# Copyright (c) 2014-2024 Maltrail developers (https://github.com/stamparm/maltrail/)
# See the file 'LICENSE' for copying permission

# Reference: https://www.proofpoint.com/us/threat-insight/post/gootkit-banking-trojan-jumps-channel

swysocki77.com
gorski83.com
ostrowski87.com
jasinski2015.com
olszewski78.com
pozheeshebudem.com
freforevermailtes.com
nidermidertom.com
ecuremailbestfree.com
securewebgooglesite.com
robertpouslen12494.pw
robertpouslen1234524.com
update-service7825t28.com
domolor.com
babosikimne.com
babosikidai.com
vaillantsawer.com
proballansmen.com
reputamadrell.com
lastrizariano.com
rokobarokkino.com
artipreambulo.com
trequablaster.com
pretriquestro.com
rebellintosto.com
mellicianactr.com
abc.doitgraphic.org
updatebase.bid
shop.lifexcellence.org

# Reference: http://www.broadanalysis.com/2017/03/13/rig-exploit-kit-via-eitest-delivers-gootkit-banking-malware-2/

duplanty.top

# Reference: https://www.cert-pa.it/news?id=10536

sph.expoartshop.com

# Reference: https://twitter.com/James_inthe_box/status/1102904911212101634

vancouverislandprocessor.com

# Reference: https://twitter.com/James_inthe_box/status/914111090425917440
# Reference: https://pastebin.com/T2ryBWdZ

/rpersist4/

# Reference: https://twitter.com/JAMESWT_MHT/status/1113395985043079169
# Reference: https://sugitamuchi.hatenablog.com/entry/2019/04/13/224350 (JP-lang)

/loadercrypt_823EF8A810513A4071485C36DDAD4CC3.php

# Reference: https://www.joesandbox.com/analysis/117861/0/pdf

/crypt0DD1D2637FDB71097213D70B94E86930.php

# Reference: https://twitter.com/VK_Intel/status/1006545151823613952

ftps.layermag.com
lab.aplusstatus.com
0.turkcedusunturkcekonus.com

# Reference: https://twitter.com/malware_traffic/status/767852827200761856

apsoo3k2i.ahgsuy3829.top

# Reference: https://twitter.com/Racco42/status/1063412662623760385

ppp.picchio-intl.com
ricci.bikescout24.fr

# Reference: https://twitter.com/BroadAnalysis/status/815211105664565248

cedar.igrooveweb.com
salsx.sedtinterrighthe.top

# Reference: https://twitter.com/BroadAnalysis/status/788400179091214336

acc.arabicdessert.co
kd67.prmhohzsl.top

# Reference: https://twitter.com/BroadAnalysis/status/782996903025844224

b6l2op.dxzvkr.top

# Reference: https://twitter.com/malware_traffic/status/766412267063607296

dmqxmz.lowashemterle.top

# Reference: https://blog.yoroi.company/warning/campagna-gootkit-verso-pec-italiane/

ami.sigaingegneria.com
erre.effe-erre.es
filuetrama.top
martatov.top

# Reference: https://twitter.com/reecdeep/status/1130497379411595266

fila.heathercrowe.ca
koohy.top

# Reference: https://app.any.run/tasks/77932db7-ffb1-409a-9b28-9cf6c8e70c1c/

fila.su170.org

# Reference: https://twitter.com/reecdeep/status/1136950470696681473

it.goodvibeskicking.com
tru.cheersportacademy.com

# Reference: https://twitter.com/reecdeep/status/1139063611681325056

kohe.even-air.com
ove.resourceny.net

# Reference: https://twitter.com/reecdeep/status/1139436492152102912

box.therusticsandbox.com

# Reference: https://twitter.com/James_inthe_box/status/1141326136212766720

checkcacheonline.com

# Reference: https://twitter.com/abuse_ch/status/1141330445663113218

onlinecachecheck.com

# Reference: https://www.cert-pa.it/notizie/campagna-gootkit-tramite-jasperloader-verso-pubbliche-amministrazioni/

fattura.directionalforcedrive.com
majorleaguepub.com
calc.1407cty13pec.com
koh.191northfront.com
karysmarie.me
otnhmtkwnz.top

