# Copyright (c) 2014-2023 Maltrail developers (https://github.com/stamparm/maltrail/)
# See the file 'LICENSE' for copying permission

# Reference: https://news.sophos.com/en-us/2018/12/06/android-clickfraud-fake-iphone/

mobbt.com
act.mobbt.com
ads.mobbt.com
sdk.mobbt.com
exevents.nativeone.co

# Reference: https://www.virustotal.com/gui/file/ec54dbb4c55b92df2113fb07ef1486a39bb5c752272230bb774018573f537132/detection

bearclod.com

# Reference: https://github.com/advanced-threat-research/IOCs/blob/master/2013/2013-04-09-one-click-fraud-variant-on-google-play-in-japan-steals-user-data/one-click-fraud-variant-on-google-play-in-japan-steals-user-data.csv

/?neosp_nontop_eropne01

# Reference: https://github.com/advanced-threat-research/IOCs/blob/master/2016/2016-04-29-fake-android-update-delivers-sms-click-fraud-europe/fake-android-update-delivers-sms-click-fraud-europe.csv

6-androdid.ru
alfabrong.eu
bugstracking.xyz
bugtracking.biz
francia-apk.ru
freeupgrade6.ru
innotion.pw
postway12.ru
slidetracking.ru
traff16.ru
traffic2015.ru
update-free-andr-6.ru

# Reference: https://github.com/advanced-threat-research/IOCs/blob/master/2016/2016-05-04-android-malware-clicker-dgen-found-google-play/android-malware-clicker-dgen-found-google-play.csv

update-sys-android.com

# Reference: https://github.com/advanced-threat-research/IOCs/blob/master/2017/2017-09-12-android-click-fraud-app-repurposed-ddos-botnet/android-click-fraud-app-repurposed-ddos-botnet.csv

ybosrcqo.us

# Reference: https://news.drweb.com/show/?lng=en&i=13464&c=14
# Reference: https://www.virustotal.com/gui/file/8809ea2387e140002654da141745baf615964452c6f2e4fee6fa9c7be1be745f/detection
# Reference: https://www.virustotal.com/gui/file/8a87f4ddb0b22c5f350029a1fb999ca058165eed05fa9dc79ab9dad9a6190e69/detection

161.117.8.243:8998
http://52.221.78.239

# Reference: https://research.checkpoint.com/2020/android-app-fraud-haken-clicker-and-joker-premium-dialer/

13.250.34.16:80
13.56.233.20:80
52.77.249.152:80

# Reference: https://security.googleblog.com/2020/01/pha-family-highlights-bread-and-friends.html

sabai5555.com
/transaction/post_click

# Reference: https://research.checkpoint.com/2020/google-play-store-played-again-tekya-clicker-hides-in-24-childrens-games-and-32-utility-apps/

api.banzinc.xyz
api.chauxincaidomainnua.icu
api.felinae.icu
api.kaluga.xyz
api.leopardus.xyz
api.lulquid.xyz
api.mantaalfredi.icu
api.maygaiproduct.icu
api.megapelagios.site
api.molatecta.icu
api.namekitchen9.xyz
api.nhudomainuong.xyz
api.pantanal.xyz
api.royalchowstudio.xyz
api.somniosus.xyz
api.sundaclouded.host
api.whitewhalestudio.host
app.slardar.icu
waws-prod-dm1-033.cloudapp.net

# Reference: https://www.virustotal.com/gui/file/189e980b1d1a429cfbc0b2d78a265ae9833ba2a9a744c193cbdd309870ec238d/detection

2e70dwl6z-7cgfugryn.ru
65wir8v9w-hz0yev62id.ru
b3jawfqky-c8kuscp3i.ru
l7vx0ks0nbf-p21w20tju3.ru
x2ibvdpbc49-0fzmpry32.ru
/apk_main.php?get_hash=

# Reference: https://www.virustotal.com/gui/file/ea44f01feeabd1eb1393af791d832c976c741c7374503f34f3fade15fa5454dc/detection

d1lxhc4jvstzrp.cloudfront.net

# Reference: https://www.virustotal.com/gui/file/d1e5d625e10c8cef8414e96bfac0edc9900a64af318c4ed2a099629c6eb18c16/detection

http://43.252.37.141/mainld/?m=

# Reference: https://www.virustotal.com/gui/file/93263869039c20a7b5c100d6499923c424891d9956302cd74c9ca6951817d9c4/detection

hdxx.xyz

# Reference: https://www.virustotal.com/gui/domain/jnd.txizd.cn/relations

jnd.txizd.cn

# Reference: https://www.virustotal.com/gui/domain/hezwl.cn/relations

hezwl.cn

# Reference: https://www.virustotal.com/gui/domain/servhost.xyz/relations
# Reference: https://www.virustotal.com/gui/file/8233e24363796a3f558be6e8851e4f558d0f97f37e1c3a8a2828b8aa79e0e065/detection

http://162.241.228.114
servhost.xyz

# Reference: https://www.virustotal.com/gui/file/336a3f85c2a651c612ceda2fe621d02ca9680791c465fcfa78cd4243ae412444/detection

