# Copyright (c) 2014-2026 Maltrail developers (https://github.com/stamparm/maltrail/)
# See the file 'LICENSE' for copying permission

# Aliases: APT-C-55, Black Banshee, Velvet Chollima, ta427, RftRAT, moonpeak, UAT-5394, archipelago, emerald sleet, sparkling pisces, springtail, kospy, Larva-25004, kimjongrat, pebbledash, HancomAgent, blindingcan, comebacker, HttpTroy, endclientrat, unc3782

# Reference: https://otx.alienvault.com/pulse/5c93c4e48312d159728a9d78
# Reference: https://blog.alyac.co.kr/2209 (Korean)

maii-daum-net.atwebpages.com
nate-on.bug3.com
hanmail.membercp.net
korea.getenjoyment.net
mail.membercp.net
/itsme.daum

# Reference: https://twitter.com/blackorbird/status/1086970613552447489

safe-naver-mail.pe.hu

# Reference: https://twitter.com/blackorbird/status/1113318554563076096
# Reference: https://github.com/blackorbird/APT_REPORT/blob/master/kimsuky/aptnote0403
# Reference: https://blog.alyac.co.kr/2234 (Korean)

tcjst.com

# Reference: https://twitter.com/blackorbird/status/1118334122592591872
# Reference: https://raw.githubusercontent.com/blackorbird/APT_REPORT/master/kimsuky/Smoke%20Screen.pdf
# Reference: https://www.virustotal.com/gui/ip-address/192.186.142.74/relations
# Reference: https://otx.alienvault.com/pulse/5cb6e14b2fefc160d9e18b24

http://192.186.142.74
192.186.142.74:81
seoulhobi.biz

# Reference: https://twitter.com/RedDrip7/status/1133268937808859136

lovemoney.mypressonline.com

# Reference: https://blog.alyac.co.kr/2336 (Korean)
# Reference: https://otx.alienvault.com/pulse/5d13373f428cfccd0fa506a6

hellojames.sportsontheweb.net

# Generic trails (also can be met in https://unit42.paloaltonetworks.com/babyshark-malware-part-two-attacks-continue-using-kimjongrat-and-pcrat/)

/expres.php

# Reference: https://blog.alyac.co.kr/2347 (Korean)
# Reference: https://otx.alienvault.com/pulse/5cffce34469a83ecb23c93db

http://202.168.155.156
carolie-svr-v1.16mb.com
my-homework.890m.com
naver-security-mail.96.lt
oeks39402.890m.com
filer1.1apps.com
filer2.1apps.com
kuku675.site11.com
kuku79.herobo.com

# Reference: https://blog.alyac.co.kr/2389 (Korean)
# Reference: https://otx.alienvault.com/pulse/5d14b11389f0f0ece394fab8

atene.myartsonline.com
hellojames.sportsontheweb.net
nid2-naver-com.medianewsonline.com
smalldeal.mypressonline.com

# Reference: https://www.anomali.com/blog/suspected-north-korean-cyber-espionage-campaign-targets-multiple-foreign-ministries-and-think-tanks
# Reference: https://otx.alienvault.com/pulse/5d5d6f5c5f0e4d2b7f5f3208
# Reference: https://twitter.com/blackorbird/status/1164370375490228224

alone-service.work
app-support.work
check-up.work
com-main.work
doc-view.work
login-confirm.work
member-service.work
minner.work
short-line.work
sub-state.work
web-line.work

# Reference: https://twitter.com/cyberwar_15/status/1166592637371060226

rnailr.com

# Reference: https://www.cert.ssi.gouv.fr/uploads/CERTFR-2019-ACT-009.pdf
# Reference: https://otx.alienvault.com/pulse/5d6d754babe6ca295f94cb1b

accounted.top
acounts.work
ahooc.com
alive-user.work
alone-service.work
app-house.online
app-main.site
app-support.site
app-support.work
check-line.site
check-operation.site
check-up.work
client-mobile.work
confirm-main.work
dounn.net
dovvn-mail.com
drog-service.com
eposcard.co
first-state.work
gstaticstorage.com
heehorse.com
hotrnall.co
imap-login.com
inbox-mail.work
inbox-yahoo.com
lh-login.com
lh-logs.com
lh-yahoo.com
local-link.work
log-yahoo.com
login-confirm.site
login-confirm.work
login-history.pw
login-sec.com
login-use.com
login-yahoo.info
logins-yahoo.com
mail-down.com
mail-inc.work
mail-service.win
mailseco.com
main-line.work
main-service.site
main-support.work
matmiho.com
member-service.work
message-inbox.work
minner.work
mobile-device.site
mobile-phone.work
myprivacy.work
net-policies.work
old-version.work
online-support.work
open-auth.work
options.work
page-view.work
phlogin.com
profile-setting.work
protect-com.work
protect-mail.work
protect-main.site
retry-confirm.com
script-main.site
sec-line.work
sec-live.com
set-login.com
setting-main.work
share-check.site
short-line.work
sign-in.work
srnbc-card.com
user-account.link
user-accounts.net
user-service.link
user-service.work
viewetherwallet.com
wallet-vahoo.com
weak-online.work
web-info.work
web-mind.work
web-online.work
web-rain.work
web-state.work
web-store.work
yah00.work
yrnall.com

# Reference: https://twitter.com/JAMESWT_MHT/status/1177115401400016901
# Reference: https://blog.alyac.co.kr/2538 (Korean)
# Reference: https://otx.alienvault.com/pulse/5d8dd05bac456c1dade338df

joelwisian.com
reunionhomesok.com

# Reference: https://twitter.com/blackorbird/status/1178497550938034177

eoplus.co.kr/board/pressed/
eoplus.co.kr/board/presset/

# Reference: https://www.virusbulletin.com/uploads/pdf/conference_slides/2019/VB2019-Kim.pdf
# Reference: https://otx.alienvault.com/pulse/5d9f541a43c2babf60994786

c-naver.com
daum-center.net
rrnaver.com
udaum.net
account-google.member-authorize.com
user-manage-center.hol.es
user-daum-center.pe.hu
user-protect-center.pe.hu
naiei-aldiel.16mb.com
nid-protect-team.pe.hu
nid-management-team.890m.com
oeks39402.890m.com
vkcxvkweo.96.lt

# Reference: https://otx.alienvault.com/pulse/5dac36de0d5134df36b16666

clouds.scienceontheweb.net

# Reference: https://twitter.com/spider_girl22/status/1191306963369353216

online---shop.atwebpages.com

# Reference: https://blog.alyac.co.kr/2645 (Korean)
# Reference: https://otx.alienvault.com/pulse/5de68f93fc4d8a6303a7598b

member-view-center.esy.es
primary-help.esy.es
ago2.co.kr/bbs/data/dir/F.php
antichrist.or.kr/data/cheditor/dir1/F.php
gyjmc.com/board/data/cheditor/dir1/F.php

# Reference: https://otx.alienvault.com/pulse/5e257c8c189e48e8e053e75b

antichrist.or.kr/data/cheditor/dir1/lyric64
batgalim.org.il/facebook/Facebook/Entities/ppp/encoding.png
jonashartley.com/hilaryolsen/wp-includes/images/crystal/1122/upload.php
jonashartley.com/hilaryolsen/wp-admin/network/run.php
jonashartley.com/hilaryolsen/wp-includes/random_compat/1122/res.php
jonashartley.com/hilaryolsen/wp-includes/random_compat/1122/expres.php
jonashartley.com/hilaryolsen/wp-includes/customize/1111/res.php
jonashartley.com/hilaryolsen/wp-includes/customize/1111/expres.php
happy-new-year.esy.es
safe-naver-mail.pe.hu

# Reference: https://www.virusbulletin.com/uploads/pdf/conference_slides/2019/VB2019-Kim.pdf
# Reference: https://otx.alienvault.com/pulse/5e42fd9c9fa37be52610c5c5

accounting-microsofft.epizy.com
csdaum-help.esy.es
daum-account-login.esy.es
daum-account-login.esy.esoeks39402.890m.com
daum-account-signin.pe.hu
daum-login-protect.hol.es
daum-setting.hol.es
daum-stting.hol.es
daumlogin.esy.es
gyjmc.com
mail-customer-safety-center.hol.es
mail-kinu.hol.es
mail-naver-protect.hol.es
mail.naver.comuf.com
member-authorize.com
member-daum-regist.hol.es
member-view-center.esy.es
memver-view-center.esy.es
nager-relogin-security.96.lt
naiei-ldel.16mb.com
naver-password.esy.es
naver-security-mail.96.lt
naverhelp.esy.es
naverkorea.esy.es
naverlogin.esy.es
nid-mail.pe.hu
nid-management-team.890m.com
nid-protect-team.pe.hu
primary-help.esy.es
protect-yahoo-teeam.000webhostapp.com
security-mail-daum.000webhostapp.com
snu-mail-ac-kr.esy.es
suppcrt-seourity.esy.es
uefa2018.000webhostapp.com
user-daum-center.pe.hu
user-management-center.hol.es
user-protect-center.pe.hu
vkcxvkweo.96.lt
webrnail-kinu.hol.es

# Reference: https://twitter.com/anyrun_app/status/1115513990711521280
# Reference: https://www.virustotal.com/gui/file/540336c5e61d589776e267eed14eac835720b4484312434ce4f27adfec8bf817/detection

185.224.137.164:21

# Reference: https://twitter.com/cyberwar_15/status/1227709181605613569

happy-boy.pe.hu

# Reference: https://www.pwc.co.uk/issues/cyber-security-data-privacy/research/tracking-kimsuky-north-korea-based-cyber-espionage-group-part-1.html
# Reference: https://otx.alienvault.com/pulse/5e4c19894aad216887c8cb3d

ago2.co.kr/bbs/data/tmp
aiyac-updaite.hol.es
daum-center.net
embed-helper.esy.es
er-manage-center.hol.es
finale-jack.esy.es
kakao-check.esy.es
my-homework.890m.com
naver-mail-com.hol.es
nid-protect-team.pe.hu
nid-yyanagemeniteam.890m.com
nortice-centre.esy.es
oeks39402.890m.com
rrnaver.com
simple-hick.esy.es
suppcrt-seourity.esy.es
udaum.net
upgradesrv.890m.com
user-daum-center.pe.hu
user-manage-cenier.nol.es
user-protect-center.pe.hu