# Reference: https://twitter.com/reecdeep/status/1153248954911514625

me.karysmarie.me

# Reference: https://twitter.com/reecdeep/status/1156085593148932097

koh.corkysfreshwater.com
lucky.bayonetbreakers.com

# Reference: https://twitter.com/reecdeep/status/1156866545651474432

drive.deescreationstore.com
kope.deessolutionsdemo.com

# Reference: https://twitter.com/reecdeep/status/1159353959271845888

me.woodlandsareareview.com

# Reference: https://twitter.com/reecdeep/status/1159349342144253954

drive.gstroop4822.org
free.deescreationstore.com

# Reference: https://twitter.com/reecdeep/status/1158754365559193602

me.kaleighrose.me
otnhmdmwnz.top

# Reference: https://twitter.com/reecdeep/status/1158751070425763840

soft.photosbydee.com

# Reference: https://twitter.com/peterkruse/status/1158761928736628736

bill.newsrental.net
help.skofirm.org
zgzimdqwnj.top

# Reference: https://twitter.com/reecdeep/status/1156866545651474432

drive.deescreationstore.com
kope.deessolutionsdemo.com

# Reference: https://twitter.com/reecdeep/status/1164503528271990784

hop.hopedaleweb.com
web.tilmonday.com
wws.no-shirt-no-shoes.com

# Reference: https://twitter.com/reecdeep/status/1164508719742423044

hop.hopedaleweb.com
zgzimdkwod.top

# Reference: https://twitter.com/JAMESWT_MHT/status/1164511396849160193

web.cfmontessori.com
wws.dbimages.com

# Reference: https://twitter.com/JAMESWT_MHT/status/1169549992345985025

wow.doorattendants.com
me.jmitchelldayton.com
web.speakingofhome.com
pro.prosperitybookkeeping.net

# Reference: https://twitter.com/reecdeep/status/1171022723587420162

ser.jonnalbandian.com
wws.christinedavies.biz
vps.healinglightwithin.com
it.its1ofakind.net

# Reference: https://twitter.com/JAMESWT_MHT/status/1172515470202871808

ser.jonnalbandian.com
wws.christinedavies.biz
you.cypressstakeyouth.com
adp.mjmentertainment.com

# Reference: https://twitter.com/MBThreatIntel/status/1174471949059125248

adp.reevesandcompany.com
beta.madeintaylors.com
picturecrafting.site

# Reference: https://twitter.com/JAMESWT_MHT/status/1175128962919542785

guipicturecrafting.site

# Reference: https://twitter.com/reecdeep/status/1176407972249001984

wws.breebrasil.com
wws.guidemyhunt.com

# Reference: https://twitter.com/reecdeep/status/1176414815033679873

web.speakingofhome.com
pro.prosperitybookkeeping.net

# Reference: https://blog.talosintelligence.com/2019/10/threat-roundup-1011-1018.html (# Win.Malware.Gootkit-7333291-0)

cibariefoodconsulting.com
hymnsontap.com
its1ofakind.net
jmitchelldayton.com
kaleighrose.me
karysmarie.me
kkillihhy.top
mjmentertainment.com
otnhmdmwnz.top
picturecrafting.site
reevesandcompany.com
simplebutmatters.com
thebellamyfamily.me
ttbuilders.com
woodlandsareareview.com

# Reference: https://twitter.com/deepspacesc/status/1133755269836693506

capfaregreem.eu

# Reference: https://any.run/malware-trends/goodkit (Note: as seen on 2019-12-04)

web.speakingofhome.com
home.ktxhome.com
home.hopedaybook.com
beta.madeintaylors.com

# Reference: https://app.any.run/tasks/18e0b136-bfa9-4837-8ea7-5ee4a6a732e9/

kasdima.top

# Reference: https://twitter.com/0xCARNAGE/status/1246485252903702528
# Reference: https://app.any.run/tasks/137d26a0-a94a-414b-a953-711647b4093b/

medicinecomplete.com

# Reference: https://twitter.com/ffforward/status/1326144202997166084
# Reference: https://twitter.com/ffforward/status/1326144205106909185
# Reference: https://tria.ge/201110-shdmh4swv6/
# Reference: https://bazaar.abuse.ch/sample/416215d488021e257a7a0552efd53ca8e80b6d066135cbf94dab5b898612c6e7/
# Reference: https://www.virustotal.com/gui/file/30c57c642bb1fc530f6a22718c8eec2b6a6834b2165168a7567c4cee4d298037/detection
# Reference: https://www.virustotal.com/gui/file/35fd40cd3529e9b39b363bba62990949468f3a97ebb7e30e0f7629a64ae3c1d3/detection

chaabattent.com
kerymarynicegross.com
kladrykroptur.com
kvaladrigrosdrom.top
madregobilsg.com
pillygreamstronh.com

# Reference: https://securelist.com/gootkit-the-cautious-trojan/102731/
# Reference: https://otx.alienvault.com/pulse/60be30837c3f13bb72131f36

kerymarynicegross.top
kvaladrigrosdrom.top
lbegardingstorque.com
pillygreamstronh.com
scellapreambulus.top

# Reference: https://www.virustotal.com/gui/ip-address/185.130.104.179/relations
# Reference: https://www.virustotal.com/gui/file/89450d2a60569fb344706de0f1d2105dfb60cfec7118f8d517a2ad0022697fad/detection

admovinseth.com
insourcehawaii.com
vinsethteas.com
dp.insourcehawaii.com
lps.admovinseth.com
xrp.vinsethteas.com

# Reference: https://www.virustotal.com/gui/file/1d0030552e6ff56b7d5469c869af95f0e315888568c00ff2c85da6ba6efa9d4c/detection

195.22.26.252:8080
195.22.26.252:6969
195.22.26.253:6969
ere5453.com
vip.ere5453.com

# Reference: https://twitter.com/GootLoaderSites/status/1514211046629814272

kepw.org
korsakovmusic.com

# Reference: https://thedfirreport.com/2022/05/09/seo-poisoning-a-gootloader-story/
# Reference: https://otx.alienvault.com/pulse/6278f9624d491d800adf4944

jp.imonitorsoft.com/test.php?hjkiofilihyl=
junk-bros.com/test.php?hjkiofilihyl=
kakiosk.adsparkdev.com/test.php?hjkiofilihyl=
/test.php?hjkiofilihyl=

