# Copyright (c) 2014-2021 Maltrail developers (https://github.com/stamparm/maltrail/) # See the file 'LICENSE' for copying permission # Reference: https://twitter.com/ps66uk/status/1032177208335450112 # Note: C2 direct link is added due to remark from #239 occe.com/image1/image/Panel/five/fre.php # Reference: https://twitter.com/malwrhunterteam/status/1032537769787183104 americaircairmakan.com botnet.americaircairmakan.com # Reference: https://twitter.com/FewAtoms/status/1033040103155871744 agodatex.ga http://185.185.40.152/jeff/five/fre.php # Reference: https://twitter.com/olihough86/status/1033055339359420417 polixservices.com # Reference: https://twitter.com/0xffff08000/status/1033054440306036737 embramedica.com.br/site/wp-content/plugnis/ipconfig/five/PvqDq929BSx_A_D_M1n_a.php # Reference: https://twitter.com/malware_traffic/status/1033003634001367042 yardng.com # Reference: https://twitter.com/pollo290987/status/1032998085503447041 rmsalf.com # Reference: https://twitter.com/olihough86/status/1031644479109963776 http://191.101.42.43/fdgd/five/PvqDq929BSx_A_D_M1n_a.php studemplo.com/admin/studemplo/Panel/five/PvqDq929BSx_A_D_M1n_a.php phcc-india.com typrat.club www.cem-hk.co # Reference: https://twitter.com/asset_island_/status/1031608741504933889 pldtdsll.net # Reference: https://twitter.com/0xffff08000/status/1031613343797207040 claudfx.win # Reference: https://twitter.com/pollo290987/status/1031544753505165312 http://191.101.42.43/fdgd/five/fre.php # Reference: https://twitter.com/James_inthe_box/status/1030579493910413312 acadaman.com dandoesinternet.com # Reference: https://twitter.com/James_inthe_box/status/1030487639688794115 kelvinarinze.ml scoverykingdom.gq # Reference: https://pastebin.com/UGm39pdU # Reference: https://pastebin.com/mgVvSRHi 002vt.tk/james/fre.php http://141.105.71.166/me/fre.php http://141.105.71.76/blz/fre.php http://151.80.162.219/marle/fre.php http://185.111.75.169/cart/disk/fre.php http://185.148.146.193/~agroinovate/zizisisi/Panel/five/fre.php http://185.206.144.81/lawi/fre.php http://185.24.233.254/donep/fre.php http://185.24.233.32/open/libs/fre.php http://185.24.233.46/dusx/busz/fre.php http://185.24.233.74/dusk/hond/fre.php http://185.24.233.79/baca/opio/fre.php http://185.24.233.80/pend/chan/fre.php http://188.215.229.41//GIS/fre.php http://191.101.42.43/fdgd/five/fre.php http://31.220.2.200/~hancockw/nok/five/fre.php http://31.220.2.200/~justicet/ag/five/fre.php http://5.206.226.99/juicy/fre.php http://80.211.102.126/deve/tide/fre.php http://84.38.132.105/oki/Panel/fre.php http://84.38.133.160/new/Panel/fre.php http://85.254.72.30/donbig/c1/fre.php http://89.187.86.7/~blackdia/new/mhoney/fre.php http://89.187.86.7/~blackdia/vic/bless/fre.php http://89.45.67.131/smg/fre.php http://89.45.67.145/emy/fre.php ace.alasrglobal.com/ace/Panel/five/fre.php ace.alasrglobal.com/skinny/Panel/five/fre.php ace.alasrglobal.com/wise/Panel/five/fre.php ackh.ir/gabi/five/fre.php ackh.ir/hamid/five/fre.php ackh.ir/papa/five/fre.php ackh.ir/sp/five/fre.php adrack.us/wp-content/uploads/five/fre.php ahmad52sell.cf/admin/five/fre.php alexamondwonderltd.com/freeBrow/fre.php alpacham.com/ndretr5478/fre.php anitoid.alasrglobal.com/austine/five/fre.php araslanow.net/js/Panel/five/fre.php araslanow.net/wipadmin/Panel/five/fre.php awele.duckdns.org:1717/zip/fre.php babasoft.ooo/fre.php bapican.com/image/admin/Panel/five/fre.php blackdiamondsco.ae/bossftown/fre.php blackdiamondsco.ae/rooney/fre.php blackdiamondsco.ae/wogor/fre.php blogsports.com.ng/cli/Panel/five/fre.php brighten2.alasrglobal.com/file/bell/five/fre.php brighten2.alasrglobal.com/file/tin/five/fre.php brighten2.alasrglobal.com/file/vas/five/fre.php brighten.alasrglobal.com/file/do/five/fre.php britlite.ga/fade/type/fre.php bsales.cf/bs/Panel/five/fre.php bsales.cf/ft/Panel/five/fre.php cityhotel.ge/believe/five/fre.php cityhotel.ge/focus/five/fre.php cityhotel.ge/rozay/five/fre.php colnoygums.com/freg/fre.php cytanets-com.cf/philip/panel/fre.php cytanets-com.cf/qwertyu/panel/fre.php dandoesinternet.com/cis1406/tutorial10/fre.php dandoesinternet.com/cis1407/fre.php dandoesinternet.com/mobile/ch1/fre.php devhaevents.us/2415452354/242424/fre.php dutch-tour-guide-marrakech.com/app/Panel/five/fre.php eastlandproduce.us/.well-known/acme-challenge/over/raw/fre.php eholes.viewyoursite.co.uk/LucianoLokiPanel/fre.php emakqroup.tk/obi/panel/fre.php emakqroup.tk/sim/panel/fre.php embramedica.com.br/site/wp-content/plugnis/fre.php emoticon.tk/hcode/kmaster/fre.php e-ne1.com/Hab-Lok/fre.php eurobike1.cf/obinna/fre.php familyhealths.ga/cdi-directory/five/fre.php fascine-cemdene.com/wp/wp-includes/js/js/five/fre.php fasterre.gq/hcode/bazon/fre.php fojidedar.com/bazz/fojide2/fre.php fojidedar.com/fojide/fre.php fojidedar.com/soft/amadin/fre.php fox-lighting.ga/poop/club/fre.php freecaps.ml/over/jump/fre.php fruitfulmonth.tk/raphael/fre.php geranntibankasi.com/getyoui980/jertyui989/fre.php haksenlimited.com/slim/fre.php hamon.ir/mate/five/fre.php highstarsino.cf/anyi/fre.php hkenngr.com/herty987/letry78/fre.php homeduderezort.com/includes/1010/fre.php homeduderezort.com/includes/gator/fre.php homeduderezort.com/includes/nas/fre.php homefieldtech.com/anu/five/fre.php homefieldtech.com/box/five/fre.php homefieldtech.com/juke/five/fre.php homefieldtech.com/mzx/five/fre.php homefieldtech.com/Obo/five/fre.php homefieldtech.com/uok/five/fre.php housded.cf/hcode/azuka/fre.php icannsorg.com/icann2/five/fre.php icannsorg.com/icann/five/fre.php incitecpivot-au.com/mertyui567/kertli879/fre.php inout-me.ml/fixx/sure/fre.php inquire.website/images/five/fre.php isnmainpasedal.com/amb/fre.php jamespanel.tk/cole/fre.php jamespanel.tk/low/five2/fre.php jamespanel.tk/odee/fre.php joxax.privatedocuments.site/jox/loki/fre.php jvl-jp.co/ser567/gotert/fre.php katherinajetter.com/vxzc/Panel/fre.php katherinajetter.com/xzcsadwqe23/fre.php khanapenaband.com/jon/fre.php lablocks.site/Panel/five/fre.php laloderkozam.com/laloder2/five/fre.php laloderkozam.com/laloder3/five/fre.php laloderkozam.com/laloder4/five/fre.php launchgrowthtoday.download/bobo22/Panel/five/fre.php launchgrowthtoday.download/choo/Panel/five/fre.php launchgrowthtoday.download/jamike/Panel/five/fre.php logsession.space/citycenter/fashion/trending/fre.php lovaniacreative.com/wp-admin/js/inc/Panel/five/fre.php madlovert.ml/swanky/wp-content/uploads/Panel/five/fre.php magic1.cf/gat/fre.php magic3.ml/gozie/fre.php marksky.org/medosky/fre.php msa-fit.gq/sql/Panel/five/fre.php mxchlp.com/team/wide/fre.php namesnetworks.com/blog/educational/fre.php nextlevelshop.info/woldpress/logistics/Panel/five/fre.php nextwaveconsulting.com.au/Cpanel/Panel/five/fre.php novachim.ro/plugins/editors/five/fre.php nutgetsloversplay.usa.cc/wp-content/themes/twentyfifteen/Panel/five/fre.php oajandassociates.com/images/oajand/Panel/five/fre.php officebase.website/js/five/fre.php ojoboplaza.club/Angel/Panel/five/fre.php ojoboplaza.club/Drama/Panel/five/fre.php ojoboplaza.club/Man/Panel/five/fre.php onlyadoonbit.com/asji/fre.php opercomex.co/billionaire/kendra/fre.php orkaden.com/wp-includes/Text/me/fre.php panelhq.cf/jr/five/fre.php panelhq.gq/airforce/five/fre.php panelhq.gq/chelsea/five/fre.php panelhq.gq/gold/five/fre.php panelhq.gq/stars/five/fre.php profirst.com.vn/aug777/five/fre.php profirst.com.vn/aug/five/fre.php ptads.ml/pide/seed/fre.php punjabjaogi.com/Panel/fre.php qureshioffice.alasrglobal.com/admin7/bgn/sfe/fre.php qureshioffice.alasrglobal.com/admin/xxx/zzz/fre.php qureshioffice.alasrglobal.com/sam1/xknf/kdlt/fre.php reachmy90s.com/includes/Panel/five/fre.php rozedaro.com/administrator/Panel/five/fre.php saintechelon.tk/fre.php sccoast.tk/logs/panel/fre.php sccoast.tk/phil/panel/fre.php schooolcode.download/uk8k/Panel/five/fre.php shaktiorkatimo.com/symboss/fre.php shinyei-co.gq/cade/dope/fre.php sinomagnetor3.cf/anyi/fre.php soolitaytangya.com/blessed/Panel/five/fre.php sternpid.ga/firm/fost/fre.php strcutform.com/vinye/Panel/five/fre.php strijdbladen.ga/donstan/five/fre.php swaz.hanirnail.net/five/fre.php szccf361.com/flinkas260/fre.php theonlygoodman.com/eig/fre.php theonlygoodman.com/nin/fre.php tondice.flu.cc/images./45skele/fre.php tondice.flu.cc/images./imgs01sg-/fre.php tradelink.qa/aug/five/fre.php tutorialdnsstep1.com/admin/fre.php tutorialdnsstep1.com/toturial/fre.php uzocloudservers.gq/jeff/five/fre.php veloceqlobal.net/rain/hope/fre.php victoralifts.com/wpss/fre.php wapsihonaylo.com/wapsi3/five/fre.php wapsihonaylo.com/wapsi4/five/fre.php wapsihonaylo.com/wapsi/five/fre.php wcegroups.com/done/hont/fre.php westiles.ga/lope/coop/fre.php wiglelamberfo.com/eme/fre.php constantialiquidators.com/freg/fre.php crownventureintl.com/wip-admin/Panel/five/fre.php gardensun.ru/daily/fre.php gardensun.ru/eca/fre.php mysticalreflections.life/web-content/web/upgrade/wp_obtain/log/Panel/five/fre.php netgateway.top/panel/fre.php scoverykingdom.gq/jeff/five/fre.php semaprin.info/mi/fre.php sierracontrol.ru/cmd11/fre.php sierracontrol.ru/vipu/fre.php woelpuu.com/hertuyi/teryio/fre.php woelpuu.com/terypp/youip/fre.php zealsale.com.np/file/Panel/five/fre.php xsftruss.ml/edunew/fre.php ymwsolutions.com/testfilez/fre.php nawck.ml mitch-portal.tk sintrol.cf sirmitch.ml # Reference: https://myonlinesecurity.co.uk/slightly-different-lokibot-delivery-via-embedded-ole-objects-in-rtf-word-doc/ kikehraeein.com/web-obtain/file/web/log/Panel/five/fre.php # Reference: https://twitter.com/DynamicAnalysis/status/1034488992987860995 apidava.tk # Reference: https://blog.talosintelligence.com/2018/08/threat-roundup-0824-0831.html szccf361.com # Reference: https://blog.talosintelligence.com/2018/08/threat-roundup-0817-0824.html 1113sophie.info 41230319.net cryptocoindigital.com kacakbahisfirmasi.com marryingmaldonado.com mywdn.com risu-nursery.com saurabh.online shiqiyingli.com sicknessfitness.com themonkeygrindervintage.com unsubchef.com win.link xn--vhq6e39ls7w.net zexpar.com # Reference: https://viriback.com/30-days-later-97-panels/ annamadums.ml/jazzy/PvqDq929BSx_A_D_M1n_a.php bellegin.ru/doncha10/pen.php bellegin.ru/don-cha11/pen.php bellegin.ru/oshok/pen.php bollingoes.ml/ngoes/PvqDq929BSx_A_D_M1n_a.php braithwalte.co.uk/blam/five/PvqDq929BSx_A_D_M1n_a.php braithwalte.co.uk/block/five/PvqDq929BSx_A_D_M1n_a.php braithwalte.co.uk/konvict/five/PvqDq929BSx_A_D_M1n_a.php braithwalte.co.uk/smith/five/PvqDq929BSx_A_D_M1n_a.php cadjetbums.ml/tbums/PvqDq929BSx_A_D_M1n_a.php domainsender.info/moon/five/PvqDq929BSx_A_D_M1n_a.php domainsender.info/sun/five/PvqDq929BSx_A_D_M1n_a.php dunysaki.ru/buch-x5/pen.php dunysaki.ru/doncha-2/pen.php dunysaki.ru/stephen/pen.php erintoba.info/bbbb/Panel/five/PvqDq929BSx_A_D_M1n_a.php eriousimen.ml/eriou/PvqDq929BSx_A_D_M1n_a.php finelets.ru/buch-x3/pen.php finelets.ru/buch-x4/pen.php finelets.ru/fankzu/pen.php gokuu.club/ckan/PvqDq929BSx_A_D_M1n_a.php gokuu.club/M/PvqDq929BSx_A_D_M1n_a.php joanread.ru/decap/pen.php joanread.ru/work-1/pen.php lidgeys.ru/buch-k/pen.php lidgeys.ru/buch-l/pen.php lidgeys.ru/buch-m/pen.php lidgeys.ru/buchX-1/pen.php lidgeys.ru/buch-x2/pen.php lidgeys.ru/eddy/pen.php papgon10.ru/davidm/pen.php papgon10.ru/don-12/pen.php papgon10.ru/don-one/pen.php papgon10.ru/kennyB-1/pen.php papgon10.ru/oshok-two/pen.php thousandan.ml/andan/PvqDq929BSx_A_D_M1n_a.php topreadz.ru/alexbe/pen.php topreadz.ru/doncha-3/pen.php topreadz.ru/willy-1/pen.php ultrainstinct.ru/file/exe/five/PvqDq929BSx_A_D_M1n_a.php unifarmex.net/Dstan/Panel/five/PvqDq929BSx_A_D_M1n_a.php unifarmex.net/hsp1/Panel/five/PvqDq929BSx_A_D_M1n_a.php unifarmex.net/nesto/Panel/five/PvqDq929BSx_A_D_M1n_a.php uy-akwaibom.ru/vinho/Panel/five/PvqDq929BSx_A_D_M1n_a.php vailablity.ml/vaila/PvqDq929BSx_A_D_M1n_a.php viettrust-vn.net/samii/PvqDq929BSx_A_D_M1n_a.php vopspyder.website/home/five/PvqDq929BSx_A_D_M1n_a.php vopspyder.website/log/five/PvqDq929BSx_A_D_M1n_a.php wheelonexs.ml/wheel/PvqDq929BSx_A_D_M1n_a.php # Reference: https://github.com/stamparm/maltrail/pull/284#issuecomment-417861246 ajmanz.gq # Reference: https://twitter.com/DynamicAnalysis/status/1037472184636256256 theonlygoodman.com/fit/fre.php # Reference: https://twitter.com/nullcookies/status/1038235674565066757 crasemerzom.com # Reference: https://twitter.com/avman1995/status/1038285919219068928 http://99.198.127.106 blackdiamondsco.ae/test/fre.php # Reference: https://twitter.com/ViriBack/status/983011333506588672 # Reference: https://pastebin.com/nwWHHFe0 bartolini-system.net/loop/PvqDq929BSx_A_D_M1n_a.php logs.boxxta.website/ikol/five/PvqDq929BSx_A_D_M1n_a.php # Reference: https://blog.talosintelligence.com/2018/09/threat-roundup-0907-0914.html (Win.Dropper.Hploki-6682476-0) bvasetro.com com-logninsauthorize.info grm-group.info healinggoodness.com losmejorescrm.com mechakawaii.com mytechnik-beratung.com ptt-test.com testci20170903033002.net thlg8.com vintageontheline.com # Reference: https://pastebin.com/bEqJKZfZ strutitinca.ro/ftp/fre.php zenshinonline.ru/amb/fre.php zenshinonline.ru/eka/fre.php zenshinonline.ru/file/fre.php # Reference: https://www.maltiverse.com/sample/1ea139164e3525a5a4f3feb333551a806852cca40e49698fbf65d49bd4f7c27c loggerkeys-hosting.xyz # Reference: https://www.maltiverse.com/sample/16d06c604487ad96b04f226827dc033d61c80b345a323faee5c9d4a0b2a108d0 tananaislanoidd.ga # Reference: http://cybercrime-tracker.net/index.php?search=Lokibot corelis.group zenshinonline.ru harltdoors.com devhaevents.us grace4good.cf theonlygoodman.com premierevents.co.zw # Reference: https://twitter.com/ViriBack/status/1046391838448537601 # Reference: https://pastebin.com/4QRaU8T7 