# Reference: https://twitter.com/blackorbird/status/1107214927402418176
# Reference: https://twitter.com/blackorbird/status/1107479347013672960

ddlove.kr/bbs/dta/1

# Reference: https://twitter.com/blackorbird/status/1082553543280680962

ago2.co.kr/bbs/data/dir

# Reference: https://twitter.com/cyberwar_15/status/1230093739554557953

pingball.mygamesonline.org

# Reference: https://twitter.com/spider_girl22/status/1233198285747154944
# Reference: https://twitter.com/cyberwar_15/status/1241591674255446016
# Reference: https://app.any.run/tasks/f4172853-90e6-49ad-be7b-bf6efa771448/

nagoya.datastore.pe.hu
suzuki.datastore.pe.hu
toyota.datastore.pe.hu

# Reference: https://blog.alyac.co.kr/2737 (Korean)

mernberinfo.tech

# Reference: https://twitter.com/cyberwar_15/status/1232989735011794945
# Reference: https://www.virustotal.com/gui/file/2cd5f1852ac6d3ed481394ea0abc49f16789c12fb81bcdf9988762730fb0aa8f/detection
# Reference: https://twitter.com/spider_girl22/status/1234761655214493697
# Reference: https://twitter.com/cyberwar_15/status/1240677656451899394
# Reference: https://twitter.com/Timele9527/status/1240620534468997125

all200.mireene.com
crphone.mireene.com
jmable.mireene.com
jmdesign.mireene.com
nhpurumy.mireene.com
orblog.mireene.com
sgmedia.mireene.com
vnext.mireene.com

# Reference: https://twitter.com/Timele9527/status/1240123132419223554

mybobo.mygamesonline.org

# Reference: https://twitter.com/DeadlyLynn/status/1245264426321600513

saemaeul.mireene.com

# Reference: https://twitter.com/AnonySecAgency/status/1250605504520318977

rolls-royce-love.890m.com

# Reference: https://twitter.com/VK_Intel/status/1257243399742251010

upload.bigfile.hol.es

# Reference: https://twitter.com/AnonySecAgency/status/1263047043150299136

gotoclean.com.co
ricefarm.kr/bbs/st/expres.php

# Reference: https://twitter.com/cyberwar_15/status/1266553918454067201
# Reference: https://www.rfa.org/korean/in_focus/nkhacking-05292020160533.html (Korean)

com-download.work

# Reference: https://twitter.com/cyberwar_15/status/1268073043365990401

part.bigfile.pe.hu

# Reference: https://blog.alyac.co.kr/3033 (Korean)
# Reference: https://otx.alienvault.com/pulse/5ed7c80f673c40df00c52fa6

boaz.kr/skin/member/basic/css/cross.php
boaz.kr/skin/member/basic/css/report.php
boaz.kr/skin/member/log/cross.php
boaz.kr/skin/member/log/pre.hta
boaz.kr/skin/member/log/report.php
boaz.kr/skin/member/log/suf.hta

# Reference: https://twitter.com/XOR_Hex/status/1273023258535886848

dept-dp.lab.hol.es

# Reference: https://twitter.com/cyberwar_15/status/1273435333430935552

gbxhd.org-help.com

# Reference: https://twitter.com/ccxsaber/status/1273804166612135940

security-confirm.bmail-org.com

# Reference: https://twitter.com/ShadowChasing1/status/1274724519803043852

finalist.org-help.com

# Reference: https://twitter.com/cyberwar_15/status/1275368364819410950

foxhunter.getenjoyment.net
korea.getenjoyment.net
pootball.getenjoyment.net

# Reference: https://twitter.com/DeadlyLynn/status/1275998401524424704

attachchosun.atwebpages.com

# Reference: https://twitter.com/ccxsaber/status/1278941222166380545

lovelovelove.atwebpages.com

# Reference: https://twitter.com/DeadlyLynn/status/1281840956170317824

bascetball.atwebpages.com

# Reference: https://twitter.com/cyberoverdrive/status/1285955528770891776
# Reference: https://www.virustotal.com/gui/file/4fae9a942aafddc8ee21a753302cec3c5273d3f71e132f176cb799dd922e30ac/detection

pingguo5.atwebpages.com

# Reference: https://app.any.run/tasks/74d55d02-7bbd-444c-a01b-30ac52a7e576/

foxonline123.atwebpages.com

# Reference: https://twitter.com/cyberwar_15/status/1296301860312084482

jongjin.000webhostapp.com

# Reference: https://twitter.com/DeadlyLynn/status/1299970605043707905
# Reference: https://www.virustotal.com/gui/file/4ff2a67b094bcc56df1aec016191465be4e7de348360fd307d1929dc9cbab39f/detection

portable.epizy.com

# Reference: https://otx.alienvault.com/pulse/5f737caa710907613c4d2773

account-protect.work
account-viewer.work
com-active.work
com-download.work
com-option.work
com-ssl.work
com-sslnet.work
com-vps.work
default.tokyo
desk-top.work
doc-view.pw
dorey.work
dutaley.work
exiweng.work
idiolos.work
intemet.work
jp-sec.pw
jp-ssl.work
kinac.work
net-sec.pw
org-view.pw
org-view.work
org-vip.work
org-vps.work
poulsen.work
robezo.work
rtyuio.work
sslport.work
sslserver.work
ssltop.work
taplist.work
tlsmain.work
unrepong.work
verdall.xyz
vpstop.work
webmain.work

# Reference: https://twitter.com/cyberwar_15/status/1313175039307476993

daumcleaner.mywebcommunity.org
naver.mywebcommunity.org
workcrafter.mywebcommunity.org

# Reference: https://twitter.com/DeadlyLynn/status/1314181830162083841
# Reference: https://www.virustotal.com/gui/file/363386c4caa5a995d3ca9345520c90942d5d3e1aaf8056831348f92eb73c15db/detection

goldbin.myartsonline.com

# Reference: https://twitter.com/vigilantbeluga/status/1315720089316941824
# Reference: https://twitter.com/vigilantbeluga/status/1315722308703543297

hdac-wallet.com
kasse-v1.hdac-wallet.com
update.hdac-tech.com
wallet.hdac-tech.com

# Reference: https://twitter.com/vigilantbeluga/status/1255002262256025600
# Reference: https://www.virustotal.com/gui/file/3110f00c1c48bbba24931042657a21c55e9a07d2ef315c2eae0a422234623194/detection

general-second.org-help.com

# Reference: https://us-cert.cisa.gov/ncas/alerts/aa20-301a
# Reference: https://otx.alienvault.com/pulse/5f9856f8655cfd07338c8e83

account.daum.unikftc.kr
account.daum.unikortv.com
account.daurn.pe.hu
amberalexander.ghtdev.com
beyondparallel.sslport.work
bigfile.pe.hu
cdaum.pe.hu
cloudmail.cloud
cloudnaver.com
coinone.co.in
com-download.work
com-option.work
com-ssl.work
com-sslnet.work
com-vps.work
comment.poulsen.work
cooper.center
csnaver.com
daum.net.pl
daum.unikortv.com
daurn.org
daurn.pe.hu
demand.poulsen.work
dept-dr.lab.hol.es
downloadman06.com
dubai-1.com
eastsea.or.kr
gloole.net
help-navers.com
help.unikoreas.kr
helpnaver.com
hogy.desk-top.work
impression.poulsen.work
intemet.work
intranet.ohchr.account-protect.work
jonga.ml
jp-ssl.work
kooo.gq
loadmanager07.com
login.bignaver.com
login.daum.kcrct.ml
login.daum.net-accounts.info
login.daum.unikortv.com
login.outlook.kcrct.ml
mail.unifsc.com
mailsnaver.com
member-authorize.com
member.daum.uniex.kr
member.daum.unikortv.com
member.navier.pe.hu
msdatl3.inc
msolui80.inc
myaccount.nkaac.net
myaccounts.gmail.kr-infos.com
myetherwallet.co.in
myetherwallet.com.mx
naver.co.in
naver.com.cm
naver.com.de
naver.com.ec
naver.com.mx
naver.com.pl
naver.com.se
naver.cx
naver.hol.es
naver.koreagov.com
naver.onegov.com
naver.pw
naver.unibok.kr
naverdns.co
net.tm.ro
nid.naver.com.se
nid.naver.corper.be
nid.naver.onektx.com
nid.naver.unibok.kr
nid.naver.unicrefia.com
nidlogin.naver.corper.be
nidnaver.email
nidnaver.net
ns.onekorea.me
nytimes.onekma.com
org-vip.work
preview.manage.org-view.work
pro-navor.com
read-hanmail.net
read-naver.com
read.tongilmoney.com
resetprofile.com
resultview.com
riaver.site
sankei.sslport.work
securetymail.com
servicenidnaver.com
smtper.cz
smtper.org
sslserver.work
ssltop.work
statement.poulsen.work
sts.desk-top.work
taplist.work
tiosuaking.com
top.naver.onekda.com
usernaver.com
view-hanmail.net
view-naver.com
vilene.desk-top.work
vpstop.work
webmain.work
webuserinfo.com
ww-naver.com

# Reference: https://www.cybereason.com/blog/back-to-the-future-inside-the-kimsuky-kgh-spyware-suite
# Reference: https://www.cyberscoop.com/north-korea-espionage-kimsuky-cybereason/
# Reference: https://otx.alienvault.com/pulse/5fa029ed2e8d9de384c74f26

csv.posadadesantiago.com/home/up.php?id=
csv.posadadesantiago.com/home?act=news&id=
csv.posadadesantiago.com/home?id=
myaccounts.posadadesantiago.com/test/Update.php?wShell=
wave.posadadesantiago.com/home/dwn.php?van=