# Reference: https://www.trendmicro.com/en_us/research/22/g/gootkit-loaders-updated-tactics-and-fileless-delivery-of-cobalt-strike.html
# Reference: https://otx.alienvault.com/pulse/62e3c4e56e6b1aff022c72ff

http://89.238.185.13

# Reference: https://tria.ge/220802-qrqatsfcf5/behavioral1

/test.php?xkiutrbcfgqble=

# Reference: https://tria.ge/220802-xhw6cabcgr/behavioral1

/test.php?wiliidivzlonkb=

# Reference: https://tria.ge/220728-tgsvrahbb3/behavioral1

/test.php?rgfufxdpdybaw=

# Reference: https://tria.ge/220728-msbmaaehf6/behavioral1

/test.php?pmfvhcbyovwmpdyx=

# Reference: https://twitter.com/AvastThreatLabs/status/1561685383368286210

frerecapucinbenin.org/search.php
giuseppedeluigi.com/search.php
kettlebellgie.be/search.php

# Reference: https://www.virustotal.com/gui/file/acf7ed3990f94b5c55dfb66537b8ec8ffc8b44855f6107934e750377d1831fb0/detection

195.22.26.253:8080
195.22.26.254:8080

# Reference: https://www.virustotal.com/gui/file/7b376ed4e818dd70ec3c07b366da439cc194694186abacc535708f090f1affbc/detection

