# Copyright (c) 2014-2021 Maltrail developers (https://github.com/stamparm/maltrail/)
# See the file 'LICENSE' for copying permission

# Aliases: arcom, jacard, javali, ousaban

# Reference: https://twitter.com/dark0pcodes/status/1338708528777859072
# Reference: https://pastebin.com/qrZiZRKf

40.65.192.150:6668
52.152.169.124:6668

# Reference: https://www.virustotal.com/gui/file/66d134dfc4861f114dc74feb61f7847fbe3ed42a3c5c25fa65770a64ab2912b2/detection
# Reference: https://www.virustotal.com/gui/file/214379b16b39f5698cf392e470eda4a0544346110b151e3921346d805bc877e7/detection

http://52.183.44.152
/shount/pixel.php
/zecountshount/pixel.php

# Reference: https://twitter.com/dark0pcodes/status/1339571862070845440

webzedomainplus.brazilsouth.cloudapp.azure.com

# Reference: https://twitter.com/dark0pcodes/status/1346172045869133825
# Reference: https://www.virustotal.com/gui/file/98f18d2e9f7f238479e854b4315ab2d3a9b42b80d914fe04f7928b662ca54376/detection
# Reference: https://www.virustotal.com/gui/file/d2574361932291bfb75f018a348ed67c3510e2893ba213cd32bad9e1828bdf1f/detection

137.135.93.161:60015
mixiricaman.duckdns.org

# Reference: https://www.virustotal.com/gui/file/e6a56ddd8fa5cbdf924353f9e9f1399893d62cbb095d4233c4837fd633874853/detection

149.28.109.229:60010
meckilloprt.org

# Reference: https://twitter.com/dark0pcodes/status/1346539733959192576

papramister.org
pumaman.ddns.net
/MEGATRONX1/MSHPOOX1.php
/MEGATRONX1/
/MSHPOOX1.php

# Reference: https://twitter.com/dark0pcodes/status/1346539881137369102

feliz2021.1gb.ru
mixiricameleca.ddns.net

# Reference: https://www.virustotal.com/gui/file/3cb3a6f1b6ecbe1b8dd818033a6153782fada2f75e777cf4898c3e6282dc939b/detection

flordeliskm26.com.br

# Reference: https://twitter.com/dark0pcodes/status/1354598005010292737

primo1982.1gb.ru
primomiguel.ddns.net
primomiguel.duckdns.org

# Reference: https://twitter.com/MalwareConfig/status/1361266524628123653
# Reference: https://malwareconfig.com/config/722aaceda2f590d2d5f9d929f6360c00
# Reference: https://www.virustotal.com/gui/file/eb82bd54113dfdb84b95670dc3e462b56312b4096abc28869802e489be6f20a0/detection

185.17.1.158:1819
/arcom/get.php

# Reference: https://www.virustotal.com/gui/file/6d8f2c652d6121e773ee605016bde18250b8708faf66e695c7346b9341008fc3/detection

cvbopmklopc.hopto.org

# Reference: https://twitter.com/ESETresearch/status/1376490539240075264

pumax2021.1gb.ru
/ZP/MIKV.php

# Reference: https://twitter.com/jumpnotzer0/status/1381888385841782789
# Reference: https://twitter.com/jumpnotzer0/status/1381887489158316034

gaspnewkailf.s3-us-west-1.amazonaws.com
kalifax01.westus2.cloudapp.azure.com
/MIXWIN33.php

# Reference: https://www.virustotal.com/gui/file/ab74425d49087265b99a17c2aee87f5f79f7a8f203b4d74dc605c0a7d0ffcbda/detection

190.200.1.227:8992
halamartini.hopto.org

# Reference: https://twitter.com/James_inthe_box/status/1422654605163307008
# Reference: https://twitter.com/c3rb3ru5d3d53c/status/1422910986160418819
# Reference: https://app.any.run/tasks/3d3b4f8e-1232-4fb7-a561-6fa033e89085/
# Reference: https://app.any.run/tasks/ec6a8740-d85b-4d65-9ee0-01f36f529cca/
# Reference: https://gist.github.com/silence-is-best/b784f56771b2556ec26edc9d6dc3ab2d

http://20.197.233.196
campeonato-brasileiro.duckdns.org
clientes-times.duckdns.org
opdahora2021.duckdns.org
opdahora2022.duckdns.org
pedrexavisos2.duckdns.org
pedrexavisos.duckdns.org
pedrexpgbl.duckdns.org
puma-avisos-2021.duckdns.org
puma-op-001.duckdns.org
tjamigodovini.duckdns.org
tjdosavisos.duckdns.org

# Reference: https://twitter.com/StopMalvertisin/status/1438231010576011266

http://20.108.64.214

# Reference: https://www.virustotal.com/gui/file/5e65b34a5b54b0941a9ebe1b5db91950bbf38b088b9f731f572d048f1f10ae7e/detection

cubajunio.duckdns.org

# Reference: https://www.virustotal.com/gui/file/3f9b5880b0076a4451cdfa5292f8b839c14fc7d9d1a88910fc5d6f66cf363322/detection

r0melte.duckdns.org

# Reference: https://www.virustotal.com/gui/file/ed8eb254b2eeba5ea8a26af90aabe261ed3f5ff7471afbae05b0505f53b550f5/detection

godindocss.duckdns.org

# Reference: https://www.virustotal.com/gui/ip-address/40.74.228.28/relations
# Reference: https://www.virustotal.com/gui/ip-address/52.171.194.225/relations

bolabanksn.duckdns.org
cubajunio.duckdns.org
danilinhos.duckdns.org
lubagalord.duckdns.org
mydocss.duckdns.org
primosprimas.duckdns.org
urubis.duckdns.org
xalitasma.duckdns.org