb2ywx25k6exfdgxabky67csqado75364b2dad.onion # https://www.welivesecurity.com/2020/07/16/mac-cryptocurrency-trading-application-rebranded-bundled-malware/ # https://github.com/eset/malware-ioc/tree/master/gmera apperdenta.com cointrazer.com creditfinelor.com cupatrade.com latinumtrade.com licatrade.com maccatreck.com macstockfolio.com nagsrsdfsudinasa.com narudina.com repbaerray.pw stepbystepby.com trezarus.com trezarus.net # https://www.welivesecurity.com/2020/07/09/more-evil-deep-look-evilnum-toolset/ # https://github.com/eset/malware-ioc/tree/master/evilnum api.adobe.com.kz api.win640.com cdn.lvsys.com d2nz6secq3489l.cloudfront.net faxing-mon.best json.ama-prime-client.com # https://www.welivesecurity.com/2020/06/24/new-ransomware-uses-covid19-tracing-guise-target-canada-eset-decryptor/ covid19tracer.ca tracershield.ca # https://www.welivesecurity.com/2020/06/18/digging-up-invisimole-hidden-arsenal/ # https://www.welivesecurity.com/wp-content/uploads/2020/06/ESET_InvisiMole.pdf 153.re adstat.red adtrax.net akamai.sytes.net amz-eu401.com blabla234342.sytes.net mx1.be statad.de time.servehttp.com upd.re update.xn--6frz82g updatecloud.sytes.net updchecking.sytes.net wlsts.net # https://www.welivesecurity.com/2020/06/17/operation-interception-aerospace-military-companies-cyberspies/ # https://www.welivesecurity.com/wp-content/uploads/2020/06/ESET_Operation_Interception.pdf # https://github.com/eset/malware-ioc/tree/master/interception chuta.jp comnet.aev.com cwjamaica.biz km.wu.ac.th nic.mywire.org online.verzatec.com safebrowsing.gleeze.com sbsserv.camdvr.org servicediscovery.kozow.com w3.casacam.net # https://www.welivesecurity.com/2020/06/11/gamaredon-group-grows-its-game/ # https://github.com/eset/malware-ioc/tree/master/gamaredon abdurs.space abies.space actor-tv.ddns.net acutifolia.space addova.xyz advansed-template.site aganta.space alastari.xyz alenko.site alenko.website amarillio.space anadima.website apino.space araino.space arionda.space armita.space aromaticus.space atropoides.space aukci.space babitors.myftp.biz baby-tv.ddns.net baill.space barrigal.space batmeast.space bbtt.site bbtt.space bbtt.website beasty.space beepapa.space beercraft.fun beercraft.space beercraft.website benzoin.space bergius.space beriuatcj.hopto.org bernado.website birion.website bits-mars.fun bits-mars.info bits-mars.site bits-mars.space bits-mars.website bits-tor.fun bits-tor.site bits-tor.space bits-tor.website bitsadmin1.space bitsadmin2.space bitsadmin3.space bitsadmin4.space bitsadmin5.space bitsadmin6.space bitsadmin7.space bitsadmin8.space bitsadmin9.space bitsadmin10.space bitsbitsa.space bitsbitsb.space bitsbitsc.space bitsbitsd.space bitsbitsf.space bitsbitsg.space bitsbitsh.space bitsbitsi.space bitsbitsk.space bitsbitsl.space bizavto.myftp.org blackardi.space borigl.space bowira.website burago.space callitris.space caprjhjkqwer.hopto.org cartu.myftp.org caryophyllus.space casopruy.myftp.org cathartica.space centifolia.space cephaelis.space cerasus.space ceredukos.hopto.org cereffiopas.hopto.org certerasdfuj.hopto.org ceyudfg.hopto.org chachand.space chairada.space chamomilla.ru changato.space charika.website cioasdg.hopto.org cleaners.fun codfgsdf.hopto.org codfjert.myftp.org comedas.space copiran.space coprtyuqw.hopto.org cornelius.website corovana.space cosdfghdf.hopto.org cowtor.space cozsdv.hopto.org cozxcgbx.myftp.org cpasah.hopto.org cpozsxcgbxf.myftp.org crons.ddns.net ctert.myftp.org cubeba.space cudawer.hopto.org cudrg.myftp.org cufjdfge.myftp.org cuiasef.myftp.org cupana.space cyberworld.host cyberworld.website davaris.space delile.space deloperaw.bounceme.net demiurg.fun demiurg.site demiurg.space demiurg.website denovar.space derpenta.space deviar.space dilana.space dolori.website dorogavi.space dortama.space drovka.space dryand.space elecan.space entona.website eregorn.space error-word.myftp.biz erythrina.space europaea.ru excelsa.space fangimen.xyz farfara.space fartiny.xyz federeal.3utilities.com feodal.bounceme.net feridonutop.myftp.org ferranot.xyz fidel.freedynamicdns.org fillin.space firecor.space firestarters.site firran.xyz fix-template.site fizanta.space flackch.space foenum.space forestac.site forestac.website forestac.xyz fragrans.ru frangula.space frondo.xyz frostani.website fuagrado.space fulo-tv.ddns.net fuubara.space gameland.host gameland.space gameland.website gameworld.space gameworld.website gereston.gotdns.ch gerotron.gotdns.ch gerotumans.myftp.org gerusta.space get-icons.ddns.net geterotuks.hopto.org geters-tv.ddns.net getro.bounceme.net getyuawer.myftp.biz gochir.space godrick.space gogora.space gorgopa.xyz goronta.website gostio.website grandiora.website graveolens.space groover.fun groover.website guitin.space gulif.space haker.fun haker.host haker.space haker.website hariva.space harpa.site harpa.space harpa.website hasuduwert.hopto.org heartal.space heavar.space hedriks.bounceme.net hestomig.hopto.org himym.site hirodomus.hopto.org hispidus.space hottob.space houtt.ru hres-tv.ddns.net httpsnc.hopto.org humulusa.ru huncea.xyz huugara.space huvasi.website hyditta.space immortals.site immortals.space immortals.website imperatoria.space indicum.space inogri.space ip-server.freedynamicdns.net isoga.space itango.space jdaeus.space jeera.space jgnatii.space jikardo.myftp.org jogara.space jontap.xyz karapuls.3utilities.com karikatos.hopto.org katalisto01.ddns.net kelogir.myftp.biz kilazurus.hopto.org kilewqrt.hopto.org kilosadwert.hopto.org kiloster.bounceme.net kilotrace.myftp.org kiodas.xyz kirasto.website kistas-tv.ddns.net kokoni.space koleran.xyz kolidus.gotdns.ch kolinstro.space korogav.space krikorro.space kristol.space kristom.hopto.org kristomen.myftp.org krossin.website krugotto.space ksevada.space landraba.website laricio.space lebrederm.space lebreman.space leeri.space leronti.space leucadendron.ru libcrash.ddns.net libda.site libdab.site libdac.site libdad.site libdade.site libdadi.site libdado.site libdaf.site libdag.site libdah.site libdak.site libdal.site libdam.site libdan.site libdas.site liboot.myftp.biz libre1.space libre2.space libre3.space libre4.space librerty.space libres.space libressimo.space liferat.space lifista.space lindras.space lionello.website liqutan.xyz lodafert.hopto.org lodus.freedynamicdns.org loomand.space lopasir.bounceme.net lopaverus.3utilities.com louthi.space lycopodium.ru macros1.space macros2.space macros3.space macros4.space malaky.site malaky.website malaky.xyz malio-tv.hopto.org mallotus.ru maltikor.website mandicap.space mapper.space mardallo.space margatti.space margon.website marmari.space marrubium.ru masseffect.fun masseffect.site masseffect.space masseffect.website matricaria.ru mazdok.myftp.org mediacentr.space melos.myftp.biz melroses.space menyanthes.ru mersi-tv.ddns.net mestara.space miragena.xyz mirani.website mirkwood.space mishel.freedynamicdns.org mokushi.space mototo.fun mototo.site mototo.space mototo.website musata.space musik-dreg.ddns.net musik-file.ddns.net musik-jiolter.ddns.net musik-klo.ddns.net musik-kreps.ddns.net musik-lio.ddns.net musik-lis.ddns.net musik-lk.ddns.net musik-oretus.ddns.net musik-pit.ddns.net musik-qas.ddns.net musik-sa.ddns.net myristica.ru naligo.space naomat.space naveria.website ncio.freedynamicdns.net ncov-2020.hopto.org ncov-2020.site nebola.space nebora.space nenadi.space new-template.site niam.space nikao.website nikolosad.myftp.org normal-template.site normandia.fun normandia.website nubiran.space obendo.space oenanthe.ru office-constructor.ddns.net officinale.space ogmar.fun ogmar.site ogmar.space ogmar.website ogremage.site ogremage.space ogremage.website old-template.site olida.xyz onyxi.xyz opatusir.hopto.org operitors.myftp.org opitrqwer.3utilities.com oput.freedynamicdns.org orangae.space orlani.xyz orlean.space orlenndi.space orteasd-tv.ddns.net oteruiowert.ddns.net overload.space overload.website overwatch.host pankratios.myftp.org pannora.website paparitto.space papatti.space paperonni.space papir.hopto.org pardi-tv.ddns.net pasucoorew.hopto.org pasudukus.hopto.org patran.space patrici.space paullinia.space pennatifolius.space pennyal.space perafidors.hopto.org periaorew.hopto.org perlandi.space pestani.space petroselinum.space phellandrium.ru physostigma.space piantra.website picea.space pilocarpus.space pinus.space piscidia.space pistacia.space plotor.space poasdrwety.hopto.org podagenus.hopto.org podr-tv.ddns.net pointerra.space polandi.website poletton.space polindar.space polygala.space poporaca.website porilis.space poronoc.website potatin.space poyrag.space predf-tv.ddns.net pridafi.website primaver.space proponda.space pterocarpus.space punica.space purshiana.space quadrivalvis.space quarta.space quassia.space quercus.space quillaja.space rabio.website radonta.space raggina.space rainak.space rantai.space redukos.bounceme.net reiloster.hopto.org remeno.space rheum.space rhus.space ricinus.space riki.space risko.hopto.org roseum.space rosmarinus.space rossalt.space roundi.space rubus.space rud.ddns.net russic.website saazer.space sabdja.3utilities.com sabinar.website saccharum.space saijar.gotdns.ch salivar.space samail.space samak-tv.ddns.net samalo.space samarutus.hopto.org sambiras.myftp.org santalum.space saponaria.space saprit.fun saprit.site saprit.space saprit.website sarakinod.myftp.biz sarutnoum.hopto.org sativum.space satkower.3utilities.com saveriutew.3utilities.com savert-tv.hopto.org saxifraga.space scopolia.space sehadus.3utilities.com seletos.3utilities.com sendobin.space senega.space serpyllum.space serumondus.hopto.org sesamum.space sevena.space sheppard.fun sheppard.website shiodai.space shokoda.xyz shoppersi.space sidochan.space silenser.fun silenser.site silenser.space silenser.website silenser.xyz sinapis.space skymage.fun skymage.space skymage.website slonar.website solonra.space sonik.hopto.org sorg.space spirantra.space srarda.space stairu.space stan-stana.fun stan-stana.site stan-stana.space stan-stana.website statsinfo.space steinh.space stenama.space stereo-bit.fun stereo-bit.site stereo-bit.space stereo-bit.website stolina.website stonewa.space strychnos.space styrax.space succedanea.space sylvestris.ru symphytum.space tamarindus.space tarapi.space tclvds.site tekora.space terihorew.hopto.org teris-tv.ddns.net termit.site termit.space termit.website termits.fun terokitos.hopto.org tesla-getro.ddns.net tesla-opt.ddns.net tesla-preat.ddns.net tesla-res.ddns.net tesla-rt.ddns.net tesla-tehno.ddns.net tesla-ufis.ddns.net thymus.space tiamor.space tilia.space tinctorum.space toqq.website torrent-vnc.ddns.net toxifera.space traksa.space trelial.xyz trigonella.space triticum.space troubl.xyz tussilago.space tyctyc.ddns.net ulmifolia.space uncaria.space underlord.site underlord.space upokan.xyz urceola.space urginea.space usbqueshions.ddns.net usitatissimum.ru utilissima.ru vabalt.space valeriana.space vantalio.space venomart.space veratrum.space verbascum.space veronis.space vertigos.space vestak.space veterra.space vibraska.website victios.space vidika.website vinara.xyz vinifera.space violina.website virtuz.xyz viruanta.website viscum.space vitis.space volotin.space vomica.space voyaget.myftp.biz vratio.space vulgare.space watcher.host wavera.space wayto.host wayto.website weaman.space wertlook.hopto.org weweca.website wifa.site wifa.space wifa.website wifb.site wifb.space wifb.website wifc.host wifc.site wifc.space wifc.website wifo.host wifo.site wifo.space wifo.website wifu.site wifu.space wifu.website wifx.site wify.space wify.website wiilasto.website wildbar.space win-apu.ddns.net wordmacros.space wostrigo.website writedoc.bounceme.net xakep.fun xakep.site xakep.website yiorewasdf.myftp.org zanusson.website zanzar.space zaoeryuijas.hopto.org zareton.space zikoarew.myftp.biz zingiber.space # https://www.welivesecurity.com/2020/05/26/agentbtz-comratv4-ten-year-journey/ # https://www.welivesecurity.com/wp-content/uploads/2020/05/ESET_Turla_ComRAT.pdf # https://github.com/eset/malware-ioc/tree/master/turla arinas.tk bedrost.com branter.tk bronerg.tk celestyna.tk crusider.tk davilta.tk deme.ml dixito.ml duke6.tk elizabi.tk foods.jkub.com hofa.tk hunvin.tk lakify.ml lindaztert.net misters.ml pewyth.ga progress.zyns.com sameera.gq sanitar.ml scrabble.ikwb.com sumefu.gq umefu.gq vefogy.cf vylys.com wekanda.tk # https://www.welivesecurity.com/2020/05/21/no-game-over-winnti-group/ # https://github.com/eset/malware-ioc/tree/master/winnti_group client.gnisoft.com n8.ahnlabinc.com nmn.nhndesk.com owa.ahnlabinc.com ssl2.ahnlabinc.com ssl2.dyn-tracker.com ssl.lcrest.com www2.dyn.tracker.com # https://www.welivesecurity.com/2020/05/11/breaking-news-app-promises-news-brings-ddos-attacks/ i-updater.com # https://www.welivesecurity.com/2020/04/23/eset-discovery-monero-mining-botnet-disrupted/ accountantlive.icu aut0hk.ddns.net aut2scr.ddns.net b.top4top.io c0d3.ddns.net calypsoempire.ddns.net d001.ddns.net ddw.ddns.net fanbmypersondrive.icu gJyapcAGoc0d3.ddns.net gulfup.me hakerz123.ddns.net jcmewjjkyc0d3.ddns.net luio.ddns.net mgud2xd.ddns.net MoOHyAYeuaut2scr.ddns.net mrxud.ddns.net mycountermppd.xyz mydrivepersonfanb.icu mydrivepersonpdvsa.icu OHOFqlXNJluio.ddns.net pNUMWWDLjPmzg.ddns.net scitie.ddns.net shittybooks.review urtyerc0d3.ddns.net volvo.ddns.net xcod.ddns.net xcud.ddns.net xcud.zapto.org xkm.ddns.net # https://www.welivesecurity.com/2020/03/12/tracking-turla-new-backdoor-armenian-watering-holes/ # https://github.com/eset/malware-ioc/tree/master/turla#turla-watering-hole-armenia adgf.am aiisa.am armconsul.ru mnp.nkr.am skategirlchina.com # https://www.welivesecurity.com/2020/03/05/guildma-devil-drives-electric/ # https://github.com/eset/malware-ioc/tree/master/guildma ambirsr.tk carnataldez.ml clooinfor.cf dbuhcbudyu.tk equilibrios.ga gucinowertr.tk iuiuytrytrewrqw.gq movbmog.ga nvfjvtntt.cf vhguyeu.ml whia7g.acquafufheirybveru.online xskcjzamlkxwo.gq zvatrswtsrw.ml # https://www.welivesecurity.com/2019/11/21/deprimon-default-print-monitor-malicious-downloader/ # https://github.com/eset/malware-ioc/tree/master/deprimon almawaddrial.com alwatantrade.com babmaftuh.com elehenishing.com img.dealscienters.net mdeastserv.com shayalyawm.com teknikgorus.com wnupdnew.com # https://www.welivesecurity.com/2019/11/19/mispadu-advertisement-discounted-unhappy-meal/ # https://github.com/eset/malware-ioc/tree/master/mispadu mcdonalds.promoscupom.cf promoscupom.cf # https://www.welivesecurity.com/2019/10/18/fleecing-onion-trojanized-tor-browser/ onion4fh3ko2ncex.onion tor-browser.org torproect.org # https://www.welivesecurity.com/2019/10/17/operation-ghost-dukes-never-left/#single-post-fancybox-5 # https://github.com/eset/malware-ioc/tree/master/dukes acciaio.com.br bandabonga.fr busseylawoffice.com ceycarb.com coachandcook.at ecolesndmessines.org fairfieldsch.org fisioterapiabb.it lorriratzlaff.com mavin21c.dothome.co.kr ministernetwork.org motherlodebulldogclub.com powerpolymerindustry.com publiccouncil.org salesappliances.com sistemikan.com skagenyoga.com varuhusmc.org westmedicalgroup.net # https://www.welivesecurity.com/2019/10/14/connecting-dots-exposing-arsenal-methods-winnti/ dns1-1.7release.com ssl.dyn-dns.com svn-dns.ahnlabinc.com xp101.dyn-dns.com # https://www.welivesecurity.com/2019/10/10/eset-discovers-attor-spy-platform/ # https://github.com/eset/malware-ioc/tree/master/attor idayqh3zhj5j243t.onion # https://www.welivesecurity.com/2019/10/03/casbaneiro-trojan-dangerous-cooking/ # https://github.com/eset/malware-ioc/tree/master/casbaneiro 4d9p5678.myvnc.com agosto2019.servepics.com hostsize.sytes.net noturnis.zapto.org seradessavez.ddns.net # https://www.welivesecurity.com/2019/09/09/backdoor-stealth-falcon-group/ electricalweb.org footballtimes.info upnpdiscover.org vegetableportfolio.com windowsearchcache.com # https://www.welivesecurity.com/2019/08/22/first-spyware-android-ahmyth-google-play/ radiobalouch.com # https://www.welivesecurity.com/2019/08/14/balkans-businesses-double-barreled-weapon/ bestfriendsroot.com consaltingsolutionshere.com dogvipcare.net hvar.dogvipcare.net kimdotcomfriends.com limosinevipsalon.com luxembourgprotections.com malmevipbikes.se pksrs.com porezna-uprava.com porezna-uprava.net pufbih.com slowbeerltd.info split.malmevipbikes.se zagreb.porezna-uprava.com # https://www.welivesecurity.com/2019/08/08/varenyky-spambot-campaigns-france/ artisticday.icu astonishingwill.icu directfood.icu gradualrain.icu jg4rli4xoagvvmw47fr2bnnfu7t2epj6owrgyoee7daoh4gxvbt3bhyd.onion proapp.icu provincialwake.icu shrek.icu thinstop.icu # https://www.welivesecurity.com/2019/08/05/sharpening-machete-cyberespionage/ # https://github.com/eset/malware-ioc/tree/master/machete 6e24a5fb.ngrok.io adtiomtardecessd.zapto.org artyomt.com ceofanb18.mipropia.com djcaps.gotdns.ch f9527d03.ngrok.io koliast.com lawyersofficial.mipropia.com mcsi.gotdns.ch tobabean.expert tokeiss.ddns.net u154611594.hostingerapp.com u929489355.hostingerapp.com # https://www.welivesecurity.com/2019/08/01/banking-trojans-amavaldo/ # https://github.com/eset/malware-ioc/tree/master/amavaldo balacimed.mine.nu # https://www.welivesecurity.com/2019/07/29/android-ransomware-back/ rich7.xyz wevx.xyz # https://www.welivesecurity.com/2019/07/18/okrum-ke3chang-targets-diplomatic-missions/ # https://github.com/eset/malware-ioc/tree/master/okrum_ke3chang buy.babytoy-online.com center.nmsvillage.com chart.healthcare-internet.com compatsec.com control.mimepanel.org cv.livehams.com daily.huntereim.com dream.zepotac.com dsmanfacture.privatedns.org dyname.europemis.com finance.globaleducat.com forcan.hausblow.com grek.freetaxbar.com info.audioexp.com inicializacion.com item.amazonout.com items.babytoy-online.com items.burgermap.org login.allionhealth.com menorustru.com misiones.soportesisco.com newflow.babytoy-online.com press.premlist.com promise.miniaturizate.org rain.nmsvillage.com sanpaulostat.com store.ufmsecret.org support.slovakmaps.com translate.europemis.com upcv.inciohali.com view.beleimprensa.org win10.ipv6-microsoft.org wind.deltimesweb.com # https://www.welivesecurity.com/2019/07/08/south-korean-users-backdoor-torrents/ bitgamego.com helloking.site higamebit.com jtbcsupport.site kingdomain.site # https://www.welivesecurity.com/2019/06/20/loudminer-mining-cracked-vst-software/ aly001.hopto.org d-d.host d-d.live d-d.space m-m.icu system-check.services system-update.info system-update.is vstcrack.com # https://www.welivesecurity.com/2019/06/05/wajam-startup-massively-spread-adware/ adrienprovenchertechnology.com armandlamoureuxtechnology.com bernardtechnology.com carmenbienvenuetechnology.com cartiertechnology.com chabaneltechnology.com chaumonttechnology.com colonialetechnology.com cormacktechnology.com customsearches.net despinstechnology.com hutchisontechnology.com imt-dashboard.tech jeanlesagetechnology.com kingwintechnology.com laubeyrietechnology.com lauriertechnology.com mansactechnology.com mounactechnology.com notification-results.com notifications-page.com notifications-service.info notifications-service.io papineautechnology.com premiumsearchhub.com premiumsearchresults.com premiumsearchtech.com preverttechnology.com search-awesome.net search-ology.com search-technology.net searchawesome2.com searchawesome3.com searchawesome-apps.com searchawesome.net searchesandfind.com searchfeedtech.com searchforall.net searchforfree.net searchnewsroom.com searchnotifications.com searchpage-results.com searchpage-results.net searchpage.com searchpageresults.com searchsymphony.com searchtech.net securesearch.xyz seekoutresultz.com sirwilfridlauriertechnology.com social2search.com tazotechnology.com technologieadrienprovencher.com technologieairflow.com technologiearmandlamoureux.com technologiebeaumont.com technologiebernard.com technologiecarmenbienvenue.com technologiecartier.com technologiechabanel.com technologiechaumont.com technologiecoloniale.com technologiecormack.com technologiedollard.com technologieduluth.com technologiehutchison.com technologiejeanlesage.com technologiekingwin.com technologielaubeyrie.com technologielaurier.com technologiemansac.com technologiemontroyal.com technologiemounac.com technologieoutremont.com technologieprevert.com technologierachel.com