# Copyright (c) 2014-2022 Maltrail developers (https://github.com/stamparm/maltrail/)
# See the file 'LICENSE' for copying permission

# Reference: https://www.mandiant.com/resources/suspected-iranian-actor-targeting-israeli-shipping
# Reference: https://www.virustotal.com/gui/ip-address/128.199.6.246/relations
# Reference: https://www.virustotal.com/gui/ip-address/143.110.155.195/relations
# Reference: https://www.virustotal.com/gui/ip-address/159.223.164.185/relations
# Reference: https://www.virustotal.com/gui/ip-address/161.35.123.176/relations
# Reference: https://www.virustotal.com/gui/ip-address/185.170.215.170/relations

http://128.199.6.246
http://144.202.123.248
161.35.123.176:4585
aspiremovecentraldays.net
celebritylife.news
fileupload.shop
lirıkedin.com
xn--lirkedin-vkb.com
naturaldolls.store
office365update.live
pfizerpoll.com
rnfacebook.com
xxx-doll.com
account.office365update.live
account.sdfsfsdf.office365update.live
ads.celebritylife.news
com.office365update.live
i.login.office365update.live
login.office365update.live
login.rnfacebook.com
login.sdfsfsdf.office365update.live
logincdn.sdfsfsdf.office365update.live
m.login.office365update.live
m.login.rnfacebook.com
m.site.rnfacebook.com
microsoft.office365update.live
microsoftonline.office365update.live
ns1.office365update.live
ns2.office365update.live
office365update.live
outlook.office365update.live
outlook.sdfsfsdf.office365update.live
sdfsfsdf.office365update.live
site.rnfacebook.com
static.login.rnfacebook.com
static.site.rnfacebook.com
test.office365update.live