# Copyright (c) 2014-2026 Maltrail developers (https://github.com/stamparm/maltrail/) # See the file 'LICENSE' for copying permission # Aliases: apt35, apt42, apt-c-51, charmingcypress, phosphorus, ajax security team, tunnelvision, nemesiskitten, ta453, ta455, greencharlie, great rift, unc1549, unc4453, unc788, plaid rain, snailresin, wezrat, emennet pasargad, bellaciao, educated manticore, subtlesnail, magichound, nimbus manticore, subtle snail, smudgedserpent # Note: https://blogs.microsoft.com/on-the-issues/2019/03/27/new-steps-to-protect-customers-from-hacking/ # Reference: https://docs.google.com/document/d/1oYX3uN6KxIX_StzTH0s0yFNNoHDnV8VgmVqU5WoeErc (2018-06-12 Charming Kitten waterhole) jewishjournal.us deutcshewelle.org deutcshewelle.com frostsullivan.org ns1.deutcshewelle.com ns2.deutcshewelle.com mail.jewishjournal.us mx0.jewishjournal.us ns1.jewishjournal.us ns2.jewishjournal.us win-ptf9aurtg8u.jewishjournal.us # Reference: https://www.clearskysec.com/charmingkitten/ # Reference: https://www.clearskysec.com/wp-content/uploads/2017/12/Charming_Kitten_2017.pdf # Reference: https://www.virustotal.com/gui/file/d4375a22c0f3fb36ab788c0a9d6e0479bd19f48349f6e192b10d83047a74c9d7/detection # Reference: https://www.virustotal.com/gui/file/971c5b5396ee37827635badea90d26d395b08d17cbe9e8027dc87b120f8bc0a2/detection # Reference: https://www.virustotal.com/gui/file/2c92da2721466bfbdaff7fedd9f3e8334b688a88ee54d7cab491e1a9df41258f/detection # Reference: https://www.virustotal.com/gui/file/734d9639fcfffef1a3c360269ccc1cda4f1d0e9dc857fa438f945e807b022c21/detection # Reference: https://www.virustotal.com/gui/file/6618051ea0c45d667c9d9594d676bc1f4adadd8cb30e0138489fee05ce91a9cb/detection # Reference: https://www.virustotal.com/gui/file/a6dea088c9e2c9191e4c2fc4ece7b7b7bd3f034f444362d35c8765f6ec4bd279/detection # Reference: https://www.virustotal.com/gui/file/2b9c941150206d38a635620f2129660628f9b08dd2f674013cacda39bde7ae56/detection 58.158.177.102:5050 85.17.172.180:5050 012mail-net-uwclogin.ml 8ghefkwdvbfdsg3asdf1.com account-customerservice.com account-dropbox.net account-google.co account-login.net account-logins.com account-log-user-verify-mail.com account-permission-mail-user.com account-servicerecovery.com accountservice.support accounts-googelmail.com accounts-googelmails.com account-signin-myaccount-users.ga accounts-logins.net accountsrecovery.ddns.net accounts-service.support accountsservice-support.com account-support-user.com accounts-yahoo.us accountts-google.com account-user.com account-user-permission-account.com account-users-mail.com account-user-verify-mail.com acounts-qooqie-con.ml addons-mozilla.download aipak.org aiqac.org aol-mail-account.com apache-utility.com app-documents.com app-facebook.co araamco.com archive-center.com asus-support.net asus-update.com berozkhodro.com book-archivecenter.bid books-archivecenter.bid books-archivecenter.club books-google.books-archivecenter.bid books-view.com bootstrap.serveftp.com britishnews.com.co britishnews.org broadcastbritishnews.com brookings-edu.in change-mail-accounting-register-single.com change-mail-account-nodes-permision.com change-permission-mail-user-managment.com change-user-account-mail-permission.com codeconfirm-recovery.bid codeconfirm-recovery.club com-account-login.com com-accountrecovery.bid com-accountsecure-recovery.name com-accountsrecovery.name com-archivecenter.work com-customeradduser.bid com-customerservice.bid com-customerservice.name com-customerservices.name com-customersuperuser.bid com-download.ml com-manage-accountuser.club com-messagecenter.bid com-messengerservice.bid com-messengerservice.work com-microsoftonline.club com-mychannel.bid com-orginal-links.ga com-recoversessions.bid com-recoveryadduser.bid com-recovery.com com-recoveryidentifier.bid com-recoveryidentifier.name com-recoveryidentifiers.bid com-recoverymail.bid com-recoverysecureuser.club com-recoverysecureusers.club com-recoveryservice.bid com-recoveryservice.info com-recoverysessions.bid com-recoverysubusers.bid com-recoverysuperuser.bid com-recoverysuperuser.club com-recoverysuperuser.name com-recoverysuperusers.bid com-recoverysupport.bid com-recoverysupport.club com-servicecustomer.bid com-servicecustomer.name com-service.gq com-servicemail.bid com-service.net com-servicerecovery.bid com-servicerecovery.club com-servicerecovery.info com-servicerecovery.name com-servicescustomer.name com-serviceslogin.com com-showvideo.ga com-showvideo.gq com-statistics.com com-stats.com com-video.net com-videoservice.work com-viewchannel.club crcperss.com cvcreate.org digitalqlobe.com display-error-runtime.com display-ganavaro-abrashimchi.com docs-google.co documents-supportsharing.bid documents-supportsharing.club documents.sytes.net document-supportsharing.bid doc-viewer.com download-link.top drive-login.cf drive-permission-user-account.com drive-useraccount-signin-mail.ga drop-box.vip dropebox.co embraer.co emiartas.com error-exchange.com eursaia.org fanderfart22.xyz fardenfart2017.xyz fb-login.cf gle-mail.com gmail-recovery.ml gmal.cf goo-gle.bid goog-le.bid goo-gle.cloud google-mail.com.co google-mail-recovery.com googlemails.co goo-gle.mobi google-profile.com google-profiles.com google-setting.com google-verification.com google-verify.com google-verify.net group-google.com help-recovery.com hot-mail.ml id-bayan.com iforget-memail-user-account.com iranianuknews.com ir-owa-accountservice.bid k2intelliqence.com line-en.me login-account-mail.com login-account.net login-again.ml login-required.ga login.loginto.me mail-account-register-recovery.com mails-account-signin-users-permssion.com mailssender.bid mail-yahoo.com.co market-account-login.net mehrnews.info messageservice.bid messageservice.club microsoft-hotfix.com microsoft-update.bid microsoft-upgrade.mobi microsoft-utility.com msoffice-update.com myaccount-login.net mychannel.ddns.net my-healthequity.com my-mailcoil.ml myscreenname.bid news-onlines.info nex1music.ml notification-accountrecovery.com nsdrive-phone.online nvidia-support.com nvidia-update.com officialswebsites.info official-uploads.com onedrive-signin.com onlinedocument.bid onlinedocuments.org onlinedrie-account-permission-verify.com onlineserver.myftp.biz online-supportaccount.com orginal-links.com outlook-livecom.bid owa-insss-org-ill-owa-authen.ml picofile.xyz policy-facebook.com privacy-facebook.com privacy-gmail.com privacy-yahoomail.com profile-facebook.co profiles-facebook.com profile-verification.com qet-adobe.com radio-m.cf raykiel.net recoverycodeconfirm.bid recovery-customerservice.com recovery-emailcustomer.com recoverysuperuser.bid register-multiplay.ml sadashboard.com saudiarabiadigitaldashboards.com saudi-government.com saudi-haj.com screen-royall-in-corporate.com screen-shotuser-trash-green.com security-supportteams-mail-change.ga sers-login.com service-accountrecovery.com service-broadcast.com servicecustomer.bid service-logins.net servicemailbroadcast.bid service-recoveryaccount.com set-ymail-user-account-permission-challenge.com shared-access.com shared-login.com shared-permission.com shorturlbot.club show-video.info slmkhubi.ddns.net smstagram.com sprinqer.com support-aasaam.bid support-aasaam.com support-accountsrecovery.com support-google.co support-recoverycustomers.com supports-recoverycustomers.com support-verify-account-user.com tadawul.com.co tai-tr.com team-speak.cf teamspeak-download.ml team-speak.ga team-speak.ml teamspeaks.cf telagram.cf token-ep.com uk-service.org update-checker.net update-driversonline.bid update-driversonline.club update-finder.com update-microsoft.bid updater-driversonline.club update-system-driversonline.bid uploader.sytes.net upload-services.com uri.cab usersettings.cf users-facebook.com users-login.com users-yahoomail.com utopaisystems.net verify-account.services verify-accounts.info verify-facebook.com verify-gmail.tk video-youtube.cf w3sch00ls.hopto.org w3school.hopto.org w3schools.hopto.org w3schools-html.com watch-youtube.org.uk webmaiil-tau-ac-il.ml webmail-tidhar-co-il.ml windows-update.systems xn--googe-q2e.ml yahoo-proflles.com yahoo-verification.net yahoo-verification.org yahoo-verify.net youetube.ga yourl.bid youttube.ga youttube.gq youtubbe.cf youtubbe.ml youtube-com.watch youtubee-videos.com youtuebe.co youtuobe.com.co youutube.cf yurl.bid # Reference: https://otx.alienvault.com/pulse/5c9bb407e5a06b014da016e3 account-profile-users.info accounts-apple.com account-servicemanagement.info account-servieemanagement.info accounts-manager.info accounts-support.services accounts-web-maii.com accounts-web-mail.com account-verifiy.net activities-recovery-options.info activities-servicesnotification.info activity-confirmationservice.info activity-session-recovery.info aeroconf2014.org aerospace2014.org appleid.com.co attacker-domain.com broadcastnews.pro com-accountidentifier.info com-identifier-servicelog.info com-identifier-servicelog.name comidentifier-servicelog.name com-identifier-servlcelog.name com-mailbox.com com-microsoftonline.club com-myaccuants.com com-privacy-help.info com-sessionidentifier.info com-useraccount.info com-users.net confirmation-recoveryoptions.info confirmation-service.info