technologieruso.com technologiesaintdenis.com technologiesaintdominique.com technologiesaintjoseph.com technologiesaintlaurent.com technologiesainturbain.com technologiesearchawesome.com technologiesirwilfridlaurier.com technologiestdenis.com technologiestlaurent.com technologiestuart.com technologietazo.com technologietravassac.com technologietrudeau.com technologievanhorne.com technologiewiseman.com technologieyvonlheureux.com travassactechnology.com trudeautechnology.com wajam-download.com yvonlheureuxtechnology.com # https://www.welivesecurity.com/2019/05/14/plead-malware-mitm-asus-webstorage/ google.com.dns-report.com update.asuswebstorage.com.ssmailer.com # https://www.welivesecurity.com/2019/07/11/buhtrap-zero-day-espionage-campaigns/ # https://github.com/eset/malware-ioc/tree/master/buhtrap blanki-shabloni24.ru hdfilm-seyret.com icq.chatovod.info ktosdelaetskrintotpidor.com Medialeaks.icu redmond.corp-microsoft.com secure-telemetry.net services-glbdns2.com sositehuypidarasi.com stat-counter-7-1.bit stat-counter-7-2.bit Superjob.icu womens-history.me # https://www.welivesecurity.com/2019/04/09/oceanlotus-macos-malware-update/ au.charlineopkesston.com daff.faybilodeau.com sarc.onteagleroad.com # https://www.welivesecurity.com/2019/03/20/fake-or-fake-keeping-up-with-oceanlotus-decoys/ aliexpresscn.net andreagahuvrauvin.com andreagbridge.com aol.straliaenollma.xyz beaudrysang.xyz becreybour.com byronorenstein.com chinaport.org christienoll.xyz christienollmache.xyz cloud.360cn.info dieordaunt.com dns.chinanews.network illagedrivestralia.xyz karelbecker.com karolinblair.com lauradesnoyers.com ntop.dieordaunt.com office.ourkekwiciver.com ourkekwiciver.com sophiahoule.com stienollmache.xyz straliaenollma.xyz ursulapapst.xyz # https://www.welivesecurity.com/2019/03/11/gaming-industry-scope-attackers-asia/ # https://github.com/eset/malware-ioc/tree/master/winnti_group api.goallbandungtravel.com bugcheck.xigncodeservice.com checkin.travelsanignacio.com dump.gxxservice.com nw.infestexe.com # https://www.welivesecurity.com/2018/12/06/danabot-evolves-beyond-banking-trojan-new-spam/ # https://github.com/eset/malware-ioc/tree/master/danabot amd.cibariefoodconsulting.it dcc.fllimorettinilegnaegiardini.it drk.fm604.com gtdspr.space icon.fllimorettinilegnaegiardini.it it.sunballast.de job.hitjob.it latest.hitweb.it pph.picchio-intl.com ricci.bikescout24.fr team.hitweb.it vps.cibariefoodconsulting.it vps.hitjob.it # https://www.welivesecurity.com/2018/11/20/oceanlotus-new-watering-hole-attack-southeast-asia/ # https://github.com/eset/malware-ioc/tree/master/oceanlotus 10cm.mypets.ws ad-appier.com arabica.podzone.net assets-cdn.blogdns.net baotgm.net benchtag2.com bootstraplink.com cart.gotdns.com cdn1.shacknet.us cdn-ampproject.com cdn-tynt.com cdnazure.com cnrp7.org conggiaovietnam.net daichungvienvinhthanh.com danchimviet.info danviethouston.com ds-aksb-a.likescandy.com effecto-azureedge.net figbc.knowsitall.info fvpoc.org gardencityclub.com gui.dnsdojo.net html5.endofinternet.net ichefbcci.is-a-chef.com imgincapsula.com io.blogsite.org labs-apnic.net lb-web-stat.com lcontacts.servebbs.net lienketqnhn.org metacachecdn.com mfaic.gov.kh mod.gov.kh mtgvinh.net nav.neat-url.com nguoitieudung.com.vn optnmstri.com p-typekit.com pagefairjs.com phnompenhpost.com pixel1.dnsalias.net player-cnevids.com raovatcalitoday.com s0-2mdn.net s-adroll.com scdn-cxense.com secure-imrworldwide.com sskimresources.com static-addtoany.com static.tagscdn.com straits-times.is-an-actor.com tcog.thruhere.net thongtinchongphandong.com tinkhongle.com tips-renew.webhop.info tiqqcdn.com tiwimg.com toithichdoc.blogspot.com trc.webhop.net trieudaiviet.com triviet.news utagscript.com weblink.selfip.info widgets-wp.com your-ip.getmyip.com ## guardicore # https://www.guardicore.com/labs/ # https://github.com/guardicore/labs_campaigns # https://github.com/guardicore/labs_campaigns/tree/master/Fanel arhive.davidhacked.tk fanelishere.com fanelishere.ro fanelishere.tk fanelroot.tk tehnichost.biz # https://www.guardicore.com/2020/04/vollgar-ms-sql-servers-under-attack/ # https://github.com/guardicore/labs_campaigns/tree/master/Vollgar a.vollar.ga aa.vollar.ga b.vollar.ga c.vollar.ga ca.vollar.ga d.vollar.ga da.vollar.ga f.vollar.ga h.vollar.ga ja.vollar.ga k.vollar.ga m.vollar.ga ma.vollar.ga n.vollar.ga na.vollar.ga o.vollar.ga oa.vollar.ga ob.vollar.ga s.vollar.ga sa.vollar.ga t.vollar.ga ta.vollar.ga v.vollar.ga x.vollar.ga xa.vollar.ga z.vollar.ga # https://www.guardicore.com/2019/09/smominru-botnet-attack-breaches-windows-machines-using-eternalblue-exploit # https://github.com/guardicore/labs_campaigns/tree/master/Smominru bee12.bumblebeeservers.com d20.xtrmserver.com down.1226bye.pw fra.gamesoxalic.com ftp.0603bye.info garrafa8.itaucredicard.tk grinknowledge.com js.1226bye.xyz server.triangleww.com wmi.1103bye.xyz wmi.1217bye.host worldsender.info # https://www.guardicore.com/2019/05/nansh0u-campaign-hackers-arsenal-grows-stronger/ # https://github.com/guardicore/labs_campaigns/tree/master/Nansh0u lokiturtle.herominers.com trtl.cnpool.cc trtl.pool.mine2gether.com turtle.miner.rocks # https://www.guardicore.com/2018/11/butter-brute-force-ssh-attack-tool-evolution/ # https://github.com/guardicore/labs_campaigns/tree/master/Butter x.bigoupai.live # https://www.guardicore.com/2018/06/operation-prowli-traffic-manipulation-cryptocurrency-mining-2/ # https://github.com/guardicore/labs_campaigns/tree/master/Prowli roi777.com startreceive.tk stats.startreceive.tk wp.startreceive.tk # https://www.guardicore.com/2017/12/beware-the-hex-men/ # https://github.com/guardicore/labs_campaigns/tree/master/Hexmen cct119.com cyg2016.xyz down.mys2016.info down.mys2018.xyz hc58.msns.cn js.mykings.top js.mys2016.info js.mys2018.xyz # https://github.com/guardicore/labs_campaigns/tree/master/Bondnet cryptmonero.com crypto-pool.fr cryptonight.net democats.org flypool.org miner.center mst.mymst007.info riepool.ovh shscrypto.net # https://github.com/guardicore/labs_campaigns/tree/master/Lemon_Duck down.ackng.com lpp.ackng.com lpp.zer2.com t.amxny.com t.awcna.com t.zer2.com # https://github.com/guardicore/labs_campaigns/tree/master/Photominer hrtests.ru iqtesti.ru jobtests.ru managtest.ru profetest.ru pstests.ru qptest.ru stafftest.ru testpsy.ru testworks.ru ## intezer # https://www.intezer.com/blog/ # https://www.intezer.com/blog/malware-analysis/vermilionstrike-reimplementation-cobaltstrike/ amazon.hksupd.com update.microsofthk.com update.microsoftkernel.com # https://www.intezer.com/blog/malware-analysis/habitsrat-used-to-target-linux-and-windows-servers/ brian-krebs-erectile-dysfunction.com brian.krebsonsecurity.top krebsonfellatio.net ## kaspersky # https://securelist.com/ # https://securelist.com/malicious-spam-campaigns-delivering-banking-trojans/102917/ Apoxiolazio55.space Karantino.xyz uqtgo16datx03ejjz.xyz # https://securelist.com/black-kingdom-ransomware/102873/ yuuuuu44.com # https://securelist.com/ferocious-kitten-6-years-of-covert-surveillance-in-iran/102806/ microsoft.com-view.space microsoft.updatei.com microsoft.updatesystem.site # https://securelist.com/andariel-evolves-to-target-south-korea-with-ransomware/102811/ allamwith.com conkorea.com ddjm.co.kr hivekorea.com jinjinpig.co.kr mail.namusoft.kr mail.sisnet.co.kr snum.or.kr # https://securelist.com/puzzlemaker-chrome-zero-day-exploit-chain/102771/ media-seoengine.com # https://securelist.com/gootkit-the-cautious-trojan/102731/ kvaladrigrosdrom.top scellapreambulus.top lbegardingstorque.com kerymarynicegross.top pillygreamstronh.com # https://securelist.com/apkpure-android-app-store-infected/101845/ foodin.site wcf.seven1029.com # https://securelist.com/gravityrat-the-spy-returns/99097/ bollywoods.co.in chat2hire.net chuki.mozillaupdates.us click2chat.org cvstyler.co.in daily.windowsupdates.eu dailybuild.mozillaupdates.com enigma.net.in gozap.co.in gyzu.mozillaupdates.us melodymate.co.in n1.nortonupdates.online n2.nortonupdates.online n3.nortonupdates.online n4.nortonupdates.online nightly.windowsupdates.eu nightlybuild.mozillaupdates.com orangevault.net sake.mozillaupdates.us savitabhabi.co.in sharify.co.in strongbox.in teraspace.co.in titaniumx.co.in u01.msoftserver.eu u02.msoftserver.eu u03.msoftserver.eu u04.msoftserver.eu ud01.microsoftupdate.in ud02.microsoftupdate.in ud03.microsoftupdate.in ud04.microsoftupdate.in wesharex.net x-trust.net zen.mozillaupdates.us # https://securelist.com/montysthree-industrial-espionage/98972/ autosport-club.tekcities.com dl10-web-stock.ru dl16-web-eticket.ru dl166-web-eticket.ru dl55-web-yachtbooking.xyz # https://securelist.com/mosaicregressor/98849/ menjitghyukl.myfirewall.org # https://securelist.com/transparent-tribe-part-2/98233/ sharemydrives.com sharingmymedia.com tryanotherhorse.com # https://securelist.com/transparent-tribe-part-1/98127/ newsbizupdates.net uronlinestores.net # https://securelist.com/ie-and-windows-zero-day-operation-powerfall/97976/ static-cdn1.com # https://securelist.com/lazarus-on-the-hunt-for-big-game/97757/ mnmski.cafe24.com # https://securelist.com/pig-in-a-poke-smartphone-adware/97607/ 51ginkgo.com 404mobi.com adfuture.cn adsunflower.com apd1.thunup.com apd1.warnlog.com bigdata800.com htapi.getapiv8.com i151125.infourl.net jueoxdr.com lbjg7.com mzeibiyr.com stable.icecyber.org ufz.doesxyz.com ywupscsff.com # https://securelist.com/oh-what-a-boot-iful-mornin/97365/ bamo.ocry.com # https://securelist.com/microcin-is-here/97353/ apps.uzdarakchi.com forum.mediaok.info forum.uzdarakchi.com owa.obokay.com # https://securelist.com/cycldek-bridging-the-air-gap/97157/ 24h.tinthethaoi.com cdn.laokpl.com cophieu.dcsvnqvmn.com hanghoa.trenduang.com hcm.vietbaonam.com images.webprogobest.com info.coreders.com khinhte.chinhsech.com kinhte.chototem.com laovoanew.com lat.conglyan.com login.dangquanwatch.com login.diendanlichsu.com login.giaoxuchuson.com login.thanhnienthegioi.com login.vietnamfar.com luan.conglyan.com mychau.dongnain.com news.cooodkord.com news.trungtamwtoa.com nghiencuu.onetotechnologys.com nhantai.xmeyeugh.com quocphong.ministop14.com thanhnien.vietnannnet.com thegioi.kinhtevanhoa.com thoitiet.yrindovn.com tinmoi.thoitietdulich.com tinmoi.vieclamthemde.com tintuc.daikynguyen21.com toiyeuvn.dongaruou.com web.hcmuafgh.com web.laomoodwin.com web.laovoanew.com # https://securelist.com/in-app-advertising-in-android/97065/ ti.domainforlite.com uu.domainforlite.com # https://securelist.com/apt-phantomlance/96772/ aki.viperse.com anaehler.com anofrio.com api.anaehler.com bit.catalinabonami.com ckoen.dmkatti.com cloud.anofrio.com cyn.ettebiermahalet.com egg.stralisemariegar.com file.log4jv.info game2015.net hr.halettebiermann.com inc.graceneufville.com itpk.mostmkru.com jang.goongnam.com log4jv.info log.osloger.biz mine.remaariegarcia.com ming.chujong.com mokkha.goongnam.com mtk.baimind.com news.sqllitlever.info nhaccuatui.android.zyngacdn.com osloger.biz quam.viperse.com sadma.knrowz.com sqllitlever.info staff.kristianfiedler.club taiphanmemfacebookmoi.info term.ursulapaulet.com us.jaxonsorensen.club video.viodger.com viodger.com # https://securelist.com/unkillable-xhelper-and-a-trojan-matryoshka/96487/ ddl.okgoodmobi.com ddl.okyesmobi.com koapkmobi.com lp.cooktracking.com # https://securelist.com/holy-water-ongoing-targeted-water-holing-attack-in-asia/96311/ adobeflash31_install.ddns.info airjaldinet.ml hroot20system20macosxdriver.serveusers.com loginwebmailnic.dynssl.com root20system20macosxdriver.serveusers.coml sys_andriod20_designer.dynamic-dns.net system0_update04driver_roots.dynamic-dns.net ubntrooters.serveuser.com # https://securelist.com/ios-exploit-chain-deploys-lightspy-malware/96407/ app.hkrevolution.club app.poorgoddaay.com appledaily.googlephoto.vip facebooktoday.cc googlephoto.vip hkrevolt.com messager.cloud movie.poorgoddaay.com news2.hkrevolution.club news.hkrevolt.com news.hkrevolution.club news.poorgoddaay.com ns1.poorgoddaay.com svr.hkrevolution.club xxinc-media.oss-cn-shenzhen.aliyuncs.com zg.poorgoddaay.com # https://securelist.com/wildpressure-targets-industrial-in-the-middle-east/96360/ upiserversys1212.com # https://securelist.com/cookiethief/96332/ api-resource.youzicheng.net api-rssocks.youzicheng.net guard.yoboxtool.com zh.yomobi.net # https://securelist.com/mokes-and-buerak-distributed-under-the-guise-of-security-certificates/96324/ kkjjhhdff.site oderstrg.site # https://securelist.com/roaming-mantis-part-v/96250/ au-ul.com au-xm.com epos-ua.com jibun.jp-bankq.com jnb.jp-bankq.com jppost.jp-bankq.com mufg.jp-bankq.com nttdocomo-uh.com nttdocomo-xm.com rakuten.jp-bankq.com sbi.jp-bankq.com seven.jp-bankq.com smbc.bk-securityo.com smbc.jp-bankq.com # https://securelist.com/azorult-spreads-as-a-fake-protonvpn-installer/96261/ accounts.protonvpn.store protonvpn.store # https://securelist.com/kbot-sometimes-they-come-back/96157/ my-backup-club-911.xyz sync-time.club sync-time.icu sync-time.info # https://securelist.com/shlayer-for-macos/95724/ api.entrycache.com api.macsmoments.com api.typicalarchive.com kodak-world.com sci-hub.tv # https://securelist.com/operation-applejeus-sequel/95596/ aeroplans.info beastgoc.com buckfast-zucht.de chainfun365.com cyptian.com invesuccess.com jmttrading.org mydealoman.com private-kurier.com unioncrypto.vip wb-bot.org wb-invest.net wfcwallet.com # https://securelist.com/smartphone-shopaholic/95544/ api.adsnative123.com # https://securelist.com/oilrigs-poison-frog/95490/ poison-frog.club # https://securelist.com/compfun-successor-reductor/93633/ adstat.pw bill-tat.pw # https://securelist.com/dropper-in-google-play/92496/ abc.abcdserver.com bcd.abcdserver.com cba.abcdserver.com # https://securelist.com/twas-the-night-before/91599/ analytics-google.org go-microstf.com itworx.com-ho.me jquerycode-download.live mci.com-ho.me moh.com-ho.me ntg-sa.com taqa.com.sa # https://securelist.com/mobile-banker-riltok/91374/ alr992.date avito-app.pw backfround2.pw background1.xyz blacksolider93.com blass9g087.com brekelter2.com broplar3hf.xyz buy-youla.ru cd78cg210xy0.com copsoiteess.com farmatefc93.org firstclinsop.com holebrhuhh3.com holebrhuhh45.com karambga3j.net le22999a.pw leboncoin-bk.top leboncoin-buy.pw leboncoin-cz.info leboncoin-f.pw leboncoin-jp.info leboncoin-kp.top leboncoin-ny.info leboncoin-ql.top leboncoin-tr.info myyoula.ru sell-avito.ru sell-youla.ru sentel8ju67.com subito-li.pw subitop.pw web-gumtree.com whitehousejosh.com whitekalgoy3.com youlaprotect.ru # https://securelist.com/mobile-subscriptions/91211/ ps.okyesmobi.com # https://securelist.com/plurox-modular-backdoor/91213/ obuhov2k.beget.tech webdynamicname.com # https://securelist.com/scarcruft-continues-to-evolve-introduces-bluetooth-harvester/90729/ acddesigns.com.au buttyfly.000webhostapp.com jnts1532.cn kmbr1.nitesbr1.org lotusprintgroup.com planar-progress.000webhostapp.com rhooters.com stjohns-burscough.org # https://securelist.com/fin7-5-the-infamous-cybercrime-rig-fin7-continues-its-activities/90703/ akamaiservice-cdn.com appleservice-cdn.com bing-cdn.com booking-cdn.com businessdailyafrica.net cdn-googleapi.com cdn-skype.com cdn-yahooapi.com cdnj-cloudflare.com cisco-cdn.com cloudflare-cdn-r5.com digi-cert.org digicert-cdn.com digicertweb.com doddyfire.dyndns.org exchange-cdn.com facebook77-cdn.com geotrusts.com globaltech-cdn.com gmail-cdn3.com googl-analytic.com google-services-s5.com hpservice-cdn.com infosys-cdn.com infotrak-research.com instagram-cdn.com itaxkenya.com k-24tv.com live-cdn2.com logitech-cdn.com msdn-cdn.com msdn-update.com mse-cdn.com nairobiwired.com nlscdn.com noreply377.ddns.net pci-cdn.com realtek-cdn.com riscomponents.pw secureclientupdate.com server.mtcc.me servicebing-cdn.com somtelnetworks.com sport-pesa.org tain.warzonedns.com testing-cdn.com toekie.ddns.net tw32-cdn.com vmware-cdn.com warmaha.warzonedns.com windowsupdatemicrosoft.com yahooservices-cdn.com # https://securelist.com/gaza-cybergang-group1-operation-sneakypastes/90068/ checktest.www1.biz dji-msi.2waky.com fulltest.yourtrap.com microsoft10.compress.to mmh.ns02.us ramliktest.mynetav.org saso10.myftp.biz supports.mefound.com testhoward.mysecondarydns.com testmace.compress.to time-loss.dns05.com wiknet.mooo.com Wiknet.wikaba.com # https://securelist.com/project-tajmahal/90240/ rahasn.akamake.net rahasn.homewealth.biz rahasn.webhop.org # https://securelist.com/basbanke-trend-setting-brazilian-banking-trojan/90365/ aplicativo-sms.com autopecasecreta.com.br bancobrasil.mobi citiapp.mobi dodothebest.esy.es ibercob.com.br investcerto.site ltau.mobi moduloempresa.com noisquevoa.mobi pagseguro.mobi rootcenter.com.br royhols.com servcobranca.in zalthome.esy.es # https://securelist.com/roaming-mantis-part-iv/90332/ ffakecg.com nttdocomo-qae.com nttdocomo-qat.com sagawa-bz.com sagawa-mqd.com sagawa-mwm.com # https://securelist.com/beware-of-stalkerware/90264/ copy9.com easyphonetrack.com flexispyapp.com freeandroidspy.com hoverspyapp.com ispyoo.com mobile-spy.com mobile-tracker-free.com mobiletool.ru mspy.com mtoolapp.net reptilicus.net spy-phone-app.com talklog.net thetruthspy.com # https://securelist.com/cryptocurrency-businesses-still-being-targeted-by-lazarus/90019/ baseballcharlemagnelegardeur.com bluecreekrobotics.com bogorcenter.com dev.microcravate.com dev.whatsyourcrunch.com enterpriseheroes.com.ng eventum.cwsdev3.bi.com hrgp.asselsolutions.com nzssdm.com streamf.ru tangowithcolette.com towingoperations.com vinhsake.com # https://securelist.com/operation-shadowhammer/89992/ asushotfix.com # https://securelist.com/azorult-analysis-history/89922/ daticho.ac.ug ravor.ac.ug # https://securelist.com/a-predatory-tale/89779/ 15charliescene15.myjino.ru axixaxaxu1337.us j946104.myjino.ru kristihack46.myjino.ru madoko.jhfree.net # https://securelist.com/piratebay-malware/89740/ mobilekey.pw # https://securelist.com/razy-in-search-of-cryptocurrency/89485/ 2searea0.info anhubnew.info apiscr.com archivepoisk-zone.info archivepoisk.info gigafilesnote.com happybizpromo.com kidpassave.xyz mirnorea11.xyz miroreal.xyz nolkbacteria.info ooo-ooo.info solkoptions.host solkoptions.site ton-ico.network touristsila1.info touristsworl.xyz # https://securelist.com/the-rotexy-mobile-trojan-banker-and-ransomware/88893/ blackstar.pro darkclub.net freedns.website gms-service.info googleapis.link holerole.org lineout.pw secondby.ru sky-sync.pw streamout.space sync-weather.pw synchronize.pw test2016.ru # https://securelist.com/octopus-infested-seas-of-central-asia/88200/ blondehairman.com certificatesshop.com desperados20.es fayloobmennik.net giftfromspace.com hovnanflovers.com humorpics.download latecafe.in mikohanzer.website porenticofacts.com prom3.biz.ua uploadsforyou.com # https://securelist.com/muddywater/88059/ adfg.ae adibf.ae benangin.com cankayasrc.com ektamservis.com gtme.ae hubinasia.com # https://securelist.com/roaming-mantis-part-3/88071/ sagawa-otqwt.com sagawa-polsw.com ## marco-ramilli # https://marcoramilli.com/ # https://marcoramilli.com/2020/03/19/is-apt27-abusing-covid-19-to-attack-people/ motivation.neighboring.site # https://marcoramilli.com/2019/11/12/ta-505-cybercrime-on-system-integrator-companies/ com-kl96.net com-mk84.net tehnofaq.work # https://marcoramilli.com/2019/10/28/sweed-targeting-precision-engineering-companies-in-italy/ corpcougar.com mail.hajj.zeem.sa # https://marcoramilli.com/2019/10/14/is-emotet-gang-targeting-companies-with-external-soc/ aijdjy.com obbydeemusic.com veeplan.com wwwkmacobd.com xsnonline.us # https://marcoramilli.com/2019/06/17/from-targeted-attack-to-untargeted-attack/ erre.effe-erre.es filuetrama.top help.goosecharger.com it.goodvibeskicking.com koohy.top minor.minorleaguepub.com tics.cibariefoodconsulting.com tru.cheersportacademy.com # https://marcoramilli.com/2019/04/05/step-by-step-office-dropper-dissection/ bilgiegitimonline.com # https://marcoramilli.com/2019/02/28/ransomware-trojan-and-miner-together-against-pik-group/ 11jamesjacksondrive.com 123graffiti.com abrahamlopz.website ac-tokushima.com acceptcreditcards-freemachine.com accesorios.online accompagnatori.online accont.ru actiontransportmanchester.com activehotelolympic.it adroitlyadvertising.com agsolucionesinmobiliarias.com