# Copyright (c) 2014-2024 Maltrail developers (https://github.com/stamparm/maltrail/)
# See the file 'LICENSE' for copying permission

# Reference: https://www.symantec.com/blogs/threat-intelligence/tortoiseshell-apt-supply-chain
# Reference: https://otx.alienvault.com/pulse/5d8201965473b98dbf01a84f

http://64.235.39.45
http://64.235.60.123

# Reference: https://blog.talosintelligence.com/2019/09/tortoiseshell-fake-veterans.html
# Reference: https://otx.alienvault.com/pulse/5d8a3103b8713b840f1b13dd

http://66.42.78.193
http://199.187.208.75
hiremilitaryheroes.com
spreadme.international

# Reference: https://otx.alienvault.com/pulse/60f07dd74b222a6b9cc38975

1st-smtp2go.email
2nd-smtp2go.email
3rd-smtp2go.email
4th-smtp2go.email
accounts.cam
activesessions.me
adobes.software
alhds.net
apppure.cf
bahri.site
bbcnews.email
bitly.cam
biturl.cx
brdcst.email
careeronestop.site
cc-security-inc.email
ccsecurity-mail-inc.email
ccsecurity-mail-inc.services
citymyworkday.com
cityofberkeley.support
cnbcnews.email
cnnnews.global
codejquery-ui.com
com-account-challenge.email
com-signin-v2.email
comlogin.online
comlogin.services
copyleft.today
crisiswatchsupport.shop
datacatch.xyz
dayzim.org
dh135.world
dollrealdoll.com
dollrealdoll.online
entrust.work
erictrumpfundation.com
facebookservices.gq
fblogin.me
fileblade.ga
findcareersatusbofa.com
fiservcareers.com
goodreads.rest
googl.club
gropinggo.com
hex6mak5z98nubb9vpd6t36cydkncfci9im872qx6hjci2egx8irq3qyt9pj.online
hike.studio
hosted-microsoft.com
iemail.today
incognito.today
infoga.cam
iqtel.org
irtreporter.com
itiee.life
itieee.life
jessicamcgill.life
jqueryui-code.com
jumhuria.com
kartick.net
kaspersky.team
linkgen.me
linksbit.com
linq.ink
liveleak.cam
liveuamap.live
lockheedmartinjobs.us
loginaccount.email
logonexchangeonline.com
logonmicrosoftonline.com
lskjirn.life
mail2go.live
mail2go.online
mail2u.live
mailaccountlive.email
mailaccountlive.support
mailpublisher.live
mails.center
metacafe.live
micorsoftonilne.com
micorsoftonline.website
micorsoftonline.xyz
microsoftoffice.systems
microsoftonilne.cloud
mispace.cam
msol.live
msonline.live
mssecurityaccount.online
mydomainxyz.xyz
news-smtp2go.email
newsl.ink
noreplay.email
novafile.tk
onpointcorp.co
outlook-services.com
outlookservices.live
outlookservices.me
outube.live
pic-shareonline.com
pixlr.live
post-jquery.com
prefiles.ml
publicsgroupe.net
pwutc.live
rali.live
recruitme.international
robotics.land
sabic.work
sandsngo.com
saudivisions2030.org
securityaccountreply.com
seery.online
sendblaster.org
shareae.cf
shlink.run
shlnk.run
short-l.link
shortli.live
shrt.rip
shur.live
shurl.site
site1.life
smtp-2go.com
smtp2go.best
smtp2go.club
smtp2go.email
smtp2go.fun
smtp2go.icu
smtp2go.live
smtp2go.me
smtp2go.pw
smtp2go.site
smtp2go.space
smtp2go.website
smtper.center
smtptogo.pw
soc-usa.email
soundcloud.fun
soundcloud.live
src-ymlang.link
support-securitymail.email
support-ymail-team.online
surl.ist
surl.live
sxk8xrjtaikv3dxl7hgghw3vptvxpzzxeynrcltu4k3yeecjq3.online
systembackend.site
techmahindra.support
teleweb.world
tetra.email
thegardian.ml
thegaurdian.live
thomsonsreuters.email
thomsonsreuters.eu
thomsonsreuters.link
thomsonsreuters.net
tinil.ink
tinly.me
tinylink.pro
tinyurl.gold
tiwpan.xyz
tox.cheap
treasury.email
treporter.com
trumphotel.net
trumpnationallosangeles.email
trumporganization.world
trumporganizations.com
tv-youtube.com
uploaderfile.cf
usdailypost.com
usdailypost.net
usdp.news
vps.limited
watch-youtube.com
wikileaks.email
workshopplatform.network
xn--rumphotels-vcc.com
xn--twitte-u9a.com
xyzsitexyz.xyz
ymail-account.support
ymail-security-support.email
ymail-security.support
ymailaccounts.us
ymailsupport.info
zain.network