# Copyright (c) 2014-2019 Maltrail developers (https://github.com/stamparm/maltrail/)
# See the file 'LICENSE' for copying permission

# Reference: https://www.fireeye.com/blog/threat-research/2017/05/cyber-espionage-apt32.html

24.datatimes.org
blog.docksugs.org
blog.panggin.org
contay.deaftone.com
check.paidprefund.org
datatimes.org
docksugs.org
economy.bloghop.org
emp.gapte.name
facebook-cdn.net
gap-facebook.com
gl-appspot.org
help.checkonl.org
high.expbas.net
high.vphelp.net
icon.torrentart.com
images.chinabytes.info
imaps.qki6.com
img.fanspeed.net
job.supperpow.com
lighpress.info
menmin.strezf.com
mobile.pagmobiles.info
news.lighpress.info
notificeva.com
nsquery.net
pagmobiles.info
paidprefund.org
push.relasign.org
relasign.org
share.codehao.net
seri.volveri.net
ssl.zin0.com
static.jg7.org
syn.timeizu.net
teriava.com
timeizu.net
tonholding.com
tulationeva.com
untitled.po9z.com
update-flashs.com
vieweva.com
volveri.net
vphelp.net
yii.yiihao126.net
zone.apize.net

# Reference: https://github.com/eset/malware-ioc/tree/master/oceanlotus

adineohler.com
aisicoin.com
alicervois.com
anessallie.com
antenham.com
arinaurna.com
arkoimmerma.com
aulolloy.com
avidilleneu.com
avidsontre.com
aximilian.com
biasatts.com
braydenhateaub.com
carosseda.com
chascloud.com
dreyoddu.com
dwarduong.com
eckenbaue.com
eighrimeau.com
errellawle.com
erstin.com
frahreiner.com
hieryells.com
hristophe.com
ichardt.com
icmannaws.com
iecopeland.com
irkaimboeuf.com
jamedalue.com
jamyer.com
jeanessbinder.com
jeffreyue.com
keoucha.com
laudiaouc.com
lbertussbau.com
loridanase.com
marrmann.com
meroque.com
moureuxacv.com
myolton.com
nasahlaes.com
ntjeilliams.com
omasicase.com
onnaha.com
onteagle.com
orinneamoure.com
orresto.com
orrislark.com
rackerasr.com
rcuselynac.com
sanauer.com
stopherau.com
tefanie.com
tefanortin.com
tephens.com
traveroyce.com
tsworthoa.com
ucaargo.com
ucairtz.com
urnage.com
venionne.com
virginiaar.com

# Reference: https://www.cybereason.com/blog/operation-cobalt-kitty-apt

food.letsmiles.org

# Reference: https://ti.360.net/blog/articles/oceanlotus-targets-chinese-university/

cctv.avidsonec.com
cert.opennetworklab.com
cloud.reneark.com
cloud.sicaogler.com
cnn.befmann.com
dieordaunt.com
dyndns.angusie.com
fox.ailloux.com
hotel.bookingshop.info
ipv6.uyllain.com
isp.cambodiadaily.org
login.ticketwitheasy.com
myaccount.philtimes.org
news.coleope.com
news.denekasd.com
news.exandre.com
ns1.cambodiadaily.org
ourkekwiciver.com
school.obertamy.com
straliaenollma.xyz
time.ouisers.com

# Reference: https://www.fireeye.com/blog/threat-research/2017/06/phished-at-the-request-of-counsel.html (Network Based Indicators (NBI))

http://104.236.77.169
http://138.68.45.9
http://162.243.143.145
autodiscover.2bunny.com
lyncdiscover.2bunny.com
tk-in-f156.2bunny.com
sfo02s01-in-f2.cloudsend.net

# Reference: https://blog.trendmicro.com/trendlabs-security-intelligence/new-macos-backdoor-linked-to-oceanlotus-found/
# Reference: https://www.virustotal.com/#/file/673ee7a57ba3c5a2384aeb17a66058e59f0a4d0cddc4f01fe32f369f6a845c8f/relations

ssl.arkouthrie.com
s3.hiahornber.com
widget.shoreoa.com

# Reference: https://unit42.paloaltonetworks.com/tracking-oceanlotus-new-downloader-kerrdown/

theme.blogsite.org
cortana.homelinux.com
word.webhop.info
work.windownoffice.com
cortanasyn.com
e.browsersyn.com
syn.servebbs.com
service.windown-update.com
check.homeip.net
outlook.updateoffices.net
mail.fptservice.net
office.windown-update.com
cortanazone.com
beta.officopedia.com
videos.dyndns.org
service.serveftp.org
syn.browserstime.com
check.webhop.org
ristineho.com

# Reference: https://www.welivesecurity.com/2019/03/20/fake-or-fake-keeping-up-with-oceanlotus-decoys/
# Reference: https://otx.alienvault.com/pulse/5c9255f84d2d890341e7f6a1
# Reference: https://twitter.com/vxsh4d0w/status/1109030685090680832
# Reference: https://pastebin.com/BiQKjQaK

aliexpresscn.net
andreagahuvrauvin.com
andreagbridge.com
aol.straliaenollma.xyz
beaudrysang.xyz
becreybour.com
byronorenstein.com
chinaport.org
christienoll.xyz
christienollmache.xyz
cloud.360cn.info
dieordaunt.com
dns.chinanews.network
illagedrivestralia.xyz
karelbecker.com
karolinblair.com
lauradesnoyers.com
ntop.dieordaunt.com
office.ourkekwiciver.com
ourkekwiciver.com
sophiahoule.com
stienollmache.xyz
straliaenollma.xyz
ursulapapst.xyz
villagedrivestralia.xyz

# Reference: https://twitter.com/blackorbird/status/1108687601475555328

office.allsafebrowsing.com

# Reference: https://twitter.com/blackorbird/status/1086186184768815104

outlook.officebetas.com

# Reference: https://twitter.com/blackorbird/status/1086188558413586432

outlook.betamedias.com

# Reference: https://twitter.com/blackorbird/status/1113328823947264001
# Reference: https://github.com/blackorbird/APT_REPORT/blob/master/Oceanlotus/aptnote0402
# Reference: https://threatvector.cylance.com/en_us/home/report-oceanlotus-apt-group-leveraging-steganography.html

kermacrescen.com
stellefaff.com
manongrover.com
background.ristians.com
enum.arkoorr.com
worker.baraeme.com
plan.evillese.com

# Reference: https://twitter.com/blackorbird/status/1113737430501212161

att.illagedrivestralia.xyz
clipboard.christienoll.xyz
snort.lauradesnoyers.com

# Reference: https://twitter.com/blackorbird/status/1115617606218727425
# Reference: https://www.welivesecurity.com/2019/04/09/oceanlotus-macos-malware-update/

daff.faybilodeau.com
sarc.onteagleroad.com
au.charlineopkesston.com
/dp/B074WC4NHW/

# Reference: https://twitter.com/blackorbird/status/1118396419595837440

load.updatetag.com