alexrbn.com allmytshirt.com altunizadecilingir.info amc-israel.com american-dsign.com americancarcruisingpodcast.com anamosashopsabovethewapsi.com ansariproperty.com antsolutions.online anydomainname.website apocalypticfail.com artuom.com asatrustore.com ashida-kougei.com ashleymeador.website assetuganda.org atikabanowati.com aup-consulting.ru auroradx.com autogirl.net azimut-industries.com banichironton.website barbarafowler.website batdongsanvngod.com belegost.csail.mit.edu belowtheweb.ru benjaminlaw.website bertranabogadosconsultores.com bestclearance.website bestpcgames.website bestvrporn.online bethelastjedi.com bjlaser.com blackmarker.net blindaccessjournal.com blog.putyrsky.ru blueprintbehavioralhealth.com bojtoles.online bongdatv.online brandinghome.online breretonhanley.com bthsp.com businessvalueandtransition.com caffeportici.it camarasdeseguridadenbogota.com cameronsimms.website camlicacilingir.info careprevention.bdpm.it carrollfamilyreunionmobile.com ccs-moscow.ru cdvo.it celebrityinfo.net cellularmaster.net cellularsignalsolutions.com cengelkoycilingir.info cerberusgo.online certifiedfeti.com champderevescannabiscanada.com chansomania.fr charlesathompson.com charlestrejo.website cheapraybanfreeshipping.com cheapwatches.website cheapwebsiteseoservices.com cheatz0ne.com chienbinhlama.com chris-hudson.net chrisgreigandthemerchants.com christian-bertero-sicilia.com christmaseveinwesterville.com cidadenatural.online claracernatthierryhuillet.com clarksvillefurniturestore.com cldtesttwo.website clubedasofertasedescontos.com cmattoon.com coast2coast.net coisasdemama.website comerciospilardelahoradada.com comfortinnhotelsorlando.com comoganartuprimermillon.com conceptos30.website consciouslivingandloving.com consecionaria.online cooperslidingdoorrepair.com coral-gables-waterfront.com couchtuner.pro creativeengravingplus.com crmemailmarketing.online crmsolutions.online cubantripadvisor.com culture-generale.info cyberdale.net dailyremedies.net davidaluke.com dcvair.com delineavit-architecture.com delrayslidingdoorrepair.com dentalexchange.nulouweb.com des-livres-pour-evoluer.com despari.informatik.uni-erlangen.de destinychangersministries.com deyarcofurniturefactory.online diamantech.com.uy diaochungthinhland.net diariolaindustriatrujillo.com digitalmarketgh.com discounthydroflaskcheap.com dnaliferegression.com dom9.online dorothyhills.website droneinside.com droyalhair.website duniabelajar.online dutchaviationphoto.com ebookpremium.net edmaudlin.com eileensmith.website elect-eng-tech.info elinika.ru elizaedmonds.website elobservadordelmundo.online elvanelson.website emmetcountyconservation.com enamoratedelmundoyviaja.com englishrep.ru entornorural.online epicexpertz.website erciyesdavetiye.com ericagilbert.website ericfoster.website escortboyz.com esdirqazan.com eskisehircicekleri.com espacio2030.com esportszon.com ethirkaalam.com everlation.com evzek.net exceliqpro.com exoduskate.com exploreidku.com extra4games.com ezbuy.online fachowe-remonty.com factsbaazar.com faithfamilyandfootball.online farhadsanat.com fastter.allsb.ru fatimafashion.net fatimsaadan.website fbgameworld.com fcjwireless.com feedersgame.com femmesandco.com ferrypointinc.com fgatti.it fidelerbeta.com fightforolddc.net fijidirectoryonline.com fildactualite.com fincapaypay.com findfreetrial.com findmeqatar.com findthebesttreatmentcenter.com fischcharters.com fishingtamarindocostarica.com fishlakechick.com fisiopilatesclaradelrey.com fisj-official.com fisketackle.com.au fitnesstime.website fixitnowrnr.com fiyatmakinesi.com fizzlecrash.com flowerbed.cz forooshfori.com fortwaynehomeschoolacademy.com fozosjatekok.net frameset-uk.com fraternidadedobeijaflor.com frbproduction.com freepdfreview.com freshflesh.online fromrussiawithglove.com fullhdmoviez.net g2dijital.com gabbaland.com gacostore.com gadget-nations.net gaia-glow.com galaarchitecturaldesign.com galamotel.com galletour.com gamereview.website garagedoorrepairbasehorks.com garagedoorrepairhaworth.com garagedoorrepairmissionks.com garagedoorrepairparamus.com garagedoorrepairstilwellks.com garagedoorrepairteaneck.com garp-mate.com garrigue-gourmande.fr gathertofly.com gatodourado.com gayarambut.website gcgcatering.com geekroutine.com gensunasumus.website gentateknik.com geopolitics.website gesatstudio.com gespartrh.com getafemplea.com getbuzzwire.com getdfygmb.com gfcenergy.com ghimcaiao.com giaibaitap.website giantltdsrl.com gilbertobarriavallarino.com gilletjones.com gingkofarms.com gironacidade.net gizmomart.online glammylissa.com glebfetisov.com global-branded-residences.com global-talent-recruitment.com globalapostolicom.org gls-tracking.net gnarmasters.com goaugmentor.com golden-june.com grapevinetxcarpetcleaning.com graphicspapers.net greatinnova.com greatpeters.com greenebikes.com greenslotscenter.info greidphotos.com greldez-vous.fr gretaweddle.website gretelbroyn.com groobysauce.com group-avana.com group-capri.com groupejados.com gtcquangnam.com guidedmedia.website guitarristasdominicanos.com gustavomata.com gymproffsen.com gyrocopterexperience.com hailuaorganic.com hallakbrode.com halterophilie-musculation.com handbagsdistributorfactory.com handstandbuffer.com healthbody.website healthexpertsview.com healthtipsadvisor.com healthtipsbd.website healthunit.website healthy-lifestyle-guide.com healthymag.website heizung-fink.de helloshowbiz.website herbs-health.website herbsandenergynaturalcures.com herlenmurieles.net himalayancruiser.com hiphop100.com hiredunia.com hirianavi.com hithasini.com hoangsong.com hobilinka.com homeandgardendecoration.com homebuyeringrandprairie.com homefashioned.net homegenious.website hometrends.website homevisions.website honeafrik.com hop-merch.com hopespoint.com hopevacay.com hostingtraffic.net hotel-villasmariana.com hotspotgy.com hrbizdirectory.com huahinprantrip.com huellashn.com hunklinger-allortech.com hunteraluminum.com hydrovegie.com hyperbent.com i-c-p-inc.com iamnangial.com ibatsystem.com ibksplace.com iceongeist.com icsam2009.com ideiinpractica.com idnsbobet88.com idownfree.com ieakademi.com ifretmusic.com igenius253.com igorfoygel.com ihawangrill.com iketodiets.com ikiteglobal.com ilcinpromosyon.com ile-paradis.com iletcreativity.com ilkbetbonus.com ilkbetgiris.com illu-studio.com ilooktobuy.com ilpadellino.com imanagecareers.com importmada.com improvkings.com imtsa.fr indiatienda.com indiaulwe.com indigo-line.com indigoconseils.com indiviajes.com indoreplumbers.com indosbobett.com indrahidayat.website inexstore.com infinitiuma.com influencersworld.com influmify.com infocerta.com infopatcom.com infosatbg.com infoteachs.com infoterunik.com ingredientesar.com inicarane.com inno-maps.com innvestio.com inoptimista.com instant-dessin.com instantbusinesslistings.com insurecrib.com interiorsribno.info internetpipelinesuk.com intransplant.com investigacionsobreeleccema.com invisionthings.com inxsights.online ipathdesign.com ipegyourpardon.com iplmatcheslive.com ipltickets.website irckingston.com irenepijoan.com irmadrinziu.com ishtawellbeing.com isk-yokohama.com islandgreeneast.info isoldrain.com istanbulatlasi.com it-coman.de itstraveltimes.com ivoryspring.website jackmendelsohn.com jackrichards.website jainempireresorts.com jakesrugbytake.com janniebyars.website jantichy.cz jaremskiphotography.com jasadukunampuh.com jaymaxmarketing.com jcmarketing.website jeanjohnston.website jeanveutencore.com jesustudyblog.com jewelrybuyersinternational.com jillconger.website jmkhealthcare.com job-grand.com johnthompson.website jonathanrozenblit.com jorgelvallejov.com joseph.gergis.net josephhoke.website josephsutton.website josevinicius.online joytourtravelrevolution.com jupitergaragedoorrepair.com justsee.ru kakarenbandung.com kalakaaris.online kalamiscilingir.info kanada-resorts.info kanrel.com kanther.net karmagreetings.com katywatchman.website kepompong.online khanhlinhchung.com khuyenmai3mien.com kiki-seikotsu.com kinesiologiahogarysalud.com kiziltepedemirdogramacilareso.org kiziltepeototamircilereso.org klenamventures.com konkonsaafrica.com ksenta.ru kushnewsportal.com kuyubasicilingir.info lagocciadacqua.com lamthemonline.net lapausaproject.com lapradellina.it laptopminhlong.com lartdebienvivre.com lasatisfaction.com lastdaysfinancial.com laurenjurado.website leadozen.com lebazarfleuri.com lebinfluencers.com leochavarriaga.com lesarchivistes.net lesothersiders.com letsgetitstore.com liberty-bikes.fr licmerchant.website lifenatureblog.com lihuidachaoshi.com lili-plaf.pl lilywebbmysteries.com linkalligator.info lintasbandar66.com lion-dynasty.website livevideorobot.com llcgoldenhomes.com location-au-bord-de-mer.com logiccloudit.com lovingmommy.online lucillegray.website luggage-master.com luxjewelryzone.com luxuryexchangemanagment.com madenagi.com madereradosdemayo.com magicien-mentalisme-monaco.com mahendradhayal.com mahnazsahebjam.com majalahislam.net majalahkerjaya.com makhuyenmaivip.com mamakatubosyuu.com mara-big-five.com maramoldo.com marathonbuilding.com marcelboom.com marefatacademy.com marielmor.com mariusardelean.com mariuszmacieja.com marketgenrator.com markmollerus.de martinburch.com martinnoziglia.com martinowithanolive.com marwanjalaleddine.com marygospe.com masculindeplin.com massme.fr maudlinrealtygroup.com mauroparisi.it mayphatdienmynhat.com mazika2day.website mckenzieholtphotos.com mcqueentargets.com mdlab.ru media360zim.online media.xtronik.ru medientechnik-schmidt.de medshingepatil.com meilleursfilmsdvd.com melissadreamsofsushi.com mentorshelponline.com meshurizmirkumrucusu.com meshurizmirkumrusu.com metabolismrecovery.com metaldetectorpicks.com metalmatazaune.com meublessalon.net meufilhonasceu.com meximillenials.com mi1.fr michaelbadal.net midwestdefense.net midwinterfurniture.com milfpornograph.com mindable.health mindfulexperiments.com mini4wdph.com miningpms.com minnhydro.com minssushi.com mirage-net.com misionmua.com misoanime.com mithostel.com mix-engineer.com mkt-msk.ru mmoharvey.com mo-ta-san-pham.com mobile1reviews.com mobilyumm.com modern-houses.info modrenexp.com modsforandroid.com mohamedelhagan.com molinemgt.com mollylinslifestyle.com momtazdarbeiranian.com moncouplevamal.com money-industry.com moneysavingduo.com montaubanbeach.com moreofppc.com morty.ultrasrv.de mosamanagement.com mostamazing.website motorhaberleri.com motosierrastop.com mountainbikecorner.com movementmortgagewestcoast.com moverenow.com moviecliq.com movieskiduniya.info moviesongdrive.com moyburger.com mrandmrsthomas.fr msdemonir.com msrent2own.website muddasser.com mulherunica.online musclehealth.website musicforvideo.net mutlusonlu.xyz myinternetjobs.com mysmartcart.website nachoserrano.com nankaijidousya.com naturabenteuerteam.com naturalcure.website naturaltoys.online naturelovingenergy.com nedvigovka.ru netprava.ru netquarry.com new-york-city-limo-service.com newbalancestudios.com neweraservice.com newsedition.website newtohongkong.info nextgenerationfaithfulness.com nineheavenshealing.com nj-production.net nkybcc.com nmcchittor.com nospointscardinaux.com notlrealty.com novi.it novicetonoticeable.com novimedical.it nutritionmeetsfoodscience.com odisstoker.website off-road-light.ru offersforyourhouse.com ohwhatastagingsite.com oksanamanagementgroup.com oldschoolsurfshop.com olive-thai-karaoke.com olivefreaks.com omegabiuro.com.pl oncallplumbingofli.com oncarrot.com onlinedeegree.online onlinehelp.website onlinernprograms.info onyxstaffingagency.com optimistron.com orientalspawellness.com outcallentertainmentxxx.com outsourcingtrainingcenter.com palbarsport.com pandulabandaraphotography.com paolaricaurte.net paracrafts.website parentresources.info parisblockchainweeksummit.com partycake.online pcmamoru.com pearl-apartment.com pepperspraychoices.com pestcontrollocalwa.com petstores.com phukhoaphucminhtam.com pib-et-flo.com piccoloparadisobeverlyhills.com pinoytambayanhd.info pneumoniavaccinesresearch.com pompanogaragedoorrepair.com pompes-funebres-blouin-jego.com pompes-funebres-du-chateau.com precioushealthandwellness.com prodvizheniesaitovufa.ru proformancebaseballacademy.com proftests.ru promoprint.online propakistani.website publichealthnw.org qhiroofingsolarcontractors.com quadrantinvestmentgroupllc.com quantumstudents.online quickcarinsurance.info raceacrossamericachallenge.com racketlonmc.fr raisagarrido.com raissa.online rajasthani.website ralphbellis.website ranchocucamongaplumbinginc.com randlbrand.website rbvrrkarimnagarreddysociety.com reallyawesomeappfactory.com realmediterraneanparadise.com realsolutions.it recolecciondedesperdicios.com reeltalkwithchuckandpam.com refugiosloan.website renovation-alexdisa-paris.com rentalsecrets.net restaurantefincadelaribera.com restrive.online retouchingwedding.com reviewplus.website robertnguyen.website ropamadeinusa.com rosettefedora.com roshinteriors.com royalartgallery.online roywatkins.website rtvelvendrell.com ruudacflorida.com rwittrup.com sabbiirahamed.com saglamkarotcu.com sahrodion.com saladopress.com salimahsumbar.com sandovalcarpetcleaningllc.com sangamnernews.com sangothanhnam.com sarbaz.online sarumakyachay.com sasitamircisi.com satvahosting.website saudagartenda.com sauvaige.com savvylifetips.com scanztech.com scarbabunforum.info schonewohnung.com scorzacostruzioni.it screenwiki.website seafoid.org sehitliklerimiz.online sergioconner.website sergiupetrisor.com seritarghe.novi.it servimarqui.website servingandsightseeing.com sewaalatcampingjogja.com sgproperty.website shahiltoursandtravels.com sharingjoyhymnandbook.com shifaadialysiscenter.com shiodashika.com shivamloanconsultancy.com shopbuildingmaterialx.com shreeganeshtourandtravels.com shysbathandcandlebakery.online sigurjon.com skenterprises.net sketchacademy.net skupnieruchomoscizagotowke.com slastiotnasti.ru smartspirit.ru smitemedia.website soul-bg.com southfloridastaffinggroup.com sportcorbon.fr springfieldboardofrealtors.com sribnotravels.info srpresse.fr starcomidachinafuencarral.online stonelegends.website stonetowerminiatures.com story-aqua.com str8upmentoringfoundation.com studiomedicoscaparro.it studiomir.net studiooffside.com studiopsychologiczne.com suanhangay.com subdomain.petstores.com successhatch.website sukra-gmbh.de sulminaspneus.net suministrosyequiposltda.com sunilwaghale.website super-deals.website superbfightmarketing.com svettenkirch.de syscomopen.it taifturk.org tarotyvidenciavalentina.com taxi-aeroport-roissy.com tayloracademyofmusic.com tbkgf.org teamsolutionsconsulting.com techfreakonline.com technogamma.ru technogeek.website tecnologiaplay.net tecnologiaytendencia.com tekken3apkmod.com telenergia.eu tendenciasdeinternet.com tengxunyunyhw.com terrehappy.website testes.xor.ptservidor.net tetrasysgroup.com thaigoodsmart.com thaisagostini.com the-diamond-club.com the-diamond-credit-center.com thecabanadogs.com thecabovillas.com thecatpumpkin.com thechamberick.com thecowsareout.net thecuratedtravelcollection.com thecustomarmy.com theeightbells.net theemeraldrecruitinggroup.com thefionastarr.com thegreatcommissionpodcast.com thehealthy.website theinsidehome.com thelamichhane.com theleejackson.com themindpuzzle.com theresourcein.net theuppercut.website thezinker.com timesindia.website tinmountain.org top100burgers.com topfullmoon.website topnewfashion.com toptechoffers.com toptenonworld.com torycapital.com touring-athens.com trabasta.com traceotop.com traceyourfoodprint.org traffik77.com trascendentalarquitectura.com travelgoals.website travelstory.website tredepblog.net tricksdaily.website trilbiche.com tripitiew.com triptogig.com trongphuc.com trunghoc.online truyenlon.com tsurigear.com tuhlaya-pizda.info tumergrup.com turbo-one.com turismointernacionalonline.com turnerbiopharmaconsulting.com tvkidunia.com twinkletoesfootcare.com txcannaco.com tyagineha.com uberiboka.com unype.com utdshowrooms.com uviaus.com valerieclementphotography.com valleorbadepurazione.it vat-registration.com veranime.online viraltalks.website visafromindia.net visualmarketingypublicidad.com vitaepreno.online wacl3.com warcraftoutlet.com wardwealthmanagementgroup.com watch-hindi-movies-online.com weaving.online werecookingrestaurantsusa.com westchesterrestorations.com whitecottagehomeandliving.com windofchange.online wisconsinweimaraners.com wk7.org woodtennis.net woodysunglass.com wpchampion.website writegenuine.com wwwnutricionistalinacorpus.com x5oemza3jjjeb7j3.onion x-radio.net xiaomistore.website xtronik.ru yedeklemesunucusu.com yelletqazan.com yenisahracilingir.info yomecanico7.website yourservicezone.net yynew1000.000webhostapp.com zattslaw.com zettlerintegratedsolutions.com zurito.es # https://marcoramilli.com/2019/01/30/spreading-csv-malware-over-google-sheets/ 7bwh.com 99grams.ddns.net # https://marcoramilli.com/2018/11/16/microsoft-powerpoint-as-malware-dropper/ a.dolo.moe batteryenhancer.com ominigrind.ml # https://marcoramilli.com/2018/08/31/hacking-the-hacker-stopping-a-big-botnet-targeting-usa-canada-and-italy/ 1000numbers.com batterygator.com beard-style.com englandlistings.com next.gardenforyou.org pomidom.com pool.jfklandscape.com pool.thefutureiskids.com romanikustop.space securitytransit.site sssloop.host sssloop.space upsvarizones.space # https://marcoramilli.com/2018/06/08/dmosk-malware-targeting-italian-companies/ 4fsq3wnmms6xqybt.onion arh.mobipot.at bbb.mobipot.at clocktop.at drive.carlsongracieanaheim.com em2eddryi6ptkcnh.onion harent.cn inc.robatop.at j11.evama.at kerions.at loop.evama.at nap7zb4gtnzwmxsv.onion poi.robatop.at t7yz3cihrrzalznq.onion takhak.at torafy.cn u55.evama.at yraco.cn # https://marcoramilli.com/2018/05/28/malhide-an-interesting-malware-sample/ oddbods.co.uk promoclass.it # https://marcoramilli.com/2018/01/20/huge-botnet-attacking-italian-companies/ 239outdoors.com api.hailstorm360.com at.moonbeammagic.com bdi2.nomadicdecorator.com bentlabel.com cdvdautomator.com cerera.survivalbid.com cloudblueprintprogram.com cnchalftone.com comedyyall.com conticellolaw.com couplesdoingbusiness.com dvoper.com elis.k9redemptionrescue.com equinnex.com ericandchrissy.com evelynleekley.com expungementstennessee.com flaveme.com grkisland.com healingfoodconsulting.com hertzsynergy.com hollywoodisruption.com home-sphere.com host1.jodiray.com integrativenutritiontherapy.com jdkanyuk.com kineloveclips.com kylesinger.com legionchristmas.com mark.k9redemptionrescue.org menshoesonlinestore.com microtiasurgery.com movielotbar.com muiienweg.com niarhoslondon.com note.lawrencechoy.com ns15.dreamsinthesun.com nsc.dayswithsunrays.com opsantorinitours.com progunjobs.com rocketpak.com scottishwindowsolutions.com silkygames.com sip3.propertiesandprojects.com snapshotsandwhatnots.com snotterkind.com solespin.com ssl.vci-cfo.com strangerthanchristmas.com synchronr.com taramadden.com terento.website theargumint.com thegildedwren.com thejourneytogodsheart.com thesaltybody.com topsantorinitours.com tuftandneedles.com videospanishlessons.com vovachka.com wall-runners.com war-arena.com z1logistics.com zayantetinyhomes.com zefeed.com # https://marcoramilli.com/2017/12/29/info-stealing-a-new-operation-in-the-wild/ ssrdevelopments.co.za # https://marcoramilli.com/2017/08/01/topransom-from-email-attachment-to-powning-the-attackers-database/ 2010.sggt-wh.de actt.gr castillodepalazuelos.es jflo.ca n224ezvhg4sgyamb.onion.link oeirasdigital.pt # https://marcoramilli.com/2017/06/15/false-flag-attack-on-multi-stage-delivery-of-malware-to-italian-organisations/ androidtutorials.info base.androidtutorials.info base.magicians-blog.info base.ozarkpatternconcrete.info base.vuquoctrung.info executenet.pw magicians-blog.info mezzelune.com online.allscapelawnservices.com ozarkpatternconcrete.info quotidianoannunci.it ## microsoft https://www.microsoft.com/security/blog/microsoft-security-intelligence/ https://github.com/microsoft/mstic # https://www.microsoft.com/security/blog/2021/05/28/breaking-down-nobeliums-latest-early-stage-toolset/ 74d6b7b2.app.giftbox4u.com aimsecurity.net cdn.theyardservice.com cdnappservice.firebaseio.com cdnappservice.web.app cityloss.com content.pcmsar.net cross-checking.com dailydews.com dataplane.theyardservice.com doggroomingnews.com email.theyardservice.com emergencystreet.com enpport.com