193.166.255.171:8080
23.253.46.64:6969

# Reference: https://threatfox.abuse.ch/browse/malware/js.gootloader/

http://5.8.18.159
http://5.8.18.7
138.197.222.36:443
1c-kursy.online/download.php
1fc-muelheim.de/download.php
5esaison.ch/download.php
7x3.jp/download.php
8659design.se/download.php
aaa-studios.de/download.php
aadesignstudio.it/download.php
aandjaudhali.com/download.php
abbazia.hu/download.php
abdmedia.online/download.php
abe.bethmcmillian.com/download.php
aboveandbeyondmovers.com/download.php
abt.hu/download.php
academics360.valaprime.com.ng/download.php
acc.odrtechinc.com/download.php
accessi.altaroma.it/download.php
acil.m-g-n.me/download.php
acuicultura.ihcantabria.com/download.php
adamolam.co.il/download.php
adamsarhan.com/download.php
aderbuild.com.au/download.php
adila.sabluxgroup.com/download.php
admisiones.ipac.edu.ec/download.php
adolphi-stiftung.de/download.php
adriaticdeluxeapartments.com/download.php
aerotechcaps.com/xmlrpc.php
afschools.vermilion.com/download.php
agent.seektobe.com.au/download.php
ahp-microsite.knockmedia.dev/download.php
aidemy.net/download.php
aikido-secrets.co.il/download.php
airtechsystem.co.jp/download.php
akademos.com.ar/download.php
aktoto.eu/download.php
al-hazam.com/download.php
alabuscnc.com/download.php
alarmz.co/download.php
alaynabowman.com/content.php
albertoferreira.art.br/download.php
alethium.com/download.php
alexeasytechnology.co.za/download.php
alfabets.pl/download.php
almazova.space/download.php
alpharealestate.amaseon.com/download.php
alsalamatryon.com/download.php
alteronreit.com/download.php
alumbramento.com.br/download.php
amatosport.pl/content.php
amatus.office.thexroadz.com/content.php
ambersdogwise.nl/content.php
amg.rmutk.ac.th/content.php
amthanhthongbao.com/content.php
ancrages.ca/content.php
anee.ee/content.php
annett.ca/content.php
anphatedu.com/content.php
antbee-corp.demodemo.link/content.php
antoun.com.au/content.php
api-help.100px.com/content.php
apostocatering.gr/content.php
app.ykasandbox.com/content.php
apparences-magazine.be/content.php
apuestagolf.com/content.php
ar-d.jp/content.php
architectuur.webdesignbrabant.net/content.php
armin.mls-test.ch/content.php
art.barakaconsultants.com/content.php
artidesign.studio/content.php
artisanvinegar.co.uk/content.php
asi-instruments.com/content.php
askyadoc.org/content.php
atelierceline.fr/content.php
atlantacreditrepair.info/content.php
atopicschool.co.il/content.php
augustynbaran.pl/content.php
autocars-sapporo.com/content.php
avada2.ladygym.ro/content.php
avindustry.org/content.php
avls.com.ph/content.php
avocadobar.mls-test.ch/content.php
azitgroup.com.au/content.php
backlogworld.demodemo.link/content.php
bagat24.de/content.php
baltimorecreditrepair.info/content.php
bams.co/content.php
bannisterministry.org/content.php
baohomnay365.com/content.php
barwyszkla.pl/content.php
bassanglersofmichigan.com/content.php
bbqaddicts.fr/content.php
bctambore.com.br/content.php
bddlandscaping.com/content.php
beachfront.demodemo.link/content.php
beauty.audreylyllian.com.br/content.php
bellevue-tourtour.com/content.php
benettonrugby.it/content.php
benlloc.es/content.php
bergenadvokatene.no/news.php
bestervergleich24.de/news.php
beta.voxpublica.no/news.php
bevdev.freshcreative.com.au/news.php
bfa.csrcpall.com/news.php
bfasa.co.za/news.php
bialpro.pl/news.php
bigbobspizza.com/news.php
bildwein.pieroth.de/news.php
biosage-saudrune.fr/news.php
biozek.com/xmlrpc.php
birbeslenme.com/news.php
biyuu.net/news.php
blakwaveproductions.com/news.php
blessed-trinity-parish.org/news.php
blog.annelie-voyage.com/news.php
blog.atelierceline.fr/news.php
blog.cerebelum.net/news.php
blog.defouw.org/news.php
blog.denelan.com/news.php
blog.france-langue.fr/news.php
blog.progamma.com/news.php
blog.wo365.com/news.php
bluefrontmagnetics.com/news.php
bna.tframe.de/news.php
bng-old.theapsgroup.scot/news.php
boyarskymurphy.com/news.php
cpbrandindia.com/xmlrpc.php
dogsfun.net/download.php
dolphins.needeepindesign.com.au/download.php
dozecomunicacao.com.br/download.php
dpiadmin.dpipreview.nl/download.php
drammensadvokatene.no/download.php
drewhuddleston.com/download.php
drguentert.mls-test.ch/download.php
drift.rayna-web.fr/download.php
druczki.pl/download.php
duinbehoud.nl/download.php
dwe.amaseon.com/download.php
easiestbatteryrepair.com/download.php
ecomuseodellegrigne.it/download.php
eigoboo.bulog.jp/download.php
eiradio.com/download.php
elektrykstaszow.pl/download.php
elmartecnologia.com.br/download.php
emailbuilder.a6uat.co.uk/download.php
embroiderybadge.rfstaging.co.uk/download.php
encompassproperties.com/download.php
energiemc2.com/download.php
erdalcengiz.com/go.php
esmmprev.dev.interstrand.com/download.php
espacoememoria.org/download.php
estarque.com.br/download.php
ets2.gr/download.php
eucontab.com.br/go.php
euskaljakintza.com/go.php
existeraboutdeplume.fr/go.php
expoteam.ro/go.php
eyu.net/go.php
fafa.ysdong.top/go.php
fahrschulethomas.com/go.php
farbenspiel-trier.de/go.php
farwestlandscape.net/go.php
fas.wyb.ac.lk/go.php
ffsimv.gr/go.php
fincompara.co/xmlrpc.php
firmenakademie.com/go.php
fisika.uad.ac.id/go.php
foblesproject.pl/go.php
formacion.energy-minus.es/go.php
freeintalk.co/go.php
freeintalk.com/go.php
freudeundheilung.de/go.php
fysiotherapie-panken.nl/go.php
gabycampo.com.ar/go.php
gasperinieps.it/go.php
gazette.cercledeyoga.fr/go.php
gebruederbild.com/go.php
gehrels.info/go.php
gghengineers.com/go.php
ggse.us/go.php
ghandchifamily.com/go.php
ghostapp.co.uk/go.php
ghostheads.gbgrid.com/go.php
giccmedical.com/go.php
glaudio.com.au/go.php
glendonlee.com/go.php
gremlin.net/go.php
gullkorndesign.com/go.php
gullkorndesign.de/go.php
gutenberg.marketing-flash.dd/go.php
gutenberg.marketing-flash.de/go.php
hadleymothersclub.org/go.php
hair-med-krakow.pl/go.php
hair-med.com.pl/go.php
ilpiccolocampo.it/blog.php
imago-dp.com/blog.php
inerino.co.za
jonathanbartz.com/test.php
karbonaudit.cf/test.php
kwagalafoundation.nl/test.php
lacocinadefrabisa.lavozdegalicia.es/test.php
lakelandartassociation.org/test.php
lakeside-fishandchips.com/test.php
lenovob2bportal.com/test.php
lesriceysimports.com/test.php
lha.co.ke/test.php
livesports.co/test.php
moussokouma.de/xmlrpc.php
my-game.biz
pillardeploymentretreat.com/xmlrpc.php
satoyamasafu.com/content.php
secora.cl/content.php
setman.es/content.php
seyhanaluminyum.com/content.php
sheffieldcoronarysociety.org.uk/content.php
sicherheitsingenieure-huber.de/content.php
sicilyin.com/content.php
silpa.co.in/xmlrpc.php
slimdiet.eu/content.php
smartcontracts.nl/content.php
spyadviser.com/content.php
srdemolition.com/content.php
studio-lapinternet.fr/content.php
szipe.org/faq.php
talentree.fi/xmlrpc.php
tavernelentrepot.be/faq.php
thediarytours.com/faq.php
thekyhomeinspector.org/faq.php
tillit-hjarta.se/faq.php
tvsguides.com/xmlrpc.php
twoviewsmovies.com/faq.php
vacanzenelmediterraneo.com/faq.php
valentinhenning.de/faq.php
vasktextil.com/faq.php
vecctor.lazyls.co/faq.php
verlaghausundmarkt.de/faq.php
villa-rosenrausch.de/faq.php
vojens-trailerudlejning.dk/faq.php
vrouwenversierentips.org/faq.php
waffen-seilz.de/faq.php
webdesignbrabant.net/faq.php
werbefirma.hamburg/faq.php
whitepanama-films.com/faq.php
wiccinigeria.org/faq.php
wild-confetti.com/faq.php
wonderfulegypttours.com/faq.php
worpswede-blog.de/faq.php
wtcomms.co.uk/faq.php
wyndemeredesigns.jonfarrell.io/faq.php
xaderbuild.com.au/download.php
yec.edu.mm/xmlrpc.php
yvesrobert-decoration.com/faq.php
za-co-za.co.za
zen-altitude.fr/faq.php
zhongguotese.net/faq.php
/tmp_it22/test_zip2/loader_zip.js

