# Copyright (c) 2014-2024 Maltrail developers (https://github.com/stamparm/maltrail/)
# See the file 'LICENSE' for copying permission

# Reference: https://github.com/pan-unit42/iocs/blob/master/keybase/keybase_ioc.csv

http://108.175.156.78/~thaisupp/asap/post.php
http://108.175.156.78/~thaisupp/assets/post.php
http://108.175.156.78/~thaisupp/crown/post.php
http://108.175.156.78/~thaisupp/elber/post.php
http://108.175.156.78/~thaisupp/nails/post.php
http://108.175.156.78/~thaisupp/nelson/post.php
http://108.175.156.78/~thaisupp/order/post.php
http://108.175.156.78/~thaisupp/rack/post.php
http://108.175.156.78/~thaisupp/real/post.php
http://108.175.156.78/~thaisupp/relay/post.php
http://108.175.156.78/~thaisupp/rendell/post.php
http://108.175.156.78/~thaisupp/sense/post.php
http://108.175.156.78/~thaisupp/shiznith/post.php
http://108.175.156.78/~thaisupp/stress/post.php
http://108.175.156.78/~thaisupp/wack/post.php
http://108.175.156.78/~thaisupp/white/post.php
http://108.175.156.78/~thaisupp/yanze/post.php
http://167.160.46.7/~keycod/~/kbz/post.php
http://190.14.37.19/~keybasec/jizzy/post.php
http://199.241.188.234/new/panel/post.php
0wn3r.me
accessoryinasia.com
aminedata.pe.hu
annabouche.com
anonleakz.890m.com
awilmelody.pe.hu
babaelectricals.com
bct-cawe.net
bekunebok.netai.net
besaeco.com
cemasian.com
chinzikurishibuk.net
clashofclans-cheat.net
comecaca.3eeweb.com
commoditiessellers.net
company777.wc.lt
conh.ga
crackingstaff.zz.mu
davisusername.esy.es
dessy.redhatservices.esy.es
destinyuband.esy.es
dmjc-malaysiapalmproducts.com
dommershuijzen.nu
dwtrade.biz
elvira1983.zz.mu
engjackinc.zz.mu
eventica.kg
gatarcement.com
gbkybze.ga
ggdigduuzdgz.esy.es
globeways.website
gobrkybz.cf
goodmorninbredrn.net
haivu8a3.esy.es
hontaman.bounceme.net
hydropo1ymer.net
itscam.pro
jorgenholzmann.nl
kaptendemir.com
kbas.zz.vc
keybase.in
keybase.ipservices-ltd.co.uk
keybase.zz.mu
keybasejasper.esy.es
keybasepanel.hol.es
keystroke.zz.vc
keystrokesunlimited.pe.hu
kyliewalksbase.com
likelikeblog.bugs3.com
locopoco.zz.mu
lucianojesse.com
madsemanden.coxslot.com
mailusaacad.com
mallustalk.com
martyn.hints.me
mattyclarkpin.com
meridansalmongroups.com
meyedibleoils.com
mezilansakushmu.net
mohiniorganic.com
muyitools.wc.lt
muzukashibrashinki.net
nelsonpanel.96.lt
nhvina.com
nnpcgroupcomd.com
nostubesaver.com
o9191.com
obamabigboy.esy.es
oceanicsolutionsenterprise.com
ogaorangeself.esy.es
oluwapanel.wc.lt
omueda.allalla.com
omueda3.esy.es
own3d.dk
pepperdeybalms.com
phonesandtabletsfix.com
pindakaas1980.host22.com
polite.besaba.com
politebobby.com
reefran.com
ressurectionplayerz.biz
restnwire.no-ip.biz
royallink.lixter.com
ruggededge.co.in
rylynnbrackett.com
safeinsta.esy.es
smartbass.net
snowcoatsounds.com
sodick-ft.com
sonetlinktech.pe.hu
srv.areshq.eu
steelholdings.eu
stellatosolutions.com
supportforpoors.zz.vc
tamwaytours.com
tavito.96.lt
trinimaxzimuxus.net
udoka.pixub.com
ugonna.besaba.com
unicorndomain.byethost10.com
unicorndomain.pe.hu
unicornpanel.pw
uniononline-ng.com
username14.esy.es
usmanmartin.allalla.com
verifylogon.me
xboxlivecodegenerator.info
yiwoagentmarkets.com

# Reference: https://twitter.com/dvk01uk/status/1175367733711712262

lykaninvestment.ga

# Reference: https://twitter.com/dvk01uk/status/1178184818280009728

integratedconsult.ga

# Reference: https://github.com/silence-is-best/c2db#keybase

pacificglobal.ga

# Reference: https://twitter.com/wwp96/status/1191353242858508288
# Reference: https://app.any.run/tasks/fc977a19-3533-49ef-8dd4-c1d55054b2ca/

idealshipka.com.mk

# Reference: https://twitter.com/securiteoff/status/737702878945644544

http://192.169.82.254/~persona1/logz/login.php

# Reference: https://twitter.com/ViriBack/status/1299807425457983488

kitesgcc.com/web/login.php

# Reference: https://www.virustotal.com/gui/file/a88f94d1c96b0224ac11dd7bcc922173877b9f6a9442b083c3fdca3d40dd1c65/detection

buzzcourer.com

# Reference: https://open.appscan.io/article-235.html

alexhillipark.ru
froglogst.us
jonnychangginc.ru
jsadas.site
l3d1.pp.ru
l3d.pp.ru
megastandbdul.ru
promotagrams.com
tokimecltd.ru

# Reference: https://app.any.run/tasks/78d6ed60-4157-45a2-b32c-7f8a296cbbe1/

ca-huskyenergy.website

# Generic trails

/keybase/login.php
/keybase/post.php
/kbpanel/login.php
/kbpanel/post.php
/key/panel/base/login.php
/key/panel/base/post.php