# Copyright (c) 2014-2019 Maltrail developers (https://github.com/stamparm/maltrail/)
# See the file 'LICENSE' for copying permission

# Reference: https://www.proofpoint.com/us/threat-insight/post/gootkit-banking-trojan-jumps-channel

swysocki77.com
gorski83.com
ostrowski87.com
jasinski2015.com
olszewski78.com
pozheeshebudem.com
freforevermailtes.com
nidermidertom.com
ecuremailbestfree.com
securewebgooglesite.com
robertpouslen12494.pw
robertpouslen1234524.com
update-service7825t28.com
domolor.com
babosikimne.com
babosikidai.com
vaillantsawer.com
proballansmen.com
reputamadrell.com
lastrizariano.com
rokobarokkino.com
artipreambulo.com
trequablaster.com
pretriquestro.com
rebellintosto.com
mellicianactr.com
abc.doitgraphic.org
updatebase.bid
shop.lifexcellence.org

# Reference: http://www.broadanalysis.com/2017/03/13/rig-exploit-kit-via-eitest-delivers-gootkit-banking-malware-2/

duplanty.top

# Reference: https://www.cert-pa.it/news?id=10536

sph.expoartshop.com

# Reference: https://twitter.com/James_inthe_box/status/1102904911212101634

/rbody320

# Reference: https://twitter.com/James_inthe_box/status/914111090425917440
# Reference: https://pastebin.com/T2ryBWdZ

/rpersist4/

# Reference: https://twitter.com/JAMESWT_MHT/status/1113395985043079169
# Reference: https://sugitamuchi.hatenablog.com/entry/2019/04/13/224350 (JP-lang)

/loadercrypt_823EF8A810513A4071485C36DDAD4CC3.php

# Reference: https://www.joesandbox.com/analysis/117861/0/pdf

/crypt0DD1D2637FDB71097213D70B94E86930.php

# Reference: https://twitter.com/VK_Intel/status/1006545151823613952

ftps.layermag.com
lab.aplusstatus.com
0.turkcedusunturkcekonus.com

# Reference: https://twitter.com/malware_traffic/status/767852827200761856

apsoo3k2i.ahgsuy3829.top

# Reference: https://twitter.com/Racco42/status/1063412662623760385

/tes2t

# Reference: https://twitter.com/BroadAnalysis/status/815211105664565248

cedar.igrooveweb.com
salsx.sedtinterrighthe.top

# Reference: https://twitter.com/BroadAnalysis/status/788400179091214336

acc.arabicdessert.co
kd67.prmhohzsl.top

# Reference: https://twitter.com/BroadAnalysis/status/782996903025844224

b6l2op.dxzvkr.top

# Reference: https://twitter.com/malware_traffic/status/766412267063607296

dmqxmz.lowashemterle.top

# Reference: https://blog.yoroi.company/warning/campagna-gootkit-verso-pec-italiane/

ami.sigaingegneria.com
erre.effe-erre.es
filuetrama.top
martatov.top

# Reference: https://twitter.com/reecdeep/status/1130497379411595266

fila.heathercrowe.ca
koohy.top

# Reference: https://app.any.run/tasks/77932db7-ffb1-409a-9b28-9cf6c8e70c1c/

fila.su170.org

# Reference: https://twitter.com/reecdeep/status/1136950470696681473

it.goodvibeskicking.com
tru.cheersportacademy.com

# Reference: https://twitter.com/reecdeep/status/1139063611681325056

kohe.even-air.com
ove.resourceny.net

# Reference: https://twitter.com/reecdeep/status/1139436492152102912

box.therusticsandbox.com

# Reference: https://twitter.com/James_inthe_box/status/1141326136212766720

checkcacheonline.com

# Reference: https://twitter.com/abuse_ch/status/1141330445663113218

onlinecachecheck.com

# Reference: https://www.cert-pa.it/notizie/campagna-gootkit-tramite-jasperloader-verso-pubbliche-amministrazioni/

fattura.directionalforcedrive.com
majorleaguepub.com
calc.1407cty13pec.com
koh.191northfront.com
karysmarie.me
otnhmtkwnz.top

# Reference: https://twitter.com/reecdeep/status/1153248954911514625

me.karysmarie.me

# Reference: https://twitter.com/reecdeep/status/1156085593148932097

koh.corkysfreshwater.com
lucky.bayonetbreakers.com

# Reference: https://twitter.com/reecdeep/status/1156866545651474432

drive.deescreationstore.com
kope.deessolutionsdemo.com

# Reference: https://twitter.com/reecdeep/status/1159353959271845888

me.woodlandsareareview.com

# Reference: https://twitter.com/reecdeep/status/1159349342144253954

drive.gstroop4822.org
free.deescreationstore.com

# Reference: https://twitter.com/reecdeep/status/1158754365559193602

me.kaleighrose.me
otnhmdmwnz.top

# Reference: https://twitter.com/reecdeep/status/1158751070425763840

soft.photosbydee.com

# Reference: https://twitter.com/peterkruse/status/1158761928736628736

bill.newsrental.net
help.skofirm.org
zgzimdqwnj.top

# Reference: https://twitter.com/reecdeep/status/1156866545651474432

drive.deescreationstore.com
kope.deessolutionsdemo.com

# Reference: https://twitter.com/reecdeep/status/1164503528271990784

hop.hopedaleweb.com
web.tilmonday.com
wws.no-shirt-no-shoes.com

# Reference: https://twitter.com/reecdeep/status/1164508719742423044

hop.hopedaleweb.com
zgzimdkwod.top

# Reference: https://twitter.com/JAMESWT_MHT/status/1164511396849160193

web.cfmontessori.com
wws.dbimages.com

# Reference: https://twitter.com/JAMESWT_MHT/status/1169549992345985025

wow.doorattendants.com
me.jmitchelldayton.com
web.speakingofhome.com
pro.prosperitybookkeeping.net

# Reference: https://twitter.com/reecdeep/status/1171022723587420162

ser.jonnalbandian.com
wws.christinedavies.biz
vps.healinglightwithin.com
it.its1ofakind.net

# Reference: https://twitter.com/JAMESWT_MHT/status/1172515470202871808

ser.jonnalbandian.com
wws.christinedavies.biz
you.cypressstakeyouth.com
adp.mjmentertainment.com

# Reference: https://twitter.com/MBThreatIntel/status/1174471949059125248

adp.reevesandcompany.com
beta.madeintaylors.com
picturecrafting.site

# Reference: https://twitter.com/JAMESWT_MHT/status/1175128962919542785

guipicturecrafting.site

# Reference: https://twitter.com/reecdeep/status/1176407972249001984

wws.breebrasil.com
wws.guidemyhunt.com

# Reference: https://twitter.com/reecdeep/status/1176414815033679873

web.speakingofhome.com
pro.prosperitybookkeeping.net

# Reference: https://blog.talosintelligence.com/2019/10/threat-roundup-1011-1018.html (# Win.Malware.Gootkit-7333291-0)

cibariefoodconsulting.com
hymnsontap.com
its1ofakind.net
jmitchelldayton.com
kaleighrose.me
karysmarie.me
kkillihhy.top
mjmentertainment.com
otnhmdmwnz.top
picturecrafting.site
reevesandcompany.com
simplebutmatters.com
thebellamyfamily.me
ttbuilders.com
woodlandsareareview.com

# Reference: https://twitter.com/deepspacesc/status/1133755269836693506

capfaregreem.eu

# Reference: https://any.run/malware-trends/goodkit (Note: as seen on 2019-12-04)

web.speakingofhome.com
home.ktxhome.com
home.hopedaybook.com
beta.madeintaylors.com