# Reference: https://threatfox.abuse.ch/browse/malware/js.gootloader/ (# 2023-09-20)

gutesherz.or/go.php
heartwoodproperties.com/blog.php
heike.teofilius.de/blog.php
heldenfutter.de/blog.php
ikhwarn.com/blog.php
ikwilvanmijnpoloaf.nl/blog.php
ilovealtona.org/blog.php
images.cjp.mx/blog.php
imas.uk.com/blog.php
informatyczny.expert/blog.php

# Reference: https://threatfox.abuse.ch/browse/malware/js.gootloader/ (# 2023-10-22)

herbert-strohmaier.de/blog.php
heuberg-einrichtungen.de/blog.php
hockeycorner.net/blog.php
hoco-moebel.de/blog.php
hologramy-kolekcjonerskie.pl/blog.php
hslawcorp.com/blog.php
ibirtm.pl/blog.php
imago-int.eu/blog.php
inprojexautomotive.com/blog.php
insource.nz/blog.phheatherwoodpta.org/blog.php
inspiration4fitness.de/blog.php
ippm.dk/blog.php
iprommark.com.ua/blog.php
iuic.de/blog.php
jacksworkspace.com/blog.php
johnryan.ie/blog.php
jphilippeau.com/blog.php
junkwize.passionstaging.co.uk/blog.php
jvasky.com/blog.php
kalendarze.merkuriusz.pl/blog.php
kantarellstigen1.se/blog.php
kapsalonbrand.nl/blog.php
karlshamnsfotoklubb.se/blog.php
kavoshpos.com/comments.php
keltek.co.uk/comments.php
kendalwills.co.uk/comments.php
kform.innan.net/comments.php
kiezradler.de/comments.php
kiub.cosavostra.com/comments.php
kizys.net/comments.php
korelyakov.com/comments.php
kr.newyork-english.edu/comments.php
kraftyadvantagemarketing.com/comments.php
krippenfreunde-schnaittenbach.de/comments.php
kristiansandadvokatene.no/comments.php
kuckste.de/comments.php
kwiatkifranciszka.edu.pl/comments.php
laboratoriocitrico.com/comments.php
legalny.com.pl/comments.php
lepanam.com/comments.php
lewispublishing.org/comments.php
limbus-holding.de/comments.php
local.silly-beer.com/comments.php
manfredfohringer.de/comments.php
manfredritschard.com/comments.php
markadsrad.ru.is/comments.php
marketdriven.chevronmarcom.com/comments.php
marketstrategiesmgmt.com/comments.php
maxguenter.de/comments.php
mcnazamecku.net.scms.sq1.io/docs.php
mdsbio-tech.com/docs.php
media-accelerator.it/docs.php
meekoppelen.klimaatadaptatie.nl/docs.php
mein.miteinander.reisen/docs.php
members.bonusbomber.com/docs.php
mercedes5pluss.no/docs.php
metagaming.tv/docs.php
metodabls.pl/docs.php
midwayfun.client.dev.rocketeffect.com/docs.php
mindfully.vn/docs.php
mirabilismusic.net/docs.php
mirazbakery.com/docs.php
mitgliederbereich.frederik-malsy.com/docs.php
mittnyahem.com/docs.php
mkbwindows.co.uk/docs.php
modatrends.nl/docs.php
moeve-schmelz.de/docs.php
mooreinsure.net/docs.php
motociclistagiapponese.com/docs.php
movingtonewzealand.org/docs.php
mps.rfstaging.co.uk/docs.php
mvz-ansbach.de/docs.php
my.freeintalk.com/docs.php
mycom.global/docs.php
myhealthspin.com/docs.php
myinternetchapel.org/docs.php
myoldcountryhouse.com/docs.php
myuoh.org/docs.php
mywinthropcondo.com/docs.php
nado.ca/docs.php
naniwa-ginzaaward.hisaki-design.com/docs.php
natrumax.com.vn/docs.php
nattivos.com/docs.php
nbconstructor.com/docs.php
nblandgroup.com/docs.php
nebo-trk.com/docs.php
netherlands.qolsys.com/docs.php
new.clovercars.net/docs.php
new.scratch-build.com/docs.php
newireluck2.com/docs.php
newperspectivellc.com/docs.php
news.soxo.bet/docs.php
nextgenlead.org/docs.phpp
nhakhoablossom.vn/docs.php
nicholasoflondon.co.uk/docs.php
ninapodiatry.co.uk/docs.php
no.sexydate.world/docs.php
nocknock.io/docs.php
nordics.qolsys.com/docs.php
northshoregreencare.co.nz/docs.php
nortproperties.se/docs.php
np.lostsoulsuk.com/docs.php
nsdayan.com/docs.php
oaklanddental.org/news.php
obrecht.agentenpreview.com/docs.php
obrobkacieplna.com/docs.php
obsessive.business/docs.php
ocatio.co.uk/docs.php
occhio.com.au/docs.php
oceanprezentow.pl/docs.php
odal.codeium.dev/news.php
ogaki-asobanight.com/news.php
okidok.se/news.php
oldtimertreffen-rethem.de/news.php
ondrejklicpera.cz/news.php
orangeprint.pl/news.php
orsomedia.cosavostra.com/news.php
ouchi-work-mei.com/news.php
pacoprian.es/news.php
palitaliawines.com/news.php
pandr.pandroutsourcing.com/news.php
parafianieboczowy.pl/news.php
paragonprinting.co.uk/news.php
parencyivf.com/news.php
parentpipelineproject.org/news.php
pasta-mania.it/news.php
path4hosts.com/news.php
pax-anders.de/news.php
pecatonicabeer.com/news.php
penzion-bawaria.cz/news.php
pepelu-staging.01staging.site/news.php
pitt.com.br/news.php
pokojechancza.pl/news.php
portugal.qolsys.com/news.php
powerthruconsulting.com/news.php
quangcaolcd.com/save.php
quote.keydesignwebsites.com/save.php
racingclub-saintcernin.fr/save.php
radium-audio.com/save.php
railway.net.tw/save.php
rallysweden.com/save.php
ranmabooks.com/save.php
rbarcia.pt/save.php
reallifecomics.com/save.php
rechtsanwalt-wucherpfennig.de/save.php
reformasceibo.es/save.php
reisebloggerwelt.de/save.php
rencontrenationaledanse.fr/save.php
restauracekup.cz/save.php
restaurangfolkparken.se/save.php
rezetennisclub.fr/save.php
ringco.ir/save.php
ringkhodro.ir/save.php
rishish.com/save.php
rodrigofischer.com/save.php
running.hkcosmo.com/save.php
russondesign.com/save.php
rvonkruger.com.br/save.php
rz-menden.de/save.php
salarquitectura.es/save.php
salsadk.dk/save.php
sandbox.herzek.net/save.php
sato-transport.net/save.php
sbc.gold-ichiba.com/save.php
scheiff.eu/save.php
schoolreport.belperschool.co.uk/save.php
schroederdennis.de/save.php
schuitemaker.twentepc.nl/save.php
shodo.cosavostra.com/save.php
shop.roseofsharon.hk/save.php