confirmation-users-service.info confirmation-users-servlee.info confirm-identity.info confirm-session-identification.info confirm-sessionidentification.info confirm-session-identifier.info continue-session-identifier.info continue-sesslon-identifier.info customer-certificate.com customer-recovery.info customers-activities.info customers-manager.info customers-services.info customize-identity.info documentofficupdate.info documentsfilesharing.cloud documentsharing.info download-teamspeak.info elitemaildelivery.info email-deiivery.info email-delivery.info eom-microsoftonline.club eom-useraccount.info eustomers-activities.info giitials.tk googledomalns.com identifier-activities.info identifier-services-sessions.info identify-user-session.info intel-update.com intelupdate.com login-gov.info message-serviceprovider.info microsoft-update.bid microsoft-upgrade.mobi mobile-messengerplus.network mobile-sessionid.customize-identity.info mobiles-sessionid.customize-identity.info myaccount-services.net notification-accountservice.com notification-accountservice.info notificationapp.info notification-manager.info notification-managers.info notifications-center.info notification-signal-agnecy.info notificatlon-signal-agnecy.info o5vdb.org outlook-livecom.bid outlook-verify.net packctstormsccurity.com plugin-adobe.com privacy-google.com recognized-activity.info recover-customers-service.info recovery-session-change.info recoveryusercustomer.info serverbroadcast.info service-accountrecoverv.com service-recovery-session.info service-session-confirm.info service-session-continue.info services-issue-notification.info services-sessionconfirmation.info session-mail-customers.info session-management.info session-manager.info session-managment.info session-recovery-options.info sessions-identifiermemberemailid.network sessions-notification.info session-users-activities.com session-verify-user.info shop-sellwear.info supportmailservice.info support.services support-servics.com support-servics.net terms-service-notification.info terms-service-notlfication.info update-microsoft.bid user-activity-issues.info useridentity-confirm.info user-profile-credentials.com users-facebook.com users-issue-services.info verification-live.com verificationlive.com verification-llve.com verifiy-account.net verifv-linkedin.net verify-linke.com verify-linkedin.net verify-user-session.info vvincicivj-c-ssenrjais.tk webemail.info xn--facebook-06k.com xn--google-yri.com yahoomail.com.co yahoo-verification.net yahoo-verification.org yahoo-verify.net # Reference: https://www.clearskysec.com/the-kittens-are-back-in-town/ # Reference: https://otx.alienvault.com/pulse/5d7e61f9aa517862e977cbad acconut-verify.com drive-accounts.com exnovin.org isis-online.net islamicemojimaker.com leslettrespersanes.net niaconucil.org seisolarpros.org skynevvs.com unrisd.com w3-schools.org # gnldp.live # Note: regular trackers # gnldr.club # gnldr.live # gnldr.website # gnldrp.live # sgnl.live # sgnl.network # sgnldp.live # sgnldr.live # Reference: https://www.clearskysec.com/wp-content/uploads/2019/10/The-Kittens-Are-Back-in-Town-2.pdf # Reference: https://otx.alienvault.com/pulse/5d9b7a71f31df0e33eefab04 bahaius.info bailment.org com-activities.site com-identifier.site com-session.site com-verifications.site customers-activities.site customers-recovery.site customers-reminder.info document-sharing.online documentsfilesharing.cloud gomyfiles.info home-access.online identifier-activities.info identifier-activities.online identity-verification-service.info inbox-drive.info inbox-sharif.info magic-delivery.info microsoftinternetsafety.net mobile-messengerplus.network mobilecontinue.network notification-accountservice.com recovery-services.info recoverysuperuser.info see-us.info sessions-identifier-memberemailid.network smarttradingfast.com system-services.site telagram.net uploaddata.info verification-services.info # Reference: https://blog.certfa.com/posts/fake-interview-the-new-activity-of-charming-kitten/ # Reference: https://otx.alienvault.com/pulse/5e3acf325495b5e504f82abc # Reference: https://www.virustotal.com/gui/ip-address/144.202.123.86/relations acconut-verify.com accounts-drive.com apple-ads-metric.com bahaius.info cpanel-services.site customers-activities.site customers-service.ddns.net drive-accounts.com finance-usbnc.info instagram-com.site inztaqram.ga isis-online.net leslettrespersanes.net malcolmrifkind.site niaconucil.org phonechallenges-submit.site recovery-options.site seisolarpros.org service-activity-checkup.site service-issues.site skynevvs.com software-updating-managers.site system-services.site two-step-checkup.site unirsd.com w3-schools.org yah00.site # Reference: https://docs.google.com/document/d/1oYX3uN6KxIX_StzTH0s0yFNNoHDnV8VgmVqU5WoeErc/edit# # Reference: https://otx.alienvault.com/pulse/5e6ff05783c525e779904d69 myconnect-support.com # Reference: https://twitter.com/ClearskySec/status/1258432745891680256 com-recovery.site com-sessions.site customer-identifier.site customer-reminder.info customers-activity.site identifier-services-session.site mobile-airbnb.site mobile-uber.site newspedia.ddns.net radiofarda.site recovery-option.site safe-solution.site scribdinc.site travel-airbnb.site # Reference: https://docs.google.com/document/d/1oYX3uN6KxIX_StzTH0s0yFNNoHDnV8VgmVqU5WoeErc/ # Reference: https://www.virustotal.com/gui/domain/kia-customerservice.ddns.net/detection # Reference: https://www.virustotal.com/gui/domain/recovery-service.site/detection document-share.info kia-customerservice.ddns.net login-users-account.site manage-accounts.info recovery-service.site us2-mail-login-profile.site # Reference: https://blogs.microsoft.com/on-the-issues/2020/10/28/cyberattacks-phosphorus-t20-munich-security-conference/ # Reference: https://otx.alienvault.com/pulse/5f99808638696999cf7b109c de-ma.online g20saudi.000webhostapp.com ksat20.000webhostapp.com # Reference: https://twitter.com/kyleehmke/status/1328374352602144770 check-panel-account.icu cover-home-panel.xyz it-service.men student-rank-number.icu # Reference: https://twitter.com/kyleehmke/status/1334170023968051200 cover-home-page.xyz # Reference: https://twitter.com/kyleehmke/status/1339602993814102016 home-reload-page.xyz # Reference: https://twitter.com/kyleehmke/status/1346154845221384194 check-panel-live.icu check-reload-page.xyz front-cover-panel.xyz front-home-panel.xyz office-live-activity.icu page-home-reload.xyz # Reference: https://blog.certfa.com/posts/charming-kitten-christmas-gift/ # Reference: https://otx.alienvault.com/pulse/5fff52390820519347e5f2d3 agentappservice.ddns.net archiverepositories.xyz basementofdarkness.ddns.net benefitsredington.ddns.net bulk-approach.site challengechampions.ddns.net com-254514785965.site com-3654623478192.site com-5464825879854.site com-apk-6712qw123asd8awf7.site com-archive.site com-posts6712qw12387.site confirm-identity.site customer-session.site deepthinkingroom.ddns.net differentintegrated.ddns.net dynamiceventmanager.ddns.net enhanceservicchecke.hopto.org heisonhisway.ddns.net hello-planet.com homedirections.ddns.net homeinspections.ddns.net identifier-service-verify.site identifier-session-recovery.site identity-session-recovery.site lonelymanshadow.ddns.net mail-newyorker.com minimumservicechek.ddns.net mobile-activity-session.site mobile-check-activity.site patchtheschool.ddns.net planet-labs.site profilechangeruser.ddns.net randomworldcity.ddns.net recover-identity.site recover-session-service.site recovery-customer-service.site recovery-session-service.site recovery-session.site reset-account.com schoolofculture.ddns.net securelogicalrepository.com service-recovery.site service-session-recovery.site service-support.site service-verification.site session-confirmation.site session-customer-activity.site uniquethinksession.ddns.net verify-session-service.site wearefirefighters.ddns.net # Reference: https://twitter.com/jfslowik/status/1347905935654539267 dhs-us.org csm-group.org procurement-inl-gov.us procurements-inl-gov.us ukborderhomeoffice-gov.org # Reference: https://www.proofpoint.com/us/blog/threat-insight/badblood-ta453-targets-us-and-israeli-medical-research-personnel-credential # Reference: https://otx.alienvault.com/pulse/6065f293e16c3e4e72044475 1drv.casa 1drv.cyou 1drv.icu 1drv.live 1drv.online 1drv.surf 1drv.xyz # Reference: https://twitter.com/ChicagoCyber/status/1391819499872137225 log-in-dropbox.com # Reference: https://twitter.com/BaoshengbinCumt/status/1423577884615081992 # Reference: https://mp.weixin.qq.com/s/oD1VQZBxgjL3rNeN72MJqg jamaat-ul-islam.com jamatapplication.com jamaatforummah.com jamaatforallah.com # Reference: https://research.checkpoint.com/2022/apt35-exploits-log4j-vulnerability-to-distribute-new-modular-powershell-toolkit/ 144.217.139.155:4444 54.38.49.6:21 0standavalue0.xyz 0storageatools0.xyz 0brandaeyes0.xyz # Reference: https://www.cybereason.com/blog/powerless-trojan-iranian-apt-phosphorus-adds-new-powershell-backdoor-for-espionage # Reference: https://www.virustotal.com/gui/ip-address/91.214.124.143/relations # Reference: https://www.virustotal.com/gui/file/ca4217b9d188cbe5fc6f4c7d5d696f93cc611dff1ffd323941f2a8b5e77284de/detection