# Copyright (c) 2014-2026 Maltrail developers (https://github.com/stamparm/maltrail/)
# See the file 'LICENSE' for copying permission

# Reference: https://www.threatfabric.com/blogs/exposing-crocodilus-new-device-takeover-malware-targeting-android-devices
# Reference: https://tria.ge/250319-12j7nsypw6/behavioral2
# Reference: https://www.virustotal.com/gui/file/c5e3edafdfda1ca0f0554802bbe32a8b09e8cc48161ed275b8fec6d74208171f/detection

register-buzzy.store

# Reference: https://x.com/naumovax/status/1906727042353107402
# Reference: https://tria.ge/250107-ya4e5avqdy/behavioral2

mastercardkeys.live
mastercardkeys.world

# Reference: https://x.com/karol_paciorek/status/1927351527938621725
# Reference: https://www.virustotal.com/gui/file/0009a5d3130c733f11e8d3a09fd66ce8089cc039bf30dfc62fb581ba85946248/detection

iko-lokata.icu
iko-power-app.sbs
rentvillcr.homes

# Reference: https://www.threatfabric.com/blogs/crocodilus-mobile-malware-evolving-fast-going-global
# Reference: https://www.virustotal.com/gui/file/6d55d90d021b0980528f56d040e78fa7b85a96f5c244e23f330f24c8e80c1cb2/detection

rentvillcr.online
rentvillcr.store

# Reference: https://x.com/0x6rss/status/1943662593475842279
# Reference: https://app.validin.com/detail?find=Crocodile%20Login&type=raw&ref_id=9b397dd311a#tab=host_pairs (# 2025-07-12)

378926ebfbdcbe7.click
crocoprimecustm.store
premiumcroco.online
uniquecroco.site