# Reference: https://securityintelligence.com/x-force/gootbot-gootloaders-new-approach-to-post-exploitation/
# Reference: https://otx.alienvault.com/pulse/655343a01d5cec168a522f27

63factory.jp/wordpress/xmlrpc.php
contentstudent.com/xmlrpc.php

# Reference: https://app.any.run/tasks/8d4ea302-a822-46b2-bb2b-51a1dd052dc0/

/sRSVYdkWbWU11.bin

# Reference: https://threatfox.abuse.ch/browse/malware/js.gootloader/ (# 2023-12-05)

inerino.co.za/index.php
insource.nz/blog.php
mpvip.com.br/docs.php
musically.shift-m.com/docs.php
oneminutechallenge.hu/news.php
onlineandon.com/news.php
openday.mcs.it/news.php
pinklittlenotebook.com/news.php
planex.wjg.jp/news.php
po.csrcpall.com/news.php
preprod.lelit.fr/news.php
prestburycheshire.com/news.php
probono.6600dev.com/news.php
project-ile.net/news.php
projectboxmedia.com/news.php
propertyshopofthecarolinas.com/news.php
quind.de/news.php
sikasonhiep.com/blog.php
slottje.com/blog.php
smarttours.ro/blog.php
smd.agency/blog.php
snopro.eu/blog.php
sonnenkirche.de/blog.php
spd-haltern-am-see.de/blog.php
spenden.procamp.org/blog.php
spice.ehero.es/blog.php
spielsand-kaufen.com/blog.php
squarechapel.co.uk/blog.php
stadnicka.com/blog.php
staging.aoibhneas.org.scms.sq1.io/blog.php
staging.ivet.edu.au/blog.php
starli.top/blog.php
stavangeradvokaten.no/blog.php
stefangubser.com/blog.php
stromduellen.no/blog.php
studentalpharotterdam.nl/blog.php
studiocircle.co.uk/blog.php
studiotapas.com/blog.php
sunbattery.ir/blog.php
sunnhordlandantirust.no/blog.php
supergaywedding.com/blog.php
support.aidemy.net/blog.php
survey.ykasandbox.com/blog.php
suzukikougei.co.jp/blog.php
svoy.pro/blog.php
swartauto.nl/blog.php
t03imd.info/blog.php
tanakakoichi.com/blog.php
tarabuhagiar.com/blog.php
tascareaga.com/blog.php
tasmanrevival.com/blog.php
tattoocapilar.com/blog.php
taxexemptconsultants.com/blog.php
tcservices.com/blog.php
teamdioxide.com/blog.php
technologiczni24.pl/blog.php
telefonteknik.se/blog.php
tennesseescholars.org/blog.php
test.calcanto.de/blog.php
test.odrtechinc.com/blog.php
textart.nonhoff.info/blog.php
the-hope-foundation.kdconnect.uk/blog.php
the-other-milk.com/blog.php
theJKinz.com/blog.php
thechip.shop/blog.php
theconniewong.com/blog.php
thedovepartnership.co.uk/blog.php
theloosechangecharity.co.uk/blog.php
thenordicman.com/blog.php
thieuhoa.com.vn/blog.php
thirstymag.com/blog.php
tintin.coffee/blog.php
tipthara.com/blog.php
tisdagskaffe.se/blog.php
titan-fitness.com/blog.php
toenchen-und-herrschmidt.de/blog.php
toenchen-und-herrschmidt.ee/blog.php
tororomba.com.br/blog.php
toshiaki1.com/blog.php
ubezpieczeniawalczyk.pl/blog.php
uczestnik.devagroup.nq.pl/blog.php
uczestnik3.devagroup.nq.pl/blog.php
udef.fr/blog.php
uk.qolsys.com/blog.php
undergroundnyc.com/blog.php
unisono.band/blog.php
upcyclestitches.com/blog.php
v3.mytalentplatform.com/blog.php
veken.de/blog.php
vicsthemovingman.net/blog.php
vinhos.grandcru.com.br/blog.php
vipaco.vn/blog.php
vladferoiu.com/blog.php
za-co-za.co.za/index.php