geranntibankasi.com/slowkizzy567/kertyui456/PvqDq929BSx_A_D_M1n_a.php hkenngr.com/herty987/letry78/PvqDq929BSx_A_D_M1n_a.php incitecpivot-au.com/dertyu987/treyuo9809/PvqDq929BSx_A_D_M1n_a.php incitecpivot-au.com/lerty67/loivet56/PvqDq929BSx_A_D_M1n_a.php incitecpivot-au.com/mertyui567/kertli879/PvqDq929BSx_A_D_M1n_a.php insightthk.com/hermonth/jerk/PvqDq929BSx_A_D_M1n_a.php insightthk.com/loki2/PvqDq929BSx_A_D_M1n_a.php insightthk.com/loki3/PvqDq929BSx_A_D_M1n_a.php jvl-jp.co/gert67/teryu7/PvqDq929BSx_A_D_M1n_a.php jvl-jp.co/nwokorie45777/fertyuoui/PvqDq929BSx_A_D_M1n_a.php jvl-jp.co/sert67/tyuio98/PvqDq929BSx_A_D_M1n_a.php jvl-jp.co/sertyoup/latinoper90/PvqDq929BSx_A_D_M1n_a.php jvl-jp.co/slamp89/ketu56/PvqDq929BSx_A_D_M1n_a.php kaokao-twn.com/yerter/getyu/PvqDq929BSx_A_D_M1n_a.php karenandkarren.com/multi980/mertyui989/PvqDq929BSx_A_D_M1n_a.php kurarray.com/fertyuio/lopiytu/PvqDq929BSx_A_D_M1n_a.php kurarray.com/loptyuier/liouy56/PvqDq929BSx_A_D_M1n_a.php kurarray.com/loptyuio/lop0980/PvqDq929BSx_A_D_M1n_a.php ledteroptyi.xyz/gertyu99/ertyu8/PvqDq929BSx_A_D_M1n_a.php ledteroptyi.xyz/hertyuu89/menter67/PvqDq929BSx_A_D_M1n_a.php ledteroptyi.xyz/kertyu767/jertyu657/PvqDq929BSx_A_D_M1n_a.php ledteroptyi.xyz/loipter/teryuop999/PvqDq929BSx_A_D_M1n_a.php lltagrain.com/cash2/PvqDq929BSx_A_D_M1n_a.php lltagrain.com/kelle/PvqDq929BSx_A_D_M1n_a.php lltagrain.com/money/PvqDq929BSx_A_D_M1n_a.php lltagrain.com/tino/PvqDq929BSx_A_D_M1n_a.php oceanlinkmarrine.com/loki2/PvqDq929BSx_A_D_M1n_a.php oceanlinkmarrine.com/loki4/PvqDq929BSx_A_D_M1n_a.php oliverrbatlle.com/setyi98/etruo89/PvqDq929BSx_A_D_M1n_a.php phcc-india.com/dertyuop345/teryup234/PvqDq929BSx_A_D_M1n_a.php phcc-india.com/limitedmert/menter567/PvqDq929BSx_A_D_M1n_a.php phcc-india.com/nertyoiu67/eartyuoiyue67/PvqDq929BSx_A_D_M1n_a.php phcc-india.com/slamptiert5/fertyupw456/PvqDq929BSx_A_D_M1n_a.php phcc-india.com/startboi89234/netwer675/PvqDq929BSx_A_D_M1n_a.php pldtdsll.net/betstyui789/erty6786/PvqDq929BSx_A_D_M1n_a.php pldtdsll.net/fishyoiu/fishtery77/PvqDq929BSx_A_D_M1n_a.php pldtdsll.net/sertyu45/teryu34/PvqDq929BSx_A_D_M1n_a.php redsseammgt.com/loki5/PvqDq929BSx_A_D_M1n_a.php rmsalf.com/hertioyu567/lertu789/PvqDq929BSx_A_D_M1n_a.php rmsalf.com/mentiyu98/letluy78/PvqDq929BSx_A_D_M1n_a.php sertencee.xyz/kogilop/yopuit77/PvqDq929BSx_A_D_M1n_a.php sertencee.xyz/shakamally/loipy67/PvqDq929BSx_A_D_M1n_a.php siyaghasourccing.com/lokily89/werty6789/PvqDq929BSx_A_D_M1n_a.php siyaghasourccing.com/smello/ertyop009/PvqDq929BSx_A_D_M1n_a.php dersertlord.xyz/loki4/PvqDq929BSx_A_D_M1n_a.php dersertlord.xyz/loki5/PvqDq929BSx_A_D_M1n_a.php sertencee.xyz/shunshuo/terrampeedar/PvqDq929BSx_A_D_M1n_a.php siyaghasourccing.com/serto99/jerty45/PvqDq929BSx_A_D_M1n_a.php siyaghasourccing.com/sertoiu/fertuiop/PvqDq929BSx_A_D_M1n_a.php slompbit.xyz/lopitre87/teryuio09/PvqDq929BSx_A_D_M1n_a.php slompbit.xyz/lopityrety/kerterty/PvqDq929BSx_A_D_M1n_a.php woelpuu.com/hertuyi/teryio/PvqDq929BSx_A_D_M1n_a.php woelpuu.com/terypp/youip/PvqDq929BSx_A_D_M1n_a.php # Reference: https://isc.sans.edu/forums/diary/More+malspam+pushing+Lokibot/23754/ oceanlinkmarrine.com/loki1/fre.php oceanlinkmarrine.com/loki2/fre.php oceanlinkmarrine.com/loki3/fre.php oceanlinkmarrine.com/loki4/fre.php oceanlinkmarrine.com/loki5/fre.php # Reference: https://twitter.com/avman1995/status/1046751735971282944 nisol.ga/chika/fre.php # Reference: https://pastebin.com/AasLyArF monochromestr.site/fbm/encode.php # Reference: https://twitter.com/avman1995/status/1052426452187185153 octone.igg.biz/chri1/cgi.php # Reference: https://app.any.run/tasks/4515e611-f351-436b-982a-72229c1a1853 hmcrogenics.com # Reference: https://twitter.com/dvk01uk/status/1097767868874264576 /LL0/200g-xz/cat.php # Reference: https://twitter.com/dvk01uk/status/1097357708246896640 /kston/link.php # Reference: https://twitter.com/Securityinbits/status/1090893221754884100 /scott/link.php # Reference: https://twitter.com/Racco42/status/1027476386808848384 maxthon.duckdns.org sockets.duckdns.org # Reference: https://twitter.com/ps66uk/status/1062658307507273733 /sgbbu2/cat.php # Reference: https://twitter.com/illegalFawn/status/1113086451233755136 alexiwobi.ga dandyla1.ga # Reference: https://twitter.com/luc4m/status/1103214408682139648 aurelio.xyz # Reference: https://twitter.com/0_1_0_1_0_0_0_0/status/1116638803475746816 camopionari.cf dankasa.tk olododo.tk sweetreuyh.tk underneat.gq yriuiuteuieu.gq # Reference: https://twitter.com/pancak3lullz/status/1121057197914509312 /cka2/cat.php # Reference: https://twitter.com/JAMESWT_MHT/status/1134360866550439936 /m/2/cat.php # Reference: https://twitter.com/JayTHL/status/1124325778685087745 /lmark/atz/link.php # Reference: https://any.run/report/0159364dc4a13deea8595d019b3c1e44ca100690b3d7f2df7d79cfd86d4b36ce/03c9c9b6-a7fc-41fc-a6d1-6f35ec60f94a romelulukaku.tk/anyi/fre.php # Reference: https://any.run/report/ff2824a9281b5e0ecd4b90b7779a66dfa4453b143b1115e4a9019a2f859083e0/b6a22489-c558-44f8-92b7-c6f90b8c0920 liverfook.ml/tuneshi/fre.php # Reference: https://twitter.com/ViriBack/status/1134662952898965504 # Reference: https://pastebin.com/pkZ0TBnc beautynams.com begurtyut.info flmates.com hyoki-jp.top # Reference: http://tracker.viriback.com/ (# Lokibot) bridgecornenterprises.com doosantax.com unimasa.icu # Reference: https://www.virustotal.com/gui/ip-address/185.79.156.24/relations http://185.79.156.24 # Reference: https://twitter.com/P3pperP0tts/status/1135824585885196288 leorentacars.com # Reference: https://twitter.com/JAMESWT_MHT/status/1136248211654545408 gadujez.tk # Reference: https://connect.security.ibm.com/app/threat-intelligence-insights/report/url/lethatch.se%2Fnelpa%2Ffive%2Ffre.php lethatch.se # Reference: https://connect.security.ibm.com/app/threat-intelligence-insights/report/url/technosevregroup.com%2Fzxd%2Fpanel%2Ffre.php technosevregroup.com # Reference: https://github.com/runvirus/LokiPWS/blob/master/README.md offset7.com # Reference: https://twitter.com/James_inthe_box/status/1136674160862609408 execuitiveship.com # Reference: https://twitter.com/dvk01uk/status/1137999393158770688 exalumnosldea.cl # Reference: https://twitter.com/dms1899/status/1138742747773460482 mbh-co-uk.ml sas-agri.ml # Reference: https://twitter.com/dvk01uk/status/1138774057606926341 fantasticpipo.club # Reference: https://twitter.com/dvk01uk/status/1138775767171698690 ezigbo-mmadu.xyz # Reference: https://twitter.com/James_inthe_box/status/1138815213640114176 http://45.67.14.154 http://185.79.156.24 # Reference: https://twitter.com/dvk01uk/status/1139485923991785473 uehsjtsjksf.tk # Reference: https://twitter.com/dvk01uk/status/1139494526307975168 fraiser-campbell.ga # Reference: https://twitter.com/pancak3lullz/status/1139534936518594561 freecapes.com # Reference: https://twitter.com/JAMESWT_MHT/status/1140603897523949568 /kas/4/cat.php # Reference: https://twitter.com/dvk01uk/status/1140936638148820995 sparkickwears.ga # Reference: https://twitter.com/blackorbird/status/1141557021000552448 fileshareing.tk # Reference: https://twitter.com/x42x5a/status/1141970343818665984 007akin.top # Reference: https://twitter.com/Racco42/status/1141969102753423360 bichchats.top # Reference: https://twitter.com/Racco42/status/1143810986920599553 saculcin.top # Reference: https://twitter.com/x42x5a/status/1143895404527988736 tqe2009.com # Reference: https://twitter.com/dvk01uk/status/1144811922715549696 lionelibrahimovich.tk # Reference: https://twitter.com/dvk01uk/status/1146410395357339649 ayakkokulari.com # Reference: https://twitter.com/killamjr/status/1147113714132275200 openningsoonming.zapto.org # Reference: https://twitter.com/_odisseus/status/988303327090937857 # Reference: https://app.any.run/tasks/20ed9962-0799-4f3b-bfbf-6dd77e5b9979/ i876edw4e5f6tg78hy9tg7r6ftgiy8.erlivia.ltd # Reference: https://twitter.com/smica83/status/1149194882231209985 mbixch.site # Reference: https://twitter.com/Racco42/status/1149662812722978816 aliiff.com villaviras.com # Reference: https://twitter.com/hexlax/status/1149768235434352645 automatia.in lestonline.ga taleohio.ga # Reference: https://twitter.com/Paladin3161/status/1149639116125921284 kitchenraja.com # Reference: https://twitter.com/hexlax/status/1150113306545467393 bioconscolors.com # Reference: https://twitter.com/James_inthe_box/status/1151156619733921792 wupx.ga # Reference: https://twitter.com/reecdeep/status/1151737917259354113 ysvina-vn.com # Reference: https://app.any.run/tasks/69193d3f-ffe6-4db8-ba64-b408caeffde0 hotkey--cn.com # Reference: https://twitter.com/coderippers/status/1152188547253846016 orientsdelivery.xyz # Reference: https://twitter.com/reecdeep/status/1145960074046791680 eko-colors-pl.com # Reference: https://twitter.com/IdoNaor1/status/1152892001844629505 abulutari.tk # Reference: https://twitter.com/reecdeep/status/1153195564852547585 # Reference: https://app.any.run/tasks/4574a922-fd08-4230-ac49-59315b0702d5/ matbin.com # Reference: https://twitter.com/blackorbird/status/1155781572718546944 sparkickwears.ga # Reference: https://twitter.com/James_inthe_box/status/1155945383048011777 pitr0s.com # Reference: https://twitter.com/reecdeep/status/1157201656397860865 hochom-tw.com # Reference: https://twitter.com/Racco42/status/1157215058319040512 maviiletisim-com.tk # Reference: https://twitter.com/Racco42/status/1158765032299270144 kusumgar.cf # Reference: https://twitter.com/reecdeep/status/1158984342108090369 monastaybags.com # Reference: https://twitter.com/reecdeep/status/1159008913691435008 hilbizworld.top # Reference: https://twitter.com/reecdeep/status/1159438247208075264 hotkey--cn.com # Reference: https://twitter.com/reecdeep/status/1159446926196183045 teslaghane.com # Reference: https://twitter.com/reecdeep/status/1159833486817034241 sovamegroup.com # Reference: https://twitter.com/Paladin3161/status/1159984272897216513 quecik.info # Reference: https://twitter.com/reecdeep/status/1161226121515544576 sportyclik.com # Reference: https://twitter.com/reecdeep/status/1161220049413246977 sun-clear.net # Reference: https://twitter.com/reecdeep/status/1164074211213807616 confirm3.pw # Reference: https://any.run/report/a234966b36ea3816665501b926ef6fe22f4e8ba90a80af0f66662c4cd4dba915/6a5e8f49-5529-4f67-a457-eab7a3f1635e scanchart-rny.com # Reference: https://any.run/report/49e77f3fa26d7427bc726783325c2729c666038e0c4546c87e5678adcadaa4a8/8c88a7b4-fac6-494f-aba2-142d845136a2 cbnid.net # Reference: https://twitter.com/DynamicAnalysis/status/1168991384457699329 clotiahs.info jiraiya.info zjvvymy.com # Reference: https://twitter.com/reecdeep/status/1169151595747127296 modcloudserver.eu # Reference: https://twitter.com/Mesiagh/status/1170048273366695936 # Reference: https://pastebin.com/kMXDsSNr 171.15.198.199:1443 # Reference: https://app.any.run/tasks/bf013836-f219-494b-a54b-e25c13a7a400/ ottappalam.com # Reference: https://www.fortinet.com/blog/threat-research/new-infostealer-attack-uses-lokibot.html palikyu.ml # Reference: https://twitter.com/reecdeep/status/1173492999457841154 mapsi-shipping.xyz # Reference: https://twitter.com/dvk01uk/status/1173464780159508480 svmarketingindia.com # Reference: https://twitter.com/Racco42/status/1173547031979278336 clotiahs.info # Reference: https://app.any.run/tasks/84841357-56f4-4d71-9f7b-4e5dde21edf7/ nucsquaremall.ga http://nucsquaremall.ga/~zadmin/lmark/ch/link.php # Reference: https://twitter.com/ninoseki/status/1175189790469189632 fatmazpharmc.com # Reference: https://app.any.run/tasks/6ecd4749-affb-4505-8b95-bd307a609be8/ handrass.co.rs/don/five/fre.php # Reference: https://any.run/report/397217271ce8684d24144b1eb612d6d45921573bb8cdd0e53fae1d44d2456a64/ff14e78f-0c45-45b0-b93e-8170121cc7de kaokao-twn.com # Reference: https://any.run/report/91628bad8c6b90dd333f850db85dcc2c313dbbccd84ecae45441b72c2a09603d/aba660a1-69bc-4f44-bc21-c962997baf13 barzaker1.tk # Reference: https://any.run/report/a2c93eb56dd983d63654dbbd82ee2967d1acb50f4fcd700ab3dfb7743fe64e9a/36fcc660-a97e-491f-9b05-af099620ac4c gruputsk.com # Reference: https://any.run/report/30e5e29f2e4e69e88032805b3cdfd8e86e48f6837a375f096263b86f9fe4de01/b5efffc2-b5b6-4e87-9958-4ab0e7c23db3 opercomex.co/php/webpanel/fre.php # Reference: https://any.run/report/c407bb7c069e983d20752c582476ab1606b4947724194f949ba90eefe9e05a24/9012e28b-9667-4070-9751-b3f2ef211d50 ponsse.site # Reference: https://any.run/report/050c206340ce8ea775797da9d55a250e488174d87d9529fb25db13a07168c471/8c33a2a5-51af-4547-bdb7-d5a3b93ea4c4 barzaker1.cf # Reference: https://any.run/report/1c0f62f0277289f74ffd1f03f5097f17a1e14494c4c612ed30aa2a9899759d3a/d4d20c0c-7aa3-449b-b365-8b2b9e243050 dtolnba.tk # Reference: https://any.run/report/78de464e43327ba4f9ef245c72e26b28e1fbd5175bccd15253fde852bd1eb61d/1a751b0b-e75f-4b67-829c-de5f1a86a932 megatradeinvestment.com # Reference: https://any.run/report/7e6b471d1fe43841b1c995df98e2feede05280d251f50fcf6b6f084ae902817a/9fd319fa-3e9d-4d15-8837-9b2d08fe6b8e 185.234.216.240/0x22/loki/fre.php # Reference: https://any.run/report/8897b096fa6661307bb3d2d97df155b2a4d673ee4e2e50ee37de23179a79afa6/e73a0ccf-14b0-4445-a00c-84076510d095 panelego018.info # Reference: https://any.run/report/7c7d40b6e024d074acb2aa9b21e60e5a2e132424cdd4f23432013cfadc368392/88ea1ed2-25ac-4786-86dc-a052020f6b2d 62.108.37.205/jeff/five/fre.php # Reference: https://any.run/report/af51d7d35c70e8572b1bf1bf7cac2f9c79da70920e972f5df338bd34b7908b51/17cb8efa-8ccb-4ccf-9e71-ca9cb30be138 jaobhaezrasam.com # Reference: https://any.run/report/da8cb79eb0b11f4c7e18890217c465afe508900d4d0fe029df10a08d7f50722e/28736ba8-2474-4fe3-9e7d-766ff32819f5 