# Reference: https://blog.alyac.co.kr/3352
# Reference: https://otx.alienvault.com/pulse/5fa1bb282c5efd7327b229a6

xeoskin.co.kr/wp/wp-includes/SimplePie/Net/

# Reference: https://twitter.com/cyberwar_15/status/1327040440189607936
# Reference: https://twitter.com/cyberwar_15/status/1327045373781635072
# Reference: https://twitter.com/cyberwar_15/status/1327403605825970176
# Reference: https://twitter.com/cyberwar_15/status/1327403626118094848

accountcheck.net
app.veryton.ml
appmedicine.whoint.cf
astrozeneca.ml
bidmc.accountcheck.net
daumi.club
daurn.ga
dup.photo.oiiio.ga
email-hanwha.pe.hu
genexine.member-info.net
jnj.accountcheck.net
kaist.r-naver.com
kari.gq
kimm.r-naver.com
krnvc.ga
logins.daumi.club
logins.daurn.ga
love.krnvc.ga
mail.astrozeneca.ml
member-info.net
oiiio.ga
on.color.oiiio.ga
r-naver.com
shinpoong.accountcheck.net
shinpoong.r-naver.com
shkj.hol.es
veryton.ml
webmail.kari.gq
whoint.cf

# Reference: https://twitter.com/RedDrip7/status/1329628989699235840
# Reference: https://otx.alienvault.com/pulse/5fb804ac581df7fe4f35bfd6
# Reference: https://www.virustotal.com/gui/file/9365ce79a51768a398cc22ec701d5f256de827fbefed283c933dea4052d66027/detection

pelebra.atwebpages.com

# Reference: https://twitter.com/jfslowik/status/1330611004456067073

asia-studies.net
itamaraty.net
midsecurity.org
netsecurityservice.com
securitycounci1report.org

# Reference: https://twitter.com/cyberwar_15/status/1332300116179312640

bidmc.accountcheck.net
genexine.member-info.net
jnj.accountcheck.net
shinpoong.accountcheck.net
shinpoong.r-naver.com

# Reference: https://twitter.com/cyberwar_15/status/1333181928606814211

daumusercenter.web.app

# Reference: https://twitter.com/cyberwar_15/status/1333767468473487363

autoway.huyndai.ml
huyndai.ml

# Reference: https://twitter.com/Timele9527/status/1333971180290592769

documentserver.site

# Reference: https://twitter.com/h2jazi/status/1339226171272286209
# Reference: https://blog.alyac.co.kr/3458 (Korean)
# Reference: https://otx.alienvault.com/pulse/5fdbc57a744937101f4f9adc

hahae.co.kr/new3/ISAF/Libs/php/cross.php

# Reference: https://twitter.com/RedDrip7/status/1336258913323216896
# Reference: https://www.virustotal.com/gui/file/1909010c264328edaf24cc2804d4f046aabd3c59de45e1d295d4155eb466d753/detection

price365.co.kr/abbi/json/ps/aa.php

# Reference: https://twitter.com/cyberwar_15/status/1343610577894088704
# Reference: https://www.virustotal.com/gui/ip-address/27.255.79.204/relations

bkl-co.ml
conm.ga
covision.tk
dongguk.ml
edongwon.ml
edongyang.ml
ejnuac.ml
ekecc.ml
ekoreapetroleum.ml
eland.ml
enepa.cf
esmec.ml
gwdeuac.ml
gwpancon.ml
imperial.fit
kangwon.ml
kccworld.ml
kyungnam.ml
kyungnam.tk
kyungshin.ml
leeko.ml
maeil.ml
miraeasset.ml
naver.srl
nexaemc.ml
nh-amundi.ml
onestorecorp.ml
s-food.ml
samyang.ml
sejonggroup.ml
slworld.cf
sogang.ml
tlbu.ml
webnaver.srl
wonik.ml
yncc.ml
zdnet.ga
email.dongwon.ml
email.dongyang.ml
email.jnuac.ml
email.kecc.ml
email.koreapetroleum.ml
email.nepa.cf
ext.imperial.fit
gwmail.deuac.ml
gwmail.pancon.ml
mail.bkl-co.ml
mail.conm.ga
mail.covision.tk
mail.dongguk.ml
mail.eland.ml
mail.esmec.ml
mail.kangwon.ml
mail.kccworld.ml
mail.kyungnam.ml
mail.kyungnam.tk
mail.kyungshin.ml
mail.leeko.ml
mail.maeil.ml
mail.miraeasset.ml
mail.naver.srl
mail.nh-amundi.ml
mail.onestorecorp.ml
mail.s-food.ml
mail.samyang.ml
mail.sejonggroup.ml
mail.slworld.cf
mail.sogang.ml
mail.tlbu.ml
mail.wonik.ml
mail.yncc.ml
mail.zdnet.ga
nidlogin.naver.srl
nmail.exaemc.ml
webmail.naver.srl

# Reference: https://twitter.com/cyberwar_15/status/1345704290069876736

karist.cf
kaist-ac.xyz
krfa.ml
veryton.ml
kaist.krfa.ml
kaist-ac.xyz
mail.kaist-ac.xyz
vpn.karist.cf
app.veryton.ml

# Reference: https://twitter.com/h2jazi/status/1347225069890789376
# Reference: https://www.virustotal.com/gui/file/18ee06625f7bddadafa8c256d63a123f4e69d5488f88828052fd7803b3aa8b3b/detection

cwda.co.kr/theme/basic/skin/new/basic/update/

# Reference: https://twitter.com/AnonySecAgency/status/1350988738973884418
# Reference: https://www.virustotal.com/gui/file/fd740b70649f06269bf8fe2d0d4fdd87d99606a7a666c4f6a2fc89bee70b6649/detection

connectter.atwebpages.com

# Reference: https://twitter.com/cyberwar_15/status/1352117474943135745
# Reference: https://twitter.com/cyberwar_15/status/1352117964527423490
# Reference: https://www.virustotal.com/gui/ip-address/121.78.88.85/relations

attach.ddns.net
bigfile-naver.servepics.com
cafe-daum.ddns.net
naver.serveblog.net
naver.servehttp.com

# Reference: https://twitter.com/ShadowChasing1/status/1358713278390673408
# Reference: https://www.virustotal.com/gui/file/39bd6b689b02d6dee329131a51aa09301889faf5698eeac0d02aef0ba47cf024/detection
# Reference: https://www.virustotal.com/gui/file/a8820cc75cd580c8eda747931eb36f5943cece48ba720af9771cf16490a78aa6/detection

reform-ouen.com/wp-includes/css/dist/nux/dotm/dwn.php

# Reference: https://twitter.com/ShadowChasing1/status/1362575412539183115
# Reference: https://www.virustotal.com/gui/file/115b9bf1c6f6040248dfa1a77044143dc318e3712ad613a022b4cced6007906f/detection

anpcb.co.kr/plugin/sns/facebook/src/update/normal.dotm

# Reference: https://twitter.com/AnonySecAgency/status/1366948179762024449
# Reference: https://www.virustotal.com/gui/file/73476d8ed35d6bbdaab3e7a17de7668af3860e994ac59107ecbe1aba7e40ace1/detection
# Reference: https://www.virustotal.com/gui/file/412baf955c1e256c4e8bf7e07ce0f1fbf14c03d11ed98932be45a58a14d55690/detection

monkey.funnystory.tech
seoul.lastpark.life

# Reference: https://twitter.com/ShadowChasing1/status/1368827485253627907
# Reference: https://www.virustotal.com/gui/file/e46887db62f3ee5583587531358e1b70cc8a171067fa4e1ae3e6693f7f9fc938/detection

koreacit.co.kr/skin/

# Reference: https://twitter.com/ShadowChasing1/status/1372464570183208961
# Reference: https://www.virustotal.com/gui/file/50d826640cc9ba66b789f0823f04308178b435f7eb39021bf7861061849f7efd/detection

inonix.co.kr/kor/board/widgets/mcontent/skins/tmp

# Reference: https://twitter.com/ShadowChasing1/status/1372537353311449091

waels.onlinewebshop.net/st/

# Reference: https://twitter.com/Xxx_8885/status/1373888922179170305
# Reference: https://twitter.com/Xxx_8885/status/1373889297414123521
# Reference: https://www.virustotal.com/gui/file/a030873cf5a9b8c76740a1ba9a4d28fc7acf4ce71ebebbe33a46be372f551004/detection
# Reference: https://www.virustotal.com/gui/file/a56163d758cd4a0a00e0991b7a4aecab35fdecb59df6d1821488826f8b37d7b9/detection
# Reference: https://www.virustotal.com/gui/file/e532685d362475dd3dec1aacedff87c7b32ec3573714a9f56ac87905fa13d66c/detection
# Reference: https://www.virustotal.com/gui/file/00bbab408dbc5c1a95143f75c282a74dddd5a87df533d7d198c1fc7eb2138269/detection
# Reference: https://www.virustotal.com/gui/file/a2465f753ff409cbd036cc0235704e3f49d9a52b8e4e2bc812428d7c8ea6f32b/detection

http://200.200.200.200/test/v.php
eucie091.myartsonline.com
eucie09111.myartsonline.com
ftcpark59.getenjoyment.net