# Reference: https://threatfox.abuse.ch/browse/malware/js.gootloader/ (#2024-03-24)

0939it.com/xmlrpc.php
52poke.com/xmlrpc.php
aarch.dk/xmlrpc.php
abako.se/wordpress/xmlrpc.php
allfridaystudio.com/xmlrpc.php
ama-studio.it/xmlrpc.php
amida.se/xmlrpc.php
ansoffs.com/xmlrpc.php
articuly.com/xmlrpc.php
artisebio.com/xmlrpc.php
atalyadis.com/xmlrpc.php
atemberaubende-akzente.de/m/xmlrpc.php
atlanticyachtandship.com/xmlrpc.php
auxiliaryenergy.com/xmlrpc.php
back-zeit.de/xmlrpc.php
balanceanddizzinessphysicaltherapy.com/xmlrpc.php
barn2.com/xmlrpc.php
belvederebenidorm.com/xmlrpc.php
bourse-du-travail.com/blog/xmlrpc.php
boxhaus.de/blog/xmlrpc.php
brainsoulsuccess.com/xmlrpc.php
brandweeravenhorn.nl/xmlrpc.php
breckenridge-vacation-homes.com/xmlrpc.php
calzaturificioliberty.it/xmlrpc.php
cathedrale-nantes.fr/xmlrpc.php
charchiinet.com/xmlrpc.php
charltonbrown.edu.au/xmlrpc.php
cheapandbestshopforlife.com/wordpress/xmlrpc.php
cittadifondazione.it/xmlrpc.php
connachttribune.ie/xmlrpc.php
conoleforcongress.com/xmlrpc.php
cultus.dk/xmlrpc.php
dansport.is/xmlrpc.php
darolvakil.com/xmlrpc.php
dgtread.com/xmlrpc.php
diereisedeineslebens.de/xmlrpc.php
divipeople.com/xmlrpc.php
djurskyddetvastervik.se/xmlrpc.php
dme.gr/xmlrpc.php
drzewkonaprezent.pl/xmlrpc.php
elbepokal.de/xmlrpc.php
emeliew.se/xmlrpc.php
eshraghbook.com/xmlrpc.php
faneuilhallmarketplace.com/xmlrpc.php
fuzionproscooter.com/xmlrpc.php
games-up.fr/xmlrpc.php
geekhacker.ru/xmlrpc.php
geekville.ru/xmlrpc.php
gochat247.com/xmlrpc.php
goldco.com/xmlrpc.php
goodklei.ru/xmlrpc.php
gradecam.com/xmlrpc.php
healthcares.life/xmlrpc.php
helpsarkari.com/xmlrpc.php
hethooghuis.nl/xmlrpc.php
hkcapsule.com/xmlrpc.php
irannihon.com/xmlrpc.php
jt.my/xmlrpc.php
kbjporn.com/xmlrpc.php
kresy.pl/xmlrpc.php
lascebrassalen.com/xmlrpc.php
lasik2020.com/xmlrpc.php
livingshorespa.com/xmlrpc.php
luxurylaunches.com/xmlrpc.php
mcws.org/xmlrpc.php
michiganumc.org/xmlrpc.php
moaetscandg.org.ng/xmlrpc.php
mundoalbiceleste.com/xmlrpc.php
mycashtree.net/xmlrpc.php
natbooks.com.au/xmlrpc.php
netmag.pk/xmlrpc.php
ngajiyok.com/xmlrpc.php
nitrobilisim.com.tr/xmlrpc.php
onlinemoneyspy.com/xmlrpc.php
outsidespace.co.nz/xmlrpc.php
palaiofaliro.gr/xmlrpc.php
parentingisnteasy.co/xmlrpc.php
pipingpotcurry.com/xmlrpc.php
playgroundbaron.com/xmlrpc.php
pointerclicker.com/xmlrpc.php
prokirpich76.ru/xmlrpc.php
promixacademy.com/xmlrpc.php
pvcfencingwarehouse.com.au/xmlrpc.php
ragmcloud.com/xmlrpc.php
rahatupu.net/xmlrpc.php
republicanpress.org/xmlrpc.php
rushradar.com/xmlrpc.php
saint-augustin.ch/xmlrpc.php
schematherapyinstitute.com.au/xmlrpc.php
seva-ese.com/xmlrpc.php
sheffi-tours.co.il/xmlrpc.php
shemshad.com/xmlrpc.php
shtourval.ru/xmlrpc.php
shywolfsanctuary.org/xmlrpc.php
smartai.com.au/xmlrpc.php
smokersplanet.de/xmlrpc.php
smwroclaw.pl/xmlrpc.php
snyk.io/xmlrpc.php
som.edu.vn/xmlrpc.php
specialeventservices.com/xmlrpc.php
susanin.fun/xmlrpc.php
swingandbeyond.com/xmlrpc.php
systemtranslation.com/xmlrpc.php
tamilcinetalk.com/xmlrpc.php
testiran.com/xmlrpc.php
thechutneylife.com/xmlrpc.php
themeatandwineco.com/xmlrpc.php
themodestwallet.com/xmlrpc.php
travel2next.com/xmlrpc.php
typhoontv.in/xmlrpc.php
urbedu.live/blog.php
uumu.fi/blog.php
vancleefinc.com/blog.php
vaqutauxfamily-fanclub.com/blog.php
vente-outillages.com/blog.php
vicantres.com/blog.php
vietsportscience.com/blog.php
viewcast.tv/blog.php
villadsen4x4.dk/blog.php
vilmas.digital-brands.de/blog.php
vogelhaus-gestaltung.de/blog.php
volleyball-muenchen.de/blog.php
volleytip.com/blog.php
volltrendyfashion.de/blog.php
voxpublica.no/blog.php
webipal.com/xmlrpc.php
weissenbach-pr.de/xmlrpc.php
wheelz.me/xmlrpc.php
wordpress.itrip.ro/xmlrpc.php
xlights.org/xmlrpc.php
yekdoa.ir/xmlrpc.php
zahiraccounting.com/xmlrpc.php
zarinbano.com/xmlrpc.php