mlebupesbuk.000webhostapp.com

# Reference: https://www.virustotal.com/gui/file/03469801287e1330b94d58b4c33521d809f34420805297e67e40666e51f039d3/detection

bbq.aalyun.cn

# Reference: https://www.virustotal.com/gui/file/000b5894281cc9037b05fdac8be112f2b32f63b9a3845c76f77eeef404545db7/detection

cuiliyan.herokuapp.com

# Reference: https://www.virustotal.com/gui/file/cf5db65c8a07b839d769e48bd0fe25db22653a11be22d884cf298cc4dcd581d3/detection
# Reference: https://www.virustotal.com/gui/file/cf5db65c8a07b839d769e48bd0fe25db22653a11be22d884cf298cc4dcd581d3/detection
# Reference: https://www.virustotal.com/gui/file/390bad4f55128db589db0d844a5354954529bbf49a773b03e7d8d9c819d2efff/detection
# Reference: https://www.virustotal.com/gui/file/1956fecd252b0135a45b9b8d1bab0906de41f4627a782239117369404cefc4a7/detection

115.91.26.2:3600
122.114.52.195:2020
211.149.157.40:2022
93.179.127.52:52009
ppyy.pro
365s666.com
365s777.com
365s888.com
365s999.com
666py.cc
7jf333.com
7jf444.com
84bethd.com
84hd10.com
84hd30.com
919shui.com
aisi111.com
chenmo666.com
gg3989.com
gg4222.com
gg4288.com
gg4299.com
gg4313.com
gg4333.com
gg4388.com
gg4448.com
gg4555.com
gg4588.com
huanci666.com
jfjf7788vip.com
mf820.com
mf850.com
mf860.com
puck666.com
vv9883.com
vv9885.com
vv9925.com
vv9930.com
vv9932.com
xp069.com
xp105.com
xp109.com
xp171.com
xp173.com
xp199.com
xp265.com
xp408.com
xp528.com
xp544.com
xp569.com
xp589.com
xp636.com
xp654.com
xp778.com
xuehuacdn.com
xuehuaweb.com
39u8heyw.xuehuacdn.com
4euvjfxz.xuehuacdn.com
8herqvk5.xuehuacdn.com
bde59u3k.xuehuacdn.com
bingnv.chenmo666.com
bingnv.huanci666.com
bingnv.puck666.com
bk8ca2uq.xuehuacdn.com
cdn.919shui.com
cdn.xuehuaweb.com
chenmo.chenmo666.com
chenmo.huanci666.com
chenmo.puck666.com
cw794uxm.xuehuacdn.com
d38nqm75.xuehuacdn.com
dayu.chenmo666.com
dayu.huanci666.com
dayu.puck666.com
dcq6f7tp.xuehuacdn.com
dsjrgqk7.xuehuacdn.com
eyz9w2hm.xuehuacdn.com
fengxing.chenmo666.com
fengxing.huanci666.com
fengxing.puck666.com
jf1.666py.cc
jf2.666py.cc
jfjf7788vip.com
lina.chenmo666.com
lina.huanci666.com
lina.puck666.com
m.365s666.com
m.365s777.com
m.365s888.com
m.365s999.com
m.7jf333.com
m.7jf444.com
m.aisi111.com
m.gg3989.com
m.gg4222.com
m.gg4288.com
m.gg4299.com
m.gg4313.com
m.gg4333.com
m.gg4388.com
m.gg4448.com
m.gg4555.com
m.gg4588.com
m.mf820.com
m.mf850.com
m.mf860.com
m.xp069.com
m.xp105.com
m.xp109.com
m.xp171.com
m.xp173.com
m.xp199.com
m.xp265.com
m.xp408.com
m.xp528.com
m.xp544.com
m.xp569.com
m.xp589.com
m.xp636.com
m.xp654.com
m.xp778.com
mori.chenmo666.com
mori.huanci666.com
mori.puck666.com
nq6svgdy.xuehuacdn.com
nuc79h3v.xuehuacdn.com
q9hus8jw.xuehuacdn.com
s26z3ang.xuehuacdn.com
s29dxeyf.xuehuacdn.com
scpmhxju.xuehuacdn.com
tf3k9ym2.xuehuacdn.com
udv593m7.xuehuacdn.com
wfnkuvdh.919shui.com
wj37xnrk.xuehuacdn.com
xiaoyu.chenmo666.com
xiaoyu.huanci666.com
xiaoyu.puck666.com

# Reference: https://www.mcafee.com/blogs/other-blogs/mcafee-labs/new-malicious-clicker-found-in-apps-installed-by-20m-users/

liveposting.net
modooalba.net
msideup.co.kr
pangclick.com
post-blog.com
sideup.co.kr

# Reference: https://www.virustotal.com/gui/file/65ed3b7af5c3eebafee8f2f9e5d50a3244dc66396f2b5597b8c95e60f1e95595/detection

shun.ml
xc.shun.ml

# Reference: https://www.virustotal.com/gui/file/d293ec55b0425e8731b17b814b5d9c9abe73b9ee10f8ae808f1ec0f4a969aebe/detection

youtubebplan.com