eventbrite-com-default-rtdb.firebaseio.com financialmarket.org giftbox4u.com hanproud.com holescontracting.com humanitarian-forum-default-rtdb.firebaseio.com humanitarian-forum.web.app logicworkservice.web.app newsplacec.com newstepsco.com pcmsar.net security-updater-default-rtdb.firebaseio.com security-updater.web.app smtp2.theyardservice.com static.theyardservice.com stockmarketon.com stsnews.com supportcdn-default-rtdb.firebaseio.com supportcdn.web.app tacomanewspaper.com techiefly.com theadminforum.com theyardservice.com trendignews.com usaid.theyardservice.com worldhomeoutlet.com # https://www.microsoft.com/security/blog/2021/05/27/new-sophisticated-email-based-attack-from-nobelium/ cdn.theyardservice.com dataplane.theyardservice.com static.theyardservice.com theyardservice.com usaid.theyardservice.com worldhomeoutlet.com ## pan-unit42 # https://unit42.paloaltonetworks.com/ # https://github.com/pan-unit42/iocs # https://unit42.paloaltonetworks.com/valak-evolution/ 00otg18ixk6o8kows.com 2zvdoq8grm7vwed20zz.com 5u2mr.com 9bgnq.com 9nag0.com 50pm4.com 58tiy.com 407.cd.gov.mn a0enorc6of7.com a4zy33hbmhxx70w9q.com a8xui1akl9gjqucfa.com a9nq0z.com adersr4utx.com amc4we.com amgvgrlm2w41l2lt373.com awh93dhkylps5ulnqbe.com bangrajan.org bbfjjf8.com bdd1b2i68gj.com bqoxits0mu0ga6aul.com c1j4xptyujjpyt8.com c1vfsbk.com c88gpm21qoal18bmk.com chersoicryss.com d6rc53.com d7uap.com d9q944ord8ltydx.com dwniu8n.com dy5x1.com e2o4bd6sh2b1sjk56fv.com e5ud9xh7fppe78y.com e7xfxb.com ebh3zy1l0l66zt144ph.com ebwz497.com edszkas7gimk7v.com eed9jqjd4b600bu2bmd.com eto9ve1.com f0hc7osjnl2vi61g.com fdhwgm.com fepz41.com ft6gw.com ft23fpcu5yabw2.com fw6rzlxc.com fz782ze.com g009clvp1l7.com g7bxxcu.com gandael6.com gma7im.com gr223t.com grumnoud.com gwn2649pm.com gx6995.com h6e2at7du07f7a2ip.com herzqvtpb99m0cn.com hges2gnmvvv8mv8yi.com his3t35rif0krjkn.com hlyctn2zx8zyjox1.com hswawuo7c8axfxw3.com hzo0aut97bfu7zweb.com ihgd1u.com iibb9j93k0z.com j4abq17dqadmb4hz.com j5sfioue15kxqs.com j20d7b.com je85oemozig2x4yq.com jzi0hc.com k0llld9j.com k1n3pxnd5e6x2h09adf.com k4xqhb6u4fo.com klt9x5q3tj.com kuvk07l2dzj6wfc.com kwjqbk2fw9p8q5y.com kzex9vp0jfw6a8up1.com l95dtz8.com landcareus.com le7dv4wry1qy0dozbdf.com lj2xwtcr7920v8.com ls9areetm1cxszmsgck.com m1rd9egxfxinnsoq.com m2mfbpsqgq0e2e20.com m4tz0of0xi8o3brr.com m8pwsczg0bbzw48j7.com mbzrrt.com nbwvg2egflr8t2da1wo.com nrhlxbt9covscex9b.com nwwgbluv65j6g0xgrxk.com oaw5ibkcxru.com ofxvp.com p7hne.com pk3ehqmow0a.com pui4p.com qqm9lv.com qut6oga5219bf00e.com qut69bf00e.com rlb9lmt.com se66ndx04fofu3sqv.com siicg8lgad.com siicg8lgadurupkt.com sktrutx.com sxfacemask.com tpc2snch0g7njxjq.com ttcfv.com turjaxqqzwyfzy6a.com u8pmg.com v0rzpbu.com v4x99v.com voaxd.com vrsv2haqaq3xy6x.com w0j3oq.com wfpyutf.com wnrfa9y.com ws3adlfkm1.com ws3lfkm.com nasproje.com x0fopmxsq5y2oqud.com xcjhb30ton.com xekolw77fznpwzb.com xljksdu.com xolzrorth.com xsiv7v4qzjq6rdmpp.com xumti39cg1kuf9t2y.com ya66lsx81lwxocgey.com yfpyutf.com zp9x80h.com zs6eb.com # https://unit42.paloaltonetworks.com/oilrig-novel-c2-channel-steganography/ acrlee.com allsecpackupdater.com digi.shanx.icu intelligent-finance.site kizlarsoroyur.com kopilkaorukov.com oudax.com rdmsi.com rsshay.com sharjatv.com tacsent.com tprs-servers.eu wwmal.com # https://unit42.paloaltonetworks.com/cryptojacking-docker-images-for-mining-monero/ 5pwcq42aa42fjzel.onion 73avhutb24chfsh6.onion # https://unit42.paloaltonetworks.com/lucifer-new-cryptojacking-and-ddos-hybrid-malware/ qf2020.top # https://unit42.paloaltonetworks.com/los-zetas-from-eleethub-botnet/ eleethub.com ghost.eleethub.com irc.eleethub.com # https://unit42.paloaltonetworks.com/hoaxcalls-mirai-target-legacy-symantec-web-gateways/ plexle.us # https://unit42.paloaltonetworks.com/updated-backconfig-malware-targeting-government-and-military-organizations/ unique.fontsupdate.com # https://unit42.paloaltonetworks.com/covid-19-themed-malware-within-cloud-environments/ kplico.com tempinfo.96.it unlimitedimportandexport.com # https://unit42.paloaltonetworks.com/silverterrier-covid-19-themed-business-email-compromise/ 6uniteddefenceforstdygorvermentsocialeme.duckdns.org 12kungwsdyducationaldeveloperinvestmenty.duckdns.org academydea.com americanmicrosoftclouddepartment.duckdns.org antipiracydetectorganisationforwsdy3film.duckdns.org bbchenkotsdywoolandpappercompanybnhs5.duckdns.org chinoex2onlineantibullyandgeneralxpstdy5.duckdns.org chnes9wealthandstdyorganisationsumit.duckdns.org chneswealstdy8thandorganisationjokbo.duckdns.org chneswealthandorganisationstdy7joppl.duckdns.org chneswsdy8wealthandorganisationjokbo.duckdns.org chneswsdy13wealthandmoduleorganisationrn.duckdns.org chnfrndsecurityandgorvermentstdy1socialf.duckdns.org chnfrndsub1inteligentangencysndy4project.duckdns.org chnfrndtsdysecurityandgorvermentsocialjf.duckdns.org chnfrndwsdy1securityandgorvermentsocialf.duckdns.org cloudfilesharingdomainurllinksys.duckdns.org coffiices.com crimedetectivefor1stdygorvermentndsocial.duckdns.org empowermentorganisationstday1government.duckdns.org engin3worldstdydevelopmentandtechnology.duckdns.org engintsdy3worlddevelopmentandtechnology.duckdns.org fileexchangeserverprotocolsystemintergra.duckdns.org filegotosecureothers.duckdns.org frndgreen1frdycreamcostmeticsladiesshop.duckdns.org frndgreen3creamwsdycostmeticsbabystored.duckdns.org globaltransfersecurefilethroughcloud.duckdns.org goldenlion.sg green9wsdyelectronicsandkitchenappliance.duckdns.org investmenteducationkungykmtsdy8agender.duckdns.org kung11ducationalstdydeveloperinvestmenty.duckdns.org kung13eduationalstdydeveloperinvestmenty.duckdns.org kungeducationalinvestment8tusdyagender.duckdns.org kungfrdyeducationalinvestment8agender.duckdns.org kungglobalinvestmenteductgpmstdy8addres.duckdns.org kungglobalinvestmentjpjeductaddres5stdy.duckdns.org kungglobalinvestmentjpjwsdy6eductaddres.duckdns.org kungstdy7globalinvestmentjmpeductaddres.duckdns.org kungwsdy7globalinvestmentjmpeductaddres.duckdns.org livevideoremoteconference.duckdns.org mastervisacloudesystemprtomicrosftwareus.duckdns.org mecharnise.ir mikeservers.eu modcloudserver.eu msofficeinternatiinalfilecloudtransfer.duckdns.org msofficewordfiletransfertotheadmintrue.duckdns.org office365securefilegatewaytransfer.duckdns.org omentradinginternationalprivateltd.duckdns.org petroindonesia.co.id posqit.net prodigtsdy5organizationalcompanygroupin.duckdns.org reynoldsgh.com russchine2specialstdy1plumbingmaterialsv.duckdns.org russchine2specialstdy2plumbingmaterialgh.duckdns.org russchine2wsdy1specialplumbingmaterialsv.duckdns.org russchine2wsdyspecial6plumbingjkmaterial.duckdns.org shgshg9nationalobjwsdyindustrialgoogler.duckdns.org shgshg13nationalwsdyobjindustrialatempt.duckdns.org shgshgnationalindustrialwsdy8googleklm.duckdns.org shgshgnationalobjindustrialstdy10atempt.duckdns.org shgshgnstdy7ationalindustrialgoogleklm.duckdns.org shgshgstdy9nationalobjindustrialgoogle.duckdns.org silentexploitfileexchangerzeroday.duckdns.org sylvaclouds.eu tescogroseryand1wsdayelectronicstorehome.duckdns.org tescohomegroseryandelectronicstday2store.duckdns.org tescostday1groseryandelectronicstorehome.duckdns.org uzoclouds.eu webxpostdytechnologyhardsoftware5buyers.duckdns.org welheadcontrol.com wewewewewesesesesasbacwederffggffddsss.duckdns.org windowsdefenderwithfiewallprotocolsecure.duckdns.org windowsfirewallprotcolsecuritysystem.duckdns.org worldengindevelopnw7stdymenttechnology.duckdns.org # https://unit42.paloaltonetworks.com/anatomy-of-formjacking-attacks/ 92wear.vn cheshirehorse.com posterburner.com # https://unit42.paloaltonetworks.com/how-cybercriminals-prey-on-the-covid-19-pandemic/ allsurgicalfacemask.com anticovid19-pharmacy.com buygoods.com cdn.dsultra.com corona-map-data.com corona-masr3.com corona-masr4.com corona-masr21.com corona-virusapps.com corona-virusus.com coronamasksupply.com coronashirts.store coronavirus2day.com coronavirus123.org coronavirus-com.info coronavirus-game.ru coronavirus-latest-update.info coronavirusaware.xyz coronaviruscovid19-information.com coronavirusinrealtime.com coronavirussecrets.com coronavirusstatus.space covid19-remedy.com covid19center.online covid-19-gov.com covide19cleanse.com covidpreventandcure.com covidwhereandhow.xyz facemasksus.com hashtag.sslproviders.net internet-covid19.xyz pandemic-survival-coronavirus.com rxcovid.com selectsanitizer.com sharkroulette.com sunrisepromos.com surgicalfacemaskpharmacyonline.com survivecoronavirus.org whatsapp.cc0.co whatsapp.version.gratis # https://unit42.paloaltonetworks.com/covid-19-themed-cyber-attacks-target-government-and-medical-organizations/ ftp.lookmegarment.com tempinfo.96.lt # https://unit42.paloaltonetworks.com/apt41-using-new-speculoos-backdoor-to-target-organizations-globally/ alibaba.zzux.com exchange.longmusic.com # https://unit42.paloaltonetworks.com/new-hoaxcalls-ddos-botnet/ irc.hoaxcalls.pw # https://unit42.paloaltonetworks.com/guloader-installing-netwire-rat/ artizaa.com matpincscr.com murthydigitals.com myamystills.com Novmintservices.com ptgteft.com rossogato.com saidialxo.com # https://unit42.paloaltonetworks.com/molerats-delivers-spark-backdoor/ app.msexchanges16.com clients.itresolver.online cloudserviceapi.online dapoerwedding.com goldenlines.site laceibagrafica.com laptower.com motoqu.com msexchange13.com nysura.com servicebios.com smartweb9.com update.itresolver.online Update.nextdata.site updates.masterservices.online webtutorialz.com zmartco.com # https://unit42.paloaltonetworks.com/cortex-xdr-detects-netsupport-manager-rat-campaign/ # https://github.com/pan-unit42/iocs/blob/master/NetSupportManager 4ourkidsky.com adroitpmps.com afsasdfa33.xyz alpinehandlingsystems.com brotherselectricco.com busyserviceinc.com edisonlee.net eom-nv.com firstteamcareer.com geo.netsupportsoftware.com hostfleek.com innovativemasonry.net jintsung.cn jnachb.com latamdcs.com ledampenergy.net marketium.com newtontool.ca quickwaysignstx.com romashka.cn ultraeventgroup.com unclebillswv.com # https://unit42.paloaltonetworks.com/xhunt-campaign-new-watering-hole-identified-for-credential-harvesting/ cloudipnameserver.com ffconnectivitycheck.com googie.email lowconnectivity.com # https://unit42.paloaltonetworks.com/the-fractured-statue-campaign-u-s-government-targeted-in-spear-phishing-attacks/ downyes.c1.biz # https://unit42.paloaltonetworks.com/muhstik-botnet-attacks-tomato-routers-to-harvest-new-iot-devices/ s.shadow.mods.net y.fd6fq54s6df541q23sdxfg.eu # https://unit42.paloaltonetworks.com/threat-brief-iranian-linked-cyber-operations/ 0ffice365.agency 0ffice365life 0ffice365services 0ffice.com 0ffiice.com 0nedrive.agency 0utlook.bid acrobatverify.com adfg.ae adibf.ae adpolioe.com Akamai.agency akamaiedge.live akamaiedge.services akamaized.live akdns.live allexa.net alsalam.ddns.net amazo0n.serveftp.com analytics-google.org asimov-win-microsoft.services azureedge.today benangin.com boeing.servehttp.com brit.ns.cloudfronts.services britns.akadns.live britns.akadns.services cankayasrc.com cdnakamaiplanet.com cdnmsnupdate.com chrome-up.date chromup.com cisc0.net ciscoupdate2019.gotdns.ch corewindows.agency cpuproc.com data-microsoft.services defender-update.com dns.cloudfronts.services edgekey.live ektamservis.com getgooogle.hopto.org gladiyator.tk googleads.hopto.org googlmail.net gtme.ae hotmai1.com hubinasia.com iecvlist-microsoft.live jsonstore.io kaspersky.host latvia-usa.org maccaffe.com managehelpdesk.com Microsoft-publisher.com microsoftexplorerservices.cloud microsoftonline.agency microsoftsubsystem.com-adm.in microsoftupdated.com microsoftupdated.net msdncss.com msoffice365update.com msservice.site mywinnetwork.ddns.net ngaaksa.ddns.net ngaaksa.sytes.net ns2.akadns.live ns2.akadns.services nsatc.agency ntpupdateserver.com office365-technical.info onecs-live.services onedrive.agency oorgans.com osupd.com phicdn.world prosalar.com qualitweb.com rdppath.com securityupdated.com service1.chrome-up.date service-eset.com service-essential.com service-explorer.com service-norton.com service.chrome-up.date servicesystem.serveirc.com shareliverpoolfc.co.uk sharepoint.agency shopcloths.ddns.net simsoshop.com skydrive.agency skydriveservices suncocity.com syn.broadcaster.rocks syn.timezone.live t-msedge.world tbs1.microsoftonline.services tbs2.microsoftonline.services timezone.live tvs1.trafficmanager.live tvs2.trafficmanager.live update-symantec.com valis-ti.cl vinnellarabia.myftp.org windowspatch.com withyourface.com zandelshop.com zeverco.com zstoreshoping.ddns.net # https://unit42.paloaltonetworks.com/rancor-cyber-espionage-group-uses-new-custom-malware-to-attack-southeast-asia/ Connect.bafunpda.xyz cswksfwq.kfesv.xyz # https://unit42.paloaltonetworks.com/mirai-variant-echobot-resurfaces-with-13-previously-unexploited-vulnerabilities/ # https://github.com/pan-unit42/iocs/blob/master/mirai/ECHOBOT_28thOct2019.md akuma.pw akumaiotsolutions.pw # https://unit42.paloaltonetworks.com/trickbot-campaign-uses-fake-payroll-emails-to-conduct-phishing-attacks/ clementeolmos.com lindaspryinteriordesign.com maisonmarielouise.org savute.in # https://unit42.paloaltonetworks.com/pkplug_chinese_cyber_espionage_group_attacking_asia/ mefound.com zyns.com # https://unit42.paloaltonetworks.com/xhunt-campaign-attacks-on-kuwait-shipping-and-transportation-organizations/ antivirus-update.top # https://unit42.paloaltonetworks.com/newly-registered-domains-malicious-abuse-by-bad-actors/ aaqkekyaum.org canada-neflxt.com eqbqcguiwcymao.info facebo0k.com halanis21yi84alycia.top hvkbvmichelfd.info installsvpn.com ketoweightlosspillsreviews.com litvxvkucxqnaammvef.com llzvrjx.site mercinogenitor.com mey12d4.xyz qgasocuiwcymao.info soroog.xyz system-alert-m99.xyz t-mogbile.com ypwosgnjytynbqin.com # https://unit42.paloaltonetworks.com/rockein-the-netflow/ cloudappconfig.com heheda.tk # https://unit42.paloaltonetworks.com/unveiling-11-new-adversary-playbooks/ # https://pan-unit42.github.io/playbook_viewer/ aa123.spdns.de s3.sovereigncars.org.uk t.w2wz.cn w.3ei.xyz w.21-3n.xyz # https://unit42.paloaltonetworks.com/attackers-increasingly-targeting-oracle-weblogic-server-vulnerability-for-xmrig-and-ransomware/ aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion decryptor.top # https://unit42.paloaltonetworks.com/behind-the-scenes-with-oilrig/ Myleftheart.com office365-management.com # https://unit42.paloaltonetworks.com/aggah-campaign-bit-ly-blogspot-and-pastebin-used-for-c2-in-large-scale-campaign/ bhenchood.ddns.net bjm9.blogspot.com blackhagga.duckdns.org bullol.duckdns.org buydildoonline.blogspot.com cocomo1.ddns.net cocomo2.ddns.net cocomo2.serveblog.net cocomo3.serveblog.net cocomo4.serveblog.net cocomo5.serveblog.net cocomo6.serveblog.net cocomo7.serveblog.net cocomo8.serveblog.net cocomo9.serveblog.net cocomo10.serveblog.net cocomo.ddns.net cycbra.duckdns.org decent1.myvnc.com decent2.myvnc.com decent3.myvnc.com decent4.myvnc.com decent5.myvnc.com decent.myvnc.com easykill1.servepics.com easykill2.servepics.com easykill3.servebeer.com easykill3.servepics.com easykill.servebeer.com emawattttson.blogspot.com emmanuelstevo.ddns.net frankmana.duckdns.org haggasinger1.ddns.net haggasinger2.ddns.net haggasinger.ddns.net helloweenhagga2.ddns.net helloweenhagga3.ddns.net helloweenhagga4.ddns.net helloweenhagga.ddns.net jayztools1.ddns.net jayztools2.ddns.net jayztools3.ddns.net jordanchen736.sytes.net jordanchen7361.sytes.net jordanchen7362.sytes.net jordanchen7363.sytes.net kronoz.duckdns.org kronozzz2.duckdns.org lalacious1.serveftp.com lalacious2.serveftp.com lalacious3.serveftp.com lalacious4.serveftp.com loramer1.ddnsking.com lulla.duckdns.org lullikhao1.ddns.net lullikhao2.ddns.net lullikhao.ddns.net majorsss.duckdns.org mastermana1.serveirc.com mastermana2.serveirc.com mastermana3.serveirc.com mastermana4.serveirc.com mastermana5.serveirc.com miganshumarataa.blogspot.com miganshumaratamoligossa.blogspot.com mrcode1.hopto.org mrcode2.hopto.org mrcode.hopto.org myownlogs.duckdns.org office365update.duckdns.org oldmandnsch.duckdns.org pussi2442.ddns.net revengerx210.sytes.net revengerx211.sytes.net revengerx212.sytes.net revengerx213.sytes.net revengerx214.sytes.net revengerx215.sytes.net revengerx216.sytes.net revengerx217.sytes.net revengerx218.sytes.net revengerx219.sytes.net skyrocket1.duckdns.org systen32.ddns.net totallol1.duckdns.org totallol2.duckdns.org totallol3.duckdns.org totallol.duckdns.org treffictesgn.blogspot.com workfine11.duckdns.org zinderhola1.ddns.net zinderhola.ddns.net # https://unit42.paloaltonetworks.com/cardinal-rat-sins-again-targets-israeli-fin-tech-firms/ affiliatecollective.club s.dropinbox.host s.spotmacro.online secure.dropinbox.pw secure.spotoption.pw wikipeldia.org # https://unit42.paloaltonetworks.com/new-mirai-variant-targets-enterprise-wireless-presentation-display-systems/ autourbe.com.co epicrustserver.cf ## prodaft # https://github.com/prodaft/malware-ioc # https://github.com/prodaft/malware-ioc/tree/master/SilverFish # https://www.prodaft.com/m/uploads/SilverFish_TLPWHITE.pdf 40ort.750.credit adagio.betterworldshopping.com admirer.onehourcfo.com alertmeter.info backup.awarfaregaming.com bmlor.750.credit builder.visionarybusiness.net champions.gdtc.org coloradospringsroofing.info combat.strategyforgood.com context.septemberyears.org d3ser9acyt7cdp.cloudfront.net daddy.stlouisdemoday.com defender5.coachwithak.com enkins.findfwd.com fanta.swofficefurniture.com flowers.netplusplans.com flowers.thegardnerco.com freeresultsguide.com freespace.givingprofits.net gallery.wineadam.com group3.pulsedesigngroup.us inferno.bigpurposebigimpact.com inspirer.cartsandmowers.com joke.webproduct.info joomla.lifepath.site lamarfish.com lion.vipjoyeria.com method.nonprofitsustainability.com moreeu.cn moreofit.cn phpmyadmin.xsunx.com pixelapn2.adsprofitnetwork.com pixelapn.adsprofitnetwork.com plkiu.daniyalmedicaltech.com pointers.ecostratas.com popcorn.net-zerodesign.com printing.laminatesandthings.com promo9.promossupply.com prompt.powerofpartnerships.net q.promossupply.com robotvice.com rock.core-thought.com roofingspecialists.info rtfv.info/time securesearchnow.com signup-now.com snuff.mybabyrose.com standart.sdtranspo.com tanzaniafisheries.com test.directfwd.com test.news.pocketstay.com time.suehyatt.com twimg-us.azureedge.net zombie.susan-hyatt.com # https://github.com/prodaft/malware-ioc/tree/master/FluBot # https://raw.githubusercontent.com/prodaft/malware-ioc/master/FluBot/FluBot.pdf 42sf.net 84blog.xyz 100cuo.com admh.in agroescape.com aitao.site alercehistorico.cl amirapache.ir amzstudy.com anapa-dive.ru apartners.vn audioquran.kz brighterdaysfi.com buguilou.com byalex-photography.co.uk canhair.net cbd-and-epilepsy.com cbd-and-seizures.com cloudstrading.com contornosdesign.pt creolegarden.com cssincronbucuresti.ro danacadesign.com dgeneration.in divam.ir dumeiwu.com ekremakin.org elektroprommash.ru elitekidsbookzone.sch.ng escuelaargentina.cl export-barazande.com fraternitykerala.org freeavporn.com garveylibertyhall.com getblogour.com gladiadoresdevendas.com.br grahaksamachar.in hentaivillage.com idea-soft.it illuminaticult.org imrt.ac.in imw6.com imwedsonpassos.com.br industrial-land.vn internetpathshala.co isabelsantos123.pt itaperunatem.com.br jexchange.ga kidimy.org kofacins.com lacasa-dh.nl lamoraleja.com.co larrecantofeliz.com.br ln-lighting.com londonroofingpros.co.uk machupicchutraveling.com mimi-mi.studio muaadzawy.com mucc.com.au mvpmsadhyapak.in nakoblog.info nbkangxi.com nfiuerwtftasnuk.com omvshop.com ouyangpengcheng.xyz palinkapatika.com payamesavadkooh.ir pescadorsportsgroup.com portalcalamuchita.com.ar printing-packingshow.ir pudhuveedu.in raeloficial.com raku-plus.com recycom.gr rishipes.co.nz rpgbundle.info ryansa.com sailorcrossfitmdp.com sdlformazione.it skipshopping.net spave.com.pk sprintintercom.com.au srinterior.co.in studiobonazzi.eu team1global.com.au techbharat.org.in telec.com.pk telugufusion.com teologianaweb.com.br thejoblessemperor.in tie.org tnell.com tuyennvtb.com twospoonsfleet.co.uk vacad.net valks3d.com.br videoeditorhub.com visotka.in weboyal.com wwworks.com.au wxz14.com xatziemmanouiltools.gr xjnwqdospderqtk.ru xn--thvitstore-c7a.com xref.icu ylem222.com yulu1953.cn