# Reference: https://threatfox.abuse.ch/browse/malware/js.gootloader/ (# 2024-03-31)

192-168-1-1-admin-admin.ru/xmlrpc.php
althaus-innenausbau.de/xmlrpc.php
amazila.cz/xmlrpc.php
assamjatiyabidyalay.com/doc.php
aurory.io/xmlrpc.php
baaghitv.com/xmlrpc.php
beeldvorm.eu/xmlrpc.php
bodylift.si/xmlrpc.php
bsdeboomgaard.be/xmlrpc.php
buckcenter.edu.ec/xmlrpc.php
bulaintel.com/xmlrpc.php
cantinalandi.com/xmlrpc.php
catherinefoundation.org/xmlrpc.php
celeritastransporte.com/xmlrpc.php
cityhomesedmonton.ca/xmlrpc.php
convertkit.com/xmlrpc.php
cuinescalaf.com/xmlrpc.php
cumm.co.uk/xmlrpc.php
descarca.info/xmlrpc.php
designtoolsnetwork.com/xmlrpc.php
digitalmarketingcompany.me/xmlrpc.php
donquichottedeladendre-ath.be/xmlrpc.php
eatech.uk/xmlrpc.php
exceloffthegrid.com/xmlrpc.php
ffteducationdatalab.org.uk/xmlrpc.php
growthworks.io/xmlrpc.php
hitech-us.com/xmlrpc.php
juststories.se/xmlrpc.php
kayoanime.com/xmlrpc.php
kemilektioner.se/xmlrpc.php
kinosait24.ru/xmlrpc.php
lasantaespina.cat/xmlrpc.php
mangacrab.com/xmlrpc.php
matchtime.co/xmlrpc.php
mcintoshdaily.com/xmlrpc.php
mepiu.it/xmlrpc.php
outdoorgearshub.com/xmlrpc.php
overbeekphotos.com/xmlrpc.php
prozhedownload.com/xmlrpc.php
seiji-folk.com/xmlrpc.php
stanta.co.uk/xmlrpc.php
support.dotregis.com/xmlrpc.php
tanya-tanya.com/xmlrpc.php
taronews.tw/xmlrpc.php
telegramguru.com/xmlrpc.php
theyogainstitute.org/xmlrpc.php
topcoloringpages.net/xmlrpc.php
vipaco.vn/xmlrpc.php
wielkopolskamagazyn.pl/xmlrpc.php
wildundhund.de/xmlrpc.php

# Generic

/rpersist4/-1008320073
/rpersist4/-327594751
/rpersist4/
/search?elweodvfxwfrwey=
/rbody320
/tes2t