# Reference: https://twitter.com/blackorbird/status/1377218251344633856
# Reference: https://twitter.com/RedDrip7/status/1377217232573321220

policy.webofknowledg.com
usamilitarysavings.webofknowledg.com
webofknowledg.com

# Reference: https://twitter.com/ShadowChasing1/status/1377841916948082689
# Reference: https://www.virustotal.com/gui/file/873b8fb97b4b0c6d7992f6af15653295788526def41f337c651dc64e8e4aeebd/detection
# Reference: https://www.virustotal.com/gui/file/4a1c43258fe0e3b75afc4e020b904910c94d9ba08fc1e3f3a99d188b56675211/detection

pcsecucheck.scienceontheweb.net

# Reference: https://twitter.com/ShadowChasing1/status/1377900770629099530
# Reference: https://www.virustotal.com/gui/file/3dd9628b3f92a1f8c340e546343c1c1448de94212a9c19e83cae661eba2d1b37/detection

beilksa.scienceontheweb.net

# Reference: https://twitter.com/mg2_tracy1/status/1379269472926638081
# Reference: https://www.virustotal.com/gui/file/b89e79ee9c4834177cbabba9b265910a6a55c7defd2863cc1699753dbfa342b8/detection

baboivan.scienceontheweb.net

# Reference: https://twitter.com/h2jazi/status/1380510153397637127
# Reference: https://www.virustotal.com/gui/file/e6f0d7e114c04017b07f321ba4df440ff55718ef451b1a3cb0f1c0856bd1c86e/detection

pc.ac-kr.esy.es

# Reference: https://twitter.com/ShadowChasing1/status/1382509560179531782
# Reference: https://www.virustotal.com/gui/file/e7fae41c0bd8d3d95253bd75dce99015599ecc404bd8d737cec305fc3e4dd018/detection

wbg0909.scienceontheweb.net

# Reference: https://twitter.com/AnonySecAgency/status/1383241650319683590
# Reference: https://www.virustotal.com/gui/file/92b9933f3477241ffd92d0f76ef0dcf46730209a1ecab7eceb399d540530799f/detection

cuinm.huikm.kro.kr

# Reference: https://twitter.com/HONKONE_K/status/1386152816545128450
# Reference: https://www.virustotal.com/gui/file/4252c0b130be39bf2258c84c436c17babfd650b6d665ac6c4e050f87fe34e46e/detection

pootball.medianewsonline.com

# Reference: https://twitter.com/ShadowChasing1/status/1388522768111656963
# Reference: https://www.virustotal.com/gui/file/f8e972a26117bd14f5ec4dca9de0244d0bfd29bbbfd9104b2ccdc49fa93416d8/detection

ikpoo.cf
onedrive-upload.ikpoo.cf

# Reference: https://twitter.com/ShadowChasing1/status/1388529890614341635
# Reference: https://www.virustotal.com/gui/file/2365a48f7d6cf6dcc83195f06ea11b93c955c3a491c60b50ba42788917ba22e2/detection

riseknite.life
download.riseknite.life

# Reference: https://mp.weixin.qq.com/s/8RgFvA_rOR2nIGxjWbEq-w

travelmountain.ml
alps.travelmountain.ml

# Reference: https://twitter.com/h2jazi/status/1390734706103234561
# Reference: https://twitter.com/ShadowChasing1/status/1391620287024668679
# Reference: https://www.virustotal.com/gui/file/622cb6a772b0034f741aa58a50f1155a2a4240021c929d90fbed4182877fa579/detection
# Reference: https://www.virustotal.com/gui/file/2ed6b0e116a50ee9be7ac74b7be0e73ac4aeb15ddb9b42a1db5bcfba4dccdead/detection

mechapia.com/_admin/nicerlnm/web/style/list.php
mechapia.com/_admin/nicerlnm/web/style/css/

# Reference: https://twitter.com/ShadowChasing1/status/1391618560753999872
# Reference: https://twitter.com/ShadowChasing1/status/1391622743146188800
# Reference: https://www.virustotal.com/gui/file/2365a48f7d6cf6dcc83195f06ea11b93c955c3a491c60b50ba42788917ba22e2/detection
# Reference: https://www.virustotal.com/gui/file/fa4d05e42778581d931f07bb213389f8e885f3c779b9b465ce177dd8750065e2/detection
# Reference: https://www.virustotal.com/gui/file/2c796053053a571e9f913fd5bae3bb45e27a9f510eace944af4b331e802a4ba0/detection

chollian.ml
daom.ml
daum-accounts.cf
gmail-account.gq
gmrail.ml
grnail-login.ml
kisa-security.cf
letterpaper.press
live-sign.ml
natesec-page.ml
naver-security.cf
navor.ml
pcjindustries.com
riseknite.life
secure-dm.tk
seoul-kor.ml
seoul-kor.tk
travelmountain.ml
alps.travelmountain.ml
check.kisa-security.cf
download.riseknite.life
login.daum-accounts.cf
login.gmail-account.gq
login.live-sign.ml
login.natesec-page.ml
login.secure-dm.tk
logins.daom.ml
logins.daum-accounts.cf
new.seoul-kor.ml
nid-nav.navor.ml
nids.naver-security.cf
nids.navor.ml
outlook.seoul-kor.tk
signin.chollian.ml
signin.gmrail.ml
signin.grnail-login.ml
texts.letterpaper.press
webmail.pcjindustries.com

# Reference: https://twitter.com/sS55752750/status/1391765099992453125

flagguarder.site
glow.flagguarder.site

# Reference: https://twitter.com/h2jazi/status/1392128092840284164
# Reference: https://www.virustotal.com/gui/file/85847cad7f57db4534634d51f7e2c74a23719fcf74c891872d98e7c921f0fd56/detection

rukagu.mypressonline.com

# Reference: https://twitter.com/cyberwar_15/status/1392376928624013312

daum-attach.ddns.net

# Reference: https://twitter.com/ShadowChasing1/status/1392284742163206146

yes24-mart.pe.hu

# Reference: https://twitter.com/ShadowChasing1/status/1394911946118295553
# Reference: https://twitter.com/ShadowChasing1/status/1394911948353859585
# Reference: https://www.virustotal.com/gui/file/9ba5266d806df037acb1144836c21b70c5fc0aa6820d2ce07ee28accdff6c9bf/detection

follcdn.myartsonline.com
sima.atspace.tv

# Reference: https://twitter.com/ShadowChasing1/status/1395684553507840003

yanggucam.designsoup.co.kr/user/views/board/skin/secret/css/list.php

# Reference: https://twitter.com/h2jazi/status/1395782753765974023

samsoding.homm7.gethompy.com/plugins/dropzone/min/css/list.php

# Reference: https://twitter.com/m0br3v/status/1399637361697378306
# Reference: https://twitter.com/ShadowChasing1/status/1399753970839547910
# Reference: https://www.virustotal.com/gui/file/fe1a734019f0dc714bd3360e2369853ea97c02f108afe963769318934470967b/detection

at-me.ml
kt1kreate.cf
ahn-lab.cf
snubh.r-e.kr
shore.ml
snu-h.ml
kumb.cf
naver-login.cf
naver-check.ml
snuh.r-e.kr
app.at-me.ml
sms.kt1kreate.cf
v3.ahn-lab.cf
mail.snubh.r-e.kr
anto.shore.ml
smtp.snu-h.ml
mail.kumb.cf
help.naver-login.cf
mail.naver-check.ml
mail.snuh.r-e.kr

# Reference: https://blog.malwarebytes.com/threat-analysis/2021/06/kimsuky-apt-continues-to-target-south-korean-government-using-appleseed-backdoor/
# Reference: https://otx.alienvault.com/pulse/60b66cda1f2d210aa677cfbe

gmail-account.gq
gmrail.ml
goggle.hol.es
googgle.kro.kr
google-manager.ga
google-signin.ga
grnail-login.ml
grnail-signin.ga
grnail-signing.work
ikpoo.cf
kr-infos.com
letterpaper.press
microsoft-office.us
mygoogle-signin.ga
mygrnail-security.work
mygrnail-signin.ga
mygrnail-signing.work
riseknite.life
travelmountain.ml
account.googgle.kro.kr
account.grnail-signin.ga
accounts.goggle.hol.es
accounts.google-manager.ga
accounts.google-signin.ga
accounts.grnail-signin.ga
accounts.grnail-signing.work
alps.travelmountain.ml
download.riseknite.life
login.gmail-account.gq
login.gmeil.kro.kr
myaccount.google-signin.ga
myaccount.google.newkda.com
myaccount.google.nkaac.net
myaccount.grnail-security.work
myaccount.grnail-signin.ga
myaccount.grnail-signing.work
myaccounts-gmail.autho.co
myaccounts-gmail.kr-infos.com
myaccounts.grnail-signin.ga
ns1.microsoft-office.us
ns2.microsoft-office.us
onedrive-upload.ikpoo.cf
protect.grnail-signin.ga
signin.gmrail.ml
signin.grnail-login.ml
texts.letterpaper.press
wscript.shell.run

# Reference: https://twitter.com/360CoreSec/status/1401863232835383302
# Reference: https://www.virustotal.com/gui/file/811b42bb169f02d1b0b3527e2ca6c00630bebd676b235cd4e391e9e595f9dfa8/detection

alyssalove.getenjoyment.net
smyun0272.blogspot.com

# Reference: https://twitter.com/ShadowChasing1/status/1402239834819743746
# Reference: https://www.virustotal.com/gui/file/934731692b12fd182acbc698dd3f8ef59984aa4e7ef56e124f9851852878817e/detection

manct.atwebpages.com

# Reference: https://twitter.com/h2jazi/status/1402267704610988033
# Reference: https://www.virustotal.com/gui/file/c362b4cb60edfa5bf17123845e59311335b03139d77ec27b9a9ffb7b31e60154/detection

quarez.atwebpages.com

# Reference: https://twitter.com/arphanetx/status/1403765541739941889
# Reference: https://www.virustotal.com/gui/file/9dac6553b89645ac8d9e0a3dc877d12641e6d05fb52e8de6ae5533b2bdf0abc9/detection

pollor.p-e.kr

# Reference: https://github.com/blackorbird/APT_REPORT/blob/master/kimsuky/Kimsuky%20APT%20Group%20targeted%20on%20South%20Korean%20defense%20and%20security%20departments.pdf

amikbvx.cf
at-me.ml
atooi.ga
bnmvg.cf
daum-or.ml
daum-vpn.ml
daums.cf
dmaccount.ml
gommi.ml
kakaoo.ml
kititi.ga
kumb.cf
may3.cf
nate-on.ml
nate-or.ga
naver-check.ml
onehappy.ml
outlookin.ml
pamik.cf
shore.ml
uhuioo.cf
wowow.ga
xdtgh.ga
yes24-mart.pe.hu
admin.daum-or.ml
anto.shore.ml
ao.nate-on.ml
app.at-me.ml
app.gommi.ml
apple.may3.cf
auth.daum-or.ml
dnhji.bnmvg.cf
exchange.amikbvx.cf
gate.uhuioo.cf
gom.kititi.ga
helper.onehappy.ml
imap.pamik.cf
mail.daums.cf
mail.dmaccount.ml
mail.kakaoo.ml
mail.kumb.cf
mail.naver-check.ml
mail.outlookin.ml
mail3.nate-or.ga
member.dmaccount.ml
members.daum-vpn.ml
owo.owo.wowow.ga
qygbn.xdtgh.ga
vpn.atooi.ga