zyzlk.com # https://github.com/prodaft/malware-ioc/tree/master/BrunhildaProject # https://github.com/prodaft/malware-ioc/blob/master/BrunhildaProject/BrunHilda_DaaS.pdf gymwithoutproblems.club skeletontree.top ttdom.xyz welnessfitnessclub.club # https://github.com/prodaft/malware-ioc/tree/master/OpBlueRaven # https://threatintel.blog/OPBlueRaven-Part1/ # https://threatintel.blog/OPBlueRaven-Part2/ colorpickerdesk.com digitalsoundmaker99.com expressdesign9.com fgfotr.com hawrickday.com hong-security.com landscapesboxdesign9.com milkmovemoney.com moviedvdpower.com mozillaupdate.com nattplot.com softowii.com tableofcolorize.com untypicaldesign9.com uoplotr.com vmware-cdn.com ## sentinelone # https://labs.sentinelone.com/ # https://www.sentinelone.com/labs/hide-and-seek-new-zloader-infection-chain-comes-with-improved-stealth-and-evasion-mechanisms/ dksaoidiakjd.com iqowijsdakm.com iweuiqjdakjd.com klbaccpoqquilwmyaxcy.com mjwougyhwlgewbajxbnn.com odjdnhsaj.com odoishsaj.com odsakjmdnhsaj.com odsakmdfnbs.com olksmadnbdj.com pornofilmspremium.com team-viewer.site teamviewerdownload.fastforbusinessandpersonaluserourserviceaugust.alightindarkplacesbook.com websekir.com wiewjdmkfjn.com yuidskadjna.com zoomvideo.site # https://www.sentinelone.com/labs/egomaniac-an-unscrupulous-turkish-nexus-threat-actor/ adobupdate.serveftp.com adobupdate.servehttp.com antivirus.myftp.org blogg.serveblog.net driver.myftp.org halkinsesitv.com messenger.serveirc.com tigereyes2.servepics.com twiter.serveblog.net # https://labs.sentinelone.com/noblebaron-new-poisoned-installers-could-be-used-in-supply-chain-attacks/ 74d6b7b2.app.giftbox4u.com content.pcmsar.net doggroomingnews.com hanproud.com # https://labs.sentinelone.com/from-wiper-to-ransomware-the-evolution-of-agrius/ theisnonamelikethis29123.com whynooneistherefornoneofthem.com #https://labs.sentinelone.com/a-deep-dive-into-zebrocys-dropper-docs/ c4csa.org xbhp.com # https://labs.sentinelone.com/new-macos-malware-xcodespy-targets-xcode-developers-with-eggshell-backdoor/ alinbox.co appmarket.co cralev.me elemark.co everestnote.com liveupdate.cc recentnews.cc suppro.co truckrental.cc # https://labs.sentinelone.com/inside-a-trickbot-cobaltstrike-attack-server/ wizardmagik.best # https://labs.sentinelone.com/sarwent-malware-updates-command-detonation/ beurbn.com blognews-joural.best blognews-joural.com blognews-joural.info blognews-journal.com rabbot.xyz rubbolt.xyz rubbot.xyz seoanalyticsp34roj.xyz seoanalyticspro32frghyj.xyz seoanalyticsproewj.xyz seoanalyticsproj.xyz seoanalyticsprojrts.xyz seoanalyticsptyrroj.xyz shopstoregame.icu shopstoregames.icu shopstoregamese.com shopstoregamese.icu softfaremiks.icu startprojekt.pro startprojekt.pw tebbolt.xyz terobolt.xyz treawot.xyz vertuozoff.club vertuozoff.xyz vertuozofff.club vertuozofff.com vertuozofff.xyz vertuozoffff.club whatsmyhomeworthlondonontario.ca # https://labs.sentinelone.com/the-anatomy-of-an-apt-attack-and-cobaltstrike-beacons-encoded-configuration/ asiasyncdb.com eustylejssync.appspot.com officeasiaupdate.appspot.com # https://labs.sentinelone.com/threat-intel-update-cyber-attacks-leveraging-the-covid-19-coronavirus-pandemic/ dewakartu.info dewarejeki.info drhuzaifa.com easytogets.com erasmus-plius.tomasjs.com f1.pipen.at intvmdt.us io.laurela.at whintdm.us ya.aftnoop.at # https://labs.sentinelone.com/breaking-ta505s-crypter-with-an-smt-solver/ 123faster.top compilator333.top conversia91.top creatorz123.top fatoftheland.top general-lcfd.com home-storages.com integer-ms-home.com microsoft-live-us.com ms-break.com ms-home-store.com ms-rdt.com ms-upgrades.com online-office365.com onms-home.com upgrade-ms-home.com windows-avs-update.com windows-en-us-update.com windows-se-update.com # https://labs.sentinelone.com/pro-russian-cyberspy-gamaredon-intensifies-ukrainian-security-targeting/ masseffect.space # https://labs.sentinelone.com/top-tier-russian-organized-cybercrime-group-unveils-fileless-stealthy-powertrick-backdoor-for-high-value-targets/ drive.staticcontent.kz kostunivo.com magichere.icu magikorigin.me northtracing.net traveldials.com web000aaa.info wizardmagik.best # https://labs.sentinelone.com/fin7-malware-chain-from-office-macro-malware-to-lightweight-js-loader/ bing-cdn.com cisco-cdn.com googleapi-cdn.com realtek-cdn.com # https://labs.sentinelone.com/fin6-frameworkpos-point-of-sale-malware-analysis-internals-2/ ns.a193-45-3-47-deploy-akamaitechnologies.com ns.akamai1811.com # https://labs.sentinelone.com/reversing-rig-exploit-kit-infection-chain-internals-exploits/ bitcoinsmaker.site ## sophos # https://news.sophos.com/en-us/category/sophoslabs/sophoslabs-uncut/ # https://github.com/sophoslabs/IoCs # https://news.sophos.com/en-us/2021/04/15/bazarloader/ # https://github.com/sophoslabs/IoCs/blob/master/Troj-BazarLd.csv australiatourism.bazar bestsightsofwildaustralia.bazar restinaustraliaplace.bazar sightsofsydney21.bazar sydneynewtours.bazar vacationinsydney2021.bazar # https://news.sophos.com/en-us/2021/03/23/black-kingdom/ # https://github.com/sophoslabs/IoCs/blob/master/Ransomware_BlackKingDom.csv yuuuuu44.com # https://news.sophos.com/en-us/2021/02/16/conti-ransomware-evasive-by-nature/ # https://github.com/sophoslabs/IoCs/blob/master/Ransomware-Conti.csv contirecovery.best docns.com tapavi.com # https://news.sophos.com/en-us/2021/01/21/mrbminer-cryptojacking-to-bypass-international-sanctions/ # https://github.com/sophoslabs/IoCs/blob/master/Miner-Mrbminer.csv mrbfile.xyz mrbftp.xyz mrbpool.xyz poolmrb.xyz vihansoft.ir # https://news.sophos.com/en-us/2021/01/12/new-android-spyware-targets-users-in-pakistan/ # https://github.com/sophoslabs/IoCs/blob/master/Android-pakchat.csv kv33.zapto.org pakchat.online pmdu.info tplinsurance.xyz # https://news.sophos.com/en-us/2020/12/18/fishy-french-covid-contact-tracing-app-is-a-data-thief-pest/ # https://github.com/sophoslabs/IoCs/blob/master/Android-fauxanticovid.csv bandofdna.top clubmasters.top differentplayers.top jrdonnald.top newwaystadium.top # https://news.sophos.com/en-us/2020/12/16/systembc/ # https://github.com/sophoslabs/IoCs/blob/master/Malware-SystemBC.csv advertrex20.xyz advertsp74.xyz asdasd08.com asdasd08.xyz decatos30.com decatos30.xyz gentexman37.xyz mexstat128.com sdadvert197.com shopweb95.xyz # https://news.sophos.com/en-us/2020/10/14/inside-a-new-ryuk-ransomware-attack/ # https://github.com/sophoslabs/IoCs/blob/master/Ransomware-Ryuk.csv chainnss.com fastbloodhunter.com mn.fastbloodhunter.com # https://news.sophos.com/en-us/2020/09/24/email-delivered-modi-rat-attack-pastes-powershell-commands/ mondns.myftp.org phix.es vanesaescribano.com # https://news.sophos.com/en-us/2020/09/09/faking-it-the-thriving-business-of-fake-alert-web-scams/ # https://github.com/sophoslabs/IoCs/blob/master/mal-fakealert.csv abdurantom.com airwiseq.cf appconnect.bekapro.xyz apps-notification.com goodthings.ml helpiossuprrt.info highsecureus.com ios-service-billing1-xps.azurewebsites.net lookee.info m.smita.club peachtrackerus.com popads.net popcash.net promobi-shield.eu qwertyasia.com qwertytracks.com qwertytrackz.com satecgs.xyz serverconnect.boraer.xyz support-main.com support.dheje.xyz support.lolopod.xyz support.marusia.xyz support.paluns.xyz system-update-alert.com top.support-quick.com trackoo.info trafiq.party yourphoneboost.com # https://news.sophos.com/en-us/2020/08/25/lemon_duck-cryptominer-targets-cloud-apps-linux/ # https://github.com/sophoslabs/IoCs/blob/master/Trojan-LDMiner.csv d.ackng.com lplp.ackng.com t.amynx.com t.jdjdcjq.top t.zer9g.com t.zz3r0.com # https://news.sophos.com/en-us/2020/07/14/raticate-rats-as-service-with-commercial-crypter/ # https://github.com/sophoslabs/IoCs/blob/master/malware-raticate-cloudeye.csv allenservice.ga anransd.com bbbr1.ddns.com.br castmart.ga farsson.com ggautosrep.ga glowtey.com jevuknz34ronf3pl.onion nyoxibwer.com pitchstak.ga stngpetty.ga # https://news.sophos.com/en-us/2020/07/02/mykings-jumps-on-the-corona-train/ 64.5b6b7b.ru 64.myxmr.pw catsmeowalot.com cnc.f4321y.com cyg2016.xyz down2.b5w91.com down2.b591.com down.0814ok.info down.down0116.info down.f4321y.com down.my0115.ru down.my0709.xyz down.mykings.pw down.mys2018.xyz down.mysking.info down.oo000oo.club down.wpdtest1017.site dwon.f321y.com dwon.kill1234.com f321y.com f4321y.com ftp.0603bye.info ftp.1226bye.xyz ftp.ftp0930.host ftp.ftp1202.site gamesoxalic.com ioad.pw jpgo.ru js.0603bye.info js.5b6b7b.ru js.1226bye.xyz js.f4321y.com js.ftp1202.site js.mykings.pw js.mys2016.info js.oo000oo.club kr1s.ru kriso.ru mbr.kill0604.ru ms.maimai666.com mykings.pw nb.ruisgood.ru ok.mymyxmra.ru ok.xmr6b.ru own.mykings.pw p.mykings.pw pc.pc0416.xyz rucop.ru ruisgood.ru shell.upme0611.info u.f321y.com up.f4321y.com up.ms1128.site upme0611.info win2016ok.hatenablog.com wmi.0814ok.info wmi.1103bye.xyz wmi.1217bye.host wmi.my0115.ru wmi.my0709.xyz wmi.mykings.top wmi.oo000oo.club wpd0126.info xmr.5b6b7b.ru xmr.xmr5b.ru zcop.ru # https://news.sophos.com/en-us/2020/06/24/glupteba-report/ # https://github.com/sophoslabs/IoCs/blob/master/Trojan-Glupteba 1.podcast.best anotheronedom.com bestblues.tech capmusic.ru easywbdesign.com fundbook.xyz gamedate.xyz getfixed.xyz gfixprice.xyz hotaction.online hotbooks.xyz infocarnames.ru maxbook.site maxbook.space myonetime.top netoftime.com pathmyonetime.top robotatten.com setbird.website sleepingcontrol.com sndvoices.com venoxcontrol.com whitecontroller.com # https://news.sophos.com/en-us/2020/06/09/kingminer-report/ # https://github.com/sophoslabs/IoCs/blob/master/Troj-Kingmine 1d28ebfdae.com 309cffdae.tk 3096bfdae.com 3190cfdae.com 31524fdae.com a.1b051fdae.tk a.5c12fdae.tk a.869d4fdae.tk a.qwerr.ga aa.30583fdae.tk aqwxrfghh.com brydfghh.com l.aqwxrfghh.com ll.homewrt.com q.112adfdae.tk q.30263fdae.tk q.30583fdae.tk qqqw1.3113cfdae.com qqqw.3113cfdae.com w1.hamewrt.com w1.homewrt.com w.30713fdae.tk w.ddff1.tk w.homewrt.com ww33.3096bfdae.com ww.3113cfdae.com # https://news.sophos.com/en-us/2020/05/21/asnarok2/ 9sg.me filedownloaderservers.com ragnarokfromasgard.com updatefileservercross.com # https://news.sophos.com/en-us/2020/05/14/raticate/ allenservice.ga binzom.com bywebhost.com cashout2018.ddns.de cbespania.info conrak.net coxemen.com czxpkj.com dachfix.com ef-oh.com gelcursot.top hearee.com hsctsu.com hypnose-beziers.com jevmod.com jinshasoft.com lighthouse-campus24.com mail.alhilaly-group.com mail.arkazo.com mail.jrdigitalstore.com mail.koyo.com.my mail.newmedicacare.com mail.qoa.com.my mail.sedirectory.com.my miscov.com negrodesigns.ga odoyo.net oleum.gmbh pedrobedoya201904.duckdns.org phochain.com pitchstak.ga pizzans.com pupilfy.com ratokasutka.com rdrfi.com skylod.com slashoff.com sofisleep.com stngpetty.ga tellpizzqhut.com terenium.com tucson1989.duckdns.org vibe.restaurant webxpo.ga yamatobb.com yncits89.com # https://news.sophos.com/en-us/2020/04/26/asnarok/ filedownloaderserver.com filedownloaderservers.com filedownloaderserverx.com ragnarokfromasgard.com sophosenterprisecenter.com sophosfirewallupdate.com sophosfirewallupdate.comt sophosproductupdate.com sophostraining.org sophoswarehouse.com updatefileservercross.com # https://news.sophos.com/en-us/2020/04/24/lockbit-ransomware-borrows-tricks-to-keep-up-with-revil-and-maze/ lockbitkodidilol.onion lockbitks2tvnmwk.onion # https://news.sophos.com/en-us/2020/02/25/cloud-snooper-attack-bypasses-firewall-security-measures/ cloud.newsofnp.com load.CollegeSmooch.com ssl.newsofnp.com # https://news.sophos.com/en-us/2020/01/15/compiling-open-source-threat-intelligence-for-threat-hunts/ 1e100.tech 1m100.tech 5ppob16.dockerjsbin.com 37atypz123.dns-bind9.com 87abfg113.dockerjsbin.com 87pqxz159.dockerjsbin.com adobe-flash.us Adobe-plugin.bid adobe-plugin.bid ads-youtube.online akamaitechnology.com alkamaihd.net anyportals.com azurewebsites.tech basepack.org boeing.servehttp.com broadcast-microsoft.tech c.cdn-edge-akamai.com cam-research-ac.com check-updater.org checkgoogle.org chrome-up.date chromeupdates.online cloudmicrosoft.net com-archivecenter.work com-messengerservice.work com-videoservice.work dns-update.club dnsrecordsolver.tk dnsserv.host Doosan-Job.com DownloadsServers.com DriverCenterUpdate.com e-qht.az EasyResumeCreatorPro.com ebizmba.com elasticbeanstalk.tech fdgdsg.xyz gesunddurchsjahr.de go0gIe.com goo-gle.mobi googlednsupdate.tk GoogleProductUpdate.net googleupdate.download googlmail.net hpserver.online ilhost.in iqhost.us jguery.net jguery.online js.jguery.online Kernel.ws kundenpflege.menrad.de login.radio-m.cf mahanserver.ir main-google-resolver.com managehelpdesk.com microsoft-ds.com microsoft-kernels-pdate.net microsoft-office-free-templates-download.btc-int.in microsoft-office-free-templates.in microsoft-security.host MicrosoftMiddleAst.com MicrosoftServerUpdate.com MicrosoftWindowsResources.com mslicensecheck.com mumbai-m.site mydomain1110.com mydomain1607.com mydomain1609.com nameserver.win net-support.info newsfeeds-microsoft.press NorthropGrumman.net offiice365.us offlineearthquake.com owa-microsoft.online persiandns.net primeminister-goverment-techcenter.tech proxycheker.pro qoldenlines.net service1.chrome-up.date service.chrome-up.date servicesystem.serveirc.com shalaghlagh.tk sharepoint-microsoft.co ssl-gstatic.online staffmusic.org static.primeminister-goverment-techcenter.tech Teledyne-Jobs.com timezone.live trendmicro.tech update-kernal.net update-sec.com updateorg.com upgradesystems.info windows-dns-resolver.org WindowsCentralUpdate.com WindowsSecurityUpdate.com WindowsServerUpdate.com WindowsUpdateServer.com winodwsupdates.me yahoooooomail.com # https://news.sophos.com/en-us/2019/12/18/mykings-botnet-spreads-headaches-cryptominers-and-forshare-malware/ # https://github.com/sophoslabs/IoCs/blob/master/malware-MyKings 64.5b6b7b.ru 64.myxmr.pw cnc.f4321y.com cyg2016.xyz down2.b5w91.com down2.b591.com down.0814ok.info down.down0116.info down.f4321y.com down.my0115.ru down.my0709.xyz down.mykings.pw down.mys2018.xyz down.mysking.info down.oo000oo.club down.wpdtest1017.site dwon.f321y.com dwon.kill1234.com f321y.com f4321y.com ftp.0603bye.info ftp.1226bye.xyz ftp.ftp0930.host ftp.ftp1202.site ioad.pw jpgo.ru js.0603bye.info js.5b6b7b.ru js.1226bye.xyz js.f4321y.com js.ftp1202.site js.mykings.pw js.mys2016.info js.oo000oo.club kr1s.ru kriso.ru mbr.kill0604.ru ms.maimai666.com mykings.pw nb.ruisgood.ru ok.mymyxmra.ru ok.xmr6b.ru own.mykings.pw p.mykings.pw pc.pc0416.xyz rucop.ru shell.upme0611.info up.f4321y.com up.ms1128.site upme0611.info win2016ok.hatenablog.com wmi.0814ok.info wmi.1103bye.xyz wmi.1217bye.host wmi.my0115.ru wmi.my0709.xyz wmi.mykings.top wmi.oo000oo.club wpd0126.info xmr.5b6b7b.ru xmr.xmr5b.ru zcop.ru # https://news.sophos.com/en-us/2019/12/09/snatch-ransomware-reboots-pcs-into-safe-mode-to-bypass-protection/ # https://github.com/sophoslabs/IoCs/blob/master/Ransomware-Snatch mydatassuperhero.com mydatasuperhero.com snatch6brk4nfczg.onion snatch24uldhpwrm.onion # https://news.sophos.com/en-us/2019/08/06/baldr-vs-the-world-a-sophoslabs-report/ # https://github.com/sophoslabs/IoCs/blob/master/Stealer-Baldr 86818.prohoster.biz 87388.prohoster.biz 87393.prohoster.biz 88517.prohoster.biz 88523.prohoster.biz 88698.prohoster.biz 88834.prohoster.biz 89064.prohoster.biz 89173.prohoster.biz 89219.prohoster.biz 89338.prohoster.biz 89506.prohoster.biz 89521.prohoster.biz 89600.prohoster.biz 89613.prohoster.biz 89736.prohoster.biz 89775.prohoster.biz 89786.prohoster.biz 89789.prohoster.biz 89815.prohoster.biz 90551.prohoster.biz 90654.prohoster.biz 91005.prohoster.biz 91331.prohoster.biz 91897.prohoster.biz 91999.prohoster.biz 92072.prohoster.biz 92178.prohoster.biz 92427.prohoster.biz 92432.prohoster.biz 93588.prohoster.biz 741963.icu a1i9o9n1.had.su acousticallysound.com.au amadeus172.com amerexp.ru arusa.name ascoglobe.com b3pro.top badseek.com baldorini.top bestdi.net blacktraders.info bonusprosto.ru book029.net businessforum3.com cbdfx.website chandlerq.xyz chockslim.site cloaka.top closepup.com cloud-backup.club creationwatchessales.com criptocheck.ru darbl.icu deimosfobos.myjino.ru dfz12.life dg4j52fds.com.hk dhus.info dimg.info doomkat.tk ekavoha.info elifanhiro.top enotflowers.com eruafwa.site ethereums.network evgentii228.myjino.ru fakinril1991.had.su fnsss77.ru forfor.site four-by-four.club francoeuralvin.myjino.ru gangbulk.icu gaswatstroy.online gepparlan.myjino.ru ghost888.hk gkjsggd.org goproeverlest.top hasanoff.su hd-1080.win hiphopforum.top impulsiv.top jbsamahi.com jesusonline.xyz karabasbarabas.info kg94jd73hs62.cn killwin44.myjino.ru kolibri.icu kvm1.j963289.n5zdn.vps.myjino.ru kvm2.wildberries0909.n5zdn.vps.myjino.ru l0l8jh6f5.cn l4eb23f8.justinstalledpanel.com l5a61b2e.justinstalledpanel.com l88a06cf.justinstalledpanel.com l781ebf3.justinstalledpanel.com lafansk.top lb3bd064.justinstalledpanel.com lb9ac9ce.justinstalledpanel.com lb49ada8.justinstalledpanel.com likelogs.net madonnahomesolutionss.com manderot.ru megasvag.top mightysam.ptr1.ru mirror-ex.pro moneyknb.online msinord.info msldr.live myfixpro.top nomoneynohoney.co nowab.info ns2.logmein-software.com ocidokki.com panel3195.prohoster.biz pineapple.ac.ug powellpablooo.myjino.ru qqepta.ru reliable-service-line.xyz research4you.su reticulum.ga revolverc.site rinnegan17.com rolfrob69.myjino.ru rolfrob.top savedcar.myjino.ru scroogeslogs.su sentervit.tk serviceaoc.top sibepoc.com soloday.su spoke.ga ssss888.ml stat.entreinaweb.com striblingm.pw suportya.ru suunderr.com tehnopolis.at texhokot.online travelman.su trysme.info union-ayurveda.top updateoffice360.top vbga.pw velikhueli.live vm558132.had.su vm596245.had.su waltprime.su warstrom0707.ptr1.ru website-link.gq weekday.su whoiam.space xzshadows14.icu yamail.online yoursme.info zeronde.in zhitinanin.temp.swtest.ru zikkurat.tk zmxrm.net # https://news.sophos.com/en-us/2019/07/11/oto-gonderici-excel-formula-injections-target-turkish-victims/ # https://github.com/sophoslabs/IoCs/blob/master/Malspam-OtoGonderici 2073.mobi 25665.club 25665.me 33016.club 60431.club 75735.club 77444.club 80001.me 82813.club aetye.ml aghkf.ml atessan.online avrupagoz.online ayanw.ml banage.live basaso.mobi burcutekstil.online cinarterlik.online cnfh.mobi cpaneh.tk ekqff.ml ewouif.gq fazilet.club gelovosaja.club ghtc.mobi gyqey.ml hcsscj.ga hfik.mobi hocoso.mobi hvaycz.cf inssanayi.mobi iquqy.ml jahlq.ml Jdokdo.ml jekarebege.online jjsiu.ml jodaje.mobi johaca.mobi jurugq.host kartalescort.mobi kayaya.mobi kojero.mobi lca.mobi mgw.mobi nafaro.mobi nefal.mobi nehabe.mobi nejoja.mobi nvmdv.ml peindikescort.mobi pqoyruw.ga professional.mobi pvrdn.ml qoloa.ml qyhhy.ml qzitt.ml rimaw.ml rlg.mobi rtrzd.ml selcukecza.online specforce.space supkh.mobi swtaegs.ml tamor.mobi taneketevo.online tgmml.ml turkcall.mobi tzlss.mobi urdnz.cf vazawoweso.online vecoha.mobi vgplb.ml vpewqz.tk walatecaqa.club wdplf.ml whyog.ml wpf.mobi wqplw.ml yepeyowora.online yerago.mobi yklud.ml ynngon.ml yolecafeha.club yomka.ml yuktu.ml zavayo.mobi zayero.mobi zororo.mobi # https://news.sophos.com/en-us/2019/02/21/abusive-mobile-adware-aggressively-touts-more-adware/ # https://github.com/sophoslabs/IoCs/blob/master/Android-HiddAd-T cdn.partycross.com dialog-4a78.kxcdn.com dialog.usatek.eu goldapp-bcf4.kxcdn.com mny-3f29.kxcdn.com remoteapp-3d8f.kxcdn.com remotesettings-3f29.kxcdn.com # https://news.sophos.com/en-us/2019/01/30/matrix-targeted-small-scale-canary-in-the-coal-mine-ransomware/ # https://github.com/sophoslabs/IoCs/blob/master/Ransomware-Matrix blushing-gasket.000webhostapp.com che.mygoodsday.org eman.mygoodsday.org fb.mygoodsday.org fredstat.000webhostapp.com jnss.mygoodsday.org jostat.000webhostapp.com jostat.mygoodsday.org mai-hoand.000webhostapp.com murik.xyz murikos.in no7654324wesdfghgfds.000webhostapp.com nobad.mygoodsday.org prcp.mygoodsday.org pre.mygoodsday.org testercmd.in third.mygoodsday.org tru.mygoodsday.org tstat.mygoodsday.org updateplayernow.win ## symantec # https://www.symantec.com/blogs/threat-intelligence # https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/microsoft-exchange-server-protection api.onedvirer.xyz # https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/lazarus-north-korea-indictment airbseeker.com ants2whale.com