twosisterswine.com.au/admin/Panel/five/fre.php # Reference: https://any.run/report/856cfd8e4168c08f6382cc6a7a94f2812d40d09e4b5a17728f142c5bf1d7b892/76cc0b7e-1668-4fea-92db-47ce9f0e2d82 gracetime.tech # Reference: https://twitter.com/P3pperP0tts/status/1179292959172370433 onlygoodm.com # Reference: https://app.any.run/tasks/2bd648b0-c9cd-45a1-ac4b-3c253c2c01aa/ peaches19.com # Reference: https://twitter.com/Racco42/status/983258396664229888 ritsuninfra.in # Reference: https://twitter.com/smica83/status/1184381866243248128 cvnty.tk # Reference: https://twitter.com/hexlax/status/1184471439476441088 cvnty.cf ggvxt.ga mbfqg.cf mlzxvi.tk prxtz.gq prztz.ga qvukl.ga qvukl.gq qvukl.tk # Reference: https://app.any.run/tasks/9b5e5e7f-ac71-484e-8dad-0d0af3bfe73b/ atritei.icu # Reference: https://app.any.run/tasks/856e216f-c979-450a-a0b7-b9dbc6ab1361/ torresansrl-it.com # Reference: https://app.any.run/tasks/abd716d5-3267-4aec-b4e5-075b0f4ddf0a/ baiksan-kr.com # Reference: https://app.any.run/tasks/2c80bfce-a4a7-4024-b943-39d4fa8e0a01/ yanchenghengxin.com corpcougar.com # Reference: https://app.any.run/tasks/2c93099b-2751-41c4-a764-f8d66dcf727d/ kaburto.info # Reference: https://app.any.run/tasks/ff303a56-d3f6-4128-8876-1c91d4d7494e/ yanchenghengxin.com # Reference: https://app.any.run/tasks/f1e17f2a-00bc-4eeb-b5be-2d10c735ed9e/ tps-finlogistics.com # Reference: https://app.any.run/tasks/f09ecafa-3e69-4171-bd36-c415c5e5f0e0/ # Reference: https://twitter.com/P3pperP0tts/status/1185592600528637952 fueda.info # Reference: https://app.any.run/tasks/9eaf57e9-015a-4357-b0f8-fe30df9c9be7/ cvnty.tk # Reference: https://app.any.run/tasks/e1756c8b-3175-4232-a4ca-9818a8ac27e6/ john-donnelly.co.uk # Reference: https://app.any.run/tasks/3318e0f8-d5e7-4316-b748-b83cc506aaf9/ danagupal.com # Reference: https://app.any.run/tasks/69ce4ecc-f88e-4523-a568-6b6a79491855/ simantramart.net # Reference: https://twitter.com/James_inthe_box/status/1185191156168065024 nvent.icu # Reference: https://blog.talosintelligence.com/2019/10/threat-roundup-1011-1018.html (# Win.Trojan.Lokibot-7288215-1) arkhesol.info lapphuongshoe.com majidfathalibeygi.com novinsazvar.com orientsdelivery.xyz pliykies8.net suksez-ab.com versuvius.ru # Reference: https://twitter.com/P3pperP0tts/status/1186987811553067009 sylvaclouds.eu # Reference: https://twitter.com/Paladin3161/status/1187160642815291392 mikeservers.eu # Reference: https://pastebin.com/29uSdMAk atritei.icu dadatiles.com.au gracetime.tech jajar.ru modatie.gq nonomonojolipoiubtrewert.tk tahetah.ir # Reference: https://twitter.com/P3pperP0tts/status/1190724582359089152 kaburto.info # Reference: https://twitter.com/wwp96/status/1191009866720124928 conceriavictoria-it.com # Reference: https://twitter.com/wwp96/status/1191009400015802368 beautynams.com # Reference: https://twitter.com/James_inthe_box/status/1191325755084435457 allaige-global.com # Reference: https://twitter.com/wwp96/status/1191408876303896576 cyttec.de # Reference: http://tracker.viriback.com/dump.php (# 2019-11-04, Lokibot) http://104.168.248.212 http://178.159.7.9 http://185.189.112.158 http://185.79.156.15 http://185.79.156.24 http://37.120.146.126 http://45.67.14.181 http://51.68.128.171 http://94.100.28.214 http://23.95.228.37 http://5.252.192.117 007akin.top 013nat.net 2lcfo.com 4thave.co.uk 9th-way.tech abbasuit.top abifph.com acptw.icu adamsjef.top aerosport.tech aljust.website allstarbelts.com andalemexico.com apollocapitalp.com baiksan-kr.com baklaysinc.com bakrakhada.com bamastra.top beancart9.top beatfile3.top beautynams.com begurtyut.info bichchats.top bigshowinc.co.uk biocodax.com bluecornerblog.tk bosal.tech bp10.webhosting123.icu bridgecornenterprises.com broomingkingpoiuty.tk bteenerji.com buildingwiring.ir bylima.icu cbnid.net cleaf.ml clotiahs.info cnedriect.com cocshipmanagment.com confirm2.pw confirm3.pw coolking-tw.com corpcougar.com corpcougar.in cosmoi098.ga cosmoi098.ml cremeroloe.com crippoloiutustrope.tk cvnty.ga diplomatgroup.org doosantax.com ebslaradio.cl efore.info eko-colors-pl.com eko-logistics.com emiliano-sala.ga enchapa.info esplanademauritius.com execuitiveship.com exsimpetroleum.com extrememx.net exwelloilfleld.com ezigbo-mmadu.xyz famoosonutt.com fantasticpipo.club fileshareing.tk filmmagapp.ir flmates.com florence-malouda.ml florence-malouda.tk forexdispatch.info fredwi.top freecapes.com freecaps4.ml freewhcm.top frenchman.icu fueda.info gama247.beget.tech giftedhands-association.com gihf2.com goldenfashiondeeds.com gooinnhtrr.ml goriaya.com gregvictor.co.uk groz-toolz.com gtigtex.info habertjohnson.top halwaja.com higomanga.info hotblowup.com hpygol-acm.com hyoki-jp.top iiranair.com iranssp.ir ivandarina.top jayconnect.co.uk jbrightbuilders.sytes.net jhpipaa.com jonjoshelvey.gq jttomwest.top kaburto.info kachi.cf kalafyn10.tk kin3p.co.uk kitchenraja.com kratheinz.com lapphuongshoe.com ledomainedesalizees.com logfert.com lovingu1.top lronman4x4.com mairon-hk.com makopolos.com manchester-derby.ga manchesterderby.gq manchesterderby.tk maritlme-net.com matbin.com mbh-co-uk.ml mbta.com.ng mhydraulics.net mizunogolfbags.com modcloudserver.eu monastaybags.com morganans.co.uk newwoldassem.top nexmarket.ir nkegi.com oasisvillasmaurice.com ofoleteadms.icu oldendroff.com orientsdelivery.xyz palacegrades.com perigon-no.com pouruinhgtrewzip.tk qkinz.tech qoqip.com quelmax.com quurieun.top rasavision.ir razaacademy.info ritedi.icu rnuganbank.com rtjf.ga saliyumakan.club scm-hk.com season1.icu sghecc.com shakekur.top shalets23.com sherwoodpest.com sibarzz.xyz siiigroup.com slimcase247.se smarytie.ir smilesbyme.com smithtony.co.uk sparkickwears.ga spidook.bid spuerinirominfo.tk stedmanpharrna.com stephero7.ml sucalcin.top sun-clear.net sunvim.cf sylvaclouds.eu telcel.tech thaeed.ir thammyvienanthea.com tienaris.com tjfr.tk tmjchange.com tourscentralasian.com tqe2009.com tradesecretsgiveandtake.ca treatascholars.com trietrre.ml unimasa.icu uzocoms.eu vastinopulotiste.tk vbih.tk venresf.ml vibecore20.top vicomdistribucion.top villaviras.com vinaprio.com vteach.com.sg wieiland.com wilfred.top willhelmsen.com wohinqfood.com yuxinproteins.com # Reference: https://twitter.com/P3pperP0tts/status/1191999299061780480 http://151.80.3.78 # Reference: https://www.virustotal.com/gui/file/df3f26fa52e1d59ae86f3e4e3e0811ff0beb10f2588dcc5372130e93fc007908/behavior/Dr.Web%20vxCube arctech--vn.com # Reference: https://www.virustotal.com/gui/file/6979ee74e6d3dfcdaf0e146faa063d70659b56cfda034d46f6a611af58a71f70/behavior/Dr.Web%20vxCube beautynams.com # Reference: https://twitter.com/P3pperP0tts/status/1192710961641205760 http://51.81.26.73 # Reference: https://www.virustotal.com/gui/file/68a511a096b68f00f40d77b497122a0da58132ec86d565a7e314452fe18b8321/behavior/Dr.Web%20vxCube kenturkeymanians.org # Reference: https://twitter.com/P3pperP0tts/status/1192809962268962818 backbaymall.ga nucsquaremall.ga # Reference: https://www.group-ib.com/blog/fakesecurity chuxagama.com umbra-diego.com # Reference: https://twitter.com/P3pperP0tts/status/1193844698370236416 http://157.52.211.11 # Reference: https://twitter.com/wwp96/status/1193942503864651776 efore.info # Reference: https://app.any.run/tasks/205df181-d1c5-4315-80b2-5456b6bfeef2/ arctech--vn.com # Reference: https://twitter.com/wwp96/status/1194325495686586370 pointqrace.com # Reference: https://twitter.com/P3pperP0tts/status/1194590128129421313 http://37.187.207.221 # Reference: https://twitter.com/P3pperP0tts/status/1194761250078699520 nvent.icu # Reference: https://twitter.com/P3pperP0tts/status/1194979247124860929 http://51.75.33.88 # Reference: https://twitter.com/JayTHL/status/1194992844039229441 onllygoodam.com # Reference: https://twitter.com/James_inthe_box/status/982003272562044928 # Reference: https://app.any.run/tasks/0893ab89-f685-40ae-bddc-83699013c804/ hydeoutent.com # Reference: https://twitter.com/Racco42/status/1196407632598310918 s-plt.club s-top.xyz # Reference: https://twitter.com/wwp96/status/1196472338960793603 gelcursot.top # Reference: https://app.any.run/tasks/30e58965-3657-457d-8aba-cf857b1ae756/ junquam.com # Reference: https://app.any.run/tasks/1dc0b30d-1713-41f3-a0f0-a98240ba9824/ onllygoodam.com # Reference: https://app.any.run/tasks/60951b2e-aac7-46b6-be01-214e104282f2/ matbin.com # Reference: https://twitter.com/wwp96/status/1196877315726135296 s-top.xyz # Reference: https://twitter.com/wwp96/status/1196870261016059905 http://46.21.147.94 # Reference: https://www.fortinet.com/blog/threat-research/custom-packer-tool-frenchy.html # Reference: https://otx.alienvault.com/pulse/5dd565d5cd733b662f366526 alphastand.top alphastand.trade alphastand.win kbfvzoboss.bid sun-clear.net # Reference: https://twitter.com/P3pperP0tts/status/1197683883627700229 http://51.91.175.183 # Reference: https://twitter.com/JayTHL/status/1197922402828791808 findmypractice.org # Reference: https://pastebin.com/a3tLkeSU http://107.175.150.73 # Reference: https://app.any.run/tasks/2b37b818-369c-4c5c-a7af-fc7d20958920/ ray-den.xyz # Reference: https://www.virustotal.com/gui/file/6b6ff1efd1dd41901c9c23dfd6d03ff6c1f6d846bf8ac8002b3af61744426e11/detection lethatch.se # Reference: https://app.any.run/tasks/216903ba-ad00-4e4b-8606-d329e1e8772e/ arctech--vn.com # Reference: https://any.run/malware-trends/lokibot (Note: as seen on 2019-12-04) worldatdoor.in kitchenraja.in gsuitekh.com avertonbullk.com offsolo-gbb.tech 1justfy.pw l1n3n.site elettroveneta-it.com ddos.dnsnb8.net smtp.siqanalytical.com adonis-medicine.at # Reference: https://twitter.com/wwp96/status/1202265059784835072 chennaiequipment.com # Reference: https://pastebin.com/ghh2y3g3 kargozar1320.ir # Reference: https://twitter.com/wwp96/status/1203005552248397824 gblasta.pw # Reference: https://pastebin.com/7Ak2nP2T awba-groups.com indextechno.com pms-center.com # Reference: https://blog.talosintelligence.com/2019/12/threat-roundup-1129-1206.html (# Win.Trojan.LokiBot-7420275-1) betaflexllc.us beyondlogx.com kontrolreport.com oscontinental.online phoenixdevs.ir porno322.com protestlabsmovings.es secure-n2.top # Reference: https://pastebin.com/B6EDa5x0 jb-qroups.com logboxreports.top # Reference: https://twitter.com/HeavyMetalAdmin/status/1204108254588080128 woobwoo.cf # Reference: https://twitter.com/wwp96/status/1204430643800793088 woobwoo.ga # Reference: https://twitter.com/wwp96/status/1204789643138473985 s-pod.xyz # Reference: https://twitter.com/wwp96/status/1204805860129755141 kyant4.com # Reference: https://www.virustotal.com/gui/file/1e191a6f8c36095e7a3c06d70086d82886447dab7119f1adb84ee321700dd7eb/detection lkpswrd.cf # Reference: https://www.virustotal.com/gui/file/994744f9be120c63c7d5819f9b9bd3fb43e19efc59b95d0153aa64adf6cc8d6c/detection sentab.tk # Reference: https://www.virustotal.com/gui/file/b939020a31f8ef30fd78bbb487469c72f61a857f699b689628a332fbedbf9959/detection lkpswrd.ml # Reference: https://twitter.com/James_inthe_box/status/1206952335764795392 onlygoood.com # Reference: https://twitter.com/smica83/status/1209204228696227840 gcirsa.com # Reference: https://twitter.com/wwp96/status/1214568832016142337 gquare.gq # Reference: https://pastebin.com/Q6Sn446k roryaftamart.duckdns.org # Reference: https://twitter.com/wwp96/status/1214932312401600512 gquare.tk # Reference: https://twitter.com/wwp96/status/1214940445530345472 egobetter.xyz # Reference: https://app.any.run/tasks/90588195-450b-42b2-be93-65b97da7a2a0 gainflows.gq # Reference: https://twitter.com/Racco42/status/1215312968348467200 cypress-tw.com # Reference: https://twitter.com/Racco42/status/1215570689379524608 ptiihk.com # Reference: https://twitter.com/Racco42/status/1214124427602022400 zni1.com # Reference: https://twitter.com/P3pperP0tts/status/1215705099776987138 onlygoodem.com # Reference: https://app.any.run/tasks/73a7b555-6bef-4aae-98a2-2dc6a5df6fda/ tranpip.com # Reference: https://twitter.com/P3pperP0tts/status/1216852518640259073 noithathoanggia.net.vn # Reference: https://app.any.run/tasks/8d60b414-aed6-4dba-80ca-f3d1b2f7556e/ allenservice.ga # Reference: https://app.any.run/tasks/6d4f51ab-0149-4b7b-b43c-d55f7c7a046e/ tbt-sceitech.com # Reference: https://twitter.com/malware_traffic/status/1217858107289866240 himkon.ga # Reference: https://twitter.com/wwp96/status/1218227068896514051 afas-kr.com # Reference: https://app.any.run/tasks/aa120a9f-7889-492b-9695-2b9c32c7a5fe/ oaa-my.com # Reference: https://twitter.com/wwp96/status/1219361313735966721 agrabahd.ga # Reference: https://twitter.com/wwp96/status/1219363482031861760 mecharnise.ir # Reference: https://app.any.run/tasks/610b93f9-38f4-466f-a46e-f0dfbc750a1b/ chol.cc # Reference: https://app.any.run/tasks/891ac638-b067-42b0-bf51-6120998204a9/ # Reference: https://app.any.run/tasks/7efd4037-e819-4b05-9dc5-c0baadcc7bb6/ http://107.175.150.73/~giftioz # Reference: https://app.any.run/tasks/09a252ef-0ebb-4f48-b4a2-2261a44dd000/ sisenor.ml # Reference: https://app.any.run/tasks/79df932f-0f42-441e-9071-64ddd88c7529/ kuomlog.xyz # Reference: https://pastebin.com/DT3diCh7 didxbooks.com fiftint.com # Reference: https://app.any.run/tasks/a1af1cea-bf86-4702-b3a2-082c1d242f15/ http://193.142.59.89 # Reference: https://www.exposedbotnets.com/2018/02/kdotrakycomloki-bot-hosted-in-shinjiru.html kdotraky.com continentalrnovers.com # Reference: https://twitter.com/wwp96/status/1220414670290456576 martirill.ga /makave/sab.php # Reference: https://www.virustotal.com/gui/file/d794747343409784e81b7754901acda8e2d3f5182ab9addc66c6121bc55aabc7/detection teiup.xyz # Reference: https://app.any.run/tasks/d4acf26b-aced-48a9-8dec-aeccd602c109/ heartychern.com # Reference: https://www.virustotal.com/gui/file/8e68b6908534b24b52ba7a1d0ef445b9b2a8681a4d35fa9d5c4d447cf3efb300/detection akito.be # Reference: https://www.virustotal.com/gui/domain/alibabahugia.com/relations alibabahugia.com # Reference: https://www.virustotal.com/gui/domain/eferiwalabd.com/relations eferiwalabd.com # Reference: https://www.virustotal.com/gui/file/e1869921f052c6dc9387b18c6884191a2c637eb21cd638ed1b2e71b31cab7e0b/detection kheeda.com # Reference: https://www.virustotal.com/gui/domain/regalscoin.co/relations regalscoin.co # Reference: https://www.virustotal.com/gui/url/b27492bd716239fe2f17a20b4c60c24bb058b7b8023be0f5a5e78bde37ea7864/detection molmarsl.com # Reference: https://www.virustotal.com/gui/file/b509e105567fe4a14e31c96d71bdf2080df1d1737fe5b1928b2e5ad88add2b31/detection bodegaslopezmoernas.com # Reference: https://www.virustotal.com/gui/file/0dbbbc6aa0686ea19b55871f0ca0b9c722064683604c04e581c8498095f0cea9/detection jdandado.info # Reference: https://www.virustotal.com/gui/file/5ffa3eaa94c6a603d21525a72d56f23915279fbd755ac0fb24d04e9a2fdd26fe/detection jscmy.co # Reference: https://www.virustotal.com/gui/file/3fcbf0a0d8ab22f5762ebf4855165c1258b57462119eb5549e7b74edcc2ce1ad/detection omabradley.ru # Reference: https://www.virustotal.com/gui/file/eb0cc81ad318a7ee0d5aef0b51538178c5e590be837a2e81cb99bf89944547f3/detection getvision2020.net # Reference: https://twitter.com/wwp96/status/1221892381831766017 oaa-my.com # Reference: https://twitter.com/wwp96/status/1222244913309454337 nwababy.cf /chikincho/sab.php # Reference: https://twitter.com/wwp96/status/1222259928422932480 wakanduz.tk /sabali/sab.php # Reference: https://twitter.com/James_inthe_box/status/1222541809454202880 zeyadigital.com # Reference: https://twitter.com/wwp96/status/1222604774484430848 himkon.cf # Reference: https://twitter.com/wwp96/status/1222651453673787393 drop-box.top # Reference: https://twitter.com/Racco42/status/1222895330422706178 hanmha.com # Reference: https://www.virustotal.com/gui/ip-address/193.142.59.107/relations 193.142.59.107:80 # Reference: https://www.virustotal.com/gui/ip-address/89.249.65.212/relations 89.249.65.212:80 # Reference: https://twitter.com/wwp96/status/1223277675688669185 # Reference: https://app.any.run/tasks/f9f4c66f-7e96-4ded-909a-f2f799658400/ gpi-q.com # Reference: https://twitter.com/wwp96/status/1223283853395144704 everest--sh.com # Reference: https://twitter.com/wwp96/status/1223331321969348613 # Reference: https://twitter.com/wwp96/status/1224402400674447361 butland.cf ezilon.tk /igine/sab.php # Reference: https://pastebin.com/v5VKwUUR batlxt.org fiftint.com top-sso3.top # Reference: https://twitter.com/wwp96/status/1224395051486400513 kdi-kongsberg.com # Reference: https://twitter.com/wwp96/status/1224395809879470080 baural.tk nedoru3.ml # Reference: https://twitter.com/wwp96/status/1224397130175041536 unrrwa.org # Reference: https://twitter.com/wwp96/status/1224403562488389632 http://193.142.59.7 # Reference: https://twitter.com/wwp96/status/1224415503206244353 baurallc.ml gadingsllc.cf /vvd/sab.php # Reference: https://twitter.com/wwp96/status/1224414499983237120 plosss.com # Reference: https://twitter.com/wwp96/status/1224415881880621062 saclex.gq # Reference: https://pastebin.com/5VDXdhPA airlinecom.tk babanovex.cf babatnx.cf bagariwa.tk baurallc.ml butland.cf butland.gq championsdeal.cf champkit.tk gadinacom.ga gadinacom.gq gadinacom.tk gadinatr.cf gadinatr.gq gadinatr.tk gbajagbaja.cf gbajagbaja.gq gbajagbaja.tk januarytins.ml juannylift.cf kutuolog.cf kutuolog.ga kutuolog.gq kutuolog.ml kutuolog.tk lilninop.ga mamado.ml martirill.ga nwababy.cf onyenzoputa.cf onyenzoputa.ml onyenzoputa.tk precisiongmbh.tk ramdymoore.ml saffen.ml simportexx.tk simpotex.ml simpotex.tk sisenor.ml solouro.ga solouro.ml tocheckoru.cf udejimji.cf ugomma.gq ugougo.cf ukwunkea.ml unvacsth.gq unvacsth.ml unvacsth.tk uwachukwuu.cf uwachukwuu.ml vintaded.ga wakanduz.cf wakanduz.ga wakanduz.gq webergmbh.ml webergmbh.tk /chikala/sab.php /chikincho/sab.php /igine/sab.php /makave/sab.php /nzubedubai/sab.php /omega/sab.php /pope/sab.php /sabali/sab.php /sweet/sab.php /vvd/sab.php /zanku/sab.php # Reference: https://app.any.run/tasks/153c9ca2-38d7-46f8-a510-2d6d13fbde4e/ shgshgsndynationalindustrialandgoogledns.duckdns.org # Reference: https://app.any.run/tasks/4dc538c1-e78e-41fe-b17e-ed9da474ea3c/ cranetechllc.ml simpotex.ga # Reference: https://app.any.run/tasks/e61bbc8a-d35d-4316-8232-b7cfd7f14a22/ cokhiquangbien.com # Reference: https://twitter.com/wwp96/status/1224789442243723265 omabradley.ru # Reference: https://twitter.com/wwp96/status/1224786717883936775 growyourwealth.cf powerlinecom.ml /makave/sab.php # Reference: https://twitter.com/wwp96/status/1224781788033245191 trouserlanditd.com # Reference: https://twitter.com/K_N1kolenko/status/1225009464815902720 http://104.223.170.113 http://107.175.150.73 http://198.23.200.241 http://78.142.18.109 about.panjihidayat.web.id barential.cf batlxt.org cv.panjihidayat.web.id difapackperu.com everest--sh.com fiftint.com gpi-q.com growyourwealth.cf lkpswrd.tk mecharnise.ir mocdong.com.vn/gx/playbook/onelove/fre.php omabradley.ru petroindonesia.co.id skyoceanshippinq.com tecon.com.mx tickerqube.com trouserlanditd.com tungyu.cf u-knlt.com worldatdoor.in zeyadigital.com # Reference: https://twitter.com/Bl4ng3l/status/1224999049880899586 etoro-miners.com # Reference: https://twitter.com/wwp96/status/1225487541484302336 drkconstrucciones.com # Reference: https://twitter.com/K_N1kolenko/status/1225784278732214272 euromopy.tech mirrapl.com missingandfound.com.my yullifyne.ml /v-2/pin.php /makave/sab.php /vvd/sab.php /zanku/sab.php # Reference: https://twitter.com/wwp96/status/1226945238448713732 serv-node4.top # Reference: https://www.virustotal.com/gui/domain/ezzy-corp.com/relations ezzy-corp.com # Reference: https://twitter.com/wwp96/status/1227267903558496256 abumchukwugi.ga coretelin.ml # Reference: https://app.any.run/tasks/904abf72-63a7-4d8c-9be4-d25ca3872cbf/ http://192.3.183.226 # Reference: https://app.any.run/tasks/dce56dd7-e6b6-45e7-9845-9c1da2ac3cbd/ http://46.21.147.207 # Reference: https://twitter.com/K_N1kolenko/status/1227511439176458240 # Reference: https://twitter.com/K_N1kolenko/status/1227511407564001281 http://103.208.86.31 bacanacabana.com.br/wp-includes/css/kay/Panel/five/fre.php bdsphatphat.com/.dtt/playbook/onelove/fre.php ijinwa.ml innoexpo.tech jfe-mineral-co.pw naelele.ga slnsa.trade telincore.tk telincorenw.gq transmarine.pw tungyu.cf /makave/sab.php /omega/sab.php /zanku/sab.php # Reference: https://twitter.com/K_N1kolenko/status/1227925694539337728 digi-sec.top ijinwa.gq telincore.gq matantalbenna.com/.legolass/fine/fre.php (# compromised site) /nzubedubai/sab.php # Reference: https://twitter.com/wwp96/status/1228000721494315008 beautynams.com # Reference: https://twitter.com/wwp96/status/1228360824676323328 dfsdfbdz.ml telincore.ml # Reference: https://twitter.com/wwp96/status/1228364048917565441 sogamco.com # Reference: https://twitter.com/wwp96/status/1228357214538170369 workherna.ga # Reference: https://twitter.com/wwp96/status/1228372948626690048 bantanmanta.cf loverineta.tk # Reference: https://twitter.com/reecdeep/status/1229403951675715586 powerlogs.top taximolinaperu.com # Reference: https://twitter.com/wwp96/status/1229438993584066562 cokhiquangbien.com # Reference: https://twitter.com/wwp96/status/1229438428598689792 kdi-kongsberg.com # Reference: https://twitter.com/wwp96/status/1229448871677485057 193.142.59.88:80 # Reference: https://twitter.com/wwp96/status/1229446037800181760 # Reference: https://twitter.com/_lockhum/status/1229477916234461184 46.21.147.206:80 /primseven/logs/omc.php # Reference: https://pastebin.com/WWcPxMMU http://paswordinc.xyz/new/fre.php http://www.dadatiles.com.au/ju/fre.php http://192.3.182.247/feblogs/logs/fre.php http://brokenbrains.xyz/James/fre.php http://185.126.201.167/~power13/.W0pohss134zCt/fre.php http://transwesemayra.top/Lokivo/Panel/fre.php http://taximolinaperu.com/fz/fre.php http://best-aluminum-co.ml/CORONACUREXXX/fre.php http://195.206.106.191/hoist3/logs/fre.php http://wesemayra.top/Lokivo/Panel/fre.php http://misiondeangeles.com/grace/five/fre.php http://94.100.18.11/plugman/logs/fre.php http://46.21.147.206/primseven/logs/fre.php http://thefieldagent.net/yo/Panel/five/fre.php http://193.142.59.109/primone/logs/fre.php http://131.153.22.150/primfour/logs/fre.php http://sariincofood.co.id/xx/Panel/fre.php http://mediagift.vn/.ki/playbook/onelove/fre.php http://masterteknoloji.com/.legolas/legolas/fine/fre.php http://mecharnise.ir/ca10/fre.php http://centrehotel.vn/oo/panel/fre.php http://www.tiltteexx.co/soft/julxx/fre.php http://pickupmylaundry.co.in/fonts/xfs/xch/fre.php http://tiltteexx.co/rokzee/kor2/fre.php http://176.57.70.28/angelo/Panel/five/fre.php http://getupandcboz.com/mine/fre.php http://www.biznetvgator.com/hyj/five/fre.php http://kceeruth.tk/kcee/fre.php http://www.matantalbenna.com/.legolass/fine/fre.php http://gassettgroup.com/1/fre,php http://netfliq.ml/binocular/fre.php http://promecco.com.tr/nel/five/fre.php http://sogamco.com/Work6/fre.php http://empresadeperu.com/bn/fre.php http://sogamco.com/Work4/fre.php http://141.105.71.35/sss/fre.php http://sogamco.com/Work5/fre.php http://thefieldagent.net/ys/Panel/five/fre.php http://portalcafecomnoticias.com.br/wp-includes/css/coco/fre.php http://gentleprlnce.com/CanDyCrUSHXXX/fre.php http://thefieldagent.net/loki/Panel/five/fre.php http://epperfums.com/dull/five/fre.php http://taximolinaperu.com/m/fre.php http://192.3.183.226/~feragamo/.legolas/fine/fre.php http://mawa2ef.com/core/five/fre.php http://mediagift.vn/.bc/playbook/onelove/fre.php http://blue-airship.com/empire/movement/kingz/fre.php http://academydea.com/includes/Panel/five/fre.php http://vlklz.xyz/A1/five/fre.php http://techcefacos.org/config/Panel/five/fre.php http://ayoobtextlie.com/cup/five/fre.php http://ayoobtextlie.com/craks/five/fre.php http://mckenzai-co.pw/Pablo/fre.php http://beerberv.com/OPAYREXING/fre.php http://portalcafecomnoticias.com.br/test/js/Panel/five/fre.php http://epperfums.com/dino/five/fre.php http://taximolinaperu.com/cg/fre.php http://193.142.59.88/primsix/logs/fre.php http://jfe-mineral-co.pw/Arinze/fre.php http://petroindonesia.co.id/xxx/xx/Panel/fre.php http://omabradley.ru/msn/Panel/fre.php http://omabradley.ru/easyph/Panel/fre.php http://corpcougar.com/zor/Panel/five/fre.php http://omabradley.ru/arewaphazzy/Panel/fre.php http://assemba.co.uk/bk2/Panel/five/fre.php http://fentlix.com/pl2y/fre.php http://isysu.net/zb_system/image/logo/good/fre.php http://transmarine.pw/Pablo/fre.php http://omabradley.ru/m16/Panel/fre.php http://myaline.com.pe/img/h/fre.php http://academydea.com/includes/pollux/Panel/five/fre.php http://uniquepierce.tech/pdot/support/rslt/fre.php http://transmarine.pw/Bobby/fre.php http://blue-airship.com/agutaz/direct/pushin/fre.php http://febspxi.xyz/P3/five/fre.php http://slnsa.trade/Work3/fre.php http://fentlix.com/onev/fre.php http://slnsa.trade/Work7/fre.php http://103.208.86.31/y/fre.php http://jfe-mineral-co.pw/Chukwuka/fre.php http://46.21.147.207/primeight/logs/fre.php http://sariincofood.co.id/no/Panel/fre.php http://184.164.142.217/primthree/logs/fre.php http://184.164.142.213/primtwo/logs/fre.php http://indiatoursntravels.in/cc/Panel/fre.php http://37.220.0.11/primone/logs/fre.php http://trailer.co.za/cg-wpi/Panel/five/fre.php http://5.152.210.188/primfour/logs/fre.php http://kimstar.com.vn/.tx/tx/playbook/onelove/fre.php http://slnsa.trade/Work5/fre.php http://innoexpo.tech/product/perf/Inc/fre.php http://131.153.22.142/rokstwo/logs/fre.php http://jfe-mineral-co.pw/Broken/fre.php http://198.23.200.241/~power13/.swoexizp/fre.php http://198.23.200.241/~power13/.firoxispz/fre.php http://klickus.com/okye/Panel/five/fre.php http://slnsa.trade/Work1/fre.php http://slnsa.trade/Work8/fre.php http://myaline.com.pe/nn/fre.php http://corpcougar.com/nedu/Panel/five/fre.php http://papelestecnicos.com.pe/vb/fre.php http://empresadeperu.com/ved/fre.php http://beerberv.com/SAMMYWAHALA/fre.php http://empresadeperu.com/vv/fre.php http://trailer.co.za/wp-cgi/Panel/five/fre.php http://klickus.com/gozie/Panel/five/fre.php http://klickus.com/cjay/Panel/five/fre.php http://185.56.137.99/primfive/logs/fre.php http://131.153.22.219/primsix/logs/fre.php http://adminfixpop3settings.com/vkay/five/fre.php http://bacanacabana.com.br/wp-includes/css/kay/Panel/five/fre.php http://karmar.com.au/wp-admin/css/colors/coffee/fre.php http://borrdrillling.com/danb/five/fre.php http://omabradley.ru/agwo/Panel/fre.php http://forlinkserver.com//parl/id2244/fre.php http://mellle.com/ses/Panel/fre.php http://trouserlanditd.com/dark/five/fre.php http://emesterul.ro/css/ok/fre.php http://vlklz.xyz/Atoz/five/fre.php http://198.23.200.241/~power13/.pRciyzfi/fre.php http://centrehotel.vn/ss/Panel/fre.php http://vcntq.ga/Mercy/five/fre.php http://rlxivz.ga/SV3/five/fre.php http://193.142.59.96/africa/logs/fre.php http://198.23.200.241/~power13/.xoiaxozp/fre.php http://etoro-miners.com/bird/five/fre.php http://198.23.200.241/~power13/.sopawqo/fre.php http://bdsphatphat.com/.dtt/playbook/onelove/fre.php http://198.23.200.241/~power13/.gvuxosacy/fre.php http://indiatoursntravels.in/oo/Panel/fre.php http://107.175.150.73/~giftioz/.fkligxrzi/fre.php http://oasischandigarh.com/wp-admin/js/widgets/Panel/five/fre.php http://trailer.co.za/bin/Panel/five/fre.php http://febtrxp.xyz/P4/five/fre.php http://febvnxp.xyz/P4/five/fre.php