# Reference: https://twitter.com/fuuuing_/status/1393102998532886531

fabre.myartsonline.com

# Reference: https://twitter.com/TeamT5_Official/status/1410206100033400838
# Reference: https://biz.chosun.com/policy/politics/2021/06/18/V4DTFCEXPRA4DFCBVVJO3DPR5I/ (Korean)
# Reference: https://www.virustotal.com/gui/ip-address/27.102.106.48/relations
# Reference: https://www.virustotal.com/gui/ip-address/27.102.107.63/relations
# Reference: https://www.virustotal.com/gui/ip-address/27.102.112.49/relations
# Reference: https://www.virustotal.com/gui/ip-address/27.102.114.89/relations

boryung.tk
cdaum.kro.kr
celltrion.ml
cimoon.ml
claum.ml
cloudmall.club
cnaver.kro.kr
csdaum.ga
dongguk.kro.kr
home-info.ml
jbnu.info
jbnu.ml
lottebp.ga
minia.ml
naver-in.ml
nhnems.nsec.kro.kr
nidcorp.n-e.kr
novavax.ml
nsec.nhnems.kro.kr
nsuites.ga
pagelock.host
uni-korea.ga
uni-tuebingen.buzz
uni-tuebingen.cf
xonate.kro.kr
admin.claum.ml
admin.naver-in.ml
alarm.naver-in.ml
aol.pagelock.host
app.seoul.minia.ml
celltrion.cloudmall.club
daum.home-info.ml
exchange.uni-tuebingen.buzz
exchange.uni-tuebingen.cf
helper.uni-korea.ga
home.xonate.kro.kr
its.jbnu.ml
mail.celltrion.ml
mail.naver-in.ml
mail.novavax.ml
manager.naver-in.ml
member.cdaum.kro.kr
member.csdaum.ga
member.daum.home-info.ml
member.dongguk.kro.kr
myinfo.cnaver.kro.kr
nhn.nsuites.ga
nhnems.nsec.kro.kr
nid.naver.home-info.ml
nidcorp.nsuites.ga
nidlogin.nidcorp.n-e.kr
nsec.nhnems.kro.kr
onedrive-upload.ikpoo.cf
onedrive.ikpoo.cf
user.lottebp.ga
user.naver-in.ml

# Reference: https://twitter.com/ShadowChasing1/status/1410887216956547076

atooi.ga
gommi.ml
kumb.cf
onono.ml
uhuioo.cf
app.gommi.ml
gate.uhuioo.cf
mail.kumb.cf
vpn.atooi.ga
go.onono.ml

# Reference: https://twitter.com/h2jazi/status/1411826239455760387
# Reference: https://www.virustotal.com/gui/file/79848ca15ec49057261b6ba52275692d131b8dd034ae9a4cca1e1b81d9e18b77/detection

chels.mypressonline.com

# Reference: https://twitter.com/k3yp0d/status/1415652277914939393

tbear.mypressonline.com

# Reference: https://twitter.com/higefox/status/1411884786323361792
# Reference: https://asec.ahnlab.com/ko/24834/
# Reference: https://asec.ahnlab.com/ko/25351/
# Reference: https://otx.alienvault.com/pulse/60f125c78978e02a40e00c85

benze.atwebpages.com
btige.myartsonline.com
ccav.myartsonline.com
chels.mypressonline.com
giruz.atwebpages.com
jupit.getenjoyment.net
lieon.mypressonline.com
lovel.myartsonline.com
lovels.myartsonline.com
mantc.getenjoyment.net
modri.myartsonline.com
obser.mygamesonline.org
ranso.myartsonline.com
rster.atwebpages.com
stair.atwebpages.com
stair.myartsonline.com
vbqwer.mypressonline.com
visul.myartsonline.com
warcr.onlinewebshop.net

# Reference: https://twitter.com/h2jazi/status/1417093562278240256
# Reference: https://www.virustotal.com/gui/file/d3138e7b0dcf5e916834b045c1b006a1cd223dca75626bd1354b47dbd0c63ae2/detection

1213rt.atwebpages.com

# Reference: https://twitter.com/fuuuing_/status/1417426427528417283

kimshan600000.blogspot.com

# Reference: https://mp.weixin.qq.com/s/og8mfnqoKZsHlOJdIDKYgQ
# Reference: https://otx.alienvault.com/pulse/60ffcd56a7dc0038376fe52e

worldinfocontact.club
alyssalove.getenjoyment.net
hanlight.mygamesonline.org
kr2959.atwebpages.com
majar.medianewsonline.com
samsoding.homm7.gethompy.com
anpcb.co.kr/plugin/sns/facebook/src/update/normal.dotm
beilksa.scienceontheweb.net/cookie/select/log/tmp
beilksa.scienceontheweb.net/cookie/select/log/list.php
cwda.co.kr/theme/basic/skin/new/basic/update/Normal.dotm
cwda.co.kr/theme/basic/skin/new/basic/update/list.php
heritage2020.cafe24.com/plugin/kcpcert/bin/list.php
inonix.co.kr/kor/board/widgets/mcontent/skins/tmp
inonix.co.kr/kor/page/product/_notes/list.php
inonix.co.kr/kor/page/product/_notes/tmp/
koreacit.co.kr/skin/new/basic/update/temp
mechapia.com/_admin/nicerlnm/web/style/list.php
miracle.designsoup.co.kr/user/views/resort/controller/css/update/list.php
nuclearpolicy101.org/wp-admin/includes/0421/d.php
reform-ouen.com/wp-includes/css/dist/nux/dotm/dwn.php
yanggucam.designsoup.co.kr/user/views/board/skin/secret/css/list.php

# Reference: https://twitter.com/360CoreSec/status/1423561133873537024
# Reference: https://www.virustotal.com/gui/file/cd9421c332a2b90b26152f0e85a7db621306cd1daa70f30af3210895d2aeb577/detection

rhwkdlaktm.atwebpages.com

# Reference: https://twitter.com/ShadowChasing1/status/1446270087506194432
# Reference: https://www.virustotal.com/gui/file/82067ef8b907888f9fc27dd0630c37c95b0a55a7c225fb2d693115c41c7dd5be/detection

greatname.000webhostapp.com

# Reference: https://twitter.com/ShadowChasing1/status/1446278566564433939
# Reference: https://www.virustotal.com/gui/file/32beeda8cffc2ecc689ea2529194cf806955879a334ec68176864d1e6c09800c

youtoboo.kro.kr
movie.youtoboo.kro.kr

# Reference: https://twitter.com/ShadowChasing1/status/1446272122058280963

navercheck.kro.kr
nidlogin.navercheck.kro.kr

# Reference: https://twitter.com/ShadowChasing1/status/1446271028481593365
# Reference: https://www.virustotal.com/gui/file/db88dc539bccce8c30e3ba6897171989c9a340f23075c614f3c5a73ae0160db1

tigerwood.tech
ppahjcz.tigerwood.tech

# Reference: https://twitter.com/ShadowChasing1/status/1446270634690895872
# Reference: https://www.virustotal.com/gui/file/324b2e2c0471e49c7cc07725a7d748041479714d265ec6dbf386edd3f619f03c

requests.p-e.kr
ping.requests.p-e.kr

# Reference: https://twitter.com/ShadowChasing1/status/1446269684072914946
# Reference: https://www.virustotal.com/gui/file/8e263345cfeda4eb6720c47d4eaaee236be294fda693d840199f221d6e1412c6

beast.16mb.com

# Reference: https://blog.talosintelligence.com/2021/11/kimsuky-abuses-blogs-delivers-malware.html

44179d6df22c56f339bf.blogspot.com
4b758c2e938d65bee050.blogspot.com
akf4tvrbmg.blogspot.com
amfuz2h5b2s.blogspot.com
byun70kh.mygamesonline.org
gyzang0826.blogspot.com
gyzang1.blogspot.com
gyzang58.blogspot.com
gyzang681.blogspot.com
gyzang682.blogspot.com
kimshan600000.blogspot.com
o61666ch.getenjoyment.net
pjeu1urxdnvef6twpveg.blogspot.com
rrmu1qrxdoekv6twc9pq.blogspot.com
smyun0272.blogspot.com
t22a44es.atwebpages.com
tvrbmkxqstbouzq0twk0ee9uaz0.blogspot.com
tvrfekxqrtvpqzr5tvrfdu5evt0.blogspot.com
tvrfeuxqrtfnqzr4t0m0ee5utt0.blogspot.com
twpbekxqsxpoqzr4txpvdu1uyzu.blogspot.com
vev4tkrrpq.blogspot.com
vgn5tvrrpq.blogspot.com
vgt5tvrnpq.blogspot.com

# Reference: https://twitter.com/h2jazi/status/1465402736996933640

3a8f846675194d779198.blogspot.com
0knw2300.mypressonline.com
faust22.mypressonline.com

# Reference: https://www.virustotal.com/gui/file/cb88d365011dce926afb1c04e6973f3d3db7135dd67d738e281f3690b8d9e6ef/detection

kr3753.atwebpages.com

# Reference: https://twitter.com/souiten/status/1473862308132651011

jinu1353.scienceontheweb.net

# Reference: https://twitter.com/souiten/status/1457946934623150090
# Reference: https://www.virustotal.com/gui/file/0cfa89348dc6007c89852907e464f3e91060e83665d6d62243be225c0e2e44a9/detection

gosiweb.gosiclass.com/m/gnu/convert/default/8ef014a/list.php

# Reference: https://twitter.com/Timele9527/status/1425640885811777542

helpnid.com

# Reference: https://twitter.com/cyberwar_15/status/1478572625291276291

com-trace.space
confirm-pw.link
navers.online
navers.store
navers.website
net-pass.store