beastgoc.com celasllc.com coingotrade.com dorusio.com globalkeystroke.com jmttrading.org kupaywallet.com levelframeblog.com qnalytica.com unioncrypto.vip woodmate.it # https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/solarwinds-raindrop-malware bigtopweb.com panhardware.com # https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/sunburst-supply-chain-attack-solarwinds avsvmcloud.com ervsystem.com infinitysoftwares.com # https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/palmerworm-blacktech-espionage-apt asiainfo.hpcloudnews.com loop.microsoftmse.com # https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/wastedlocker-ransomware-us advokat-hodonin.info backup.awarfaregaming.com click.clickanalytics208.com cofeedback.com connect.clevelandskin.com connect.clevelandskin.net connect.clevelandskin.org consultane.com cushion.aiimss.com feedbackgive.com lgrarcosbann.club link.easycounter210.com msoftwares.info mwebsoft.com net-giftshop.info penaz.info rocket2.new10k.com rostraffic.com sodality.mandmsolicitors.com track.positiverefreshment.org traffichi.com typiconsult.com websitesbuilder.info # https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/sodinokibi-ransomware-cobalt-strike-pos d2zblloliromfu.cloudfront.net # https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/sms-phishing-coronavirus client-7492703.online Scotia-0nline.com uk-covid-19.webredirect.org # https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/greenbug-espionage-telco-south-asia apps.vvvnews.com kopilkaorukov.com vsiegru.com # https://www.symantec.com/blogs/threat-intelligence/increase-emotet-spam-observed-blocked-symantec capsaciphone.com essay.essaytutors.net miracles-of-quran.com travalogo.com urwww.4celia.com # https://www.symantec.com/blogs/threat-intelligence/waterbug-espionage-governments codewizard.ml dubaiexpo2020.cf markham-travel.com microsoft.updatemeltdownkb7234.com updatenodes.site vision2030.cf vision2030.tk zebra.wikaba.com # https://www.symantec.com/blogs/threat-intelligence/beapy-cryptojacking-worm-china info.abbny.com info.ackng.com info.beahh.com v.beahh.com v.y6h.net # https://www.symantec.com/blogs/threat-intelligence/elfin-apt33-espionage backupnet.ddns.net hyperservice.ddns.net microsoftupdated.com mynetwork.cf mynetwork.ddns.net mypsh.ddns.net mywinnetwork.ddns.net remote-server.ddns.net remserver.ddns.net securityupdated.com servhost.hopto.org service-avant.com srvhost.servehttp.com svcexplores.com update-sec.com # https://www.symantec.com/blogs/threat-intelligence/african-financial-attacks moneygram.servehttp.com nemesis225.ddns.net noreply377.ddns.net # https://www.symantec.com/blogs/threat-intelligence/leafminer-espionage-middle-east adobe-flash.us adobe-plugin.bid ilhost.in iqhost.us offiice365.us ## tgsoft # https://www.tgsoft.it/italy/news_list.asp # https://www.tgsoft.it/italy/news_archivio.asp?id=1113# adopteerightslaw.org afurtak.com agenciann.com aleis.com altdigital.co.uk amyemitchell.com andreortega.com arkamedia.pl baobatdongsanonline.com baoduongdieuhoa365.com baulamusic.com beeptool.com belviderewrestling.com bepbosch.com billingup.com bj5800.com bjqinghuan.net bloggingbow.com blvrdev.com brindesecologicos.com byuro-perevodov.su c8xtt.com caboned.com chicagoyachtguru.com cloudcertitude.com cmswrexham.com coelcompany.com comingweb.com cookie.com.br coparmexpuebla.org corazonesalmar.com countercon.com.br countrygroup.nl cryptokuota.com csdajin.com csmbuildersllc.com culturizate.es dagongolfcity.com dandorahiphopcity.com dcpltech.com deam.com.vn demae.life demosiam.com dezarii.net diamondbraintutor.com dinhphuoclong.tk djmastertlacolula.com dmjteak.com dotshop.gr dpsoma.com dutarini.com e-machine.com.br earthpath.com eastbayhub.com elnoursteel-eg.com emediserv.com ensanz.com enviglobe.com ergosnooze.com eventgiftpk.com expart.com ezerangyal.hu fabfastfashion.com funarbe.org.br fzweiming.com galaenterprises.com.au gameplays.fun gazedice.com genevievebeaupre.com gettruefoods.com goodluckstoneshop.com goturizm.com groupchips.com grupomacro.com.br halesplumbing.com.au hepingzyy120.com hoangminhmz.com identisoft.pt illhaqsteeleng.com ilmazon.com inquima.com.br interactivegood.com itulstaging.com jesstalk.com joomlas123.info jpm.gov.my juliekaplanphoto.com juniorsplayground.net justinkongyt.com kangen-international.com katebayless.com kevincameron.net kmgusa.net krayons.biz laboratoruldeganduri.ro laijie88.com lead2019.tk ledgr.xyz lidoraggiodisole.it lifepartner.hk liveheart.co.jp lordtakipci.com lt-pet.com lyveinc.com mamelina.com marthecornelie.com maxsoft.cz mbakluli.com mcatcher.cn megasolucoesti.com mersia.com meteoannecy.net metropolitanelites.com minimocha2u.com mo-billy.com morlo.net muliarental.com mumara.com myportalx.com ncryptedprojects.com netflick4u.com newforceltd.com nourishmentjuices.com nucleoevent.com nucleokardecistalace.org.br office4u.info pnaia.com productbeforebuying.com protonpowertools.com psuperstore.com rayzacastillo.com rebeltraiteur.com remt-standart.ru rhinopaving.com robimentheos.com rologyx.com runzexd.com safariilab.com saharfiroozian.com samelimarket.com sariweb.com.br scootervenlo.nl secrice.com securenetit.com.au septicst.ru shopeeinfo.com smartinteractivetech.com smartscape.eu soarflix.com sososothemes.com soundaffairs.net speranza2000.com stefanzrenner.com stoutarc.com studentscorner.info suenaga.jp sukhumvithomes.com swingalgo.com synologlogin.com terrafreshorganics.com tz005.com viralstyle.shop vplast.com.br wb0rur.com whitehautephotography.com willowcreekct.com xiangxiinfo.ac.cn xs-xl.cn zcly.cn zerohungerapp.com # https://www.tgsoft.it/italy/news_archivio.asp?id=1111 airmidhealthgroup.com aligod.duckdns.org broganfamily.org brucemulkey.com butteyoungprofessionals.com buybywe.com caritatea.nl chromaccess.com crossofthefaithfull.com debnath.org dgreitkelis.lt dkeventmarketing.com driftaway-holidays.co.uk dropbox.friulmarbleandtile.ca dropbox.lightsculpters.com dt-anesthesia.com epicmediasv.com fattnumdelordine.com fex-tracks.com focalaudiodesign.com fon-gsm.pl foresteryt01.com fsastudio.com godhasanaddress.com healthywithhook.com herald.hu/A7.jpg hlsquared.ca igametalent.com janewagtus.com joomlas123.info lahistoriade.com landbank.site leyu91.com librosdecienciaficcion.com mansiobok.info marketingsiamgrains.zapto.org meccafon.com merrimack.ie mersia.com microcomm-group.com microcommindia.com mikeflavell.com milebgd.mycpanel.rs missetiquette.com mobiletech.net mosdk.com mx2interests.com ncsu.org.ng nfis.com noizemakerproductions.com oasisproject.us obserai.co.jp odytravelgear.com onefarmdesign.com overcreative.com pages28.sf2p.intern.weebly.net pages42.sf2p.intern.weebly.net pakamuros.com pallabhazarika.com profileorderflow.com randynowell.com rapport-happy-wedding.com renatocoto.com rouxweb.com sallyabbeyarts.com sharethin.com sitebilisim.com sixpenceworkshop.com skydiarynepal.org spektrondesigns.com statoffbal.com sunflowermoonstudio.com techlh.com tedbrengel.com tedde.nl teldesign.com tvsanmiguel.com umphrey.us valorartetattoo.com vipi.co.ke wanderingcollective.com webmotion-design.com webstack.com.au whatsnexttnd.com wiretube.com.br wksbsolutions.com wolfbird.com yoyodvd.com z2uymda2mjc.top # https://www.tgsoft.it/italy/news_archivio.asp?id=1109 617pg.com alaksir.com amventas.com arrd.ro artewebestudio.com astronica.org atelierbrasilia.com ative.nl auniqueart.co.uk av2m.com azjones.info ballooneo.com bartboutens.nl bazarot.com bcpcircle.com benconry.com bendys.com.au benluckman.com benmedia.com berner-limousine.ch biglaughs.org billandroger.com biomayest.com bitbenderz.com bjbus.net bladimirindustrial.com blogline.net blondenerd.com bluespaceit.com bostonseafarms.com cankoc.com cgemtalent.com chadcast.com charihome.com cistilniservis-t530.com classic-recipes.com cotrafina.com deegit.com degriekseadvocaten.com dishnchips.com dogbluemedia.com dragonfang.com duhallow.com duncanllc.com eldridgelondon.com elifmakina.net elisent.com eliteseobusiness.com empmtg.com enhancementtechnology.co.uk fedaicoskun.com finestones.dk firman.com.au firstaid-redliv.dk flancalfaltd10.com ftp.persisiciptautama.com geodesign07.com gestioneinbizzotutto.com globeartdesigners.com gravelrecords.com greatfxmedia.com greaudstudio.com gregladen.com groncrete.com gsiquick.com gtsouth.com guarany.net gunesoluk.com guppon.com guyn3.com haek.net inkarainbow.com instamal.com interibericos.com inviatotutoneladon.com irvingstudios.com itbparnamirim.org jabenitez.com jamesgrantguitar.com jojofun.co.uk joyprimeschools.com juniorsplayground.net juroca.com karerguvenlik.com katebayless.com ke-s.com kennol.pk kjoeller.nu kmgusa.net knightlycomputing.com kompkon.com kyleriffic.com laboratbahasa.com leannewaller.com leframe.com lf-hj.cz lgpass.com linearis.ch luckybit.jp m0h.net macserwis.pl marisqueiraobarqueiro.pt matuteroofing.com maxiquim.cl mc130.com mc-interiorismo.com mediainmedia.com megasolucoesti.com mellysphotography.com mentarimedia.com merlincolor.com meuambientedecoracoes.com.br meulocal.com.br mgbryant.com mgregoire.net mickreevesmodels.co.uk microclan.com mikeflavell.com misenar.com mktf.mx mo-billy.com mobialive.com mobilesbestprice.com moncheznous.ca mosdk.com mosquitohawk.net motorcomunicacion.com moverviseu.com mpbharat.com nixoid.com petafilm.com phanmemninjarank.com planetkram.com radioavivamiento939.com rikotut.net rivcon.net rollingturtle.com ronnietucker.co.uk ronsonpainting.com saangberg.com saludenestambul.com seriousvanity.com sfjacobs.com shablingo.com sheilasteinfeld.com sourcetechno.com spiidgas.com.br starrpromotions.co.uk strange.info strike3productions.com surguy.com talkceltic.net taltus.co.uk tarjetasas.com tatweeralsham.com thewineartist.com torqueandtalk.com trendsonlines.com urbaneden.net vipmein.com virtualmillers.com webappbr.com webpresario.com whatsappsenderpro.com wiredmoney.net worldhealthtourismcongress.org xaviertapias.com ximboo.com xsesa.com yamnadlan.com yeandle.co.uk yeichner.com zmgmedia.com # https://www.tgsoft.it/italy/news_archivio.asp?id=1108 alysonrecord.com arnoldscreekps.vic.edu.au aryaenterprisesrbl.com banhangsivn.com benmp.com bnemati.ir catalystitsolution.com chatflair.com coobra.online coverdomesticappliances.com crimsonrealtypoint.com crpelectric.com dainiksomoy24.com danmax.dynip.online duhocjk.vn duoclieu247.com emarclofitnessacademy.com enco-software.net fabfastfashion.com fivestarcleanerstx.com frituraslavictoria.com ftp.antares-group.ro ftp.artego.ro gengduyw.com grupocruzco.com grupoitalopoblano.com henneli.com heyfoxcomic.com hohwy.com houseofgriffin.org instant-resume.com kendra.ee kipliani.com koalamedya.com lidermuebles.com.ar localpelis.org magadariable.com metanor.gr milebgd.mycpanel.rs mishalalqasim.com monikaimpex.com mpbharat.com mridubykirti.com namedforyou.ianselby.com nazarmedya.com oakeno.com ooskajoos.com oraripersonale.metodoinforma.it petafilm.com phamthuan.com phanmemninjarank.com rmacadetstore.com ronmadisonbooks.com rufaro.hopto.org serenitypoint.com shepherdfellowship.org shubhinfoways.com steamunlocked.site storepc.ro sugarcoatitdev.online techyhint.com thelibrarysamui.com thewineartist.com trendsonlines.com trustguarantydelivery.com worldfleetbd.com xechuyendung24h.net zeing-kor.com # https://www.tgsoft.it/italy/news_archivio.asp?id=1107 alphastand.trade boeschboddenspies.com cayyoluhaliyikamaci.com ecoverydata.merehosting.com greenbuss.com gstat.coneybucks.com gstat.ineedcurbappeal.com kbfvzoboss.bid lwyhef.eu mynewbranch.com mzgotech.com peliculadeestreno.com pickpickict.com ponmer.eu redflash.org sharmasfabrics.com sheyenneweber.com sirisms.com web.emergingsun.com web.heartyian.com web.rpasfoundation.org wycomm.com # https://www.tgsoft.it/italy/news_archivio.asp?id=1106 186564.com amehota2gfgh.cm besthappybuds.net casevacenze2020top.com documents.forwardlifeservices.com documents.gstroop4822.org e9bja.com gofast22gfor.com gstat.careinmexico.com gstat.peshtigodental.com gstat.sergiocilli.com gstat.sloleaks.com igametalent.com jamesanderson68986.ddns.net line.winneratlaw.com qumogtromb2a.com rochesterlocalseo.com uncomfermed.com web.zdesigns-studio.net # https://www.tgsoft.it/italy/news_archivio.asp?id=1102 casecose20smart.net documents.downloadthatmusic.com documents.forwardlifeservices.com gstat.262productions.com gstat.securityguardlisting.com lavorosubordinatosmartw.org line.ehrlum.com link.rolandchase.com z2uymda2mjc.top # https://www.tgsoft.it/italy/news_archivio.asp?id=1099 alphastand.trade calipoolslv.com gstat.thecrowband.com kbfvzoboss.bid line.lifeartphotographers.com nerfvbg.eu tech-vopsire.ro xoptutorials.com # http://www.tgsoft.it/italy/news_archivio.asp?id=1097 documento.jescy.com documento.madeintaylors.com documento.mialeeka.com documento.noothercouncil.com documento.reevesandcompany.com documento.selltokengarffhonda.com pec.catherineschepise.com pec.minorleaguepub.com pec.tugnutz.com z2uymda1mtk.top # https://www.tgsoft.it/italy/news_archivio.asp?id=1096 alphastand.trade consaltin.com consaltin.org egamcorps.ga gstat.llbntv.org gstat.vmf216.com # https://www.tgsoft.it/italy/news_archivio.asp?id=1095 billionaire.ddns.net bizzznez.com bizzznez.org gstat.llbntv.com # https://www.tgsoft.it/italy/news_archivio.asp?id=1094 dnsaa.net # https://www.tgsoft.it/italy/news_archivio.asp?id=1089 consaltinger.com consulttrus.org fofl.it gstat.ddoborguild.com gstat.echowin.com lame-mht.duckdns.org line.beibiandmom.com line.xuexiaomi.com wshsoft.company # https://www.tgsoft.it/italy/news_archivio.asp?id=1088 adaada.spdns.org addiamentali.org cloudservices-archive.best fatturadiitali.com gstat.getlearningsolutions.com gstat.securitiessupportunit.com line.farmingtondewdays.com post.medusaranch.com rezidentialia.xyz # https://www.tgsoft.it/italy/news_archivio.asp?id=1087 bilkas.eu illionback.eu lintux.ir ptankers.com tarfros.eu zapforyou.eu # https://www.tgsoft.it/italy/news_archivio.asp?id=1085 alisiemental.host alphastand.trade consaltingz.com cozyshop.com/Doc.iso gstat.couturefloor.com kbfvzoboss.bid line.starlightgroupllc.com marketpalasei.casa victorlascos.tech # https://www.tgsoft.it/italy/news_archivio.asp?id=1083 billionaire.ddns.net gstat.dondyablo.com securezza.at # https://www.tgsoft.it/italy/news_archivio.asp?id=1081 andrewzelaya.com dermvalet.xyz eectechnology.com gstat.bluechipstaffing.com gstat.hamiltoncustomhomesinc.com merth3.eu naijabizdirectory.com produccionesmoyajimenez.com rolandojgarcia.com securezza.at slookf2.eu # http://www.tgsoft.it/italy/news_archivio.asp?id=1080 basa.nutarborg.com for.iuyefgweoiuhf.xyz iuyefgweoiuhf.xyz line.largefamiliesonpurpose.com service.pandtelectric.com # http://www.tgsoft.it/italy/news_archivio.asp?id=1078 bibpap.com broken2.cf capital-sd.com cnybo.cnyboypower.com fentlix.com murray.danielrmurray.com # http://www.tgsoft.it/italy/news_archivio.asp?id=1077 dominatecode-co.com eccom.pagamento-sella.it-0d530238.noleggiobicidoctorbike.it identitysuspended.myftp.org # http://www.tgsoft.it/italy/news_archivio.asp?id=1075 1afb7ecd.ngrok.io 9ureyowuher9b.xyz bslines.xyz englee-sg.com loadkaklokja.xyz newitpagamentofor.xyz phamchilong.com # http://www.tgsoft.it/italy/news_archivio.asp?id=1074 esengey.com falloitalbar.store mail.ios.co.id # http://www.tgsoft.it/italy/news_archivio.asp?id=1073 195123a6.ngrok.io bito.carlaarrabito.it eiurbfvpewirub.xyz eouryfvioeurfoevri.xyz films.midamericaestatebuyers.com findoitaliafattura.pw mgm.perc-up.com scan.perc-upcoffee.com # http://www.tgsoft.it/italy/news_archivio.asp?id=1071 castrolascotools.us dman30.ddns.net italycovid-19.site rachellubell.com recoverrryasitalycovid-19.xyz stornocovid-19.pw teddyboe34.dns.navy # http://www.tgsoft.it/italy/news_archivio.asp?id=1070 5spoons.com # http://www.tgsoft.it/italy/news_archivio.asp?id=1068 ashtoncandlecompany.com bespokelightingsystems.com way.tribalalpha.com # http://www.tgsoft.it/italy/news_archivio.asp?id=1065 airsack.ddns.net dman20.duckdns.org falcontension.tech gofundmedonorhelp.com gpagamilmegpagamil.xyz innoexpo.tech megpagamil.pw.me reellifeoutdoors.com robertgronstedtjr.com # http://www.tgsoft.it/italy/news_archivio.asp?id=1064 businessknowledgetransfer.com febspxiii.xyz mandyenando.xyz stilthousebeer.xyz tohomeroom.com # http://www.tgsoft.it/italy/news_archivio.asp?id=1063 dvt553ldkg.com f200rotcl2.com fal6qo3f68.com hiteronak.icu kmqdagp70r.com matantalbenna.com qr12s8ygy1.com wv01gwbrgs.com # http://www.tgsoft.it/italy/news_archivio.asp?id=1062 unicredit.it.banca.accedi.conto.clienticredit.online # http://www.tgsoft.it/italy/news_archivio.asp?id=1060 9jabliss.com beholdbhutantravels.com bghqyf1.com buildwithinnovation.com cheapwebvn.net clicksbyayush.com crimecitynews.com dealwithus.tk fastacompany.com finerbook.com foto-periodismo.com funatsu.biz gadgetgi.com gs11fd5.com hatbhutantour.com hgklighting.com ku3rgq4.com kuu15austin21.com nurofenpanadol.su nvdvdgp.com nvl.netsmartz.net qryyueeriberto.com sakurabacninh.com steakhouse42.site sundevilstudentwork.com tandinbhutantravel.com tbadl-ashtrakat.000webhostapp.com v15zxnapoleonln.com web23.s170.goserver.host xlkz.xyz z4v1qth.com # http://www.tgsoft.it/italy/news_archivio.asp?id=1059 addahost.ddns.net agenziadellentrate.space all-fly.info beststaffusa.com bjenkins.webview.consulting blasmontavez.com blinkro.eu butland.gq charliemoney.com.br clcindy.com desaidles.fun dineka.lt/pastas duhochvc.com euromopy.tech gostareh.org hammersummer.com hindwalkerphoto.com johnfrancisellis.com kabookapp.com kolonimalosi.pw lamdep24h.life lamilla.net legogogogo.pro luxuryflower.net recentgovtjobcircular.com redmoonexport.in sccslink.xyz speedpassitalia.it studiomap.kr uglobalfinance.com uwachukwuu.cf zaletuf.pro # http://www.tgsoft.it/italy/news_archivio.asp?id=1058 alexbase.com allainesconsultancyinc.com asemancard.com besthelpinghand.com betactecto.com dynomind.tech fampraffer.com gadinacom.gq goharm.com hecquet.info icanpeds.com iconeprojetos.eng.br jottnistic.com kueproj.linuxpl.eu mimeaniega.com nicest-packaging.com oasineldeserto.info omstarfabricators.com panouluers.com phbarangays.com safari7.devitsandbox.com seepisiolt.com soulcastor.com testtaglabel.com tkaystore.com trilochan.org trungcapduochanoi.info vendameucarroo.com vinetechs.net w04.jujingdao.com xishicanting.com # https://www.tgsoft.it/italy/news_archivio.asp?id=1057#17_gennaio_2020 bbvaticanskeys.com blog.51cool.club cg.hotwp.net ckav.ru clinicacrecer.com compta.referansy.com conilizate.com de.offbeat.guide demu.hu fbabob.com holodrs.com ifunanya.cf itconsortium.net jayracing.com jewellink.com.au josemoo.com link.philippeschellekens.com myevol.biz nguyenminhthong.xyz parcerias.azurewebsites.net rcmgdev44.xyz searchfundanalyst.com snchealthmedico.com taobaoraku.com understudyknowledge.com understudyvideo.com unvacsth.tk vikisa.com vlkl.xyz # https://www.tgsoft.it/italy/news_archivio.asp?id=1056#UBIBanca carte.bancocpm.it kaxyzs.online # https://www.tgsoft.it/italy/news_archivio.asp?id=1055 aguilarygarces.com chikota.cf hamburgergmbh.tk kbfvzoboss.bid # https://www.tgsoft.it/italy/news_archivio.asp?id=1050 8a8e6597.ngrok.io acgvideo.co agenziadelleentrate.site air-pegasus.com bar-ola.com braddmcbrearty.com chloroz.xyz compelconsultancy.com desaidles2.fun eioeruhgirbe.xyz excellencegroup.biz excellencegroup.org excellenceservices.org furmul2aso.com gamesigns.com ge1dmond.info gedmond0.pro goldonam.com hedayetsaadi.com helenelagnieu.fr helloseatravel.com hotmembersonly.com kolonimalosi8.pw lubinco.co.il mattonicomunicacao.com myagentco.com new1discoveries1.com newsaplicamento2.surf newsaplicamento.surf ohfebveub.xyz ondesignstudio.in pakspaservices.com qsquareads.com rinani.com salvacodina.com serviska.com show-lifez.com smdelectro.com textilesunrise.com tripuruguay.info usa.slackart.ch wangjy1211.xyz wowmotions.com xuelko.xyz yantami.de zal6etuf.pro # http://www.tgsoft.it/italy/news_archivio.asp?id=1047 webserverportalitalia.site # http://www.tgsoft.it/italy/news_archivio.asp?id=1046 860259.com billrothhospitals.com birdlandonetoone.com customerspick.com elettroveneta-it.com ese.emarv.com essemengineers.com gessuofk.net greencrosscc.com gunnertalk.com hanaimchurch.net hasbrew.com hintdeals.com invision-me.com