http://162.55.136.233 http://162.55.137.20 169.51.60.221:1331 45.77.76.158:23643 onedriver-srv.ml windows-driver.ml google.onedriver-srv.ml update.windows-driver.ml /gadfTs55sghsSSS/phppost.php /gadfTs55sghsSSS # Reference: https://www.sentinelone.com/labs/log4j2-in-the-wild-iranian-aligned-threat-actor-tunnelvision-actively-exploiting-vmware-horizon/ # Reference: https://otx.alienvault.com/pulse/620f76b08f1d06ea8646c0d3 microsoft-updateserver.cf service-management.tk # Reference: https://twitter.com/BaoshengbinCumt/status/1494478437960286208 # Reference: https://www.cisa.gov/uscert/sites/default/files/publications/aa22-320a_joint_csa_iranian_government-sponsored_apt_actors_compromise_federal%20network_deploy_crypto%20miner_credential_harvester.pdf http://182.54.217.2 51.89.181.64:443 us‐nation‐ny.cf # Reference: https://thedfirreport.com/2022/03/21/apt35-automates-initial-access-using-proxyshell/ http://148.251.71.182 /ecp/auth/aspx_wkggiyvttmu.aspx /aspx_wkggiyvttmu.aspx /dhvqx.aspx # Reference: https://twitter.com/ChicagoCyber/status/1562047469126656001 # Reference: https://www.shodan.io/host/173.209.51.54 # Reference: https://blog.google/threat-analysis-group/new-iranian-apt-data-extraction-tool/ (# HYPERSCRAPE) http://136.243.108.14 http://173.209.51.54 173.209.51.54:5985 # Reference: https://twitter.com/IronNetTR/status/1562913025350303744 # Reference: https://twitter.com/IronNetTR/status/1562913027951042561 # Reference: https://twitter.com/IronNetTR/status/1562913029620203520 # Reference: https://www.shodan.io/host/136.243.108.10 # Reference: https://www.shodan.io/host/136.243.108.11 # Reference: https://www.shodan.io/host/136.243.108.12 # Reference: https://www.shodan.io/host/136.243.108.13 # Reference: https://www.shodan.io/host/136.243.108.14 # Reference: https://www.shodan.io/host/136.243.108.9 # Reference: https://www.shodan.io/host/78.47.90.60 http://136.243.108.10 http://136.243.108.11 http://136.243.108.12 http://136.243.108.13 http://136.243.108.14 http://136.243.108.9 http://159.69.105.181 http://195.201.46.42 http://78.47.90.60 136.243.108.10:10000 136.243.108.10:22 136.243.108.10:25 136.243.108.10:4040 136.243.108.10:443 136.243.108.10:465 136.243.108.10:587 136.243.108.10:993 136.243.108.10:995 136.243.108.11:10000 136.243.108.11:22 136.243.108.11:25 136.243.108.11:4040 136.243.108.11:443 136.243.108.11:465 136.243.108.11:587 136.243.108.11:993 136.243.108.11:995 136.243.108.12:10000 136.243.108.12:22 136.243.108.12:25 136.243.108.12:4040 136.243.108.12:443 136.243.108.12:465 136.243.108.12:587 136.243.108.12:993 136.243.108.12:995 136.243.108.13:10000 136.243.108.13:22 136.243.108.13:25 136.243.108.13:4040 136.243.108.13:443 136.243.108.13:465 136.243.108.13:587 136.243.108.13:993 136.243.108.13:995 136.243.108.14:10000 136.243.108.14:22 136.243.108.14:25 136.243.108.14:4040 136.243.108.14:443 136.243.108.14:465 136.243.108.14:587 136.243.108.14:993 136.243.108.14:995 136.243.108.9:10000 136.243.108.9:22 136.243.108.9:25 136.243.108.9:4040 136.243.108.9:443 136.243.108.9:465 136.243.108.9:587 136.243.108.9:993 136.243.108.9:995 159.69.105.181:2082 159.69.105.181:2083 159.69.105.181:2086 159.69.105.181:2087 159.69.105.181:21 159.69.105.181:22 159.69.105.181:443 159.69.105.181:53 195.201.46.42:10000 195.201.46.42:22 195.201.46.42:25 195.201.46.42:443 195.201.46.42:465 195.201.46.42:587 195.201.46.42:993 195.201.46.42:995 78.47.90.60:10000 78.47.90.60:110 78.47.90.60:143 78.47.90.60:2082 78.47.90.60:2083 78.47.90.60:2086 78.47.90.60:2087 78.47.90.60:21 78.47.90.60:25 78.47.90.60:443 78.47.90.60:465 78.47.90.60:53 78.47.90.60:587 78.47.90.60:993 78.47.90.60:995 # Reference: https://research.checkpoint.com/2022/check-point-research-exposes-an-iranian-phishing-campaign-targeting-former-israeli-foreign-minister-former-us-ambassador-idf-general-and-defense-industry-executives/ litby.us # Reference: https://twitter.com/LukasStefanko/status/1569258418283905026 # Reference: https://www.mandiant.com/media/17826 (# apt42, crookedcharms) # Reference: https://www.virustotal.com/gui/file/5d3ff202f20af915863eee45916412a271bae1ea3a0e20988309c16723ce4da5/detection # Reference: https://www.virustotal.com/gui/file/c2c1d804aeed1913f858df48bf89a58b1f9819d7276a70b50785cf91c9d34083/detection # Reference: https://www.virustotal.com/gui/file/a8c062846411d3fb8ceb0b2fe34389c4910a4887cd39552d30e6a03a02f4cc78/detection # Reference: https://www.virustotal.com/gui/file/90e5fa3f382c5b15a85484c17c15338a6c8dbc2b0ca4fb73c521892bd853f226/detection 137.184.212.205:4373 51.38.87.253:3535 cdsa.xyz developer-app.xyz hardship-management.com office-updates.info # Reference: https://cloud.google.com/blog/topics/threat-intelligence/untangling-iran-apt42-operations acconut-signin.com account-signin.com accounts-mails.com accredit-validity.online accurate-sprout-porpoise.glitch.me admin-stable-right.top admiscion.online admit-roar-frame.top advission.online affect-fist-ton.online aspenlnstitute.org avid-striking-eagerness.online azadlliq.info beaviews.online besvision.top bloom-flatter-affably.top bq-ledmagic.online briview.online businesslnsider.org check-online-panel.live check-pabnel-status.live check-panel-status.live check-short-panel.live confirmation-process.top connection-view.online continue-recognized.online coordinate.icu cvisiion.online d75.site daemon-mailer.info dloffice.buzz dloffice.top ecomonist.org email-daemon.biz email-daemon.biz.tinurls.com email-daemon.online email-daemon.online.tinurls.com email-daemon.site endorsement-services.online eocnomist.com foreiqnaffairs.com foreiqnaffairs.org forieqnaffairs.com fortune-retire-home.top g-online.org geaviews.site glory-uplift-vouch.online go-conversation.lol go-forward.quest gview.site identifier-direction.site indication-service.online israelhayum.com join-paneling.online jpost.press jpostpress.com khaleejtimes.org khalejtimes.org last-check-leave.buzz live-project-online.live live-projects-online.top loriginal.online m85.online maariv.net mailer-daemon.info mailer-daemon.us mccainlnstitute.org mterview.site myaccount-signin.com nterview.site online-access.live panel-check-short.live panel-live-check.online panel-short-check.live panel-view-short.online panel-view.live panel-view.online panel-views-cheking.live panelchecking.live paneling-viewing.live panels-views-ckeck.live quomodocunquize.site recognize-validation.online reconsider.site revive-project-live.online s20.site s51.online s59.site short-url.live short-view.online shortenurl.online shorting-ce.live shortingurling.live shortlinkview.live shortulonline.live shoting-urls.live signin-acconut.com signin-accounts.com signin-mail.com signin-mails.com signin-myaccounts.com simple-process-static.top status-short.live stellar-roar-right.buzz support-account.xyz sweet-pinnacle-readily.online tcvision.online themedealine.org timesfisrael.com title-flow-store.online tnt200.mywire.org twision.top vanityfaire.org verify-person-entry.top view-cope-flow.online view-panel.live view-pool-cope.online view-total-step.online viewstand.online viewtop.online virtue-regular-ready.online washinqtonpost.press we-transfer.shop ynetnews.press youronlineregister.com youtransfer.live # Reference: https://community.emergingthreats.net/t/ruleset-update-summary-2022-11-22-v10179/172 dnx.capital sharedrive.ink washingtonlnstitute.org # Reference: https://community.emergingthreats.net/t/ruleset-update-summary-2022-11-30-v10185/185 # Reference: https://twitter.com/ThreatBookLabs/status/1613825659582959617 cutly.biz mailer-daemon.live mailer-daemon.me mailer-daemon.net mailer-daemon.online mailer-daemon.org tinyurl.ink # Reference: https://www.recordedfuture.com/suspected-iran-nexus-tag-56-uses-uae-forum-lure-for-credential-theft-against-us-think-tank # Reference: https://otx.alienvault.com/pulse/638e5648107623c3429e8c21 continuetogo.me mailer-daemon-message.co # Reference: https://twitter.com/ET_Labs/status/1629278117071147008 compact-miracle-abounds.top funeral-engineering-expression.top node-dashboard.site node-panel.site stellar-stable-faith.top # Reference: https://www.secureworks.com/blog/cobalt-illusion-masquerades-as-atlantic-council-employee bonny-marvels-authentic.top live-redirect-system.top progress-captivate-amply.top review-status-plan.online sincerely-sensation-outdo.top # Reference: https://twitter.com/k3yp0d/status/1650513653802708996 # Reference: https://cloud.google.com/blog/topics/threat-intelligence/uncovering-iranian-counterintelligence-operation azadijobs.me beparas.com bilal1com.com damavand-hr.me damkahill.com darakeh.me dream-jobs.org dream-jobs.vip dreamy-job.com dreamy-jobs.com dreamycareer.com golanjobs.me hat-cast.com irnjobs.me joinoptimahr.com jomehjob.com kandovani.org opthrltd.me optima-hr.com optimac-hr.com optimax-hr.com parasil.me radabala.com rostam-hr.vip salamjobs.me shirazicom.com syrtime.me titanium-hr.com topiranjobs.me topwor4u.com trnjobs.me vipjobsglobal.com wazayif-halima.com wazayif-halima.org wehatcast.com youna101.me younamesh.com # Reference: https://research.checkpoint.com/2023/educated-manticore-iran-aligned-threat-actor-targeting-israel-via-improved-arsenal-of-tools/ deersharpfork.info subinfralab.info blackturtle.hopto.org # Reference: https://x.com/salmanvsf/status/1930185668560597209 # Reference: https://www.virustotal.com/gui/ip-address/185.132.176.240/relations # Reference: https://www.virustotal.com/gui/file/f54dc4b91383d84e0a51fee2e232916da8899a7b7b39f91a782af8ef17f15d02/detection http://185.132.176.240 mywebdout.ddns.net # Reference: https://businessinsights.bitdefender.com/unpacking-bellaciao-a-closer-look-at-irans-latest-malware # Reference: https://otx.alienvault.com/pulse/64499283c56cf14e277f9063 mail-updateservice.info maill-support.com mailupdate.com mailupdate.info msn-center.uk msn-service.co twittsupport.com # Reference: https://www.proofpoint.com/us/blog/threat-insight/welcome-new-york-exploring-ta453s-foray-lnks-and-mac-malware # Reference: https://www.virustotal.com/gui/ip-address/144.217.129.176/relations checkup.webredirect.org filemanager.theworkpc.com fuschia-rhinestone.cleverapps.io library-store.camdvr.org # Reference: https://twitter.com/blackorbird/status/1690994786415874048 # Reference: https://github.com/blackorbird/APT_REPORT/blob/master/Charming%20Kitten/2023-08-10-cyber-brief-no-01-2023.pdf beape.live beasze.live beeasaze.top check-control-panel.live check-reload-page.live direct-view-check.live direct-view-panel.xyz ksview.top load-panel.online panel-review-check.live view-direct-panel.live view-direct-panel.xyz view-home-panel.xyz # Reference: https://www.welivesecurity.com/en/eset-research/sponsor-batch-filed-whiskers-ballistic-bobcats-scan-strike-backdoor/ http://37.120.222.168 # Reference: https://app.validin.com/axon?find=58.158.177.102&type=ip canvas-life.me flash-adobe.org lgupluscdn.com manage-tech.club channel-shop.manage-tech.club helper.canvas-life.me # Reference: https://community.emergingthreats.net/t/ruleset-update-summary-2023-12-04-v10478/1178 igsecurity.email metaemailsecurity.com metaemailsecurity.net metahelpservice.net metasecurityemail.org metasupportmail.co metasupportmail.com xn–metaspport-v43e.com # Reference: https://www.microsoft.com/en-us/security/blog/2024/01/17/new-ttps-observed-in-mint-sandstorm-campaign-targeting-high-profile-individuals-at-universities-and-research-orgs/ # Reference: https://community.emergingthreats.net/t/ruleset-update-summary-2024-01-17-v10508/1292 cloud-document-edit.onrender.com coral-polydactyl-dragonfruit.glitch.me east-healthy-dress.glitch.me epibvgvoszemkwjnplyc.supabase.co kwhfibejjyxregxmnpcs.supabase.co ndrrftqrlblfecpupppp.supabase.co # Reference: https://twitter.com/MsftSecIntel/status/1747666342897963362 # Reference: https://twitter.com/G60930953/status/1747821766074863690 # Reference: https://www.virustotal.com/gui/file/e0ba0cedd8a8624c75af29965e5fa7ab754fc0fcddbb330bb548dab4f2be333f/detection prism-west-candy.glitch.me # Reference: https://twitter.com/billyleonard/status/1757556382176313624 # Reference: https://blog.google/technology/safety-security/tool-of-first-resort-israel-hamas-war-in-cyber/ # Reference: https://services.google.com/fh/files/misc/tool-of-first-resort-israel-hamas-war-cyber.pdf # Reference: https://github.com/google/threat-team/blob/main/2024/2024-02-14-tool-of-first-resort-israel-hamas-war-cyber/indicators.csv bitly.org.il cyberflood.io daemon-mailer.co fbmro.com glorynewstoday.com ifstate.page.link isra-help.org latest-tools.store mailer-daemon.co mailerdaemon.online myprofileface.page.link ncgrassfed.com pasmoiapp.com ppmataro.com shebacenter.online shebacenter.org solofansapp.page.link stromectolonline.com # Reference: https://twitter.com/k3yp0d/status/1764938541203612004 # Reference: https://twitter.com/k3yp0d/status/1764940785345089940 # Reference: https://www.volexity.com/blog/2024/02/13/charmingcypress-innovating-persistence/ # Reference: https://www.virustotal.com/gui/file/3226b3e7d7fdaebfe7d7f06bdaf0cad08ea9792cd32843d01e6023f67cd0c889/detection # Reference: https://www.virustotal.com/gui/file/0e51029ba28243b0a6a071713c17357a8eb024aa4298d1ccc9e2c4ac8916df4d/detection drive-file-share.site worried-eastern-salto.glitch.me # Reference: https://www.validin.com/blog/expanding-apt42-intelligence-with-validin/ # CERT_FINGERPRINT_SHA256-HOST=fc6b8570bf7f77380959a1314d2d8ded69f0e22c7faad781c984ca3da8021497 3dauth.live acconut-mail.com account-drive.com account-siqnin.com accredit-validity.ddns.net accredit.network africanblackwidow.ddns.net atlanticconucil.org atlanticcuoncil.com businessinssider.org centrallibrary.info clarification.network conferencecall.live confirm-direction.ddns.net confirm-integrity.ddns.net confirm-validation.ddns.net confirm-validation.mywire.org confirm-validity.hopto.org confirm-verify.servepics.com confirmation-verify.hopto.org continue-recognized.ddns.net continue-recognized.hopto.org digitalpufferfish.ddns.net direction-check.online direction-session-verify.site direction-veracity.ddns.net drive-acconut.com drive-acconuts.com drive-account.com eatonthehotground.ddns.net elated-supportive-exultation.top entrpreneur.org flowerskindergarten.ddns.net gatestonelnstitute.org identifier-direct.ddns.net identifier-service.ddns.net identifier-verify.ddns.net identity-session.ddns.net jubilatesee.site meeting-share.online modification-check.online modification-verify.ddns.net oceanofinformation.ddns.net ourredbucket.ddns.net panel-status-join.live paneling-check-live.live paneling-cheking-df.live pay.entrpreneur.org permission-data.online pnael-checking.live products-services.network recognize-validation.theworkpc.com responsiblestatcraft.org review-session.hopto.org safeshortl.ink schoolofpinkmice.ddns.net session-review.hopto.org short-modification.site short-urling.live shorting-urling.live shortoni.live shorturling.live signin-identifi.com strainitiatives.ddns.net thefireisburnt.ddns.net validation-confirm.ddns.net validity-accredit.ddns.net verify-corroborate.ddns.net web-getdata.site # Reference: https://www.virustotal.com/gui/file/9146f8c1e0a88d961e5d1b6ac4633506c6e904e4cdf4c36ac5c1b5bd44867628/detection 94.156.128.60:5252 https://community.emergingthreats.net/t/ruleset-update-summary-2024-05-06-v10590/1615 decorous-super-blender.glitch.me wulpfsrqupnuqorhexiw.supabase.co # Reference: https://twitter.com/k3yp0d/status/1572561485376950274 # Reference: https://www.mandiant.com/media/17826 # Reference: https://www.virustotal.com/gui/file/2be8c9591d9aab6d81e4dd4a7e04371c7b1577404fa9ead11372251afcd13059/detection technical-updates.info # Reference: https://blog.google/threat-analysis-group/iranian-backed-group-steps-up-phishing-campaigns-against-israel-us/ # Reference: https://app.validin.com/detail?find=135.181.203.1&type=ip4&ref_id=7bb26af05d1#tab=resolutions # Reference: https://app.validin.com/detail?find=212.162.152.151&type=ip4&ref_id=ea7526bb584#tab=resolutions # Reference: https://app.validin.com/detail?find=38.180.121.133&type=ip4&ref_id=f79dde040dd#tab=resolutions # Reference: https://app.validin.com/detail?find=66.151.40.83&type=ip4&ref_id=45cc7c174db#tab=resolutions # Reference: https://app.validin.com/detail?find=66.151.40.84&type=ip4&ref_id=d413894d497#tab=resolutions # Reference: https://www.virustotal.com/gui/file/f83e2b3be2e6db20806a4b9b216edc7508fa81ce60bf59436d53d3ae435b6060/detection # Reference: https://www.virustotal.com/gui/file/f1819b6aed24b81e6432a6d738206a388c266f72dbde4a8f4a4b9b6e3c55e609/detection # Reference: https://www.virustotal.com/gui/file/89c1d1b61d7f863f8a651726e29f2ae3de7958f36b49a756069021817947d06c/detection # Reference: https://www.virustotal.com/gui/file/0180f4f29c550aa1ffaa21af51711b29de99fb1d7c932d008a0e9356ae8a7d60/detection http://91.107.150.184 accredit-navigation.online accredit.validity.werifcattion.info app-engage-station.help boundary.cfd brookings.email cdn-workspacestudio.redirectme.net check-fa-pane.live checking-paneling.live click-choose-figured.cfd click-manage-room.cfd complete-telecom-operation.top confirrnation.info continueworkflow.onthewifi.com correction.verify.rsession.site duuuumpy.click dynamicroute.serveirc.com essential-guide.serveirc.com essentialeditor.serveirc.com expandprocess.serveblog.net filecloudmanager.site flow-exulltation-uplift.top green-light.bond happened.fun host-bulk-stack.cfd house-server-digital.xyz interconnected-equipment-buildings.buzz make-host-solution.buzz makeit.lat meetroomonlin1925.w3spaces.com modification-control.online nail-forward-valid.lol overviewstatus.redirectme.net panel-check-live.live panel-status-joining.live paneling-checke.live program-indipendent-system.buzz re-brandly.store real-vision.redirectme.net recognize.site rectification.info recursivedns.site rendercomponents.site request-human-received.xyz review-continue-entered.cfd review.validation.recognize.site rsession.site s3api.shop s4api.shop sharedrive.webredirect.org shooort.site shooourt.click shoring-live.live short-ion-per.live short-jg934hw.live short-rigf.live smaaaal.cfd submissiveness.online taskprocess.viewdns.net teams.webredirect.org umberella.icu understandingthewar.org validation.recognize.site validity.werifcattion.info verify.rsession.site visioneditor.loseyourip.com webdirecthost.site werifcattion.info wysebeyond.gotdns.ch youtransfer.online /Gallery/Ref/FSaEM5gG /Gcollection/Ref/CkliPwaM /Ref/CkliPwaM /CkliPwaM /Lcollection/Ref/F53OQQkE /Ref/F53OQQkE /F53OQQkE /aliasauthG/autoref/vNSX6c2m /autoref/vNSX6c2m /vNSX6c2m # Reference: https://x.com/RecordedFuture/status/1825867926043312398 # Reference: https://go.recordedfuture.com/hubfs/reports/cta-ir-2024-0820.pdf activeeditor.info admin.cheap-case.site api.cheap-case.site api.overall-continuing.site app.cheap-case.site backend.cheap-case.site callfeedback.duia.ro carservices.dns-dynamic.net chatsynctransfer.info cheap-case.site cloudarchive.info cloudregionpages.info cloudtools.duia.eu coldwarehexahash.dns-dynamic.net configtools.linkpc.net contentpreview.redirectme.net continue.duia.eu continueresource.forumz.info currentpageeditor.dns-dynamic.net demo.cheap-case.site destinationzone.duia.eu dev.cheap-case.site directfileinternal.info doceditor.duckdns.org documentcloudeditor.ddnsgeek.com dynamicrender.line.pm dynamictranslator.ddnsgeek.com editioncloudfiles.dns-dynamic.net entryconfirmation.duckdns.org fileeditiontools.linkpc.net filereader.dns-dynamic.net finaledition.redirectme.net highlightsreview.line.pm hugmefirstddd.ddns.net icegelato.ddns.net icenotebook.ddns.net itemselectionmode.info joincloud.duckdns.org joincloud.mypi.co lineeditor.001www.com lineeditor.32-b.it lineeditor.mypi.co linereview.duia.eu longlivefreedom.ddns.net messagepending.info minascs.ddns.net mobiletoolssdk.dns-dynamic.net nextbox.line.pm nextcloud.duia.us nextcloudzone.dns-dynamic.net onetimestorage.info onlinecalendar.ddnsgeek.com onlinecloudzone.info onlinereader.linkpc.net overall-continuing.site overflow.duia.eu pagerender.duckdns.org pagerendercloud.linkpc.net pageviewer.linkpc.net personalcloudparent.info personalstoragebox.linkpc.net personalwebview.info pkglessplans.xyz preparingdestination.fixip.org proceeddestination.dns-dynamic.net projectdrivevirtualcloud.co.uk readquickarticle.dns-dynamic.net realcloud.info realpage.redirectme.net researchdocument.info reviewedition.duia.eu rozetka.dyndns.org s1vega.dyndns.org searchstatistics.duckdns.org selfpackage.info servicesfiledrop.theworkpc.com sharestoredocs.theworkpc.com smartview.dns-dynamic.net softservicetel.ddns.net sourceusedirection.mypi.co splitviewer.linkpc.net storageprovider.duia.eu streaml23.duia.eu synctimezone.dns-dynamic.net termsstatement.duckdns.org testecs48.ddns.net thisismyapp.accesscam.org thisismydomain.chickenkiller.com timelinepage.dns-dynamic.net timezone-update.duckdns.org towerreseller.dns-dynamic.net tracedestination.duia.eu translatorupdater.dns-dynamic.net uptime-timezone.dns-dynamic.net uptimezonemetadta.run.place vector.kozow.com vegas777.dyndns.org viewdestination.vpndns.net webviewerpage.info worldstate.duia.us # Reference: https://www.proofpoint.com/us/blog/threat-insight/best-laid-plans-ta453-targets-religious-figure-fake-podcast-invite-delivering # Reference: https://app.validin.com/detail?find=6d7b0b16f0cbad033ee08e6b414f02fd&type=hash&ref_id=015842d48f4#tab=host_pairs_v2 # Reference: https://www.virustotal.com/gui/ip-address/54.39.143.120/relations deepspaceocean.info pinnaclegen.com hoticecream.ddns.net pencilbrush.ddns.net # Reference: https://www.virustotal.com/gui/file/c67cd544a112cab1bb75b3c44df4caf2045ef0af51de9ece11261d6c504add32/detection http://190.2.150.50 190.2.150.50:443 # Reference: https://x.com/k3yp0d/status/1828699405056180664 # Reference: https://www.virustotal.com/gui/ip-address/38.180.111.244/relations # Reference: https://app.validin.com/detail?find=38.180.111.244&type=ip4&ref_id=86db3c91efa#tab=resolutions cspvpn.duckdns.org em-payments-bot.duckdns.org empaymentsbot.duckdns.org vpncsp.duckdns.org # Reference: https://app.validin.com/detail?find=38.180.111.246&type=ip4&ref_id=c6b5b76ecdb#tab=resolutions zedisdead.duckdns.org # Reference: https://harfanglab.io/insidethelab/cyclops-replacement-bellaciao/ autoupdate.uk mail-update.info servicepackupdate.info systemupdate.info servicesupdate.info servicechecker.top ns2.servicechecker.top freeheadlines.top ns2.freeheadlines.top # Reference: https://x.com/blackorbird/status/1840667306583572653 # Reference: https://www.ic3.gov/Media/News/2024/240927.pdf # Reference: https://www.resecurity.com/blog/article/iranian-cyber-actors-irgc-targeting-the-2024-us-presidential-election 3dconfirrnation.com accesscheckout.online accessverification.online accunt-loqin.ml accurateprivacy.online atlantic-council.com boom-boom.ga bytli.us continue-to-your-account.000webhostapp.com covi19questionaire.000webhostapp.com covid19questionnaire.freesite.vip css-ethz.ch cutly.vip daemon-mailer.com direct-access.info discovery-protocol.ml docfileview.org doctransfer.online dr-sup.live email-protection.online file-access.com filetransfer.club freahman.online freshconnect.live gdrive-files.com gettogether.quest gl-sup.online gm-sup.com idccovid19questionaire.000webhostapp.com ipsss.000webhostapp.com linkauthenticator.online lovetoflight.com lst-accurate.com ltf.world mailer-daemon.site mailer-support.online mailerdaemon.info mfa-ic.ae mofa-ic.ae private-file-sharing.000webhostapp.com qmaiil.ml reactivate-disabled-accuonts.000webhostapp.com redirect-drive.online shared-files-access.live sharefilesonline.live summit-files.com tinyurl.co.il tinyurl.live uani.us verificationservice.online workstation2020.000webhostapp.com www-myaccounts-support.000webhostapp.com # Reference: https://x.com/k3yp0d/status/1840762048826728893 # Reference: https://app.validin.com/detail?type=ip&find=38.180.91.211#tab=resolutions # Reference: https://www.gov.il/BlobFolder/reports/alert_1803/he/ALERT-CERT-IL-W-1803.pdf cloudviewer.site directpathfellow.zapto.org formcloud.redirectme.net launchmeetprofile.servehttp.com # Reference: https://app.validin.com/detail?find=38.180.91.195&type=ip4&ref_id=96da503d30d#tab=resolutions cloudcomputing.webredirect.org matchtomeet.ddns.net mycloudhosting.redirectme.net zoomcloud.redirectme.net # Reference: https://app.validin.com/detail?find=38.180.91.193&type=ip4&ref_id=96da503d30d#tab=resolutions navigationtools.site flashpointfarm.gotdns.ch main-packages.strangled.net # Reference: https://app.validin.com/detail?find=38.180.91.206&type=ip4&ref_id=96da503d30d#tab=resolutions entrydirect.ddns.net # Reference: https://app.validin.com/detail?find=38.180.91.175&type=ip4&ref_id=96da503d30d#tab=resolutions sublimetxtcontent.serveblog.net virtual-notes.gotdns.ch workspaceconsole.servehttp.com # Reference: https://app.validin.com/detail?find=38.180.91.195&type=ip4&ref_id=96da503d30d#tab=resolutions cloudcomputing.webredirect.org matchtomeet.ddns.net mycloudhosting.redirectme.net zoomcloud.redirectme.net # Reference: https://app.validin.com/detail?find=38.180.91.193&type=ip4&ref_id=96da503d30d#tab=resolutions navigationtools.site flashpointfarm.gotdns.ch main-packages.strangled.net # Reference: https://app.validin.com/detail?find=38.180.91.190&type=ip4&ref_id=96da503d30d#tab=resolutions pagerenderstatus.info destinationreferrer.serveirc.com essential-overview.sytes.net featurespace.ooguy.com featurespace.serveblog.net usabilitystatus.servehttp.com # Reference: https://app.validin.com/detail?find=38.180.91.184&type=ip4&ref_id=96da503d30d#tab=resolutions realcdnworker.site hardbookshelf.ooguy.com myselfdatahistory.serveirc.com # Reference: https://x.com/HostileSpectrum/status/1722628312013660665 # Reference: https://x.com/k3yp0d/status/1852051018181452143 # Reference: https://www.virustotal.com/gui/ip-address/45.143.167.87/relations # Reference: https://www.ic3.gov/CSA/2024/241030.pdf # Reference: https://research.checkpoint.com/2024/wezrat-malware-deep-dive/ # Reference: https://www.virustotal.com/gui/file/4431b2a4d7758907f81fb1a0c1e36b2ce03e08d43123b1c398487770afd20727/detection # Reference: https://www.virustotal.com/gui/file/e37b95bb9bee64cc0313eaad8a0269493745f89413bd78b58bb3b479b36084ae/detection # Reference: https://www.virustotal.com/gui/file/a624768f28ca66e82cb5d157e5ddd427644e903476099ef0d155ab1f426da8a3/detection # Reference: https://www.virustotal.com/gui/file/84366a894120d4a8c83411925ef04de52fa56da6fad0023a71f71a9bf21259ad/detection http://45.143.167.87 http://194.11.226.9 http://194.4.49.175 194.11.226.9:443 194.4.49.175:443 45.143.167.87:443 46.249.58.136:4444 46.249.58.136:8080 cybercourt.io gamershotel.pro il-cert.net onlinelive.info pro-today.org rgud-group.com rgud-group.net zeusistalking.com zeusistalking.io zeusistalking.net # Reference: https://about.fb.com/wp-content/uploads/2022/04/Meta-Quarterly-Adversarial-Threat-Report_Q1-2022.pdf # Reference: https://otx.alienvault.com/pulse/624f0d6039be61f29b5f463c # Reference: https://lists.emergingthreats.net/pipermail/emerging-sigs/2022-April/030630.html alharbitelecom.co apply-jobs.com applytalents.com appslocallogin.online archery.dedyn.io bnt2.live careers-finder.com cloudgoogle.co cortanaservice.com cortanaupdate.co defenderupdate.ddns.net edge-cloudservices.com elecresearch.org enerflex.ddns.net enerflex.org etisalatonline.com exprogroup.org freechess.live funnychess.online getadobe.ddns.net getadobe.net globaltalent.in googleservices.co googleupdate.co helpdesk-product.com kavkazru.press khaleejtimes.co latinoamericareporta.com librarycollection.org