# Reference: https://twitter.com/souiten/status/1472757875839619079
# Reference: https://www.virustotal.com/gui/file/2ef30a004e68213faa8cfef567af2292ff03f8ea9f273ae1c9c2b7845ba6ea87/detection

zippe.myartsonline.com

# Reference: https://blog.alyac.co.kr/3228?category=957259 (Korean)

pingguo2.atwebpages.com
ramble.myartsonline.com

# Reference: https://asec.ahnlab.com/ko/26183/
# Reference: https://otx.alienvault.com/pulse/6110fe0ab195f83ceb72fcff

dkekftks.atwebpages.com
dktkglrkshqhfn.atwebpages.com
tktlal2.atwebpages.com
tktlal3.atwebpages.com
tksRpdl.atwebpages.com

# Reference: https://twitter.com/ShadowChasing1/status/1482976392958865413

gooeglle.mypressonline.com

# Reference: https://twitter.com/cyberwar_15/status/1485607323154644999

bigfilemail.net
cmaildown.lovestoblog.com
msgbugreporting.lovestoblog.com
/wwwppp/index2.php

# Reference: https://twitter.com/ShadowChasing1/status/1489054323946319876
# Reference: https://www.virustotal.com/gui/file/5d25e53b59bd2dcf234c6819f8cd294efe6d943d04625b9d575002362794e74a/detection

com-info.store
ms-work.com-info.store

# Reference: https://twitter.com/jaydinbas/status/1493522324011851776
# Reference: https://www.virustotal.com/gui/file/3ca7067d60ee47be7448da74be7dab23699cda64cac7ed0cd7a2d219875cb902/detection

asenal.medianewsonline.com

# Reference: https://twitter.com/s1ckb017/status/1493907536117964802
# Reference: https://www.virustotal.com/gui/file/1fa38bd7a3d6a7b73ac4893bb7edc04fb3f56dcfad3b3e6b3fa6d4729add22e2/detection

byusunity.000webhostapp.com

# Reference: https://twitter.com/ShadowChasing1/status/1500778382966939653
# Reference: https://www.virustotal.com/gui/ip-address/161.97.100.171/relations

com-checking.link
com-pass.online
com-password.link
com-silver.site
jp-check.online
naver-active.online
certificate.medis.navers.store
com.com-pass.online
daum.confirm-pw.link
downfile.mybox.com-password.link
downfile.naver.com-pass.online
medis.navers.store
moue.naver-active.online
ms-work.com-pass.online
ms-work.com.com-pass.online
mybox.com-password.link
myetherwallet.com-checking.link
naver.com-pass.online
naver.com-silver.site
navers.com-checking.link
navers.com-silver.site
naverwebs.com-password.link
navrenewal.confirm-pw.link
neaply.naver-active.online
nib.com-checking.link
nic.navers.com-checking.link
nid.moue.naver-active.online
nid.naver-active.online
nid.navers.com-checking.link
nid.navers.confirm-pw.link
nid.navrenewal.confirm-pw.link
nid.neaply.naver-active.online
nld.naverwebs.com-password.link
nld.neaply.naver-active.online
nld.thus.navers.com-checking.link
nood.navers.jp-check.online
thus.navers.com-checking.link
uid.navers.com-silver.site

# Reference: https://www.virustotal.com/gui/file/0b2db410c50d9e4eb7e88177c463be3da5fff5527d9dc2ae10fa26ebe2721ef1/detection

healerboy.000webhostapp.com

# Reference: https://twitter.com/cyberwar_15/status/1507270188882067460

mailnotification.xyz
naveruser.com
nid.naver.com.pe
pay.naver.com.pe
report.mailnotification.xyz
star.mailnotification.xyz

# Reference: https://twitter.com/s1ckb017/status/1507316584079142915
# Reference: https://www.virustotal.com/gui/file/af6b98cabdaf0e3f12fd32509c6b99c141ce59bd73019730d85f66f41ca399da/detection

hannarng.kro.kr
update.hannarng.kro.kr

# Reference: https://twitter.com/souiten/status/1514440361887690753
# Reference: https://www.virustotal.com/gui/file/f28d087adb5f959c62e318d0a3c4639df5513781587aa46bb8df2521f7970ac5/detection

manage-box.com

# Reference: https://twitter.com/souiten/status/1519167359918911488
# Reference: https://www.virustotal.com/gui/file/2f7f3a86a868f6c5a85fb12fe028fd254cd9622075b179923187461c72d6aea0/detection

dusieme.com

# Reference: https://twitter.com/ShadowChasing1/status/1519514517465485312

uekaf.myartsonline.com

# Reference: https://twitter.com/InQuest/status/1521136176530436098
# Reference: https://www.virustotal.com/gui/file/5ed36771ac803408325326322f6909e8f768ed9a4c9e98217a82a66f71e7627d/detection

leehr36.mypressonline.com

# Reference: https://twitter.com/jaydinbas/status/1521408843774844929

weworld59.myartsonline.com

# Reference: https://twitter.com/h2jazi/status/1521906180553068546
# Reference: https://www.virustotal.com/gui/file/0e9689ea8056e3016ccc7fbfed31d8566403f394b68aceb69fb1a3dfec6b6f09/detection
# Reference: https://www.virustotal.com/gui/file/4b0202a8452fe202d25fc5c75aabef3ae52083d2edb7f57cbde02a1bca02a028/detection

attach.mail.daum.net/bigfile/v1/urls/d/exeuQzisacbcTtb5my1snadAn5Q/8nrA37fWtx1JOg3Vo6Jufg
attach.mail.daum.net/bigfile/v1/urls/d/6akA_Jg1Chbl_TcCTytJJQk4mfE/-z8Vw6BjxQC7ds4lmMKxpA

# Reference: https://twitter.com/BlackLotusLabs/status/1524012722622386176
# Reference: https://twitter.com/BlackLotusLabs/status/1524012726133178374
# Reference: https://www.virustotal.com/gui/file/99e58217d03645fe15ae19476554965e93e3d5f50deb85b515eb5543573f9007/detection

trueliebe.com

# Reference: https://asec.ahnlab.com/en/34694/
# Reference: https://twitter.com/malwrhunterteam/status/1525046722120097798
# Reference: https://twitter.com/ShadowChasing1/status/1525070825480949761
# Reference: https://www.virustotal.com/gui/file/2c20ac485fd55bd1a5c4b75c5ba521e5b19912325737617178dfcb5a4e408aef/detection

mc.pzs.kr/themes/mobile/images/about/temp/attach
mc.pzs.kr/themes/mobile/images/about/temp/upload
mc.pzs.kr/themes/mobile/images/about/temp/upload/lib.php
mc.pzs.kr/themes/mobile/images/about/temp/upload/list.php
mc.pzs.kr/themes/mobile/images/about/temp/attach/attach.docx

# Reference: https://asec.ahnlab.com/ko/34883/
# Reference: https://otx.alienvault.com/pulse/629714934cca82a7351d5254

fedra.p-e.kr
leomin.dothome.co.kr
printware2.000webhostapp.com

# Reference: https://twitter.com/blackorbird/status/1534127714336055296

ielsems.com
worldinfocontact.club

# Reference: https://twitter.com/cyberwar_15/status/1536865901899022336

cloudfiles.epizy.com
clouds.great-site.net
fils.clouds.great-site.net
joongang.epizy.com
daum.cloudfiles.epizy.com
kakao.cloudfiles.epizy.com
khu.cloudfiles.epizy.com
konkuk.cloudfiles.epizy.com
naver.cloudfiles.epizy.com
snu.cloudfiles.epizy.com

# Reference: https://twitter.com/cyberwar_15/status/1550740560033779713
# Reference: https://twitter.com/cyberwar_15/status/1547107301949308928

cdndaum.online
marsus.online
navecom.website
naveos.online
naveos.tokyo
naver-sec.site
navow.website
nonghyup.website
oneearthfuture.online 
private-banking-group.com
sslnaver.online
unifiedworldwideexpress.com
cood.nonghyup.website
nid.nonghyp.com-checking.link
nld.naveos.tokyo
noid.naveos.online
nong.navow.website

# Reference: https://twitter.com/h2jazi/status/1551566274664300544
# Reference: https://www.virustotal.com/gui/file/e59f0aa13e2da2a0cd5c07e882014d9b37927b9bd9a493f83c2bcb103e5a739c/detection

asssambly.mywebcommunity.org

# Reference: https://twitter.com/blackorbird/status/1552846355613097984
# Reference: https://www.volexity.com/blog/2022/07/28/sharptongue-deploys-clever-mail-stealing-browser-extension-sharpext/
# Reference: https://github.com/volexity/threat-intel/blob/main/2022/2022-07-28%20SharpTongue%20SharpTongue%20Deploys%20Clever%20Mail-Stealing%20Browser%20Extension%20SHARPEXT/indicators.csv

gonamod.com
siekis.com
worldinfocontact.club

# Reference: https://twitter.com/Des00464472/status/1550410336364527616

aire.us.to

# Reference: https://twitter.com/Des00464472/status/1529321196231487488

naverauthority.com

# Reference: https://twitter.com/Des00464472/status/1408013493358391296

preledd.club

# Reference: https://twitter.com/Des00464472/status/1554308879139618817

protect-team.n-e.kr
mail.protect-team.n-e.kr

# Reference: https://twitter.com/cyberwar_15/status/1559744857023062017

net-all.website
daum.net-all.website
kakao.net-all.website
onedrive.net-all.website
yahodrive.net-all.website
yandex.net-all.website