jandmadventuring.servermaintain.com jdcc-stu.com lalletera.cat luigicafagna.it modiracc.com myphamthuydung.com nagel.pintogood.com nineti9.com onllygooodam.com opticsbd.com primepenguin.com rampbay.com recreate.bigfilmproduction.com sda-express.icu sda-express.xyz sdaexpress.icu shourayinfotech.xyz sscupace.xyz sutsyiekha.casa t666v.com ukrembtr.com way.securewebgateway.com wilkopaintinc.com # http://www.tgsoft.it/italy/news_archivio.asp?id=1045 101.edufav.com accdb.opengate.it ahsappanjur.com arinlays.com avmaxvip.com awchang.com cirugiaurologica.com cr-easy.com exhicon.ir extrautilidades.com itcslimited.com landzoom.com lyciawood.com majorlandproperty.com milux-my.com mobitechgroup.com municipales.lejournaltoulousain.fr offisepost.info panjurkapak.com qiuqiu.biz saveearth.org.in shopbkk.online vaytaichinhonline.com vyhoang.airaworldtourism.com wanderunderwater.com waraly.com # http://www.tgsoft.it/italy/news_archivio.asp?id=1043 aahch.org andrea-alvarado.com bomberosvilladelrosario.org gelcursot.top goddoskyfc.com insidermetric.com jdiwindows.com juzhaituan.com ketshops.com kiddostoysclub.com navinfamilywines.com ncafp.com old.bigbom.com onlykissme.com oshodrycleaning.com pharmachemsales.com picslife7.com poshouse.vn purviitech.com sennesgroup.com shampoocaviar.com sptconstruction.co.za titrshop.ir usd78.com valeriademonte.com youcaodian.com # http://www.tgsoft.it/italy/news_archivio.asp?id=1042 agenta.airosgroup.com annonces.ga-partnership.com astrametals.com ayalacarranza.com bellespianoclass.com.sg cevizmedia.com demo.voolatech.com enegix.com gwrkfpmw.net highschools.creationlife.com iruainvestments.com jaafarattar.com jameslotz.com joufhs.net ketobes.com mastermindescapetheroomgame.com mercadry.com momo2.test.zinimedia.com monitoring.bactrack.com news.yaoerhome.com oakessitecontractors.com onllygoodam.com pcera.eu preprod.planetlabor.com prettyangelsbaptism.com skilmu.com sofizay.com vcntq.gq youtubeismyartschool.com # http://www.tgsoft.it/italy/news_archivio.asp?id=1041 ced-ania.com info-servizi.com inps-ced.com inps-nuovoportaleinps.com parker-network.cc parkernetwork.freezoy.com pasker.no-ip.org puntofisco.freezoy.com scuolaelementarediorziveccho.191.it # http://www.tgsoft.it/italy/news_archivio.asp?id=1039 sglobal.online # http://www.tgsoft.it/italy/news_archivio.asp?id=1038 accedisellercentral.amazson.it encounterkarmatreks.com hovermop.com misericordia.pistoia.it # http://www.tgsoft.it/italy/news_archivio.asp?id=1036 jbond.sytes.net langchaixua.com matbin.com t6kamillemoshe.com # http://www.tgsoft.it/italy/news_archivio.asp?id=1035 accelerating-success.com food.foodforthoughtkids.com home.ktxhome.com isolve-id.com staging.fuel10k.com # http://www.tgsoft.it/italy/news_archivio.asp?id=1033 curlmyip.net digoedani.xyz purealeaf.com qxf.com rinivaskasojufoundation.com tahmidmac.com thegothamhotelny.com theshavegallery.xyz vegascollegecoach.com # http://www.tgsoft.it/italy/news_archivio.asp?id=1032 carringtonit.xyz obrbands.com ryktzzula.com teamltc.com thefuturesgame.biz yourpremiersmile.com # http://www.tgsoft.it/italy/news_archivio.asp?id=1031 10bonusonline24.info 107gam.com adigitalteam.com agcemployeebenefitsolutions.com alphastand.trade atbstroy.com atomoton.xyz bonvies.com capitalpremiumfinancinginc.com customwastereceptacles.com dahuanigeria.com efectivafm.com enrichcollege.xyz finemineraldealers.co gaimaps.com joangorchs.com lindasamson.com line.alicetheguru.com line.harpbyrequest.com line.orangetheorymb.com line.rosenstock.net line.zepcnc.com link.406lawyers.net link.emilystravel1.com link.mesondelprincipe.com link.miamicoffeebar.com litum.org matrixkw.com movie69hd.com organizersondemand.com parishadtoday.com pentechplumbing.com physicaltrainernearme.com proboxingfans.com prodartsfans.com rankrobotics.com saigonbowldenver.com securityinsite.com sprintsalesapi.com stat-football.com suckpussycat.com sun-clear.net techecn.com thekingofsoul.com thepartnerships.com theramones.com thinktobehappy.com yensaogianguyen.com yukosalon.com # http://www.tgsoft.it/italy/news_archivio.asp?id=1030 amazon-net-info2019.casacam.net bps-net.eu d2cabfzcca78ju.cloudfront.net emozionedata.it # http://www.tgsoft.it/italy/news_archivio.asp?id=1025 aylaspa.com bedianmotor.com blog.dakkha.com combinedenergytech.com connect.simplebutmatters.com cours-theatre-anglais.com creationhappened.org cuisineontheroadspr.com dilandilan.com dymardistribuidora.com ephemereparfum.com freeslits.net goitsoluciones.com gonetplay.xyz grupocemx.com home.isdes.com home.southerntransitions.net megaestereocalca.net mevaembalagens.com n01goalkeeper.com newuvolume2.com novawebdesigns.com pacificbehavioral.com panelfiberton.com prettywoman-cambodia.com qirqle.com stewardtechnicalcollege.com superecruiters.com sysmobi.com transporteselfenix.com xmxazd.com # https://www.tgsoft.it/italy/news_archivio.asp?id=1021 30082019.xyz aplsolutionsonline.com atchec.com bateshkeeutgv.best chefeladlevi.com dirproperties.com faraweel.com fileouya.xyz followergods.com hotelkrome.com jannahqu.org leuzervllik.website maceju.com maymaychihai.com nomadztruck.com refferalstaff.com rezervoi300819.online run-germany.com sathorncondos.com saxtorph.net shekinahwiz.ddns.net startupforbusiness.com sukhumvithomes.com sunflagsteel.com szmoldparts.com tvjovem.net vanscheers.com zelrvllik.fun # https://www.tgsoft.it/italy/news_archivio.asp?id=1020 blacktechmecca.com butchscorpion.com it.its1ofakind.net iumju1.eu kofeservis.com ser.jonnalbandian.com siurreje.xyz vps.healinglightwithin.com wws.christinedavies.biz # https://www.tgsoft.it/italy/news_archivio.asp?id=1018 aliiuyrt.space aliiuyrt.xyz alloiudh.casa farmaciastefani.it hsz59c1evs1h30.com img.blumenstock.com m87770f3jlmmbz.com me.jmitchelldayton.com newupprolods.club newupprolods.fun oupfqhmkezgnvi.com pro.prosperitybookkeeping.net wow.doorattendants.com wwd.hollishealth.com wws.guidemyhunt.com ## trendmicro # https://blog.trendmicro.com/trendlabs-security-intelligence/ # https://blog.trendmicro.com/trendlabs-security-intelligence/xcsset-mac-malware-infects-xcode-projects-performs-uxss-attack-on-safari-other-browsers-leverages-zero-day-exploits/?utm_source=feedburner&utm_medium=feed&utm_campaign=Feed%3A+Anti-MalwareBlog+%28Trendlabs+Security+Intelligence+Blog%29 # https://documents.trendmicro.com/assets/pdf/XCSSET_Technical_Brief.pdf adobestats.com flixprice.com # https://blog.trendmicro.com/trendlabs-security-intelligence/water-nue-campaign-targets-c-suites-office-365-accounts/ highstreetmuch.xyz takeusall.online # https://blog.trendmicro.com/trendlabs-security-intelligence/updates-on-thiefquest-the-quickly-evolving-macos-malware/ andrewka6.pythonanywhere.com lemareste.pythonanywhere.com # https://blog.trendmicro.com/trendlabs-security-intelligence/new-mirai-variant-expands-arsenal-exploits-cve-2020-10173/ methcnc.duckdns.org methscan.duckdns.org # https://blog.trendmicro.com/trendlabs-security-intelligence/us-local-government-services-targeted-by-new-magecart-credit-card-skimming-attack/ cdns-static.com renew-analytics.com # https://blog.trendmicro.com/trendlabs-security-intelligence/new-android-spyware-actionspy-revealed-via-phishing-attacks-from-earth-empusa/?utm_source=feedburner&utm_medium=feed&utm_campaign=Feed%3A+Anti-MalwareBlog+%28Trendlabs+Security+Intelligence+Blog%29 appbuliki.com bloomberg.com.cm cdn.doublesclick.me geo2ipapi.org goforssl.top gotossl.ml start.apiforssl.com static.apiforssl.com static.doublesclick.info status.search-sslkey-flush.com t.freenunn.com umutyole.com # https://blog.trendmicro.com/trendlabs-security-intelligence/backdoor-devil-shadow-botnet-hidden-in-fake-zoom-installers/ hosting303.000webhostapp.com madleets.ddns.net # https://blog.trendmicro.com/trendlabs-security-intelligence/qnodeservice-node-js-trojan-spread-via-covid-19-lure/ central.qhub.qua.one # https://blog.trendmicro.com/trendlabs-security-intelligence/tropic-troopers-back-usbferry-attack-targets-air-gapped-environments/ # https://documents.trendmicro.com/assets/Tech-Brief-Tropic-Trooper-s-Back-USBferry-Attack-Targets-Air-gapped-Environments.pdf dpponline.trickip.org jupiter.qpoe.com mila1314.4dq.com mila1314.25u.com mila1314.ddns.info myinfo.ocry.com myzinfo.myz.info oldape.4dq.com oldape.25u.com # https://blog.trendmicro.com/trendlabs-security-intelligence/new-macos-dacls-rat-backdoor-show-lazarus-multi-platform-attack-capability/ loneeaglerecords.com # https://blog.trendmicro.com/trendlabs-security-intelligence/webmonitor-rat-bundled-with-zoom-installer/ dabmaster.wm01.to # https://blog.trendmicro.com/trendlabs-security-intelligence/gamaredon-apt-group-use-covid-19-lure-in-campaigns/ Bambinos.bounceme.net bbtt.site bbtt.space harpa.site harpa.space harpa.website himym.site kristoffer.hopto.org kristom.hopto.org miragena.site miragena.xyz papir.hopto.org sabdja.3utilities.com sakira.3utilities.com seliconos.3utilities.com solod.bounceme.net sonik.hopto.org tele.3utilities.com violina.website voyager.myftp.biz voyaget.myftp.biz # https://blog.trendmicro.com/trendlabs-security-intelligence/exposing-modular-adware-how-dealply-iserik-and-managex-persist-in-systems/ # https://documents.trendmicro.com/assets/Appendix-Exposing-Modular-Adware-How-DealPly-IsErIk-ManageX-Persist-in-Systems.pdf Adofd.com Boqudo.com Bujot.com Buluw.com busucak.com butapujo.com Bxvdc.com Cabarula.com Cunakod.com d1etigj2h443kd.cloudfront.net d1hpofzsaxmzog.cloudfront.net d2b46e7ax2atfi.cloudfront.net d2vut1jfnnygcg.cloudfront.net d2wv7denc1jx9z.cloudfront.net d2zyvlskj53q65.cloudfront.net d3s1tkg9f4254q.cloudfront.net d3tq9gtc0bxu1s.cloudfront.net d33wv995bk7lag.cloudfront.net d36lv9781gxp5z.cloudfront.net d274eq41c39r2n.cloudfront.net Daqah.com ddukmql.com dlrabaly59cp3.cloudfront.net dnodjoiz0vcnz.cloudfront.net Eakqz.com Focuquc.com Fotuwuk.com gahuwa.com Gapoloha.com Gasasot.com gujujoh.com Gukacado.com Hahofaba.com Hajanac.com hoduqoq.com hufunuk.com Jafuq.com Juronu.com katunaq.com Kugocu.com lomokonu.com mogaf.com Norugu.com Nusojog.com Nutojo.com Pacudoh.com Pajuwu.com Pawotapu.com Pocxc.com Pofufaco.com Pudacasa.com pugugu.com puloja.com qajolos.com Qaloqum.com Qamopo.com Qukusut.com Rokuq.com rududulu.com Ruqut.com Sanupu.com sao.kanrq.com Sastts.com Suhacuc.com Tawuhoju.com tdfpa.com Tocopada.com Toluhuku.com Tomupaj.com Tuwoqol.com Uyvsa.com wagng.com wavbsly.com Wugulaf.com yxhpa.com zahirq.com # https://blog.trendmicro.com/trendlabs-security-intelligence/coronavirus-update-app-leads-to-project-spy-android-and-ios-spyware/ cashnow.ee spy.cashnow.ee xyz.cashnow.ee # https://blog.trendmicro.com/trendlabs-security-intelligence/zoomed-in-a-look-into-a-coinminer-bundled-with-zoom-installer/ 2no.co # https://blog.trendmicro.com/trendlabs-security-intelligence/raccoon-stealers-abuse-of-google-cloud-services-and-multiple-delivery-techniques/ biome.es coliqiou.com etyourfree.cloud germanrights4u.com hrcorp1.site makemoneyeazywith.me maximili.com mybetterdl.com p201298.mybetterdl.com # https://blog.trendmicro.com/trendlabs-security-intelligence/operation-poisoned-news-hong-kong-users-targeted-with-mobile-malware-via-local-news-links/ # https://documents.trendmicro.com/assets/Tech-Brief-Operation-Poisoned-News-Hong-Kong-Users-Targeted-with-Mobile-Malware-via-Local-News-Links.pdf app.hkrevolution.club app.poorgoddaay.com appledaily.googlephoto.vip facebooktoday.cc googlephoto.vip messager.cloud movie.poorgoddaay.com news2.hkrevolution.club news.hkrevolt.com news.hkrevolution.club news.poorgoddaay.com svr.hkrevolution.club # https://blog.trendmicro.com/trendlabs-security-intelligence/operation-overtrap-targets-japanese-online-banking-users-via-bottle-exploit-kit-and-brand-new-cinobi-banking-trojan/ # https://documents.trendmicro.com/assets/pdf/Tech%20Brief_Operation%20Overtrap%20Targets%20Japanese%20Online%20Banking%20Users.pdf 4w6ylniamu6x7e3a.onion 5frjkvw2w3wv6dnv.onion bank-japanposst.jp bank-japanpost.com bank-japanpostjp.com bank-japanpostpo.jp byte.inteleksys.com cionx.inteleksys japanp0st.jp jp-bamk.jp jp-bank-japanossts.jp priv.inteleksys.com safetb-amazon.jp safety-amazon.jp sales.inteleksys.com security-amazon.jp shop.inteleksys.com ts3cardd.com view.inteleksys.com xizr.inteleksys.com # https://blog.trendmicro.com/trendlabs-security-intelligence/outlaw-updates-kit-to-kill-older-miner-versions-targets-more-systems/ minpop.com # https://blog.trendmicro.com/trendlabs-security-intelligence/first-active-attack-exploiting-cve-2019-2215-found-on-google-play-linked-to-sidewinder-apt-group/ ap1-acl.net aws-check.net deb-cn.net ms-db.net ms-ethics.net reawk.net # https://blog.trendmicro.com/trendlabs-security-intelligence/more-than-a-dozen-obfuscated-apt33-botnets-used-for-extreme-narrow-targeting/ # https://documents.trendmicro.com/assets/white_papers/wp-drilling-deep-a-look-at-cyberattacks-on-the-oil-and-gas-industry.pdf oorgans.com qualitweb.com service-eset.com service-essential.com service-explorer.com service-norton.com simsoshop.com suncocity.com update-symantec.com zandelshop.com zeverco.com # https://blog.trendmicro.com/trendlabs-security-intelligence/mobile-cyberespionage-campaign-distributed-through-callerspy-mounts-initial-phase-of-a-targeted-attack/ gooogle.press # https://blog.trendmicro.com/trendlabs-security-intelligence/mac-backdoor-linked-to-lazarus-targets-korean-users/ crabbedly.club craypot.live indagator.club # https://blog.trendmicro.com/trendlabs-security-intelligence/new-exploit-kit-capesand-reuses-old-and-new-public-exploits-and-tools-blockchain-ruse/ blockchainblog.club blockchainblogger.club shophandbag.store # https://blog.trendmicro.com/trendlabs-security-intelligence/fin6-compromised-e-commerce-platform-via-magecart-to-inject-credit-card-skimmers-into-thousands-of-online-shops/ volusion-cdn.com # https://blog.trendmicro.com/trendlabs-security-intelligence/new-fileless-botnet-novter-distributed-by-kovcoreg-malvertising-campaign/ # https://documents.trendmicro.com/assets/Appendix-New-Fileless-Botnet-Novter-Distributed-by-KovCoreG-Malvertising-Campaign.pdf 1065695240.rsc.cdn77.org 1118069275.rsc.cdn77.org bo0uiomeglecaptures.net uoibppop.tk ## uscert # https://www.us-cert.gov/ncas/analysis-reports # https://us-cert.cisa.gov/ncas/analysis-reports/ar21-189a baroquetees.com rumahsia.com # https://us-cert.cisa.gov/ncas/analysis-reports/ar21-148a theyardservice.com worldhomeoutlet.com # https://us-cert.cisa.gov/ncas/analysis-reports/ar21-126b feticost.com # https://us-cert.cisa.gov/ncas/analysis-reports/ar21-105a eyetechltd.com megatoolkit.com nikeoutletinc.org reyweb.com sense4baby.fr # https://us-cert.cisa.gov/ncas/analysis-reports/ar21-048b beastgoc.com jmttrading.org # https://us-cert.cisa.gov/ncas/analysis-reports/ar21-048d kupaywallet.com levelframeblog.com # https://us-cert.cisa.gov/ncas/analysis-reports/ar21-048c unioncrypto.vip # https://us-cert.cisa.gov/ncas/analysis-reports/ar21-048g ants2whale.com qnalytica.com # https://us-cert.cisa.gov/ncas/analysis-reports/ar20-232a agarwalpropertyconsultants.com anca-aste.it automercado.co.cr curiofirenze.com # https://us-cert.cisa.gov/ncas/analysis-reports/ar20-216a cnaweb.mrslove.com # https://www.us-cert.gov/ncas/analysis-reports/ar20-133p btt5sxcx90.com rottastics36w.net # https://www.us-cert.gov/ncas/analysis-reports/ar20-133o nanocoatingindonesia.co.id # https://www.us-cert.gov/ncas/analysis-reports/ar20-133n nanocoatingindonesia.co.id # https://www.us-cert.gov/ncas/analysis-reports/ar20-133m indogulf.hopto.org # https://www.us-cert.gov/ncas/analysis-reports/ar20-133l marianvanherp.nl # https://www.us-cert.gov/ncas/analysis-reports/ar20-133i sharedisplay.crabdance.com # https://www.us-cert.gov/ncas/analysis-reports/ar20-133g crphone.mireene.com # https://www.us-cert.gov/ncas/analysis-reports/ar20-133f inhyunits.co.kr # https://www.us-cert.gov/ncas/analysis-reports/ar20-133a 028xmz.com 3x-tv.com 33cow.com 51shousheng.com 92myhw.com 97nb.net 168wangpi.com 530hr.com 919xy.com aedlifepower.com aisou123.com aloe-china.com anlway.com ap8898.com apshenyihl.com as-brant.ru aurumgroup.co.id bogorcenter.com cabba-cacao.com castorbyg.dk creativefishstudio.com danagloverinteriors.com duratransgroup.com eventum.cwsdev3.biz eygingenieros.com growthincone.com inverstingpurpose.com locphuland.com markcoprintandcopy.com marmarademo.com matthias-dlugi.de new.titanik.fr nuokejs.com pakteb.com qdbazaar.com rhythm86.com rxrenew.us sensationalsecrets.com stokeinvestor.com streamf.ru theinspectionconsultant.com vinhsake.com # https://www.us-cert.gov/ncas/analysis-reports/ar20-133d 1588-2040.co.kr korea-tax.info # https://www.us-cert.gov/ncas/analysis-reports/AR18-337C anonyme.com evilsecure9.wordpress.com followsec7.wordpress.com key88secu7.wordpress.com keytwocode.wordpress.com lordsecure4u.wordpress.com payforsecure7.wordpress.com secangel7d.wordpress.com union83939k.wordpress.com zeushelpu.wordpress.com # https://www.us-cert.gov/ncas/analysis-reports/AR18-337B jcmi5n4c3mvgtyt5.onion ## yoroi # https://yoroi.company/blog/ # https://yoroi.company/research/threatening-within-budget-how-wsh-rat-is-abused-by-cyber-crooks/ kinghome.logsik.net mercedez.duckdns.org # https://yoroi.company/research/connecting-the-dots-inside-the-italian-apt-landscape/ failaspesa.altervista.org ffaadd332211.altervista.org fujinama.altervista.org studiocpv.it xhdyeggeeefeew.000webhostapp.com # https://yoroi.company/warning/nuove-campagne-di-attacco-quakbot/ donostiayocio.com # https://yoroi.company/warning/campagna-di-attacco-previdenza-sociale/ gstat.kangweid.com gstat.premiamo.com gstat.premiamo.eu gstat.secundamo.com gstat.secundato.com gstat.secundato.net gstat.securanto.com gstat.securanto.net gstat.securezal.com gstat.securezal.xyz gstat.securezzas.com gstat.securezzis.net gstat.sloleaks.com web.coryriley.com # https://yoroi.company/warning/campagna-di-attacco-agenzia-entrate/ gstat.peshtigodental.com gstat.premiamo.com gstat.premiamo.eu gstat.secundamo.com gstat.secundato.com gstat.secundato.net gstat.securanto.com gstat.securanto.net gstat.securezal.com gstat.securezal.xyz gstat.securezzas.com gstat.securezzis.net gstat.securityguardlisting.com gstat.sloleaks.com line.ehrlum.com # https://yoroi.company/research/new-cyber-operation-targets-italy-digging-into-the-netwire-attack-chain/ cloudservices-archive.best # https://yoroi.company/research/cyber-criminal-espionage-operation-insists-on-italian-manufacturing/ atn-com.pw # https://yoroi.company/research/poulight-stealer-a-new-comprehensive-stealer-from-russia/ fff.gearhostpreview.com poullight.ru u43692210a.ha003.t.justns.ru # https://yoroi.company/research/outlaw-is-back-a-new-crypto-botnet-targets-european-organizations/ debian-package.center # https://yoroi.company/warning/ondate-di-attacco-sload-tramite-pec/ joplock.eu keepm.eu lookf2.eu lookf.eu merfan.eu merth.eu nephemp.com nonosink.eu pivpot.eu tokenradio.com utywrg.eu woodlandislamiccenter.com zarwrite.eu zoomovers.com # https://yoroi.company/research/a-brand-new-ursnif-isfb-campaign-targets-italian-organizations/ newuploadswift.pw yefgweoiuhf.xyz # https://yoroi.company/warning/campagne-di-phishing-a-tema-webex/ globalpagee-prod-webex.com # https://yoroi.company/research/a-new-complex-infection-chain-to-deliver-ursnif-malware/ kolamana.com tealex.it # https://blog.yoroi.company/research/the-north-korean-kimsuky-apt-keeps-threatening-south-korea-evolving-its-ttps/ suzuki.datastore.pe.hu # https://blog.yoroi.company/research/karkoff-2020-a-new-apt34-espionage-operation-involves-lebanon-government/ godoycrus.com # https://blog.yoroi.company/research/transparent-tribe-four-years-later/ awsyscloud.com # https://blog.yoroi.company/warning/nuova-campagna-di-attacco-ursnif/ adult-emoji.com adultemojiapp.com adultemojiapps.com agenciaemdigital.com allodchurch.com allodchurch.org app-angels.com artproctor.com arturoproctor.com audreysfeedandtack.com audreysfeedvb.com banksesiqueira.xyz blackplague04.com blackplague1904.com bloombread.com blueoceanmngt.com bone-hog.com bonehog.com bonehogging.com bonehogs.com brightseedbakery.com brightseedbread.com brightseedbreads.com brightseedfoods.com californiapiexam.com celebcandle.com celebprayercandles.com celebritysaint.com charlotteanabardesigns.com chentowin.com