http://198.23.200.241/~power13/.xwospaxi/fre.php http://xgkxc.xyz/P4/five/fre.php http://www.worldatdoor.in/panel2/Panel/five/fre.php http://liderazgocristoforo.org/n/fre.php http://198.23.200.241/~power13/.sixnrpq/fre.php http://hanmha.com/drunk/five/fre.php http://rlxivz.tk/SV2/five/fre.php http://198.23.200.241/~power13/.goxizmsxir/fre.php http://datedi.icu/hoist1/logs/fre.php http://mikeservers.eu/kings/five/fre.php http://104.223.170.113/Silkop/Panel/five/fre.php http://euromopy.tech/etty/black/download/fre.php http://borrdrillling.com/luckyadmin/five/fre.php http://expertisem.net/empire/movement/kingz/fre.php http://blastforcleaningservices.com/fonts/panel/fre.php http://etoro-miners.com/gate/five/fre.php http://mecharnise.ir/ca11/fre.php http://mkplogistics.co.id/oo/Panel/fre.php http://mkplogistics.co.id/aa/Panel/fre.php http://liderazgocristoforo.org/g/fre.php http://centrehotel.vn/cc/Panel/fre.php http://u-knlt.com/Bobby/fre.php http://missingandfound.com.my/kv/Panel/fre.php http://u-knlt.com/Pablo/fre.php http://trouserlanditd.com/dabs/five/fre.php http://everest--sh.com/coco/five/fre.php http://gpi-q.com/cake/five/fre.php http://trailer.co.za/wp-index/Panel/five/fre.php http://198.23.200.241/~power13/.zipxzios/fre.php http://tungyu.cf/CROWNEDPRINCE/fre.php http://esenciamaya.com/leo/five/fre.php http://saclex.gq/flabs/fre.php http://5.196.123.14/yg/Panel/fre.php http://omabradley.ru/smik/Panel/fre.php http://mirrapl.com/big/Panel/fre.php http://funerariapracadabandeira.com.br/include/Panel/five/fre.php http://printystore.com.pe/img/lop/fre.php http://printystore.com.pe/js/v/fre.php http://66.85.173.45/africa/logs/fre.php http://xlkz.xyz/P4/five/fre.php http://5.152.210.181/roksone/logs/fre.php http://103.70.137.123:82/five/fre.php http://noniwire7.website/Work4/fre.php http://107.175.150.73/~giftioz/.shptioixmaz/fre.php http://centrehotel.vn/oo/Panel/fre.php http://noniwire7.website/Work5/fre.php http://drkconstrucciones.com/v/fre.php http://trouserlanditd.com/didi/five/fre.php http://xigkxc.xyz/Atoz/five/fre.php http://193.142.59.7/hoist3/logs/fre.php http://missingandfound.com.my/mba/Panel/fre.php http://espoirpharmaceutical.com/includes/Panel/five/fre.php http://missingandfound.com.my/bb/Panel/fre.php http://terayu.tk/irkk/fre.php http://unrrwa.org/rich/Panel/fre.php http://hanmha.com/dope/five/fre.php http://precisiongmbh.cf/kboss/fre.php http://hanmha.com/duck/five/fre.php http://hanmha.com/divide/five/fre.php http://printystore.com.pe/img/hu/fre.php http://kdi-kongsberg.com/stan/Panel/fre.php http://217.64.114.179/africa/logs/fre.php http://hedsoni.com/jahbless/fre.php http://mediceldl.com/Broken/fre.php http://tickerqube.com/Loki2020/fre.php http://lethatch.se/nelpa/five/fre.php http://tresolutionsdr.com/CHK/five/fre.php http://missingandfound.com.my/urch/Panel/fre.php http://trailer.co.za/wp-adon/Panel/five/fre.php http://78.142.18.109/jaydee/logs/fre.php http://serviciotecnicoenlima.com/js/g/fre.php http://xecogioisg.com/go/playbook/onelove/fre.php http://gimhon.ml/kcyi/fre.php http://omabradley.ru/kiriko/Panel/fre.php http://difapackperu.com/n/fre.php http://tecon.com.mx/onye/five/fre.php http://198.23.200.241/~power13/.xjksapxiz/fre.php http://gpi-q.com/cup/five/fre.php http://sino-spriulina.com/demo1/Panel/fre.php http://aikchimhin.com/walterXXXX/fre.php http://trouserlanditd.com/data/five/fre.php http://107.175.150.73/~giftioz/.notoxo/fre.php http://mediceldl.com/David/fre.php http://everest--sh.com/cream/five/fre.php http://mediceldl.com/Bobby/fre.php http://duprcxoffshore.com/yaas/fre.php http://everest--sh.com/click/five/fre.php http://107.175.150.73/~giftioz/.fsabljkxioaxo/fre.php http://corpcougar.com/buggy/Panel/five/fre.php http://gpi-q.com/copy/five/fre.php http://mediceldl.com/Pablo/fre.php http://borrdrillling.com/lokiadmin/five/fre.php http://198.23.200.241/~power13/.xoiaspxo/fre.php http://cokhiquangbien.com/.jx/playbook/onelove/fre.php http://omabradley.ru/garuba/Panel/fre.php http://expertisem.net/agutaz/direct/pushin/fre.php http://193.142.59.107/africa/logs/fre.php http://cleaning-hygiene.com/kay/Panel/five/fre.php http://perfectelectricalsolution.com/css/bb/Panel/fre.php http://brokenskul.xyz/Bobby/fre.php http://gpi-q.com/craks/five/fre.php http://trouserlanditd.com/drug/five/fre.php http://trouserlanditd.com/draw/five/fre.php http://gpi-q.com/cutter/five/fre.php http://petroindonesia.co.id/xx/Panel/fre.php http://omabradley.ru/ekene/Panel/fre.php http://petroindonesia.co.id/admin/Panel/fre.php http://trailer.co.za/cgi/Panel/five/fre.php http://gpi-q.com/clean/five/fre.php http://everest--sh.com/cola/five/fre.php http://amotach-cn.com/DOTNETXXX/fre.php http://gpi-q.com/clap/five/fre.php http://uniformescorporativosperu.com/catalogopw/g/fre.php http://uniformescorporativosperu.com/imgdamas/faldas/j/fre.php http://ecoorganic.co/Work8/fre.php http://euromopy.tech/rosemond/backup/dataz/fre.php http://89.249.65.212/africa/logs/fre.php http://uwhfdsndcjdn.ml/chikafams/fre.php http://zeyadigital.com/etty/black/download/fre.php http://hanmha.com/deal/five/fre.php http://petroindonesia.co.id/ss/Panel/fre.php http://stampilam.ro/axe/five/fre.php http://securesharing.top/Lokivo/Panel/five/fre.php http://107.175.150.73/~giftioz/.vodojik/fre.php http://everest--sh.com/clock/five/fre.php http://aivazidis.gq/mad-ooo/fre.php http://grensena.tk/kboss/fre.php http://107.175.150.73/~giftioz/.myprolokip/fre.php http://drop-box.top/Lokivo/Panel/five/fre.php http://pipermode.com/agutaz/direct/pushin/fre.php http://defacci22.net/rosemond/backup/dataz/fre.php http://perfectelectricalsolution.com/mb/panel/fre.php http://sino-spriulina.com/demo/Panel/fre.php http://brokenskul.xyz/Broken/fre.php http://cleaning-hygiene.com/bab/Panel/five/fre.php http://ecoorganic.co/Work2/fre.php http://ecoorganic.co/Work4/fre.php http://aladebtrading.com/loki/Panel/fre.php http://sccslink.xyz/P5/five/fre.php http://ecoorganic.co/Work7/fre.php http://ecoorganic.co/Work1/fre.php http://somafe.dz/zmnko/five/fre.php http://corpcougar.com/bin/Panel/five/fre.php http://himkon.cf/kcyi/fre.php http://107.175.150.73/~giftioz/.ASlxkaDx8x/fre.php http://107.175.150.73/~giftioz/.xozizuxoze/fre.php http://institutdemathologie.fr/GO/ve/fre.php http://altoinfor.co/base/fre.php http://softtouchcollars.com/Loki/Panel/five/fre.php http://107.175.150.73/~giftioz/.suxozisxfi/fre.php http://104.223.170.113/dsikio/Panel/five/fre.php http://dongthanhcompany.vn/.ox/playbook/onelove/fre.php http://heartychern.com/deal/five/fre.php http://192.210.238.10/five/fre.php http://193.142.59.3/teejay/logs/fre.php http://perfectelectricalsolution.com/bb/Panel/fre.php http://kimstar.com.vn/.tx/playbook/onelove/fre.php http://193.142.59.98/africa/logs/fre.php http://xylanperu.com/op/fre.php http://petroindonesia.co.id/cgi-bin/cc/Panel/fre.php http://107.175.150.73/~giftioz/.ciiiiiiric/fre.php http://seguridadindustrialujan.com/hu/fre.php http://seguridadindustrialujan.com/jii/fre.php http://docupubfilesretrieve.com/sp/five/fre.php http://thaubenuocngam.com/go/playbook/onelove/fre.php http://buasang5sao.com/Panel/five/fre.php http://107.152.36.110/GhosTHunTerX/fre.php http://bollorre.pw/Work4/fre.php http://bollorre.pw/Work5/fre.php http://oaa-my.com/copy/five/fre.php http://xgkixc.xyz/Atoz/five/fre.php http://plosss.com/lok/Panel/fre.php http://molmarsl.com/leks/five/fre.php http://assemba.co.uk/mk/Panel/five/fre.php http://byedtronchgroup.yt/jik/Panel/five/fre.php http://192.210.238.10/emmy/fre.php http://iplusvietnam.com.vn/jo/playbook/onelove/fre.php http://xecogioisg.com/mx/playbook/onelove/fre.php http://bollorre.pw/Work6/fre.php http://tbt-sceitech.com/coco/five/fre.php http://107.175.150.73/~giftioz/.xotorsvi/fre.php http://sino-spriulina.com/Panel/fre.php http://107.175.150.73/~giftioz/.vorokimovi/fre.php http://107.175.150.73/~giftioz/.coterzio/fre.php http://sccslink.xyz/P4/five/fre.php http://uwhfdsndcjdn.tk/evawater/fre.php http://107.175.150.73/~giftioz/.dycosmxiz/fre.php http://about.panjihidayat.web.id/cc/Panel/fre.php http://193.142.59.89/africa/logs/fre.php http://asi1.ir/sch/five/fre.php http://protestlabsmovings.es/blender/Panel/five/fre.php http://w-tranz.club/game/luxx/fre.php http://rohockey.ro/wp-content/five/fre.php http://107.175.150.73/~giftioz/.fodoixz/fre.php http://chol.cc/Work2/fre.php http://chol.cc/Work1/fre.php http://107.175.150.73/~giftioz/.cotolier/fre.php http://107.175.150.73/~giftioz/.dsabkjczpxzo/fre.php http://107.175.150.73/~giftioz/.vogofis/fre.php http://snodrite.pw/tipe/hope/fre.php http://zoncline.club/stud/hace/fre.php http://fvrlink.online/P2/five/fre.php http://wusetwo.xyz/public_html/file/five/inc/class/pCharts/info/Panel/five/fre.php http://ma.co.ir/huu/fre.php http://alwaysdelivery.xyz/five/fre.php http://www.traz.ir/erqzxewqrtyacxz/five/fre.php http://worldatdoor.in/lewis/Panel/five/fre.php http://107.175.150.73/~giftioz/.jorosin/fre.php http://superson-com.cc/Bobby/fre.php http://oaa-my.com/clean/five/fre.php http://deliveryexpressworld.xyz/five/fre.php http://sccslink.online/P3/five/fre.php http://govirtual.ga/targets/fre.php http://chol.cc/Work4/fre.php http://cleaning-hygiene.com/bin/Panel/five/fre.php http://apexsourcingltd.com/maka/emmy/fre.php http://107.175.150.73/~giftioz/.zozoas/fre.php http://vlkl.xyz/Atoz/five/fre.php http://107.175.150.73/~giftioz/.lokijisi/fre.php http://107.175.150.73/~giftioz/.kobovoih/fre.php http://fvrlink.xyz/P1/five/fre.php http://digi-sec.top/lokivo/Panel/five/fre.php http://deliciasdvally.com.pe/includes/gter/fre.php http://krompres.tk/loki/Panel/five/fre.php http://piscinasaguamarinha.com.br/moon/five/fre.php http://mecharnise.ir/ca3/fre.php http://penworkresearch.com/app/five/fre.php http://difapackperu.com/fg/fre.php http://brodam.ro/rtc/five/fre.php http://chol.cc/Work3/fre.php http://leakaryadeen.com/parl/id345/fre.php http://107.175.150.73/~giftioz/.ckyfdgxo/fre.php http://pehledinekam.com/amey/fre.php http://noithathoanggia.net.vn/jo/playbook/onelove/fre.php http://chol.cc/Work5/fre.php http://pur-ant.club/page/gain/fre.php http://107.175.150.73/~giftioz/.sfaojaxz/fre.php http://agrabahd.ga/locale/fre.php http://afas-kr.com/drug/five/fre.php http://cast-den.pw/cape/spot/fre.php http://107.175.150.73/~giftioz/.pojonv/fre.php http://about.panjihidayat.web.id/aa/Panel/fre.php http://ivad.com.vn/go/playbook/onelove/fre.php http://mocdong.com.vn/gx/playbook/onelove/fre.php http://omabradley.ru/china20/Panel/fre.php http://getvision2020.net/etty/black/download/fre.php http://ht-electric.dz/qatar/five/fre.php http://107.175.150.73/~giftioz/.zohohov/fre.php http://mecharnise.ir/ca6/fre.php http://noithathoanggia.net.vn/kk/playbook/onelove/fre.php http://nan5.ir/jty/fre.php http://southeasterncontractingco.com/jo/panel/five/fre.php http://178.17.170.6/five/fre.php http://107.175.150.73/~giftioz/.tororo/fre.php # Reference: https://app.any.run/tasks/ed92457b-1989-490b-86d6-80392502143f/ http://107.189.10.150/Pi2/ martiq.org # Reference: https://app.any.run/tasks/62e6801e-cabb-4cf7-af74-0cc2e9997080/ # Reference: https://www.virustotal.com/gui/ip-address/107.175.150.73/relations chnthreewealthsndy3andreinforcementagenc.duckdns.org http://107.175.150.73/~giftioz/ # Reference: https://app.any.run/tasks/32270993-012f-4ec8-a88f-119917767e7d/ epperfums.com # Reference: https://app.any.run/tasks/1376f2cb-7008-4840-9df3-a54be7c75fd1/ sndy2kungglobalinvestmentgooglednsaddres.duckdns.org # Reference: https://twitter.com/wwp96/status/1229809833521614849 brokenhead.xyz # Reference: https://twitter.com/wwp96/status/1230208744824410113 bdzdfsdf.gq # Reference: https://twitter.com/wwp96/status/1230209217015025666 fdjshe.tk # Reference: https://twitter.com/wwp96/status/1230213776521269249 shefdj.cf # Reference: https://twitter.com/wwp96/status/1230220429832445953 bdzdfsdf.cf # Reference: https://app.any.run/tasks/3b425f86-5b45-413b-82ce-94572bc89f77/ desertfox.ru # Reference: https://twitter.com/Bl4ng3l/status/1230429843118006273 zdwallcoveing.com # Reference: https://twitter.com/wwp96/status/1230546137427435520 matantalbenna.com/.legolass/fine/fre.php # Reference: https://app.any.run/tasks/9cfa85fa-ed4e-4629-a2bc-98aa095bbd29/ duclongetc.com # Reference: https://app.any.run/tasks/0579bdb6-a14f-458f-80c3-222c5c251cec/ atlasdecarqo.com # Reference: https://app.any.run/tasks/7890bc79-567c-403b-be23-19e52c91664f/ naourl.com # Reference: https://app.any.run/tasks/156ee10c-d61a-478e-b0b7-b8088ee4d0d1/ http://198.12.125.130/~axsonipc/ # Reference: https://twitter.com/wwp96/status/1232400592787693568 hergyi.com # Reference: https://twitter.com/wwp96/status/1232394253118115848 # Reference: https://app.any.run/tasks/4750d11b-76c7-46c8-820f-fe87e6159117/ febspxii.xyz # Reference: https://app.any.run/tasks/fef43720-c2c0-4305-8697-0b2637c44db9/ sisiinno.tech # Reference: https://app.any.run/tasks/08c78083-b2f6-4c61-90c7-6fc4c0291226/ vivalingard.gq vivalingard.cf # Reference: https://app.any.run/tasks/9fbcb0ae-61c8-42b0-8314-adf7202a8a45/ falcontension.tech # Reference: https://app.any.run/tasks/71fb5323-5556-4b24-90b3-c835d0d095a9/ missingandfound.com.my/prin/Panel/fre.php # Reference: https://app.any.run/tasks/be2aca26-f021-4a7c-8f9e-8a536549eafd/ blog.huangyang.cc/goziiu/ klickus.com/gozie/Panel/five/fre.php # Reference: https://app.any.run/tasks/6145a1fc-6bcf-42e5-b3bb-9d4830fb738b/ doqantekstil.com # Reference: https://app.any.run/tasks/d46ce8df-0f19-40c7-97bd-7ca23c6360a1/ http://107.175.150.73/~giftioz/ # Reference: https://app.any.run/tasks/1248ab72-b0de-4ebc-af9e-3b6f68a70d86/ epperfums.com # Reference: https://app.any.run/tasks/cc714b2d-7440-45c4-a70e-e25ad256dd27/ nileloqistics.com # Reference: https://any.run/report/7767c2ec0369f22b90a0edb03260057b834195b6a5d12d67fa26e28ac2e6933a/4c4433cd-e9c7-46bc-bebf-c88a90b36bff expertswebservices.com Reference: https://www.virustotal.com/gui/domain/aquavictus.hr/relations aquavictus.hr/img/panel/index.php aquavictus.hr/ap/Panel/index.php aquavictus.hr/mkk/Panel/five/fre.php # Reference: https://app.any.run/tasks/2cf293f3-2994-483d-adfe-7f5988288cae/ http://198.23.148.71 # Reference: https://twitter.com/K_N1kolenko/status/1234817078458290176 academydea.com/noni/Panel/five/fre.php imperiaskygarden.net/.wp-admini/wp-admini1/wp-admini2/fre.php lucianogroup.xyz sonqan-vn.com topuogodo.ga wesemayra.top # Reference: https://twitter.com/wwp96/status/1234946520329445378 kdhema.ga topuogodo.ml # Reference: https://app.any.run/tasks/58554586-a4b7-4586-b7b1-cc8f86f0caa8/ vnn-nv.com # Reference: https://app.any.run/tasks/40f44fdd-5eeb-41b1-98b3-bfc102ee0865/ altamonteorators.com/images/images/Panel/five/fre.php # Reference: https://app.any.run/tasks/6b80811c-c9f7-43c5-aab1-d4a1eb8cd54f/ tailuong.com.vn/.xxx/playbook/onelove/fre.php # Reference: https://app.any.run/tasks/9194de26-2044-405c-be7c-340e4da5dd83/ worldatdoor.in/lewis1/Panel/five/fre.php # Reference: https://app.any.run/tasks/eedcbfc1-89e0-49f4-8fa9-b7cbb9afc577/ gorillahikeafrica.com/wp-includes/images/img/five/fre.php # Reference: https://app.any.run/tasks/e2412cb7-33cc-4e57-87c2-44e8c79e7edd/ pmw-ch.com # Reference: https://www.virustotal.com/gui/file/4a0e276b4730abd7ee51cf8876d25cd3928321acbb39d6d5f0e2fa8138312e2d/behavior/Dr.Web%20vxCube topuogodo.cf drakum.ml # Reference: https://twitter.com/casual_malware/status/1235189716917645312 mmanueud.cf topuogodo.ga # Reference: https://twitter.com/wwp96/status/1234938182208278529 hockvvee.com # Reference: https://twitter.com/wwp96/status/1234567430900535297 lieshitextile.com # Reference: https://www.virustotal.com/gui/ip-address/91.215.169.70/relations pmw-ch.com vnn-nv.com cpf-th.com solefex.com # Reference: https://twitter.com/wwp96/status/1235248119354478595 vnn-nv.com # Reference: https://app.any.run/tasks/2cfba30b-91b9-4827-ba96-e3dfb4d71b9e/ http://193.142.59.22/jaydee/logs/fre.php # Reference: https://app.any.run/tasks/a6d64f54-c294-49eb-82e6-f952777d80bb/ http://107.175.150.73/~giftioz/.dxuz/fre.php # Generic (callback) paths # Reference: https://twitter.com/hexlax/status/1157657573790814208 # Reference: https://pastebin.com/LHJrNpnV # Reference: https://pastebin.com/wHV90Sc2 # Reference: https://twitter.com/P3pperP0tts/status/1185096874241548291 # Reference: https://twitter.com/P3pperP0tts/status/1185096537271164928 /0110/s/cat.php /0110/s/desk.php /092j/7/cat.php /092j/7/desk.php /0sc9/cat.php /l3y0/cat.php /200/zc-b/cat.php /200/zc-b/desk.php /2leek/cat.php /50-red/cat.php /500two/cat.php /52006/link.php /atz/link.php /ch/link.php /hol/1/cat.php /hol/1/desk.php /humb/1/cat.php /humb/1/desk.php /igine/sabali.php /jes/link.php /key/link.php /chri1/cgi.php /fbm/encode.php /ka22/cat.php /makave/sabali.php /st3ph/cat.php /umgo2/cat.php /sail/cat.php /seems/cat.php /slek-b/cat.php /vh/630/cat.php /vh/630/desk.php /3sx0z2.php /45_76_8.php /AklDq9M1n_a.php /BobBy929BSx_A_D_M1n_a.php /BobDq929BSx_A_D_M1n_a.php /ChiNa929BSx_A_D_M1n_a.php /CvqDq929BSx_A_D_M1n_a.php /DaqDq929BSx_A_D_M1n_a.php /EvqTq939BSx_B_D_D1p_a.php /IkeNn929BSx_A_D_M1n_a.php /KelDq929BSx_A_D_M1n_a.php /KelEc929BSx_A_D_M1n_a.php /KelEh929BSx_A_D_M1n_a.php /KenDq929BSx_A_D_M1n_a.php /Natyyx_A_D_M4n_a.php /NonYe929BSx_A_D_M1n_a.php /ObiNn929BSx_A_D_M1n_a.php /PceHq925BSx_L_B_M1n_a.php /PrCm98ArhvF_A_K_M2n_a.php /Pvq929sM1n_a.php /PvqDNINo_M1n_a.php /PvqDerereA_D_M1n_a.php /PvqDq929BSx_A_D_M1n_a.php /PvqDq92allin_a.php /PvqDq92nat1n_a.php /PvqDq9MAxxxoloa.php /PvqDq9ohhho_a.php /SliDq929BSx_A_D_M1n_a.php /SlqDq929BSx_A_D_M1n_a.php /SomAq929BSx_A_D_M1n_a.php /SsgDq929BSx_A_D_M1n_a.php /SsqDq929BSx_A_D_M1n_a.php /StaDq929BSx_A_D_M1n_a.php /StaRm929BSx_A_D_M1n_a.php /StaRq929BSx_A_D_M1n_a.php /TryNdie.php /Ttq929BSx_A_X_M11n_a.php /UpDated_X_T_N1q_a.php /VirGi929BSx_A_D_M1n_a.php /graceofgod-favour.php /okwy_A_D_server.php /panel_jee.php # Reference: https://twitter.com/wwp96/status/1235606545771175943 site-inspection.com # Reference: https://twitter.com/wwp96/status/1235976467215011841 fllxprint.com # Reference: https://twitter.com/wwp96/status/1236012534534213632 yal1am.com # Reference: https://twitter.com/wwp96/status/1236016958564372482 http://192.3.204.226 # Reference: https://twitter.com/wwp96/status/1236018276909690884 halloway.ru # Reference: https://app.any.run/tasks/461c4d7b-f11c-45eb-b5bf-7c0aefbfe24d/ damagedskull.xyz # Reference: https://app.any.run/tasks/faeeb41c-fe3a-4165-b65d-eba3d49bcfda/ # Reference: https://app.any.run/tasks/ebe2f251-79c3-403a-87c0-4882f0765e19/ posqit.net martiq.org didxbooks.com # Reference: https://app.any.run/tasks/e0296815-ebdf-43ce-87c3-22fabbaa4f07/ http://67.43.224.151 # Reference: https://pastebin.com/vMc4ATVq # Reference: https://app.any.run/tasks/58c77ed3-4d5a-4816-8422-bfcc0cf9bd12/ http://141.105.71.126 http://23.95.132.48 bibpap.com # Reference: https://twitter.com/wwp96/status/1237138658404294657 snxmrch.xyz # Reference: https://twitter.com/wwp96/status/1237141226350096386 fitrtefast.com # Reference: https://app.any.run/tasks/422168f9-9d03-49dc-827e-51ec179b296f/ onllygooodam.com # Reference: https://twitter.com/wwp96/status/1237808235689762818 fucksars.xyz # Reference: http://cybercrime-tracker.net/index.php?search=turasogutmas.com # Reference: https://app.any.run/tasks/b67fc2b1-2b6b-49f0-abb4-d2e94703bad9/ turasogutmas.com # Reference: https://twitter.com/JAMESWT_MHT/status/1238073558326292480 castrologs.xyz # Reference: https://blog.talosintelligence.com/2020/03/threat-roundup-0306-0313.html (# Win.Malware.Ursu-7610305-0) abizima.gq forza-lindelof.cf forza-lindelof.ga forza-maguire.cf forzalindelof.ml forzamaguire.ga forzamaguire.ml forzamaguire.tk global-solution.gq mabelis.cf nomnyz.cf nomnyz.ga radiomar.cf somaplast.cf somaplast.ga yanguz.cf # Reference: https://twitter.com/James_inthe_box/status/1239577931195662338 seacrafts.ru # Reference: https://app.any.run/tasks/5900bea3-b146-4982-94bb-023e082dfe13/ anoroc.ru # Reference: https://app.any.run/tasks/a94b863f-caec-4f26-ac3f-6ac55575456b/ cpf-th.com # Reference: https://app.any.run/tasks/15d7e6c5-0078-4d61-be32-af531fcb932b/ pyungz.org # Reference: https://app.any.run/tasks/fcee8e0c-120d-417a-96bb-489a5d5be106/ # Reference: https://app.any.run/tasks/3aca1800-6fc0-4c4a-a8f4-a9bd4b03169f/ # Reference: https://app.any.run/tasks/22e3ec37-4972-4ef1-aa53-e94c082cb7e4/ russchine2specialstdy2plumbingmaterialgh.duckdns.org http://23.95.132.48/~main/ # Reference: https://app.any.run/tasks/51111254-4c18-4627-bdd2-5216a4c85bab/ greenelectronicsandkitchen10apliancestdy.duckdns.org asia-maap.com # Reference: https://app.any.run/tasks/cd98661a-75f9-4900-8d02-59275e05e4a6/ # Reference: https://app.any.run/tasks/196ba7fa-9850-4c4f-9b9a-e19fc4c72b86/ castmart.ga # Reference: https://app.any.run/tasks/bfc65c50-f43c-41d7-8ba4-febf6ccc7eea/ byedtronchgroup.yt http://104.223.170.93/jore/Panel/five/fre.php # Reference: https://app.any.run/tasks/80cab2e3-1373-4479-a8e0-0f079ec5757e/ hgmatal.com # Reference: https://twitter.com/bit_dam/status/1242553127548735488 /1g7/pin.php # Reference: https://www.virustotal.com/gui/domain/fuly-lucky.com/relations fuly-lucky.com # Reference: https://www.virustotal.com/gui/file/564121a4958991dcbdd3cbd18ae899c960c2f633decb3dfff09ca0a9abc3338f/behavior/Dr.Web%20vxCube # Reference: https://www.virustotal.com/gui/file/9e7bfbe18c5482f6967dfd30d79dd92679167ee400f9bd525737ee83842754c5/behavior/Dr.Web%20vxCube http://77.81.121.20/~kukddoco/ # Reference: https://twitter.com/K_N1kolenko/status/1235896986659889153 http://185.94.191.8 http://193.142.59.2 aliminksrl.cf assemba.co.uk/jpg/five/fre.php centrehotel.vn/wp-admin/user/cc/Panel/fre.php fitrtefast.com # Reference: https://twitter.com/JayTHL/status/1245781548776947717 parisgranhotels.ga # Reference: https://twitter.com/_lockhum/status/1239596021778448384 xpologistics.ga # Reference: https://pastebin.com/jd2T3CeC # Reference: https://www.virustotal.com/gui/ip-address/185.126.202.111/relations http://185.126.202.111 /.ku/sj'x.php # Reference: https://www.virustotal.com/gui/url/07e950cfaf51929eba8128986f4d2a704b6da6ee773a6826cd592d5dace13081/detection orderhrf.info # Reference: https://pastebin.com/zQD12eKq jinglejinglen.sytes.net # Reference: https://app.any.run/tasks/fc9b4808-e1ee-4c09-835d-512690fbba60/ brokenme.xyz # Reference: https://twitter.com/jcarndt/status/1250094793558036480 # Reference: https://app.any.run/tasks/854f4157-cb4c-4aa1-b1bc-ceea2e17b4fa/ http://198.23.200.239 stdy3frndgreencreamcostmeticsbabystored.duckdns.org # Reference: https://twitter.com/JayTHL/status/1253013042557849602 iranssp.ir # Reference: https://twitter.com/Bl4ng3l/status/1253681108304232455 alforcargo.com # Reference: https://twitter.com/DynamicAnalysis/status/1253740533186527234 15wsdychneswealthandmoduleorganisationcv.duckdns.org avertonbullk.com # Reference: https://twitter.com/Bl4ng3l/status/1254779727442665472 oneflextiank.com # Reference: https://twitter.com/jorgemieres/status/1254791348445515783 i-bss.com pyv.cl # Reference: https://twitter.com/James_inthe_box/status/1255496095586713606 nicecars.com.ar/mine/Panel/five/fre.php # Reference: https://www.virustotal.com/gui/domain/obimmaa.ir/relations obimmaa.ir # Reference: https://app.any.run/tasks/a7d1e0c4-3672-4b1e-a226-eeeae7f2eda7/ victorlascos.tech # Reference: https://www.trendmicro.com/vinfo/hk-en/security/news/cybercrime-and-digital-threats/loki-info-stealer-propagates-through-lzh-files # Reference: https://www.trendmicro.com/vinfo/hk-en/security/news/cybercrime-and-digital-threats/loki-delivered-as-cab-file-attachment # Reference: https://otx.alienvault.com/pulse/5eb18e3eefd6849508bbfbf4 # Reference: https://www.virustotal.com/gui/domain/retrak.co.ke/relations retrak.co.ke/psy/five/fre.php retrak.co.ke/wrdp/five/fre.php retrak.co.ke/wrdp4/five/fre.php # Reference: https://twitter.com/Racco42/status/1259780193142616065 evervisionicd.com vitecqroup.com # Reference: https://twitter.com/Bl4ng3l/status/1260481607200395264 beesco.net # Reference: https://twitter.com/malwrhunterteam/status/1260927561166553089 gllnar.com # Reference: https://app.any.run/tasks/948b2be1-45ec-4945-bc1b-e7c340b70053/ suckadick.website # Reference: https://twitter.com/malwrhunterteam/status/1261550904773402626 attlogistics-vn.com # Reference: https://twitter.com/James_inthe_box/status/1262383816724959233 abass.ir # Reference: https://twitter.com/James_inthe_box/status/1262742262968020994 # Reference: https://app.any.run/tasks/a03db040-fc61-416e-b178-61a8b15dddc8/ achbiz.xyz mecharnise.ir opilacorp-bd.com # Reference: https://twitter.com/reecdeep/status/1263123147517239297 shehig.com # Reference: http://tracker.viriback.com/dump.php (2020-02-29) # Reference: https://twitter.com/malwrhunterteam/status/1263421500142518279 maylnk.ml # Reference: https://twitter.com/ScarletSharkSec/status/1268202304995557378 1filesharing.ga # Reference: https://pastebin.com/FEP38DaR zangs.ga # Reference: https://pastebin.com/ZfiFFaaU b2bseller.ga medfinals.co.uk # Reference: https://app.any.run/tasks/325bf778-36b5-45c0-96ff-755f9cc0b1c1/ primalfoodsqroup.com # Reference: https://pastebin.com/4pZn49kK skullisland.gq # Reference: https://twitter.com/JCyberSec_/status/1272561016853991424 remote1.ga # Reference: https://twitter.com/malware_traffic/status/1272577932783947777 crogtrt.com # Reference: https://www.virustotal.com/gui/file/f5f343318832ad44e43a225a1b454d54ccbedfa4e6447c6467869b90c0e92e52/detection ' http://31.220.2.200 # Reference: https://www.virustotal.com/gui/file/d2857b888fbab6dc4e36c403e86f39fedee428ba5ed45b28b8f99e59fb93ff58/detection http://104.223.170.102 # Reference: https://twitter.com/JAMESWT_MHT/status/1275079040773189634 # Reference: https://app.any.run/tasks/212e514b-3f3d-4177-88ba-f242e081781d/ nnasout.com # Reference: https://blacklist.cyberthreatcoalition.org/vetted/url.txt http://193.142.59.169 apoxnew.com bchicct.com broken2.cf broken3.cf broken4.cf broken5.cf broken6.cf broken7.cf broken8.cf broken9.cf broken10.cf brokenservices.xyz bubuyayatoolslog.ir capital-sd.com clemglobal.com deloilte.com ducatl.com eocaenlogistics.com furnituresales.ir hazelmayclothing.com idehados.com.ar jastex.info just-in-timelog.com lapphoungshoes.com mahetechasia.com orangetoolzdemo.com orthopaedix.com.au psqdover.com rnarport.com sdgengtie.com skull247.cf skull3.ga skullisland.tk spqlobal.info taksamall.ir taruntextlies.com tehranfish.ir toyo-at-jp.info yaliapartotel.com ygsddl1.ml gorillahikeafrica.com/wp-includes/images/app/five/PvqDq929BSx_A_D_M1n_a.php gorillahikeafrica.com/wp-includes/images/img/five/PvqDq929BSx_A_D_M1n_a.php gorillahikeafrica.com/wp-includes/images/js/five/PvqDq929BSx_A_D_M1n_a.php irangoodshop.com/cd/PvqDq929BSx_A_D_M1n_a.php vancouverkitchencabinetrefinishing.com/five/fre.php vfsds.com/ark/fre.php wardia.com.pe/files/five/fre.php wardia.com.pe/wp-content/update/five/fre.php wardia.com.pe/wp-includes/files/five/fre.php # Reference: https://app.any.run/tasks/7c509e00-8424-4ffd-b5ee-7a8cc560a266/ argensudalimentaria.com.ar # Reference: https://pastebin.com/Hc73BzJT http://104.223.143.181 asatech.cf asatechw.gq asatechw.ml asatechw.tk emirate-net.me flexpak-th.com karachiwalla.com kranement.cf kranement.gq # Reference: https://www.virustotal.com/gui/file/d524ee4c7f70b45694218e309e9aaef64f96e812505c9c95891585555a195459/detection http://192.236.146.147 # Reference: https://app.any.run/tasks/d070ad67-c4e5-4c66-acda-c88a46885264/ beckhoff-th.com # Reference: https://app.any.run/tasks/dbb2312b-d7e1-468f-8956-9dfe6942e234/ reklaimapparel.com/wp-includes/ # Reference: https://app.any.run/tasks/c3ee77fd-bd3b-4ac8-a0fa-26cb0a8409f7/ http://195.69.140.147 # Reference: https://twitter.com/theDark3d/status/1288867976209469442 ckrlmay.ml # Reference: https://pastebin.com/iATkHK3K http://104.223.143.234 # Reference: https://pastebin.com/MUXDnknj joyn.com.pk # Reference: https://www.virustotal.com/gui/file/eeadaefc0f9331fbb9e1ceecf90667722dcae800a29c37413be37ff484daa61a/detection jetterweb.tech # Reference: https://www.virustotal.com/gui/file/23eb723f81c3f73aa38542436c30d9f1fe6a9bd26739b96438eb7a60b3f4b6c5/detection rbuaction.com # Reference: https://www.virustotal.com/gui/file/cc3053cb6f811fbef11211393b78e6e6fc49c05ba706a6daea440dab97db3736/detection goxer.club # Reference: https://securityliterate.com/analysis-of-lokibot-infostealer/ smallthingstress.sytes.net # Reference: https://twitter.com/ganeshnathan28/status/1297527613049712640 buildbd.org/slid/btc/Panel/five/PvqDq929BSx_A_D_M1n_a.php thernagictouch.com # Reference: https://twitter.com/ganeshnathan28/status/1297794454665953280 brokenbones.ml candestie.pw sieqwarteg.com # Reference: https://twitter.com/jstrosch/status/1298650225092034562 # Reference: https://www.virustotal.com/gui/file/e495e0e080d84256bbbd2b12d9ca05c4d1bcfcd623095ba87ec67f5abada017c/behavior alifmedical.shop # Reference: https://twitter.com/ganeshnathan28/status/1298656876800942087 sabzihome.com preprod.bridge2finance.com/xx/ petroindonesia.co.id optimavaluers.com # Reference: https://twitter.com/ganeshnathan28/status/1299024973026275329 joovy.ga # Reference: https://twitter.com/James_inthe_box/status/1014556042141679616 life-is-beautiful.in/inc/Panel/five/fre.php # Reference: https://twitter.com/JAMESWT_MHT/status/1300342452839161857 espaciointeriores.com.ar/espac/five/fre.php # Reference: https://pastebin.com/7LNRJB0c pvcfloorco.com # Reference: https://app.any.run/tasks/aa135b0a-6820-464a-9bb2-265eebc0ae06 # Reference: https://www.virustotal.com/gui/file/f3e4d77337c25f19d92971ac9386f5d0d22696d82f13cf28a7b3ab340e0c0295/behavior/VMRay mogawes.pw # Reference: https://app.any.run/tasks/e3801880-86d1-4828-bccf-634027c23a52/ remzclot.ga # Reference: https://otx.alienvault.com/pulse/5f522d7eaaaf821e26a2ba7c coltec.ga # Reference: https://twitter.com/VirITeXplorer/status/1305771835016044544 septxpm.xyz # Reference: https://otx.alienvault.com/pulse/5f60ae09c4538222cf48ad7c afcompresors.com # Reference: https://app.any.run/tasks/3e297077-5e3e-4f76-9b21-758e3efb15a7/ mflogistics-my.com # Reference: https://twitter.com/reecdeep/status/1313729438736146432 # Reference: https://app.any.run/tasks/86d35181-6dbf-412d-b965-f299882ea27e/ pklz.xyz # Reference: https://twitter.com/reecdeep/status/1315527072358576128 # Reference: https://app.any.run/tasks/25e32d38-6409-493f-a468-49f7c2696627/ # Reference: https://www.virustotal.com/gui/file/e4d4a263b17fa6e270bac22967c430a96671cc462862f15c9d5e917a32222118/detection xcpx.xyz # Reference: https://www.virustotal.com/gui/file/838a8c1b12270b248fd13d1f110998a79ee9442d19fb3f3562dfe734d7033367/detection http://104.223.143.132 # Reference: https://app.any.run/tasks/7e41dd5c-ac10-4032-81f5-034c985f26d6/ http://192.236.178.210 # Reference: https://www.virustotal.com/gui/file/0ddaa044ebe06ddc2b50948728a493bb027da4d42a7b15fa3a3361d590457fa7/detection theonlygoodman.com # Reference: https://www.virustotal.com/gui/file/580e2cee4eaf9102e25345a5d152f57a98b1d9299983d176575115ac6267f04e/detection venitronics.com/oo/Panel/fre.php # Reference: https://app.any.run/tasks/e7d8c2d3-81c8-4158-923e-66b9dc19484a/ magicview.ga # Reference: https://otx.alienvault.com/pulse/5f9023f897491403e533b1c0 amhercom-mx.com crestmart.ga kregmartlime.ga # Reference: https://otx.alienvault.com/pulse/5f9175733036fb104e24dd74 xvbt.ga # Reference: https://app.any.run/tasks/c607d61f-c52e-43ad-a2f3-737f29f26a75/ http://79.124.8.8/plesk-site-preview/heliopoliss.com/ # Reference: https://www.virustotal.com/gui/file/8ab355a4e825d4b233ce66f8e5f5b75b4c161cbb25f070f3355b6b15625dc784/detection # Reference: https://www.virustotal.com/gui/file/9fe21e1d604d54836584a3d8397e626200f3f4a533485bfb1922a46f7a4c0b96/detection # Reference: https://www.virustotal.com/gui/file/802b71bbcc620842158906bae965562bdaa4f5651529c3956dc2d6ac8ac6962a/detection smithandwollensky.com.tw/y1/Panel/fre.php smithandwollensky.com.tw/y2/Panel/fre.php smithandwollensky.com.tw/y3/Panel/fre.php # Reference: https://twitter.com/Racco42/status/1320715529754185730 # Reference: https://app.any.run/tasks/adc29078-5f0e-46e4-b9e3-819c37cc96fd/ olaplexs.com # Reference: https://twitter.com/d4rksystem/status/1321149663928614914 ckav.ru # Reference: https://app.any.run/tasks/a9efae2b-8245-496a-a52a-47f66ac1b094/ qataracfridgerepaire.com/templates/five/fre.php # Reference: https://twitter.com/James_inthe_box/status/1321453787576291328 pabloservices.ml # Reference: https://twitter.com/Racco42/status/1321596828765347841 # Reference: https://app.any.run/tasks/a51d3726-63d4-4d7e-ac67-e0bfb18f6afc/ vn-toupo.com # Reference: https://www.virustotal.com/gui/file/602c58e4deb0110c6b00d71231f12af54ee438c6a5e26ebda65021de6acaed32/behavior/C2AE mexicocomix.com # Reference: https://www.virustotal.com/gui/file/f4b7759a1a42ebd89a61ed697ca26661dff56719bbf254b7b1f400f3cf4487d1/detection brokensoul.cf # Reference: https://www.virustotal.com/gui/file/ed76de60fc812d7a8361a6b476f960ed8d3c07a6e1425d6c02c5d63e449cb0b3/detection pabloservices.ga # Reference: https://www.virustotal.com/gui/file/5ece83fb3098dfcfa2c8e9dbae44041364219db26d8a653dbb7b0a8223e04dc6/detection jagajaga-chichi.com # Reference: https://twitter.com/gorimpthon/status/1135854857682792448 epi.org.mk/css/vgn/ # Reference: https://www.virustotal.com/gui/file/76f44ea3c148283602e4dbd717f22ac95828b7e8e7677428f759c03cab0c8d49/detection nevomw.com # Reference: https://www.virustotal.com/gui/file/7c26db40707fee3b4f842feb653bad7e1dfa20cd05d8cdb944f0916d7de3453a/detection qqmailappupdate.ga # Reference: https://tria.ge/201112-l27a6ga2hj azzmtool.com kbfvzoboss.bid alphastand.trade alphastand.win alphastand.top # Reference: https://twitter.com/wwp96/status/1329978193932148736 drdoganaykurkcu.com myrilullimoti.blogspot.com # Reference: https://twitter.com/wwp96/status/1331061816466825217 # Reference: https://app.any.run/tasks/0aee4b8a-f366-4664-9064-c57f2464f9be/ alahlasi.com # Reference: https://www.virustotal.com/gui/file/f33cdff4f644b093d5781173c8de5df4d59f862c7b7744223b7190f4f385bdaa/detection blueriiver-eu.com # Reference: https://twitter.com/wwp96/status/1331050614520942597 drdoganaykurkcu.com # Reference: https://twitter.com/ffforward/status/1331239313036742658 # Reference: https://twitter.com/wwp96/status/1331415443375091714 alphastand.top alphastand.trade alphastand.win kbfvzoboss.bid legalpath.in/cc/Panel/fre.php # Reference: https://www.virustotal.com/gui/file/786bf0aa16596b06d3675c227f92bf8e0480c583b519b6b245933b46c268ecdd/detection propertymanagementmelbourne.biz # Reference: https://www.virustotal.com/gui/domain/x2z6c.xyz/relations # Reference: https://app.any.run/tasks/35acbab8-06d0-46d2-8f6f-3a1b198c24ae/ x2z6c.xyz # Reference: https://www.virustotal.com/gui/domain/quehenbergar.com/relations quehenbergar.com # Reference: https://www.virustotal.com/gui/file/af1a2e495c046c3b0e03d321c1f20c43198e2e8c88c41ab09a91ae80c5610137/community # Reference: https://urlhaus.abuse.ch/url/852301/ stdyshgshgnationalobjindustrialatstvar.ydns.eu # Reference: https://twitter.com/wwp96/status/1332138215877316608 tradesgroups.com # Reference: https://app.any.run/tasks/0fe6cd64-2924-4c30-9fd9-3fc06373293c/ endustrigm.eu # Reference: https://otx.alienvault.com/pulse/5fcb7771ab7af05588bf0f85 # Reference: https://app.any.run/tasks/823eff01-5489-4ae3-a364-aaab1cba7822/ # Reference: https://app.any.run/tasks/cd3ce9d3-e315-455e-84f7-de96cd1cb52c/ # Reference: https://app.any.run/tasks/ca5c5b8f-f927-481b-ba08-1226901a19d8/ greenwsdykegheedahatakankeadeshnaawsgma.ydns.eu digicon.com.mx hanmails.net thunlen.com webtex.ga # Reference: https://twitter.com/wwp96/status/1335697459452973057 x26zc.xyz # Reference: https://twitter.com/wwp96/status/1335698009515057160 # Reference: https://www.virustotal.com/gui/ip-address/104.168.146.103/relations http://104.168.146.103 /eXcessBLESSINGforTheBoy/ /MegAMOneyMenINTurkey/ # Reference: https://twitter.com/wwp96/status/1335698347051671553 # Reference: https://app.any.run/tasks/5bb59473-bef2-4392-9b65-00885ef59489/ http://45.134.225.18 # Reference: https://twitter.com/wwp96/status/1335698992768954373 # Reference: https://app.any.run/tasks/38bcb9fb-7377-4850-a0da-137748114e80/ retrak.co.ke/psy/five/fre.php # Reference: https://twitter.com/JAMESWT_MHT/status/1335857233792557056 benweve.com # Reference: https://twitter.com/wwp96/status/1336054621501071361 roycolemandds.com/royco/five/fre.php # Reference: https://twitter.com/wwp96/status/1336055936893509640 foremanindustrial.com # Reference: https://twitter.com/wwp96/status/1336342722131730432 # Reference: https://app.any.run/tasks/22cf8f61-87d2-4b93-b7a1-f0a674694f8c/ begadi.ga sndyantipiracydetectorganisationfsnfilm.ydns.eu # Reference: https://twitter.com/wwp96/status/1336339387085307904 # Reference: https://app.any.run/tasks/429f4ced-640a-4690-b6c3-87e2e2ce38c4/ http://185.239.242.219 # Reference: https://twitter.com/wwp96/status/1336338329235648514 # Reference: https://app.any.run/tasks/56e10048-ca4a-47fd-b009-7d6b8954d56f/ http://37.46.150.41 # Reference: https://twitter.com/wwp96/status/1336342967230062597 # Reference: https://app.any.run/tasks/3d21e672-ad77-4e06-a4c6-a49b22799f04/ ge0x.com # Reference: https://twitter.com/wwp96/status/1336487986519830533 clubulvacantei.ro # Reference: https://twitter.com/wwp96/status/1336838356316073987 # Reference: https://app.any.run/tasks/9bc031c5-cb69-4318-b51c-0c89033cc5b5/ http://198.44.96.231 /ZanGarOLLIngChiFAGbor/ # Reference: https://twitter.com/wwp96/status/1336832463868452870 # Reference: https://app.any.run/tasks/254603fe-3ca6-4de2-923d-eb841a889697/ forrastfoods.com # Reference: https://twitter.com/wwp96/status/1336831438315016193 # Reference: https://app.any.run/tasks/ca33f943-cb89-494c-950b-20ca747dc70e/ jessicaarnold.com # Reference: https://twitter.com/wwp96/status/1338467036037574657 balanceconmunity.com # Reference: https://twitter.com/wwp96/status/1338467507313782785 bms-itd.com # Reference: https://twitter.com/wwp96/status/1338465275142868993 asiacmolds.com # Reference: https://www.virustotal.com/gui/file/79c9d49f88ea4b408c8bfd88e0b60ffbd9f63dd6542eb54867b49cfb09933a8a/behavior/Dr.Web%20vxCube # Reference: https://www.virustotal.com/gui/url/e29d5fc79b469f8028281e4a08ef2a3e372e9d5521509a6a36a52ba9b438c44f/details shgshgstdynationalobjindustrialatstftp.ydns.eu # Reference: https://twitter.com/wwp96/status/1338897248894275585 stdyantipiracydetectorganisationfstfbbc.ydns.eu # Reference: https://twitter.com/wwp96/status/1338885068601896960 cyber-access.co.uk # Reference: https://twitter.com/wwp96/status/1338893400750211074 cleo2solutions.com.au/wp212/five/fre.php # Reference: https://twitter.com/reecdeep/status/1339494112278573056 wsdychnesqudusisabadassniggainthewsbkw.ydns.eu # Reference: https://blog.talosintelligence.com/2020/12/threat-roundup-1211-1218.html (# Win.Dropper.LokiBot-9810026-0) # Reference: https://www.virustotal.com/gui/file/7134a18aa564b29298bc83a170ad8262264b18d788d5fcc104de189b1522deab/detection pionveriy.com resgisupdatex.com seeuaround.info techsupdate1.com # Reference: https://www.virustotal.com/gui/file/31d3b6f541ae1432070588b31f3e57ea088d96c19ca00780b7e3a5a9637f393e/detection microsoft23-uslive4.online # Reference: https://app.any.run/tasks/6122c973-3625-4a60-aef7-511ae9d1a248/ habibmentro.com # Reference: https://www.virustotal.com/gui/file/dcc94b0c8fdf6952bd3018d92c1264651d50aaa7911195bb6f9bc6b97618b191/detection http://185.206.215.56 # Reference: https://www.virustotal.com/gui/file/84bad84c6f92ba34b25d9a3164f1abc82986ddd901128eb5e71f60d23d063c32/detection http://79.124.8.6 # Reference: https://www.virustotal.com/gui/file/956741cfb963a29651abae4b0bee9185ad7688cdc0f97f2336c891daab84976e/detection gulshanti.com # Reference: https://www.virustotal.com/gui/file/89ca0ea25e05983099ae8221becde0d57c5528d85d6ab8fd944f7c941437d679/detection deqtmaysoor.com # Reference: https://www.virustotal.com/gui/file/81274d23515440feac07a591db64f946640ab3a4350bbfaa0d955ced83175fb0/detection taiwanmoid.com # Reference: https://www.virustotal.com/gui/file/02944dc72a15e92ec94c453c74c9564cb59ac7717dffcb25fa854a2e587fb737/detection worldpackmx.com # Reference: https://app.any.run/tasks/f22144f0-004d-4a55-845e-9cee9c776cef/ # Reference: https://www.virustotal.com/gui/domain/paciflxinc.com/community paciflxinc.com # Reference: https://twitter.com/reecdeep/status/1349635770060042240 # Reference: https://otx.alienvault.com/pulse/600184f383b1874288c3d81f # Reference: https://www.virustotal.com/gui/file/9213594d63646a5144de658badc6f9fd4ac15ce711bac1f115ccdf08d74c8add/detection blueriiver-eu.com lmpulsefashion.net shgshgwsdynationalws.dns.navy # Reference: https://twitter.com/reecdeep/status/1351181201382502402 # Reference: https://app.any.run/tasks/3cd52c62-e96c-465c-ae06-aec3059a8414/ # Reference: https://app.any.run/tasks/2f90556b-c4c6-4b1a-a6ce-f924fbb49be1/ becharnise.ir # Reference: https://www.virustotal.com/gui/domain/dcspm.xyz/community dcspm.xyz # Reference: https://www.virustotal.com/gui/domain/katikati1.ga/community katikati1.ga # Reference: https://www.virustotal.com/gui/domain/xz26c.xyz/community xz26c.xyz # Reference: https://www.virustotal.com/gui/domain/martinskrtel.gq/community martinskrtel.gq # Reference: https://www.virustotal.com/gui/domain/ovcslogs.ml/community ovcslogs.ml # Reference: https://www.virustotal.com/gui/domain/spmdc.xyz/community spmdc.xyz # Reference: https://www.virustotal.com/gui/domain/jumiliaintl.ml/community jumiliaintl.ml # Reference: https://www.virustotal.com/gui/domain/kox.juristi.info/community kox.juristi.info # Reference: https://www.virustotal.com/gui/domain/pkuz.xyz/community pkuz.xyz # Reference: https://www.virustotal.com/gui/domain/mnbp.tk/community mnbp.tk # Reference: https://www.virustotal.com/gui/domain/onlygodem.com/community onlygodem.com # Reference: https://www.virustotal.com/gui/domain/ge0x.com/community ge0x.com # Reference: https://www.virustotal.com/gui/domain/adobedocument.cf/community adobedocument.cf # Reference: https://www.virustotal.com/gui/domain/microsoft23-uslive4.online/community microsoft23-uslive4.online # Reference: https://www.virustotal.com/gui/domain/balanceconmunity.com/relations balanceconmunity.com # Reference: https://www.virustotal.com/gui/domain/asiacmolds.com/relations asiacmolds.com # Reference: https://www.virustotal.com/gui/domain/tuandat-vn.com/community tuandat-vn.com # Reference: https://app.any.run/tasks/9f65a096-38c7-4f88-b7f7-6ed925e70995/ zunlen.com # Reference: https://www.virustotal.com/gui/file/03cf03d1cb4fa502ef1992e2aad3f1f7f0d7fbf1f16839d87eaa04f330211bbe/detection http://104.223.170.100 # Reference: https://otx.alienvault.com/pulse/600abf719f1151b28321f55a # Reference: https://www.virustotal.com/gui/file/902097c3f3f47a39b7d661c3ee5736ce258ed3862a3740a71820b10cc2fcf939/detection # Reference: https://www.virustotal.com/gui/file/600e4f952ff54d9e5051b0b7b1a32a8a12c8efd6e08a87b9f67447d354853e91/detection # Reference: https://www.virustotal.com/gui/file/0363812a5fc968e7f43e83873dcf81915da64f4458ce84deb8906a31a1b7962b/detection mannaton.com papanwa.com wagisz.com # Reference: https://app.any.run/tasks/aae239db-83f1-4277-a29a-e1e9bacef997/ oct2.xyz # Reference: https://app.any.run/tasks/f224a884-cda3-48da-9aca-5e3361a6bbee/ pearl-energia-hu.ml # Reference: https://app.any.run/tasks/47bea1eb-f304-4820-a700-f14886b77741/ upbckwsdyfaruzevwskx.dns.army # Reference: https://app.any.run/tasks/47bea1eb-f304-4820-a700-f14886b77741/ zangaa.com # Reference: https://app.any.run/tasks/7c07b1d2-7595-48c6-b3eb-4e63dafd72a4/ # Reference: https://urlhaus.abuse.ch/url/986053/ # Reference: https://urlhaus.abuse.ch/url/980012/ # Reference: https://www.virustotal.com/gui/file/bf96d045cd9edd9519e2f4738ca03e73c409dd1a36b2cb70228bb6c7aaf53cc5/behavior/Dr.Web%20vxCube # Reference: https://www.virustotal.com/gui/file/dfe044c12d3cd08182460432bc569811a9d657fc69d18549b7e66fcf1d16af2d/behavior/Dr.Web%20vxCube # Reference: https://www.virustotal.com/gui/ip-address/103.99.1.173/relations mslogstdyinvestmstqw.dns.army mslogtsdyinvestmntsn.dns.army sndymsloginvestmntsn.dns.army mslogwsdyinvestmntws.dns.army # Reference: https://twitter.com/reecdeep/status/1357239822667177984 ragnaar.us # Reference: https://twitter.com/MSteve25/status/1357400557015695360 dstutoring.co.za/dstu/five/fre.php # Reference: https://twitter.com/reecdeep/status/1359083800337252353 sspmoct.xyz # Reference: https://twitter.com/whitehoodie4/status/1359427231907471361 # Reference: https://app.any.run/tasks/0ea99cf7-a982-4fd5-8fdb-8fb87bb91729/ # Reference: https://app.any.run/tasks/7cd630b8-aa8f-4b94-b825-b12e5ab8ab00/ http://51.195.53.221 # Reference: https://app.any.run/tasks/27248d81-0a85-4dea-8024-88a95d3b0f72/ atlasqrp.com # Reference: https://www.virustotal.com/gui/file/84262bd7245efd69020a3c4dadc42814d6450467c7f111326019ccbd5cb1a4c1/detection azmtool.us # Reference: https://www.virustotal.com/gui/file/96fc6262a2fc1c74b041cbf0189fe02225dd5b117a2d80dca53d665f34376d71/detection klimsourcinq.com # Reference: https://www.virustotal.com/gui/file/b2bb1dbe470290b55f3e236d70d497ada40c1436c61432924c4503f120e191a0/detection newcesarnex.com # Reference: https://app.any.run/tasks/9087025d-aeb9-4c0a-b5fb-0c6c01bdc161/ 3tril.com # Reference: https://twitter.com/wwp96/status/1364222356844130305 # Reference: https://app.any.run/tasks/1e40d1c0-441f-4f04-8c63-0b11b66a64be/ opdebeeck-vvorth.com # Reference: https://twitter.com/reecdeep/status/1364120441430892545 nitengystdylunatsthj.dns.army or-logistlcs.com # Reference: https://twitter.com/wwp96/status/1364617639595761667 # Reference: https://app.any.run/tasks/d84243a5-a811-4f9f-8f74-a4d1d62758f4/ ianmaclaod.com # Reference: https://twitter.com/wwp96/status/1364811956763455489 stdychnesquduslasisi.dns.army # Reference: https://twitter.com/wwp96/status/1364985123918200833 mndytheviejupcafgast.dns.army # Reference: https://otx.alienvault.com/pulse/603cd878f5c176eb44d16c62 fakeme.us notaires.ml # Reference: https://twitter.com/wwp96/status/1366423563067080708 # Reference: https://app.any.run/tasks/cb3e403c-8a4e-4e11-bd17-3998d52be8d3/ takr.xyz # Reference: https://twitter.com/wwp96/status/1366433733331595267 # Reference: https://app.any.run/tasks/52134e48-f8f9-4211-a5c0-de8221497f19/ nbnbstdynewagedevice.dns.army # Reference: https://twitter.com/wwp96/status/1366434054904684548 ritcophysiotherapy.com.au/hod/five/fre.php # Reference: https://twitter.com/wwp96/status/1366433733331595267 twocups.io/fonts/csm/twoc2/fre.php # Reference: https://twitter.com/luc4m/status/1366807263168499713 # Reference: https://www.virustotal.com/gui/file/25316976638e2904db2baa1dcaee6f5b2aa1745e268236545cb0bb353bdd3133/detection gilardoni-it.xyz # Reference: https://twitter.com/wwp96/status/1366833259167023112 sunwindz.in.net # Reference: https://twitter.com/wwp96/status/1366833336430325761 hiqhway39clothing.com # Reference: https://twitter.com/wwp96/status/1367333816461897728 # Reference: https://app.any.run/tasks/e49801eb-8626-452b-b053-b01ae8383661/ tsdytopretwoanimavin.dns.army turbinetechnlcs.com # Reference: https://www.virustotal.com/gui/file/17c2cd6cfad567f1a23bba2bba2ffa42127fc96a47b16ec712a6cfb861329d37/detection manioscinetools.ga # Reference: https://www.virustotal.com/gui/file/267d978525035bd0bea01078c5d2370e39eeb0580c644ea9ded109175ce99db2/detection stdyrusschine2ganmax.dns.army # Reference: https://twitter.com/pmmkowalczyk/status/1367513333629337604 ibgreenstdyfestivers.dns.army kungsb2stdygotmental.dns.army stdyrusschine2ganmax.dns.army # Reference: https://twitter.com/K_N1kolenko/status/1367777662341636097 http://142.11.210.173 eurasiacl--kr.com locandasolagna.xyz merivaara.xyz # Reference: https://twitter.com/K_N1kolenko/status/1367777709032677378 schroederindustries.cf sdworks-kh.com turbinetechnlcs.com # Reference: https://www.virustotal.com/gui/file/4c5927931366b44575743070f799c7f7b4ac67a248fd4551dcbd4cced53fd358/detection taker1.xyz # Reference: https://www.virustotal.com/gui/domain/gunrunners.com/detection gunrunners.com # Reference: https://twitter.com/wwp96/status/1369456626231607302 # Reference: https://app.any.run/tasks/1062df81-c0b5-4d74-8c68-9aca280a2578/ bremileintl.ga # Reference: https://twitter.com/wwp96/status/1369455636434591749 # Reference: https://app.any.run/tasks/095e3089-f42a-4a20-9071-054ccb5db7f0/ optimalwellengineering.com/hkd/five/fre.php # Reference: https://twitter.com/wwp96/status/1369452911193956353 # Reference: https://app.any.run/tasks/ba3afc27-b868-4873-b6d2-5167d570386a/ taker2.xyz # Reference: https://twitter.com/wwp96/status/1369685805057314817 # Reference: https://app.any.run/tasks/ca5905fd-4141-42af-b1d7-2375f4a9dbf0/ http://193.56.29.165 # Reference: https://twitter.com/wwp96/status/1369685649918398469 # Reference: https://app.any.run/tasks/1e8c8938-2f96-4e72-b1ea-6c865223e098/ eurasiacl--kr.com stdytopreoneenversrw.dns.army # Reference: https://twitter.com/wwp96/status/1369682990628999175 # Reference: https://app.any.run/tasks/b93ad205-66a9-4104-810b-7f6cf14d89da/ seafirst-kr.com theviestdyjupcafgsvb.dns.army # Reference: https://otx.alienvault.com/pulse/604b58f4d2a09cb827a9df55 astro--pacific.com # Reference: https://twitter.com/pmmkowalczyk/status/1370437460971360265 libo-cc.com # Reference: https://twitter.com/wwp96/status/1371823183347728385 # Reference: https://app.any.run/tasks/4cb0713d-41dc-4598-9883-e8cbddf4503f/ exchangebill.xyz # Reference: https://twitter.com/wwp96/status/1371824003392942094 # Reference: https://app.any.run/tasks/e9508d8c-38c7-41fe-951a-e8f78e502232/ http://87.251.79.157 # Reference: https://twitter.com/wwp96/status/1371823839278211073 doshlforex.com # Reference: https://twitter.com/wwp96/status/1372017516961280005 # Reference: https://app.any.run/tasks/520f4cc5-26fe-4af2-9a6c-e3cd0cd35ed8/ raptechenglneering.com # Reference: https://twitter.com/wwp96/status/1372015190036865026 # Reference: https://app.any.run/tasks/be4e8355-d827-4522-a2fc-b833a2757f1a/ kweend.com # Reference: https://twitter.com/wwp96/status/1372014489290350595 # Reference: https://app.any.run/tasks/d3e8c107-7139-4dac-928a-1f25f75d0e34/ btsuganda.net # Reference: https://twitter.com/wwp96/status/1372013239517773824 # Reference: https://app.any.run/tasks/6accddac-e53b-4f13-9abd-5effeeaacee5/ solumaticsac.com # Reference: https://twitter.com/wwp96/status/1372012705687732224 # Reference: https://app.any.run/tasks/c474020f-46e4-46ee-8f5a-b4585881f17f/ wonkwonschoolrp.hopto.org # Reference: https://twitter.com/wwp96/status/1372218390761377792 # Reference: https://app.any.run/tasks/4aac3803-55b7-4cba-9224-19cc193c42b2/ nakib.buet.ac.bd/ox/Panel/fre.php # Reference: https://twitter.com/wwp96/status/1372219685098389509 # Reference: https://app.any.run/tasks/f5088ddd-0c00-42d6-9405-533605623cf2/ papanwa.us # Reference: https://twitter.com/reecdeep/status/1372831122174963713 stdykungsb2talentwej.dns.army # Reference: https://twitter.com/wwp96/status/1374089580337623044 # Reference: https://app.any.run/tasks/4dd28dbf-a5d5-418b-a275-d0dbd65ed241/ splitwise.xyz # Reference: https://twitter.com/wwp96/status/1374087082503778308 # Reference: https://app.any.run/tasks/85549f57-5e33-425c-806a-f4141c414edc/ kencana-sakti.com # Reference: https://twitter.com/wwp96/status/1374086006589296646 # Reference: https://app.any.run/tasks/0b18d4be-7833-4ae4-a5df-6fb791c866a5/ http://203.159.80.87 # Reference: https://twitter.com/wwp96/status/1374085642309804039 # Reference: https://app.any.run/tasks/8f3c8422-e6ea-4738-9e47-c1e7b910e91d/ akhtargroup.xyz # Reference: https://twitter.com/pmmkowalczyk/status/1374317050320068610 # Reference: https://twitter.com/pmmkowalczyk/status/1374317051788021762 fauracia.biz moem-my.com transcorpoil.us nbnbnstdylionkistwcx.dns.army pmrimestdylimtstwork.dns.army rkkrstdygorgiousejds.dns.army stdyunitedkesokostxc.dns.army # Reference: https://twitter.com/wwp96/status/1376023882168156163 # Reference: https://app.any.run/tasks/99a8ed00-e4e4-44dc-bce6-451c00f47455/ camfil.xyz # Reference: https://twitter.com/wwp96/status/1376544786069458954 # Reference: https://app.any.run/tasks/2eb65481-a609-4cd3-a354-0f047fc93733/ baysankazan.biz rkkrstdygorgiousejtw.dns.army # Reference: https://twitter.com/jstrosch/status/1376561007477280775 chem.buet.ac.bd/ox/ # Reference: https://twitter.com/wwp96/status/1376721258004500483 interocean-my.com # Reference: https://www.virustotal.com/gui/file/07ec8aba1d41b1769e50c309d5a8a7f6a513c1d373f8e32bbc2fc766bfc66e04/detection gccorps.com # Reference: https://www.virustotal.com/gui/file/8e15f76149baa634caba6bcb021a5793f9b86c6290247d62a3f9628e5e147c7f/detection lucreneluxe.com # Reference: https://twitter.com/wwp96/status/1379440650689593345 # Reference: https://app.any.run/tasks/43f83b67-59ff-46db-b39f-03c8d1cc92c1/ transcorpoil.com # Reference: https://www.virustotal.com/gui/file/90264601dc078ff9628a36dcca7a4ca0c65c7c68315601f6688f2690847fdab7/detection amrp.tw # Reference: https://otx.alienvault.com/pulse/606ef1757caeabbc2d4aa847 laes12.com # Reference: https://twitter.com/malwrhunterteam/status/1381494190706659329 covid19vaccinations.hopto.org # Reference: https://www.virustotal.com/gui/file/7eacabe85e7c5d75c8505348c3729fb9b1a865674632cbe95bf2b3a23828a6b1/detection zkl-cz.com # Reference: https://twitter.com/wwp96/status/1382001625498271748 # Reference: https://app.any.run/tasks/a2fe837f-befc-4d24-bc8b-039e9f87316e/ eyecos.ga # Generic /~dasdas/ff.php /.halo/rsd.php /.isuoxiso/w.php /.op/cr.php/ /.tcsogb/ /.tcsogb/gi'v.php /.tcsogb/vc.php /.well-known/pki-validation/w.php /etc/main/l09/ /high/sumy/ltd.php /ibiki/gate.php /logs/omc.php /luck/ag.php /22/2/cgi.php /mor/f/cgi.php /p.php/3g7lxZzzM12qa /p.php/6LCNCuwTJZMVe /p.php/dT1AczPg2GOit /p.php/Gs8nhPqptLJln /p.php/lJ606117cGKwY /p.php/S7zr5v1fXI3Rb /p.php/TABGAUKhpT2hu /p.php/UjL7jh4u2t3CH /S7zr5v1fXI3Rb /$01/5l/h/site.php /$01/b1/c/site.ph /$01/t7/x/site.php /$01/zC/f/site.php /iH/cy/l/site.php /iH/da/!/site.php /amb/0/site.php /b0/t8/site.php /bu/!!/site.php /m/2/site.php /ne3/h/site.php /r!/e/site.php /t70/H/site.php /vp-/9/site.php /liv-01/pin.php /slice/pin.php /3yt00/pin.php /tyi/pin.php /m0ham/pin.php /morx/1/cgi.php /rozay/pin.php /chikincho/fina.php /makave/fina.php /monyman/gate.php /newman/fina.php /omega/fina.php /vvd/fina.php /zanku/fina.php /zmzmz/file.php /zszszs/file.php /fre.php /Lokii_Panel.zip /oy1vwB10bvfF3 /receipmt/regasm.exe /m0ha/0/pin.php /bo22/1/pin.php