# Reference: https://twitter.com/PhantomXSec/status/1561490582513496064

bybitesupport.com
drivergooogles.com
kakaosupport.com

# Reference: https://twitter.com/PhantomXSec/status/1561738109884059649
# Reference: https://www.virustotal.com/gui/ip-address/51.195.155.36/relations

navericorp.com
nid.navericorp.com
avlinkt.online
avlinkx.online
avlinky.online
avlinkz.online
cutalink.store
cutblink.store
cutclink.shop
cutdlink.shop
linkurla.online
linkurlb.online
linkurlc.online
linkurld.online
midalink.live
midamain.shop
midaurl.site
midaurl.tech
midblink.xyz
midbmain.shop
midburl.site
midburl.tech
midclink.xyz
midcmain.click
middmain.click
movelinka.online
movelinkb.online
movelinkc.online
movelinkd.online
navurla.tech
netalink.space
netblink.space
netclink.store
netdlink.store
nilinks.online
nilinkt.online
nilinku.online
nlinka.link
nlinka.online
nlinkb.link
nlinkb.online
nlinkc.link
nlinkc.online
nlinkd.link
nlinkd.online
nlinke.link
nredia.tech
nredib.link
nredic.link
nredid.link
nredie.link
nredif.link
nredif.live
nredig.link
nredirea.live
nredireb.live
nredirec.live
nredirecti.tech
nredirectj.tech
nredirectk.tech
nredired.live
nserva.link
nserva.live
nservb.link
nservb.live
nservc.link
nservc.live
nservd.link
nservd.live
nserve.live
nshortlinka.live
nshortlinkb.live
nshortlinkc.live
nshortlinkd.live
nshortlinke.live
nurla.link
nvurli.online
nvurlu.online
nvurly.online
reashow.live
rebshow.live
recshow.live
redalink.xyz
redclink.xyz
redelink.tech
redflink.tech
redireact.online
redirebct.online
redirecct.online
rediurla.live
rediurlb.live
rediurlc.live
rediurld.live
redomain.info
redombin.info
redserva.online
redservb.online
redservc.online
redservd.online
redshow.live
shortacut.tech
shortanet.click
shortaurl.site
shortbcut.tech
shortbnet.click
shortburl.site
shortccut.info
shortcurl.site
shortcuta.online
shortcuta.xyz
shortcutb.online
shortcutb.xyz
shortcutc.online
shortcutc.xyz
shortcutd.online
shortcutd.xyz
shortdcut.info
shortdurl.site
shortlinka.xyz
shortlinkb.xyz
urlalink.info
urlblink.info
urlclink.info
urldlink.info
help.nredid.link
port.movelinkb.online
port.nredig.link
port.nservc.link
port.nservc.live
port.nshortlinke.live
port.redserva.online
postgres.nlinkd.online

# Reference: https://twitter.com/RedDrip7/status/1562282889693126659
# Reference: https://www.virustotal.com/gui/file/6a435e2aab6dce39d626eacb39fc964967e35e94abf513da0f6511ab7b1f826e/detection

uppgrede.scienceontheweb.net

# Reference: https://securelist.com/kimsukys-golddragon-cluster-and-its-c2-operations/107258/

225b4d3c305f43e1a590.blogspot.com
3a8f846675194d779198.blogspot.com
c52ac2f8ac0693d8790c.blogspot.com
leejong-sejong.blogspot.com
21nari.getenjoyment.net
21nari.mypressonline.com
21nari.scienceontheweb.net
attach.42web.io
attachment.a0001.net
bigfile.totalh.net
chmguide.atwebpages.com
chunyg21.sportsontheweb.net
clouds.rf.gd
glib-warnings.000webhostapp.com
global.onedriver.epizy.com
global.web1337.net
hochdlincheon.mypressonline.com
hochuliasdfasfdncheon.mypressonline.com
hochulidncheon.mypressonline.com
hochulincddheon.mypressonline.com
hochulincheon.mypressonline.com
hochulindcheon.mypressonline.com
hochulindddcheon.mypressonline.com
hochulinsfdgasdfcheon.mypressonline.com
koreajjjjj.atwebpages.com
koreajjjjj.sportsontheweb.net
kpsa20201.getenjoyment.net
leehr24.mywebcommunity.org
weworld78.atwebpages.com
weworld79.mygamesonline.org
yulsohnyonsei.atwebpages.com
yulsohnyonsei.atwewbpages.com
yulsohnyonsei.medianewsonline.com

# Reference: https://twitter.com/RedDrip7/status/1563074487452848128
# Reference: https://www.virustotal.com/gui/ip-address/216.189.154.6/relations
# Reference: https://www.virustotal.com/gui/file/7903bdf0976d5c6f3c28abf40c41414380f4494a8bf72af9e27ff810599faaf2/detection
# Reference: https://www.virustotal.com/gui/file/f63ff642e7025db96d6ebbd6da26aa9cece4f132891ce2a8385d7c034a7ead25/detection
# Reference: https://www.virustotal.com/gui/file/db18e23bebb8581ba5670201cea98ccf71ecea70d64856b96c56c63c61b91bbe/detection

accountverify.hmail.us
office.pushitlive.net
qwert.mine.bz

# Reference: https://twitter.com/Jup1a/status/1562720823869583360
# Reference: https://www.virustotal.com/gui/file/a0fddbb638fc4f3ba4cefc0707226e8c01eefd98f78d6a9b4fbca1ba74b21adf/detection

sectionss.scienceontheweb.net

# Reference: https://twitter.com/Des00464472/status/1564151538553352193
# Reference: https://www.virustotal.com/gui/ip-address/210.16.120.163/relations

xxdzts.com
autoconfig.xxdzts.com
autodiscover.xxdzts.com
mail.xxdzts.com

# Reference: https://twitter.com/ShadowChasing1/status/1568061411011760129

aasssambly.mywebcommunity.org

# Reference: https://twitter.com/PhantomXSec/status/1567738114638237697
# Reference: https://twitter.com/PhantomXSec/status/1567733296083398656
# Reference: https://www.virustotal.com/gui/ip-address/27.255.81.84/relations
# Reference: https://virustotal.com/gui/ip-address/61.97.251.247/relations

daum-master.com
daum-security.com
daurn.net
help-naver.com
kk01aodia.cfd
kk03aidoa.cfd
kk06aiaoa.cfd
logincommandserver.store
logincookieserver.store
naccountguardcom.store
naccountserver.store
naccountstorecomservice.store
naver-edoc.com
naver-edocu.com
naveradmin.center
naverc0rp.com
navercorp.date
navernail.eu
naverscenter.com
naverssl.com
ncontrolhome.store
ncookiedefenderlog.info
ncorpguardteamlog.info
ncorpmailserver.store
ncorpmailservice.store
ncorpvisitlogin.store
ndefendercenter.store
ndefenderserver.store
nenterservice.store
ngeniuscom.store
ngeniusserver.store
nguardiancomserver.store
nguardianserver.store
nguardteamlog.info
nhelpserver.store
nhelpservice.online
nhomedefender.store
nhomedefendercom.store
nhomemailserver.store
nhomeserver.store
nhomeservercom.store
nhomeserveron.store
nhomeservervisit.store
nhomeservice.store
nmailcorponline.store
nmailservicelogcom.store
nonhomeservice.store
nonlinehomeserver.store
nonlinemailserver.store
nonlinemailservice.store
nonlineservicecom.store
nonlinevisitserver.store
nprotectercom.store
nprotecthome.store
nprotectorhelp.store
nsafecenter.store
nsafeguardteam.store
nsafehelper.store
nsafeserver.store
nsafeservicemode.store
nservercommander.info
nserveronline.store
nserversafemode.store
nservicecentercom.store
nservicecenterlog.info
nservicecommanager.store
nserviceguardian.store
nservicehome.site
nservicehomelog.store
nservicemanage.store
nservicemanagercom.store
nservicemodehome.store
nserviceteamcom.info
nvisitservercom.store
nvisitservercominfo.info
onlinenservercom.store
onlinenservicesite.store
onlinensitecom.store
peacer.store
policeserveronline.cfd
policeservicecom.cfd
qq02aiai.cfd
qq07pizd.cfd
qq10aiai.cfd
sec-naver.com
ss10aidiaua.cfd
ss11siaidoao.cfd
ss14aidoaisis.cfd
ss15aidiaoa.cfd
ss1aiaoaidde.cfd
ss3aidiaodiaa.cfd
ss4aidiaodifia.cfd
ss5aidoaidiaoa.cfd
ss7iaiaoaoa.cfd
visitnservercom.store
visitserviceguardcom.store
zz01aqwes.cfd
zz03amcnc.cfd
zz05iolnc.cfd
zz06ioncc.cfd
zz08vnbvi.cfd
zz15ijnvc.cfd
zz19eridn.cfd
zz24nzcij.cfd
6xv2abhu1nc0.help-naver.com
6xv2abhu1nc0.sec-naver.com
7nv42j9qxt140.help-naver.com
7nv42j9qxt140.sec-naver.com
ad.daurn.net
cafe.daurn.net
gud2abhu1nc0.help-naver.com
gud2abhu1nc0.sec-naver.com
m.cafe.daurn.net
nid.naverssl.com
nidiogin.naverc0rp.com
nidlogin.naverc0rp.com
nidlogin.navercorp.date
nids.naverscenter.com
ns.naverssl.com
rcaptcha.help-naver.com
rcaptcha.sec-naver.com
sks1.smartvpn.pe.kr
smartvpn.pe.kr
static.help-naver.com
static.sec-naver.com
uns.naverssl.com
wat.ad.daurn.net

# Reference: https://twitter.com/cyberwar_15/status/1567828108790890498

certuser.info
koreailmin.com

# Reference: https://twitter.com/PhantomXSec/status/1566863825999400960
# Reference: https://www.virustotal.com/gui/ip-address/38.132.122.162/relations

accounts-kakao.date
cds.naver2.info
com2.space
com3.top
hello.naver2.info
help2.top
help2.xyz
member2.download
naver-corp.top
naver-corp.xyz
naver.com3.top
naver.help2.xyz
naver.member2.download
naver2.eu
naver2.info
naver2.space
naver2.top
naver2.xyz
naver3.space
naver3.xyz
naver4.info
navercorp.top
navercorp.world
navercorp1.xyz
navercorp2.space
navercorp2.top
navercorp2.xyz
navercorp3.xyz
naverpwd.space
naverpwd.top
naverpwd.world
naverpwd.xyz
nid-naver.top
ro.naver2.info
sync-t1.naver2.info
tm.naver2.info
us7lb-cdn.naver2.info

# Reference: https://twitter.com/Des00464472/status/1568885820031135744
# Reference: https://www.virustotal.com/gui/ip-address/104.128.239.16/relations

hiworks.ga
insopack.mcsoft.org
myclouds.r-e.kr
office.hiworks.ga
softmail.kro.kr
app.softmail.kro.kr
office.myclouds.r-e.kr