codyandlita.com codyfaeth.com conceptionmayday.com conceptiontragedy.com decoartsinc.com diablodawg.com disgruntledoverlanding.com diveaboardtheconception.com diveboatconception.com divelogconception.com divemasterconception.com diverslogconception.com drinkfreetea.com dungdoptiop.xyz emojihunter.com eurothrash.com fidelityresources.co fidelityresources.com fidelityresources.info fidelityresources.net fidelityresources.org fidelitytrans.com fidtrans.com fireontheconception.com fluentfilter.com fluentintegration.com funnysaintcandles.com h2oscada.com harmonybread.com hibenjee.com hiopal.com holyfrijoli.com homycons.com laperrerax.com licketysplitapps.com ligafut7.com ligafut7fem.com ligaluff.com litaandcody.com liveaboardtheconception.com lockedintheconception.com logicfluent.com lovebreads.com luffem.com marilurice.com maydayconception.com maydaytheconception.com mexicons.com murderontheconception.com mysmartfoodie.com mysmartgaydad.com mysmartgaydads.com mysmarttravelcard.com mywatersolved.com omniprojector.com onthedotservices.com ourwatersolved.com patukulo.com process-emogi.com processemogi.com radiantbread.com reparms.com republicarmsmanufacturing.com republicarmsmfg.com republicarmsoftexas.com robertdtripsoninc.com saintcandle.com saintceleb.com saintcelebrity.com saintscandle.com saintscandles.com samscartel.com samtripsoncartel.com saveourshoresfl.com saveourshoresfl.org saveourshoresirc.com scadaoasis.com seyoso.com spacegrunt.com strand-jewelry.com superfoodbread.com superfoodbreads.com tah-co.com tahcocorp.com talesofwaldo.com telemetrydesign.com telemetrysolved.com texastacticool.com thelovebread.com thepenisinmymouth.com thespacemarine.com thetwigshop.com threadsboutiquevb.com tohomeroom.com tororevolution.com totalcleaningservicevero.com tragedyontheconception.com transformativescada.com transformativesi.org transformativeui.com trapperhackett.com trapperhackett.info trapperhackett.net trapperhackett.org vigilanteinvestigations.com waldosbontanicals.com waldosexton.com waldosexton.org waldosgarden.com wastewatersolved.net waterautomated.com waterautomated.info waterautomated.net waterautomated.org waterdefended.com waterintegrated.com waterminds.info waterminds.net waterminds.org wytextrans.com wytextransportation.com zvrtrans.com zvrtransportation.com # https://blog.yoroi.company/research/cyberwarfare-a-deep-dive-into-the-latest-gamaredon-espionage-campaign/ get-icons.ddns.net masseffect.space win-apu.ddns.net # https://blog.yoroi.company/warning/nuove-operazioni-di-attacco-sload/ cafebellissimo.com cambodiaswimmingpools.com clubdeajedrezmatamoros.com hnerert.eu nweryh.eu # https://blog.yoroi.company/warning/nuovi-attacchi-ursnif-in-corso-gls-italy/ aromareadytools.com betterbusinessresults.com bibpics.com customerspick.com desaidles2.fun ge1dmond.info gedmond0.pro hintdeals.com kolonimalosi8.pw more-patients-now.com myaromatoolsstore.com mylocalreputationreport.com new1discoveries1.com newsaplicamento2.surf newsaplicamento.surf ohfebveub.fun ohfebveub.xyz oneway.rent personalizedkreations.com pixelsuperstore.com rxbizsolutions.com shoes2boots1991.com sp344-my.sharepoint.com sscupace.xyz student-pod.com temps.team thallofloraldesign.com thedogoodarmy.com wanderunderwater.com zal6etuf.pro # https://blog.yoroi.company/warning/ondata-di-attacchi-sollecito-pagamento/ booksale.red eiufhvhrc.xyz guatemal.xyz hummercarss.com nsdaqos.pw padareova.fun randomord.com reoomavo.fun skrollinu.xyz steercos.pw toloadname.xyz wessell.pw # https://blog.yoroi.company/warning/campagna-di-attacco-nuovo-documento/ 2short2waste.org bethelarts.org bethelucc-ontario.org boathandlingjack.com composerforfilms.com crccoating.com crclaserfab.com crclasertechnologies.com embroiderydigitizing.miami hivechannel3.com homesredmond.com inlandempiresymphony.com myegy.club pizzaonenj.com promoteyourico.com realestatewoodinville.net samuelbillett.com teablitziloilo.xyz thefork.info thenuttyheads.us uccontario.com websitemaestra.com woodinvillewa.com # https://blog.yoroi.company/research/the-sload-threat-ten-months-later/ butchscorpion.com carpediem123.com clutchmagazine.com cvrwe.eu dreamacinc.com famebite.com fanaaru.com ghettoaffiliatemarketing.com ijve.eu interloc-tp.com iumju1.eu jonwilliam.com kd5ndz.com memoriesmadelb.com rdtber1.eu rdtber.eu uilomiku1.eu uilomiku.eu # https://blog.yoroi.company/warning/campagna-di-attacco-emotetursnif/ alister-mathmatics.club aylaspa.com panelfiberton.com qirqle.com sysmobi.com transporteselfenix.com # https://blog.yoroi.company/research/commodity-malware-reborn-the-agenttesla-total-oil-themed-campaign/ handrush.com # https://blog.yoroi.company/warning/nuove-operazioni-di-attacco-gootkit/ cdn.areascans.com itp.surfpapara.com web.mavensd.org # https://blog.yoroi.company/warning/ritorno-delle-campagne-di-attacco-emotet/ biyunhui.com broadpeakdefense.com followergods.com hotelkrome.com lecairtravels.com nautcoins.com refferalstaff.com startupforbusiness.com sunflagsteel.com think1.com # https://blog.yoroi.company/warning/ondata-di-attacchi-contro-aziende-italiane-ursnif/ aliiuyrt.space aliiuyrt.xyz alloiudh.casa newupprolods.club newupprolods.fun siurreje.xyz # https://blog.yoroi.company/research/new-gobrut-version-in-the-wild/ formfactset.org # https://blog.yoroi.company/warning/campagna-di-email-pec-infette-sload/ antonmolok.com drgenehawkins.com fasotechnologie.com hackonbrawlstars.com hulksterfitness.com turningcash.com # https://blog.yoroi.company/research/the-evolution-of-aggah-from-roma225-to-the-rg-campaign/ createdbymewithdeniss.blogspot.com rgalldmn.duckdns.com # https://blog.yoroi.company/warning/pericolosa-campagna-di-attacco-trickbot/ altxcode.com penpilot.net # https://blog.yoroi.company/research/p2p-worm-spreads-crypto-miners-in-the-wild/ xcnpool.1gh.com # https://blog.yoroi.company/warning/nuova-campagna-di-attacco-verso-aziende-italiane/ outlowupdt.info # https://blog.yoroi.company/research/spotting-rats-tales-from-a-criminal-attack/ thisurl.doesntexist.com # https://blog.yoroi.company/research/loocipher-the-new-infernal-ransomware/ hcwyo5rfapkytajg.darknet.to hcwyo5rfapkytajg.onion hcwyo5rfapkytajg.onion.pet hcwyo5rfapkytajg.onion.sh hcwyo5rfapkytajg.onion.ws hcwyo5rfapkytajg.tor2web.xyz # https://blog.yoroi.company/research/how-ursnif-evolves-to-keep-threatening-italy/ fileneopolo.online filomilalno.club newupdatindef.info reziki.online reziki.xyz # https://blog.yoroi.company/warning/campagna-di-attacco-sload-verso-pec-italiane/ agilebeats.com alberta-davidson.com americangoatfederation.com areabasics.com atonceegypt.com bdsm-training.com behemothadvertising.com belgrade4u.com berkeleytaylorconsultants.com cinematicleo.com citilamp.com decorretouch.com drapermerch.com e-gency.com easthamorg.com hellokittyvietnam.com implantrefer.com jimifox.com kelleyrecording.com kitapplatformu.com libreko.com marionettedesigns.com mdcreativevision.com metaphysicalstores.com misedocs.com moresaleswithai.com mullinsbeach.com myvahine.com nanolayercoatings.com nothinbutsports.com nuvenn.com nycloot.com olxtree.com openofficelight.com ourinnerhealth.com petperksandstuff.com phobosstudio.com phunctions.com piramal-usa.com pratapsinhpatil.com princewilliamcountylife.com revofine.com safariarmy.com silentbidder.com staceymorse.com ta-meyer.com tcjwelding.com thepicturecafe.com thetomatokitchen.com topcreditloans.com trailerhireonline.com truganics.com villasencancun.com wakeupcalluk.com watchgq.com wbhrconsultants.com webberwebsites.com webshops-linux.com wickedelve.com wtxhemp.com # https://blog.yoroi.company/warning/nuova-campagna-di-attacco-ransomware-sodinokibi/ aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion decryptor.top # https://blog.yoroi.company/research/the-russian-shadow-in-eastern-europe-a-month-later/ bitvers.ddns.net my-certificates.ddns.net torrent-vnc.ddns.net # https://blog.yoroi.company/research/ta505-is-expanding-its-operations/ kentona.su # https://blog.yoroi.company/research/the-stealthy-email-stealer-in-the-ta505-arsenal/ bullettruth.com nettubex.top # https://blog.yoroi.company/warning/campagna-gootkit-verso-pec-italiane/ ami.sigaingegneria.com ema.emeraldsurfsciences.com martatov.top safa.205dundas.com ssw.138front.com vdd.c21breeden.com # https://blog.yoroi.company/research/the-russian-shadow-in-eastern-europe-ukrainian-mod-campaign/ bitwork.ddns.net librework.ddns.net # https://blog.yoroi.company/warning/ondata-di-attacco-ursnif-fattura-doc alltimedfgsf.icu illeain.info # https://blog.yoroi.company/warning/nuova-campagna-di-attacco-sload/ areaclienti.17025-accreditation.com areariservata.17025-accreditation.com areariservata.alleycathydroponics.com areariservata.anniversaryguides.com areariservata.arprop.com areariservata.astrolivia.com areariservata.english2helpu.com areariservata.hvacprosgreensboro.com areariservata.rhohost.com areariservata.vendeycompradetodo.com areariservata.vipsfollowingleadership.com assistenza.anniversaryguides.com assistenza.dentistsseattlewa.com assistenza.happybeatmaking.com assistenza.poddiva.com assistenza.startourschi.com casefinity.com cloud.correctivepixels.com cloud.flamebarandgrill.com cloud.spiritcation.com discoversolarpower.com help.flutterlashstudios.com help.opticlink.com hotxm90.com resellrightscreator.com serviziweb.adventureswithangelsnextdoor.com serviziweb.bodagadelsantek.com thechosenrub.com # https://blog.yoroi.company/research/apt28-and-upcoming-elections-possible-interference-signals/ functiondiscovery.net # https://blog.yoroi.company/research/limerat-spreads-in-the-wild/ hacks4all.net netpipe.warzonedns.com # https://blog.yoroi.company/research/ursnif-the-latest-evolution-of-the-most-popular-banking-malware/ nuovalo.icu nuovalo.site # https://blog.yoroi.company/research/the-ursnif-gangs-keep-threatening-italy/ blogger.scentasticyoga.com link.kunstsignal.net # https://blog.yoroi.company/warning/campagna-di-attacco-ransomware/ blogs.nwp2.xcut.pl gandcrabmfe6mnef.onion mutualamcoop.com.ar oshorainternational.com tehms.com testzagroda.hekko24.pl # https://blog.yoroi.company/research/the-document-that-eluded-applocker-and-amsi/ riscomponents.pw # https://blog.yoroi.company/research/apex-legends-for-android-a-fake-app-could-compromise-your-smartphone/ apexhack.site areyouabot.net krater.giize.com # https://blog.yoroi.company/research/op-pistacchietto-an-italian-job/ certificates.ddns.net config01.homepc.it config02.addns.org paner.altervista.org verifiche.ddns.net visionstore.info # https://blog.yoroi.company/warning/campagna-di-attacco-scarica-il-documento/ dod.suze10n1.com dod.suzienow.com link.kunstsignal.com munosi.acnepatient.com munosi.addpatient.com munosi.baptiststay.com munosi.bharatbioscience.in munosi.buddhiststay.com munosi.catsdogsbabies.com munosi.ihavedryskin.com munosi.irritablebowelsyndromepatient.com munosi.jacksonvillerentalcommunity.com munosi.lupusinfotech.com munosi.mepex.in ortusi.adderallpatient.com ortusi.albertmuzaurieta.net ortusi.allergypatient.net ortusi.civilexpo.in ortusi.goodappledigital.com ortusi.icesurat.org ortusi.insomniapatient.com solini.albertmuzaurieta.com solini.allergypatient.net solini.anxietypatient.com solini.bharatbioscience.in solini.catholicstay.com solini.codeconcepts.co solini.headachepatient.com solini.icesurat.org sortini.albertmuzaurieta.net sortini.bharatbioscience.in sortini.buddhiststay.com sortini.catholicstay.com sortini.catsdogsbabies.com sortini.codeconcepts.in sortini.goodappledigital.com sortini.irritablebowelsyndromepatient.com sortini.jorgetonarely.com sortini.lupusinfotech.com sutori.allergypatient.net sutori.bharatbioscience.in sutori.catsdogsbaby.com sutori.codeconcepts.co sutori.codeconcepts.in sutori.icesurat.org sutori.ihavedryskin.com sutori.jaipurmurtibhandar.in sutori.lupusinfotech.com sutori.mepex.in sutori.pichvaitraditionandbeyond.com # https://blog.yoroi.company/warning/ondata-di-attacchi-con-archivi-cifrati/ cyihenryqd.city n79ye83au4268.com wbfnjohanna.band xbtillmanee.company # https://blog.yoroi.company/research/the-long-run-of-shade-ransomware/ 3dpers.com 3forfree.org 250land.000webhostapp.com 365poker.000webhostapp.com 29061.dcpserver.de aafiyaat.com aceponline.org.ng acm.ee agence.nucleus.odns.fr aguimaweb.com aialogisticsltd.com akiko.izmsystem.net alax.nexxtech.fr alexis.monville.com alfaqihuddin.com alongthelines.com americanstaffordshireterrier.it ankarabeads.com anket.kalthefest.org anneliesje.nl app-1536185165.000webhostapp.com aslike.org asztar.pl atjtourjogja.com autolikely.com azraglobalnetwork.com bakita.life balkaniks.de bar-tenderly.com barbarapaliga.pl basicpartner.no berkje.com berplamon.de bienhieutrongnha.com bishokukoubou.com bit-com.info bits-kenya.com biurorachunkowe24.waw.pl blackout.pub blessedstudiodigital.000webhostapp.com blockchainhowtouse.com bobathsi.pl bojacobsen.dk bookle.se brewmethods.com brigitte-family.com bundartree.000webhostapp.com byce.nl caferaclete.pt caraccessonriesr9.com careersatltd.com caringsoul.org chancesaffiliates.com changematterscounselling.com choinkimarkus.pl chuletas.fr citylawab.com clareplueckhahn.com.au clarte-thailand.com clermontmasons.org clubs.hmmagic.com co2services.be codebyshellbot.com comments.hmmagic.com comsystem.ch coptermotion.aero cozynetworks.com creativeapparel.co.uk cryptsen7fo43rr6.onion cryptsen7fo43rr6.onion.cab cryptsen7fo43rr6.onion.to d-fannet.com danieljenkins2000.000webhostapp.com dawgpoundinc.com deflektori.ru demosthene.org dev01.europeanexperts.com dev.europeanexperts.com digituote.fi dixo.se djisyam38.com doktech.cba.pl dreams-innovations.com drjoshihospital.com duttonandsherman.com e-online.fr ecchionline.com efficientlifechurch.org emlak.baynuri.net enjoy-kobac.com equiracing.fr erataqim.com.my ericotv.com evansindustries.com eviescoolstuff.com expert-centr.com fayanscimustafa.com fibeex.com firstbaptisthackensack.org firstdobrasil.com.br fupu.org ghetto-royale.com good-deal.ml grenop-invest.cz hanuram.net happysungroup.de helpingpawsrescueinc.org hi-shop.ml hiwentis.de hobbysalon-tf.com home-spy-shop.com hopperfinishes.com hugomaia.com ia-planet.com ijweaver.com ikuhenta.net ilan.baynuri.net immobilien-dresdner-land.de indigo-daisy.000webhostapp.com ingridandryan.com insight-analytica-amir.000webhostapp.com insperide.nl instaforexmas.com iphonedelivery.com irapak.com isolation.nucleus.odns iventix.de jillharness.com joinjohndoeit.000webhostapp.com jonathantercero.com jupajubbeauty.com kasutwakai.com katharinen-apotheke-braunschweig.de kensei-kogyo.com kerusiinovasi.com kiathongind.com.my klotho.net kobac-hita.com kobac-namerikawa01.com kobac-suzuka.com kobac-takayama.com kobac-yokohama01.com kokoon.co.uk kvintek.com kwebfun.com lakematheson.com lam.cz landing-page1169.000webhostapp.com latinbeat.com lawaaike.nl lbermudez.000webhostapp.com leeth.org lg4square.com lightbox.de lingvaworld.ru lipraco.cz lokersmkbwi.com lutnikwitwicki.pl madrascrackers.com mail.optiua.com manhtructhanhtin.com manoulaland.com market.optiua.com master-of-bitcoin.net maxdvr.000webhostapp.com maxwatermit2.com meble-robert.pl medgen.pl mentoringjagojualan.com mizutama.com mobshop.schmutzki.de mock.fpdev.xyz mod.sibcat.info montolla.tk morganbits.com morsengthaithai.com motelfortpierce.com muapromotion.com muratto.site musojoe.com myboysand.me myspaceplanner.fr mztm.jp mztm.sixcore.jp na-korable.ru nagoyan.fun nexxtech.fr nienkevanhijum.nl nkcatering.pl nn-webdesign.be northmaint.se nts-solution.net old.vide-crede.pl orangeconsultingin.000webhostapp.com orhangencebay.gen.tr osiedle-polna.pl otterloo.nl p30qom.ir paewaterfilter.com pakmedcon.com panska.cz parrocchiadellannunziata.it pausin-fotografie.de peinture-marseille.com pickledbrain.com planetpainter.ca posadaelnogal.000webhostapp.com presse.schmutzki.de primeeast.net projectmmo.ru psychoactive-mentio.000webhostapp.com qlcalendar.com qlknowledge.com quarenta.eu rarejewelry.net raymieszoo.com rbgrouptech.000webhostapp.com re-set.fr refurbished.my rentacar.baynuri.net rheniumsolutions.co.ke ri-photo.com rivercitylitho.com robjunior.com rocksolidstickers.com rosarioalcadaaraujo.com rosetki.sibcat.info rupinasu410.com sacredheartwinnetka.com sale-petit-bonhomme.com schmutzki.de scotts-grotto.org semiworldwide.net senital.co.uk service.baynuri.net shatki.info skincareshopbeauty.com smile-kobac.com sobornarada.gov.ua somelie.jp speak-and-translate.com spleenjanitors.com.ng srikrungdd.com staroil.info stellacosmeticos.com stonescrossing.com stradious.com strewn.org stringletter.com sunrise-sprit-enkazu.com super-industries.co supersnacks.rocks taking-technician.000webhostapp.com tanecni.org taoday.net tb.ostroleka.pl tekanova.com tewsusa.co the-bombay-summit.000webhostapp.com theboltchick.com thegiddystitcher.com therollingshop.com thielepape.de thorxer.de thu-san-world-challenges.org tontonfilms.com transforma.de tree.sibcat.info tunisiagulf.com u-kagawa.info uborprofit.com usep75.fr ventecservice.no videodiburama.com vps200999.vps.ovh.ca wallpapershd.xyz wamambotrading.com waterfordcomputers.ie wcf-old.sibcat.info weblogos.org webonlineshop.ml withyou2408.com xavietime.com xindetrading.000webhostapp.com yurayura.life zmastaa.com # https://blog.yoroi.company/research/gootkit-unveiling-the-hidden-link-with-azorult/ avant-garde.host hairpd.com host.colocrossing.com ivanzakharov91.example.com kinzhal.online # https://blog.yoroi.company/warning/campagna-malevola-dhl/ databeuro.com driverconnectsearch.info faceboolmotorses.com googodsgld.com ssl.admin.itybuy.it suihuajx.com # https://blog.yoroi.company/research/ursnif-long-live-the-steganography/ nolavalt.icu pereloplatka.host roiboutique.ru sendertips.ru uusisnfbfaa.xyz # https://blog.yoroi.company/warning/campagna-di-attacco-fattura-corretta/ felipllet.info fillialopago.info # https://blog.yoroi.company/research/the-story-of-manuels-java-rat/ thegoldfingerinc.com # https://blog.yoroi.company/warning/campagna-di-attacco-tramite-pec/ flpscuolafoggia.it gtdspr.space it.sunballast.de martatovaglieri.com ws.cmgsystems.it # https://blog.yoroi.company/research/the-ave_maria-malware/ anglekeys.warzonedns.com masaimaranationalparkkenya.com sentinelx.tk xinchingho.ml # https://blog.yoroi.company/warning/campagne-di-attacco-dichiarazione-dei-redditi/ donations.storecery.com local.firstcapitalmortgages.ca pinghostwell.info pragueat.com returns.chrismissirian.net sriyukteshvar.com ticketiinvoice.info todayutos.info # https://blog.yoroi.company/research/the-enigmatic-roma225-campaign/ cdtmaster.com.br minhacasaminhavidacdt.blogspot.com office365update.duckdns.org pocasideiascdt.blogspot.com systen32.ddns.net # https://blog.yoroi.company/research/dissecting-the-danabot-paylaod-targeting-italy/ equityfloat.pw # https://blog.yoroi.company/warning/campagna-di-attacco-invio-documenti-ursnif/ halamobedlam.org allooalel.club # https://blog.yoroi.company/research/dissecting-the-muddywater-infection-chain/ amorenvena.com amphira.com pazazta.com # https://blog.yoroi.company/research/dissecting-the-latest-ursnif-dhl-themed-campaign/ apt.melotor.at groupschina.com grwdesign.com in.ledalco.at int.nokoguard.at io.ledalco.at rest.relonter.at web2003.uni.net web2341.uni5.net # https://blog.yoroi.company/warning/attacchi-ursnif-nuovo-documento/ boby.ancorarestaurantnyc.com link.esempleo.com nana.anarindianhollywood.com # https://blog.yoroi.company/research/the-sload-powershell-threat-is-expanding-to-italy/ balkher.eu bureaucratica.org cavintageclothing.com firetechnicaladvisor.com hamofgri.me icodeucode.com ljfumm.me peatsenglishcider.com perecwarrior.eu rootcellarproductions.com sciencefictionforgirls.com three-bottles.com upabovenewyork.com # https://blog.yoroi.company/warning/campagne-di-propagazione-malware-gootkit/ bodim.jaipurmurtibhandar.in comm.clicktravelex.com ipo.pranavashram.in lenam.uk mercati.gasheatingrepairs.com predisposto.mattpodschweit.com # https://blog.yoroi.company/warning/ondate-di-attacchi-danabot/ driversearch.site driversearch.space # https://blog.yoroi.company/research/hunting-for-sofacy-lojax-double-agent-analysis/ mail.regvirt.com regvirt.com # https://blog.yoroi.company/warning/campagna-di-attacco-ursnif-re/ cjwefomatt.com dubbergergbb.com ninasukash.com ticrerfgiff.com