linkedinz.me listen-books.com localadmin.online localadmin.ru lukoil.in market.dedyn.io market.vinam.me mastergatevpn.com microsoftcdn.co microsoftdefender.info microsoftedgesh.info mideasthiring.com monitor-ua.com office-shop.me onedrivelive.me onedriveupdate.net online-audible.com online-chess.live outlookde.live outlookdelivery.com politica.in.ua remgrogroup.com revistadcr.com saipem.org sauditourismguide.com savemoneytrick.com sharepointnotify.com signin.dedyn.io sparrowsgroup.org supportskype.com talent-recruitment.org talktalky.azurewebsites.net thefreemovies.net ukraine2day.com updateddns.ddns.net updatedefender.net updatedns.ddns.net updateservices.co # Reference: https://x.com/StrikeReadyLabs/status/1851438224834433154 # Reference: https://x.com/ClearskySec/status/1856268257734410647 # Reference: https://x.com/asdasd13asbz/status/1851513587967078410 # Reference: https://www.clearskysec.com/wp-content/uploads/2024/11/Iranian-Dream-Job-ver1.pdf # Reference: https://www.virustotal.com/gui/file/4e27556432464375a9016a410b6eef586f3a27377424ffc09f40eb252af144a2/detection # Reference: https://www.virustotal.com/gui/file/918e70e3f5fdafad28effd512b2f2d21c86cb3d3f14ec14f7ff9e7f0760fd760/detection careers2find.com xboxapicenter.com cdn.careers2find.com quiz.careers2find.com # Reference: https://twitter.com/malwrhunterteam/status/1762813636001570980 # Reference: https://www.mandiant.com/resources/blog/suspected-iranian-unc1549-targets-israel-middle-east # Reference: https://www.virustotal.com/gui/file/5aa317d3682ff127e1e92d2016c08f94be60937a1b8a210876d931d072386336/detection 1stemployer.com airconnectionapi.azurewebsites.net airconnectionsapi.azurewebsites.net airconnectionsapijson.azurewebsites.net airgadgetsolution.azurewebsites.net airgadgetsolutions.azurewebsites.net altnametestapi.azurewebsites.net answerssurveytest.azurewebsites.net apphrquestion.azurewebsites.net apphrquestions.azurewebsites.net apphrquizapi.azurewebsites.net arquestions.azurewebsites.net arquestionsapi.azurewebsites.net audiomanagerapi.azurewebsites.net audioservicetestapi.azurewebsites.net birngthemhomenow.co.il blognewsalphaapijson.azurewebsites.net blogvolleyballstatus.azurewebsites.net blogvolleyballstatusapi.azurewebsites.net boeisurveyapplications.azurewebsites.net browsercheckap.azurewebsites.net browsercheckingapi.azurewebsites.net browsercheckjson.azurewebsites.net cashcloudservices.com changequestionstypeapi.azurewebsites.net changequestionstypejsonapi.azurewebsites.net changequestiontypes.azurewebsites.net changequestiontypesapi.azurewebsites.net checkapicountryquestions.azurewebsites.net checkapicountryquestionsjson.azurewebsites.net checkservicecustomerapi.azurewebsites.net coffeeonlineshop.azurewebsites.net coffeeonlineshoping.azurewebsites.net connectairapijson.azurewebsites.net connectionhandlerapi.azurewebsites.net countrybasedquestions.azurewebsites.net customercareservice.azurewebsites.net customercareserviceapi.azurewebsites.net emiratescheckapi.azurewebsites.net emiratescheckapijson.azurewebsites.net engineeringrssfeed.azurewebsites.net engineeringssfeed.azurewebsites.net exchtestcheckingapi.azurewebsites.net exchtestcheckingapihealth.azurewebsites.net flighthelicopterahtest.azurewebsites.net helicopterahtest.azurewebsites.net helicopterahtests.azurewebsites.net helicoptersahtests.azurewebsites.net hiringarabicregion.azurewebsites.net homefurniture.azurewebsites.net hrapplicationtest.azurewebsites.net humanresourcesapi.azurewebsites.net humanresourcesapijson.azurewebsites.net humanresourcesapiquiz.azurewebsites.net iaidevrssfeed.centralus.cloudapp.azure.com iaidevrssfeed.centrualus.cloudapp.azure.com iaidevrssfeed.cloudapp.azure.com iaidevrssfeedp.cloudapp.azure.com identifycheckapplication.azurewebsites.net identifycheckapplications.azurewebsites.net identifycheckingapplications.azurewebsites.net ilengineeringrssfeed.azurewebsites.net integratedblognewfeed.azurewebsites.net integratedblognews.azurewebsites.net integratedblognewsapi.azurewebsites.com integratedblognewsapi.azurewebsites.net intengineeringrssfeed.azurewebsites.net intergratedblognewsapi.azurewebsites.net javaruntime.azurewebsites.net javaruntimestestapi.azurewebsites.net javaruntimetestapi.azurewebsites.net javaruntimeversionchecking.azurewebsites.net javaruntimeversioncheckingapi.azurewebsites.net jupyternotebookcollection.azurewebsites.net jupyternotebookcollections.azurewebsites.net jupyternotebookcollections.com jupyternotebookscollection.azurewebsites.net logsapimanagement.azurewebsites.net logsapimanagements.azurewebsites.net logupdatemanagementapi.azurewebsites.net logupdatemanagementapijson.azurewebsites.net manpowerfeedapi.azurewebsites.net manpowerfeedapijson.azurewebsites.net marineblogapi.azurewebsites.net notebooktextchecking.azurewebsites.net notebooktextcheckings.azurewebsites.net notebooktextcheckings.com notebooktexts.azurewebsites.net onequestions.azurewebsites.net onequestionsapi.azurewebsites.net onequestionsapicheck.azurewebsites.net openapplicationcheck.azurewebsites.net optionalapplication.azurewebsites.net personalitytestquestionapi.azurewebsites.net personalizationsurvey.azurewebsites.net qaquestionapi.azurewebsites.net qaquestions.azurewebsites.net qaquestionsapi.azurewebsites.net qaquestionsapijson.azurewebsites.net queryfindquestions.azurewebsites.net queryquestions.azurewebsites.net questionsapplicationapi.azurewebsites.net questionsapplicationapijson.azurewebsites.net questionsapplicationbackup.azurewebsites.net questionsdatabases.azurewebsites.net questionsurveyapp.azurewebsites.net questionsurveyappserver.azurewebsites.net quiztestapplication.azurewebsites.net refaeldevrssfeed.centralus.cloudapp.azure.com regionuaequestions.azurewebsites.net registerinsurance.azurewebsites.net roadmapselector.azurewebsites.net roadmapselectorapi.azurewebsites.net sportblogs.azurewebsites.net surveyappquery.azurewebsites.net surveyonlinetest.azurewebsites.net surveyonlinetestapi.azurewebsites.net technewsblogapi.azurewebsites.net teledyneflir.com.de testmanagementapi1.azurewebsites.net testmanagementapis.azurewebsites.net testmanagementapisjson.azurewebsites.net testquestionapplicationapi.azurewebsites.net testtesttes.azurewebsites.net tiappschecktest.azurewebsites.net tnlsowki.westus3.cloudapp.azure.com tnlsowkis.westus3.cloudapp.azure.com turkairline.azurewebsites.net uaeaircheckon.azurewebsites.net uaeairchecks.azurewebsites.net vscodeupdater.azurewebsites.net vsliveagent.com workersquestions.azurewebsites.net workersquestionsapi.azurewebsites.net workersquestionsjson.azurewebsites.net xboxplayservice.com # Reference: https://x.com/Cyberteam008/status/1866677248587337914 # Reference: https://x.com/ValidinLLC/status/1867193831612985822 # Reference: https://en.fofa.info/result?qbase64=dGl0bGU9PSJVUkwgU2hvcnRlbmVyIiAmJiBpY29uX2hhc2g9IjE5MDgxNDcxMjEi allocationwithour.info conveniente-sharefile.info filterfiletransfer.hopto.org filtertransferfile.online loss-modification.site recognizedshare.site transfer-filterless.ddns.net viewfileitems.info emv1.allocationwithour.info ns2.allocationwithour.info transfer.loss-modification.site # Reference: https://x.com/Cyberteam008/status/1868875414510485876 dash.shortoni.live emv1.short-jg934hw.live emv1.short-rigf.live emv1.statuss-short-join.live fazadi.info ftur-sher.online live-join-short.online mrz.fazadi.info redirect-b.online redirect-c.live redirect-d.online redirect-k.online redirect-l.online redirect-m.live redirect-o.online redirect-p.online redirect-q.online redirect-r.online redirect-s.online redirect-t.online redirect-u.online room-meet-url.live sh-tro.live sho-flu.live shor-erier-f.xyz shor-fg.live shor-trv.live short-join-live.online short-redirect.online short-view-url.online shr-r4yr93d.live sht-rgtio9.live statuss-short-join.live url-room-meet.live visit-site-online.online # Reference: https://www.bitdefender.com/en-us/blog/businessinsights/unpacking-bellaciao-a-closer-look-at-irans-latest-malware http://88.80.148.162 188.165.174.199:18080 # Reference: https://community.emergingthreats.net/t/ruleset-update-summary-2025-03-12-v10877/2511 googles.site drives.googles.site # Reference: https://x.com/Cyberteam008/status/1919571782983356563 agm-rto-ewi.com brannew-home.info dazedebtor.com emv1.brannew-home.info emv1.newsaboutecology.info get-ready.blog ismywhs.com.de mail.brannew-home.info meet-online.site meet-room.site meetime.info meeting-invite.live meeting-room.live meeting-time.info meetingonline.live meetingzone.info meetland.info meetonline.pro meot-roem.online newsaboutecology.info ns2.brannew-home.info ns2.newsaboutecology.info populationnote.com room-online.one sejoinu.cc shrtlink.space shrtlnk.info snap-short.online stablis.online verifymeet.live wwwlmeetic.com # Reference: https://x.com/blackorbird/status/1920061952459518406 # Reference: https://mp.weixin.qq.com/s/nY2Hyg6ZsM7ViXW1lhO2Ag # Reference: https://app.validin.com/detail?find=2c2951f9c795c19412bf900f8e0ea00e&type=hash#tab=host_pairs (# 2025-04-25) # Reference: https://app.validin.com/detail?find=Thoughts%20and%20Reflections%20-%20A%20Personal%20Blog&type=raw&ref_id=b7e5679da39#tab=host_pairs (# 2025-05-07) # Reference: https://www.virustotal.com/gui/ip-address/185.182.194.175/relations # Reference: https://www.virustotal.com/gui/ip-address/31.42.176.171/relations # Reference: https://www.virustotal.com/gui/ip-address/78.159.117.177/relations # Reference: https://www.virustotal.com/gui/ip-address/78.159.117.175/relations # Reference: https://www.virustotal.com/gui/ip-address/91.107.155.179/relations http://185.153.197.236 academy-update.com bookstoragestore.com cloudtransferfile.info commercialstudio.ddns.net computerlearning.ddns.net creating-loceer.ddns.net holyicker.ddns.net lastfilterfile.info publicreservoir.info research-storage.com searchfilterapp.info starmanblind.ddns.net tepbit.site timtechlab.duckdns.org # Reference: https://x.com/Cyberteam008/status/1927915406288695626 accounts.google.live-meet.blog accounts.google.live-meet.cfd accounts.google.live-meet.cloud accounts.google.live-meet.info accounts.google.network-show.online actor.rap-art.info albert-company.online all-for-city.info amg-car-ger.info anna-blog.info apple.beta-man.info april.spring-club.info arizonaclub.me arrow-click.info backback.info best85best.online beta-man.info bmw.amg-car-ger.info book.anna-blog.info bvio85.info cc-newton.info chapter1.cc-newton.info cnt-worth.online connect-room.online crysus-h.info data.live-meet.blog dmn-for-car.online exir-juice.online friends.lizza-blog.info friends.thomas-mark.xyz good-student.online goods-companies.online google.live-meet.blog google.live-meet.cfd google.live-meet.cloud google.live-meet.info google.network-show google.network-show.online hrd-dmn.info human-fly900.online intelligence.live-meet.blog ip-194-11-226-29.rockhoster.net isftyviliam.platinum-cnt.info live-coaching.online live-conn.online live-gml.online live-meet.blog live-meet.cfd live-meet.cloud live-meet.info live-meet.live live.connect-room.online live.goods-companies.online live.live-coaching.online live.live-gml.online live.live-meet live.live-meet.cloud live.live-meet.info live.online-room.online live.platinum-cnt.info live.white-life-bl.info live.yamal-group.online lizza-blog.info lynda-tricks.online mail.bvio85.info meet-work.info message-live.online mickel.connect-room.online mickel.goods-companies.online mickel.live-coaching.online mickel.platinum-cnt.info mickel.white-life-bl.info mickel.yamal-group.online mikel.yamal-group.online network-show.online nsim-ph.info ntp-clock-h.info online-room.online oranus.albert-company.online oranus.connect-room.online oranus.human-fly900.online oranus.live-coaching.online oranus.platinum-cnt.info oranus.white-life-bl.info oranus.yamal-group.online outlook.live.live-meet.cloud outlook.live.live-meet.info panel.live-meet.blog panel.live-meet.cfd panel.live-meet.cloud panel.live-meet.info panel.live-meet.live panel.network-show.online pfl.redirect-review.online ph-crtdomain.info platinum-cnt.info prj-ph.info profile.arizonaclub.me profile.best85best.online prt-max.online rap-art.info rbconline-support.info redirect-review.online richard-3th.online right.arrow-click.info rockhoster.net roland-cc.online sandbox.live-meet.blog shadow-network.best smtp.amg-car-ger.info spring-club.info stats.live-meet.blog steve-brown.info superset.sandbox.live-meet.blog thomas-mark.xyz viliam.albert-company.online viliam.cnt-worth.online viliam.connect-room.online viliam.crysus-h.info viliam.dmn-for-car.online viliam.exir-juice.online viliam.goods-companies.online viliam.hrd-dmn.info viliam.human-fly900.online viliam.live-coaching.online viliam.live-conn.online viliam.lynda-tricks.online viliam.meet-work.info viliam.message-live.online viliam.nsim-ph.info viliam.ntp-clock-h.info viliam.online-room.online viliam.ph-crtdomain.info viliam.platinum-cnt.info viliam.prj-ph.info viliam.prt-max.online viliam.richard-3th.online viliam.roland-cc.online viliam.steve-brown.info viliam.warning-d.info viliam.wer-d.info viliam.white-life-bl.info viliam.work-meeting.info viliam.yamal-group.online violet.backback.info warning-d.info wer-d.info white-life-bl.info work-meeting.info yamal-group.online # Reference: https://x.com/skocherhan/status/1932952171122737290 cacademy-update.com ccreservoir.info cholyicker.ddns.net cresearch-storage.com csearchfilterapp.info # Reference: https://research.checkpoint.com/2025/iranian-educated-manticore-targets-leading-tech-academics/ adams-cooling.online alex-mendez-fire.info alison624.online alpha-man.info becker624.online bestshopu.online black-friday-store.online book-handwrite.online bracs-lion.online city-splash.online clame-rade.online cloth-model.blog clothes-show.online conn-ectionor.cfd cook-tips.info course-math.info crysus-p.info cyberlattice.pro dmn-for-hall.online door-black-meter.online encryption-redirect.online est5090.online everything-here.info expressmarket.online first-course.online food-tips-blog.online gallery-shop.online good-news.cfd good-news.fashion healthy-lifestyle.fit idea-home.online infinit-world.info lenan-rex.online lesson-first.info live-content.online live-message.online loads-ideas.online make-house.online master-club.info network-game.xyz network-review.xyz network-show-a.online nice-goods.online normal-dmn.info nsim-pa.info ntp-clock-p.info optio-nalynk.online pa-crtdomain.info panel-meeting.info panel-network.online panel-redirect.online ph-work.info pnl-worth.online prj-pa.info ptr-cc.online ques-tion-ing.xyz reading-course.online reg-d.info ricardo-mell.online royalsoul.online sendly-ink.shop shaer-likn.store show-verify.xyz sky-writer.online socks.beauty stadium-fresh.online storm-wave.online suite-moral.info teammate-live.online tomas-company.online top-game.online ude-final.online warplogic.pro wash-less.online white-car.online white-life.info wood-house.online word-course.online world-shop.online zra-roll.online # Reference: https://catalyst.prodaft.com/public/report/subtle-snail-expands-espionage-campaign-to-european-telecom-organizations # Reference: https://github.com/prodaft/malware-ioc/tree/master/SubtleSnail safrangroup-careers.com telespazio-careers.com auto-updater.azurewebsites.net background-update.azurewebsites.net cache-cleaner-check-111.azurewebsites.net cache-cleaner-check-805.azurewebsites.net cache-cleaner-check-926.azurewebsites.net cache-cleaner-check.azurewebsites.net cache-managment.northeurope.cloudapp.azure.com check-security-update.azurewebsites.net group-policy-update.azurewebsites.net hyperv-heartbeat-service.azurewebsites.net patch-provider-247.azurewebsites.net patch-provider-597.azurewebsites.net patch-provider-745.azurewebsites.net patch-provider.azurewebsites.net send-feedback-296.azurewebsites.net send-feedback-413.azurewebsites.net send-feedback-838.azurewebsites.net send-feedback.azurewebsites.net services-update-check.azurewebsites.net update-health-service.azurewebsites.net verify-publisher.azurewebsites.net # Reference: http://researchcenter.paloaltonetworks.com/2017/02/unit42-magic-hound-campaign-attacks-saudi-targets/ # Reference: https://github.com/pan-unit42/iocs/blob/master/iran_linked_operators/MagicHound.csv servicesystem.serveirc.com chrome-up.date timezone.live analytics-google.org microsoftsubsystem.com-adm.in microsoftexplorerservices.cloud # Reference: https://x.com/ThreatBookLabs/status/1957276288944918620 # Reference: https://app.validin.com/detail?find=WIN-46MPMA44ISV&type=raw&ref_id=777b5254d85#tab=host_pairs # Reference: https://app.validin.com/detail?find=185.132.176.236&type=ip4&ref_id=1013ff6b648#tab=resolutions # Reference: https://app.validin.com/detail?find=185.132.176.27&type=ip4&ref_id=1013ff6b648#tab=resolutions # META-HOST=::"og:title":"title":"ShortURL - URL Shortener" 1stl.ink beetly.online bytli.ink electrons-residingonthemoon.info eventer.ink filevisitresult.site msnl.ink proctor-custodian.site revstoragefile.site short-abbreviate.info shorten-abbreviate.site shortlycc.site supervisor-protector.online mobile.proctor-custodian.site mobile.shorten-abbreviate.site outstanding.revstoragefile.site reproduce.outstanding.revstoragefile.site ace-capitalpartners.ddns.net centrallibrary.bounceme.net consistent-provisioned.accesscam.org enovation-affirm.theworkpc.com implemen-tmeasures.myftp.org internationalbester.ddns.net revstoragefil.ddns.net revstoragefile.ddns.net # Reference: https://app.validin.com/detail?find=URL%20Shortener&type=raw&ref_id=7eee58f2849#tab=host_pairs (# 2025-08-18) bdroyer.webredirect.org bouncer.qc.to cloud.qc.to continue-short.ddns.net db.qc.to fdns1.duckdns.org gc.n-e.kr i-love-tux.qc.to miniurl.duckdns.org my.abrdns.com rb1chesid8.ocry.com rb2chesid8.otzo.com shortener.ddns.net shorter.kozow.com sites.bounceme.net tinygo.duckdns.org tracking.ns02.info updatedisplacement.ddns.net viewfileitems.myftp.org websites.freemyip.com # Reference: https://x.com/ThreatBookLabs/status/1968132855827181901 # Reference: https://www.virustotal.com/gui/ip-address/185.132.176.27/relations # Reference: https://www.virustotal.com/gui/ip-address/185.182.194.50/relations # Reference: https://app.validin.com/detail?find=%3A%3A%22og%3Atitle%22%3A%22title%22%3A%22ShortURL%20-%20URL%20Shortener%22&type=raw&ref_id=9b9c611b5fd#tab=host_pairs (# 2025-09-17) file-review.hopto.org fileviewitems.myftp.org first-myshortel.ddns.net interactive-view.myftp.org javedpension.is-a-good.dev licentiegegevens.ddns.net onwards-gerencia.ddns.net rb4chesid8.serveuser.com shorten-abbreviate.ddns.net shortfile-interactive.webredirect.org videozoom.ddns.net # Reference: https://app.validin.com/detail?find=%3A%3A%22og%3Atitle%22%3A%22title%22%3A%22ShortURL%20-%20URL%20Shortener%22&type=raw&ref_id=9b9c611b5fd#tab=host_pairs (# 2025-09-17) shortener-abbreviate.info veracity-revision.info share.veracity-revision.info # Reference: https://research.checkpoint.com/2025/nimbus-manticore-deploys-new-malware-targeting-europe/ activehealthlab.azurewebsites.net activespiritluth.eastus.cloudapp.azure.com acupuncturebentonville.com aeroclinicit.azurewebsites.net airbus.careers-portal.org airbus.careersworld.org airbus.germanywork.org airbus.global-careers.com airbus.usa-careers.com airmdsolutions.azurewebsites.net airtravellog.com arabiccountriestalent.azurewebsites.net arabiccountriestalent.com arabiccountriestalenthr.azurewebsites.net arabiccountriestalents.azurewebsites.net arabiccountriestalentshr.azurewebsites.net asylimed.azurewebsites.net backsrv66.azurewebsites.net backsrv74.azurewebsites.net biolinksystems.azurewebsites.net boeing-careers.com cardiomedspecialists.azurewebsites.net carebytesolutions.azurewebsites.net careers-hub.org careers-portal.org careersworld.org check-backup-service-179.azurewebsites.net check-backup-service-288.azurewebsites.net check-backup-service-736.azurewebsites.net check-backup-service.azurewebsites.net clinichaven.azurewebsites.net cloudaskingquestioning.azurewebsites.net cloudaskingquestioning.azurewebsites.net.net cloudaskingquestions.azurewebsites.net.net cloudaskingquestions.eastus.cloudapp.azure.com cloudaskingquestions.eastus.cloudapp.azure.com.net cloudaskquestionanswers.azurewebsites.net cloudaskquestionanswers.azurewebsites.net.net cloudaskquestionanswers.com cloudaskquestionanswers.com.net cloudaskquestioning.eastus.cloudapp.azure.com cloudaskquestioning.eastus.cloudapp.azure.com.net collaboromarketing.com createformquestionshelper.com createformquestionshelper.com.net datasheet96.azurewebsites.net digicura.azurewebsites.net digithealthplatform.azurewebsites.net doctorconsult-app.azurewebsites.net ehealthpsuluth.com exchtestchecking.azurewebsites.net exchtestcheckingapihealth.com exchtestcheckingapijson.azurewebsites.net flydubaicareers.ae.org focusfusion.eastus.cloudapp.azure.com frameforward.azurewebsites.net germanywork.org global-careers.com gocareers.org grownehealth.eastus.cloudapp.azure.com healsanctum.azurewebsites.net healthbodymonitoring.azurewebsites.net healthcare-azureapi.azurewebsites.net healthcarefluent.com healthdataanalyticsrecord.azurewebsites.net hivemedtech.azurewebsites.net lensvisionary.azurewebsites.net mainrepo10.azurewebsites.net managetools-platform.azurewebsites.net marsoxygen.azurewebsites.net masterflexiblecloud.azurewebsites.net maydaymed.azurewebsites.net mediasylum.azurewebsites.net medical-deepresearch.azurewebsites.net medicalit-imaging.azurewebsites.net medicoreit.azurewebsites.net medicpathsolutions.azurewebsites.net mentalhealth-support-portal.azurewebsites.net mojavemassageandwellness.com msnotetask-insights.azurewebsites.net mstrakcer-tools.azurewebsites.net nanobreathe.azurewebsites.net neurocloudhq.azurewebsites.net nextgenhealthtrack.azurewebsites.net olemanage-dashboard.azurewebsites.net oletask-tracker.azurewebsites.net patient-azureportal.azurewebsites.net patientcare-portal.azurewebsites.net pharmainfo.azurewebsites.net rheinmetall.careers-hub.org rheinmetall.careersworld.org rheinmetall.gocareers.org rheinmetall.theworldcareers.com rheinmetallcareer.com rheinmetallcareer.org rpcconnection.azurewebsites.net smartapptools.azurewebsites.net smartmediq.azurewebsites.net storagewiz.co.azurewebsites.net sulumorbusinessservices.com symptom-recordchecker.azurewebsites.net systemmedicaleducation.azurewebsites.net tacticalsnap.eastus.cloudapp.azure.com talenthumanresourcestalent.com telehealthconnectpro.azurewebsites.net thecloudappbox.azurewebsites.net therashelter.azurewebsites.net thetacticstore.com theworldcareers.com totalcaremedcenter.azurewebsites.net traveltipspage.com trustedcarehub360.azurewebsites.net turbulencemd.azurewebsites.net usa-careers.com ventilateainest.azurewebsites.net virgomarketingsolutions.com virgomarketingsolutions.comtions.com virtualcliniczone.azurewebsites.net vitatechlink.azurewebsites.net vitatechlinks.azurewebsites.net wellnessfirstgroup.azurewebsites.net wellnessglowluth.azurewebsites.net yourfamilymdclinic.azurewebsites.net zerogmed.azurewebsites.net # Reference: https://x.com/volrant136/status/1971653625274683671 # Reference: https://x.com/volrant136/status/1971654091656122835 hotchichenfly.info # Reference: https://x.com/4rchib4ld/status/1972582381275275498 # Reference: https://www.stormshield.com/news/apt35-plays-same-music-again/ # Reference: https://www.virustotal.com/gui/ip-address/79.132.131.184/relations # Reference: https://www.virustotal.com/gui/ip-address/84.200.193.20/relations alpha-meet.online alpha-met.online arcanet.online azdava.online besatoo.online cppsg.online dmn-inter.online ell-safe.online go0gle.online into-support.online kuret-live.online live-board.online look-together-online.online online-speak.online owner-rate.online p-safe.online proof-video.online robinthing123.online rohand63.xyz safe-lord.online superlite.online tensore.online teslator.online toolfare.online video-connect.online viliam-live-identity.online go0gle.online look-together-online.online owner-rate.online p-safe.online rohand63.xyz toolfare.online video-connect.online book.kuret-live.online live.besatoo.online meet.azdava.online meet.ell-safe.online meet.go0gle.online meet.proof-video.online meet.video-connect.online mickel.besatoo.online oranus.besatoo.online viliam.alpha-meet.online viliam.alpha-met.online viliam.arcanet.online viliam.azdava.online viliam.besatoo.online viliam.cppsg.online viliam.dmn-inter.online viliam.into-support.online viliam.kuret-live.online viliam.kuret-met.online viliam.live-board.online viliam.look-together-online.online viliam.online-speak.online viliam.owner-rate.online viliam.p-safe.online viliam.robinthing123.online viliam.rohand63.xyz viliam.safe-lord.online viliam.superlite.online viliam.tensore.online viliam.teslator.online viliam.toolfare.online viliam.viliam-live-identity.online villiam.online-speak.online # Reference: https://x.com/skocherhan/status/1973278284906635640 # Reference: https://www.virustotal.com/gui/file/0596554b58c644d42d44ba24c7b6c31a7b8999f77672cb430e6f6a006c022bdc/detection # Reference: https://www.virustotal.com/gui/file/48883dcbac14e1f57613f482ec69b1a50458c8fd59e78a5ce66b988bf4a06347/detection # Reference: https://www.virustotal.com/gui/file/5b1b7d9c5f08d67834dcb8d15a25941363441b235dd82bface19588ece8a9841/detection # Reference: https://www.virustotal.com/gui/file/c8baf145f2f586167ed108eca143ce4d2b86af8df050a226959fcb172462cd0a/detection 179.43.177.130:3333 ameen-alkhalij.org ameen-alkhalij.is ameen-alkhalij.nu ameen-alkhalij.com ameen-alkhalij.se musalas.se shopleta.ru # CERT_CN-HOST=WIN-GT7DSJ6SLAI quickmath-solver.site redfoxteeth.site # Reference: https://www.proofpoint.com/us/blog/threat-insight/crossed-wires-case-study-iranian-espionage-and-attribution accountroyal.com airbus-careers.onlyoffice.com airbus-survay.onlyoffice.com airbusaerodefence.com airbusaerodefence.nl airbusgroup-careers.com airbushiring.com alwayslivehealthy.com anteromarketing.com asiandefenses.com bodywellnessbycynthia.com boeinginformation.onlyoffice.com boeingspace.com chakracleansetherapy.com clearmindhealthandwellness.com droneflywell.com dronetechasia.org easymarketing101.com emiratescareers.org emiratesgroup-careers.com flydubai-careers.com healthcarefluent.com healthiestmama.com healthinfusiontherapy.com jadehealthcenter.com joinboeing.com kibanacore.com malebachhew2506090936.onlyoffice.com marketinglw.com msnapp.help msnapp.live msnclouds.com opportunities2get.com palaerospace.careers randcorp.onlyoffice.com rhealthylivingsolutions.com rheinmetallcareer.onlyoffice.com rheinmetallcareers.com thecareershub.org uavnodes.com worldcareers.org zytonhealth.com # Reference: https://x.com/blackorbird/status/1992075483836744154 # Reference: https://dti.domaintools.com/threat-intelligence-report-apt35-internal-leak-of-hacking-campaigns-against-lebanon-kuwait-turkey-saudi-arabia-korea-and-domestic-iranian-targets/ http://212.175.168.58 103.57.251.153:2000 103.57.251.153:443 212.175.168.58:443 # Reference: https://dti.domaintools.com/the-apt35-dump-episode-4-leaking-the-backstage-pass-to-an-iranian-intelligence-operation/ bbmovements.com cavinet.org israel-talent.com israel-talent.xyz kanplus.org moses-staff.io moses-staff.to secnetdc.com tecret.com termite.nu # Reference: https://x.com/ThreatBookLabs/status/2010540242932269492 # Reference: https://www.virustotal.com/gui/file/e7b2cc236af9edbe44307d293a7d7fcbb199a286f7eec864f363fcb725c7ef70/detection # Reference: https://www.virustotal.com/gui/file/a6b0c63b2aa25d5fe8ff5b9bd4d28636fbfa7f7af5db7c34d82459738243163a/detection baochinhphu.org