# Reference: https://twitter.com/ShadowChasing1/status/1570601703598338049
# Reference: https://www.virustotal.com/gui/file/d3930b2494f45bb2c169124d4a39308303b9e8e87043afc54327c1e2a378e4e0/detection

cuts.dothome.co.kr
napoyo.mypressonline.com

# Reference: https://twitter.com/Des00464472/status/1570558688267739138

navers.tech
confluence.navers.tech
myboxs.navers.tech
myboxes.navers.tech
nied.navers.tech
techmyboxes.navers.tech

# Reference: https://twitter.com/ShadowChasing1/status/1576944331050471425
# Reference: https://www.virustotal.com/gui/file/f03a7a96e3ce5e35dd52ce026266b68aa35301828f1d909d858658051371473d/detection

krinnsnail.sportsontheweb.net/file/upload/list.php

# Reference: https://twitter.com/ShadowChasing1/status/1580001848211410944
# Reference: https://www.virustotal.com/gui/file/e1c09e045af8b7301390cd9619e3cca7a96d9d2bba2b5fc3385a093f3d69b6b4/detection

wayna.myartsonline.com

# Reference: https://twitter.com/cyberwar_15/status/1585965668054073345

docxpcgle.epizy.com
imhyoj8.myartsonline.com

# Reference: https://twitter.com/souiten/status/1592758204198719488
# Reference: https://www.virustotal.com/gui/file/2e1aca8c86562cc52b8bee6ecc45dabb1c11ebba94c81b059d8859a1b263f1e7/detection

yundy.mypressonline.com

# Reference: https://twitter.com/cyberwar_15/status/1575476579639078913

attachnents.epizy.com
cloud.kcrea.rf.gd
ewha-cloud.epizy.com
clouds.kvongnum.rf.gd
files.khu.rf.gd

# Reference: https://asec.ahnlab.com/ko/42163/ (Korean)
# Reference: https://otx.alienvault.com/pulse/63766a570640a9c4b0bd052d

jojoa.mypressonline.com
okihs.mypressonline.com

# Reference: https://twitter.com/ThreatBookLabs/status/1593523949664493568

quickedit.o-r.kr
www1.quickedit.o-r.kr

# Reference: https://twitter.com/souiten/status/1603398380687790080
# Reference: https://www.virustotal.com/gui/file/b9dcf7fe7e8ba30d363a19c2c43fc3eea93d281b10f6ee89cffe2a3e533af442/detection

infotechkorea.com

# Reference: https://twitter.com/ThreatBookLabs/status/1607989665487032320

m6.p-e.kr

# Reference: https://asec.ahnlab.com/en/44680/
# Reference: https://otx.alienvault.com/pulse/63a5a4e0a2d0a650343cda1c

3.supports.o-r.kr
conf.simpleedit.n-e.kr
configment.p-e.kr
dashboard.quikveoriy.o-r.kr
digital.pepperbank.kro.kr
foward.viewpropile.p-e.kr
heungkukfire.p-e.kr
inglife.kro.kr
k-bank.o-r.kr
k-bank1.kro.kr
kakaosaving.kro.kr
kamco.kbloan.kro.kr
kamco.kbloan.r-e.kr
kamco.webs.kro.kr
kbank.o-r.kr
kbloan.r-e.kr
naver.o-r.kr
naver65.n-e.kr
nhlife.kro.kr
pepperbank.kro.kr
quikveoriy.o-r.kr
secure-edit.n-e.kr
simpleedit.n-e.kr
smartshinhan.kro.kr
supports.o-r.kr
tos.p-e.kr
user2list.kro.kr
viewpropile.p-e.kr
w1.user2list.kro.kr
w3.secure-edit.n-e.kr
webs.kro.kr
wvw1.user2list.kro.kr
wvw3.secure-edit.n-e.kr
wwv3.supports.o-r.kr
www2.configment.p-e.kr

# Reference: https://twitter.com/souiten/status/1614811574119849989
# Reference: https://www.virustotal.com/gui/file/4e5ef5933078edeb09fd7d44f90843f4a221c1754d9d15a39aded79416b40779/detection

ielsd.myartsonline.com

# Reference: https://asec.ahnlab.com/en/45658/
# Reference: https://otx.alienvault.com/pulse/63c81a99d295f5fc0e67b465

lifehelper.kr

# Reference: https://twitter.com/StopMalvertisin/status/1622820104236077056

hydrotec.co.kr/bbs/img/cmg/upload2/
hydrotec.co.kr/bbs/img/cmg/upload3/

# Reference: https://twitter.com/StopMalvertisin/status/1621390517249654785
# Reference: https://www.virustotal.com/gui/file/a2e6e833947a1d5c526c0c2d6943e35bad9cbe22b52a6f7013ab8c1de0aa2d31/detection

jooshineng.com
/gnuboard4/adm/img/ghp/up/

# Reference: https://twitter.com/StopMalvertisin/status/1620651498014404608
# Reference: https://www.virustotal.com/gui/file/38640d508c137d0e05c6d34d6bf5618095baed364482baef908fe1d7b2310e15/detection

hkisc.co.kr/gnuboard4/bbs/img/upload/list.php
/gnuboard4/bbs/img/upload/

# Reference: https://twitter.com/StopMalvertisin/status/1626528455289610241
# Reference: https://www.virustotal.com/gui/file/97516e5250e44461a479de391daa0538b9714346263577bcb61961c1991efb27/detection

globalinbest.com
/src/bbs/sec/img3/

# Reference: https://twitter.com/fmc_nan/status/1635537014891372545
# Reference: https://www.virustotal.com/gui/file/8ac8eedfc8a155066915aed214dbf78c1f200124e5663b35f1935f31576fb71e/detection
# Reference: https://www.virustotal.com/gui/file/cd127b2f17e686c77898d0ed8b5325503fcbc9dbc4c9b63c7ae8722089db7564/detection

nideso.mywebcommunity.org

# Reference: https://twitter.com/StopMalvertisin/status/1635933718618734593
# Reference: https://www.virustotal.com/gui/file/451f50db8bc6719f3d34abc3ee3b907ac999c4139b58cab91066248d3b04c80f/detection

eum-it.co.kr/gnuboard4/bbs/img/upload/
/gnuboard4/bbs/img/upload/

# Reference: https://asec.ahnlab.com/en/49295/
# Reference: https://community.emergingthreats.net/t/ruleset-update-summary-2023-03-14-v10267/358
# Reference: https://otx.alienvault.com/pulse/64120cb4ea4bae2a4dbdf8d8

ria.monster
mp_eval_r.ria.monster
mpevalr.ria.monster
mpevlar.ria.monster
viewfile.ria.monster
/SmtInfo/show.php

# Reference: https://twitter.com/asdasd13asbz/status/1636173992695582720
# Reference: https://www.virustotal.com/gui/file/d0ec6d91cf9e7c64cf11accadf18f8b5a18a10efbecb28f797b3dbbf74ae846d/detection

http://172.93.193.158

# Reference: https://twitter.com/ShadowChasing1/status/1636391606592094208
# Reference: https://www.virustotal.com/gui/file/4e9d8f2d6bd17f71ed2a6c356deebc87801e413aad931b7ae1a70a8aa431d007/detection

breezyhost.net

# Reference: https://twitter.com/fmc_nan/status/1636667175913287680

delps.scienceontheweb.net/ital/info/list.php
delps.scienceontheweb.net/ital/info/sample.hwp

# Reference: https://asec.ahnlab.com/ko/50394/ (Korean)
# Reference: https://www.virustotal.com/gui/file/7a45a529b275cfaa6ebde88bf00413a11c0f701bf9e1e7e93ef27423fd17e3f5/detection

zetaros.000webhostapp.com

# Reference: https://twitter.com/BridewellCTI/status/1640376166858063874
# Reference: https://twitter.com/MichalKoczwara/status/1640393007382904851
# Reference: https://www.bridewell.com/insights/news/detail/bridewell-intelligence-report-kimsuky-apt-group---key-insights-for-uk-energy-cisos

aontechu.com
bsconvid.info
cdn-smtp.com
cereoni.org
cgui.eu
cmember.info
daumblog.eu
dmrxcloud.com
dreamhosregister.eu
edronium.com
gmember.eu
gmember.info
innovace.info
kakao-privacy.com
kakao-security.com
msn-imap.com
ncop.info
onkrdot.info
ontechvip.eu
publishhostmap.shop
umember.info
wordpress1s.xyz
accountc.gmember.eu
fqdn.nid.sslnaver.online
kr4.wordpress1s.xyz
logins.cdndaum.online
mail.cdndaum.online
nid.sslnaver.online
tls.publishhostmap.shop
web.publishhostmap.shop
web.sslnaver.online
webmail.dreamhosregister.eu

# Reference: https://twitter.com/ni_fi_70/status/1566770766389149696
# Reference: https://www.verfassungsschutz.de/SharedDocs/publikationen/EN/prevention/2023-03-20-joint-cyber-security-advisory.pdf
# Reference: https://otx.alienvault.com/pulse/641dd2ad4310d178a4c6766e

navernnail.com

# Reference: https://twitter.com/souiten/status/1645307251903840257
# Reference: https://www.virustotal.com/gui/file/0d663b9907a34604f120963b64a763c472e7e896857728199d3df912c93208a0/detection

messydoan.000webhostapp.com
mvix.xn--oi2b61z32a.xn--3e0b707e

# Reference: https://twitter.com/suyog41/status/1647956514005450752
# Reference: https://www.virustotal.com/gui/file/b92cb632535fd8b5c3863635b980611deae61420d76158fc6e7b307518302490/detection
# Reference: https://www.virustotal.com/gui/file/9fcd77ff9ec8a0b701316c3d45d4e6f7a0f012f5c2254a77628d233045839a7d/detection
# Reference: https://www.virustotal.com/gui/file/4f1081d688ba2477e097ebbbf0cce4048dbe9134da526949ae6e729f7b0494de/detection
# Reference: https://www.virustotal.com/gui/file/35cb65a70e8296aafd09b7550b13da2255bed9c30d6f284cce395e8e4532804c/detection

ibsq.co.kr/config/demo.txt
ibsq.co.kr/m.layouts/demo.txt
ibsq.co.kr/config
ibsq.co.kr/m.layouts

# Reference: https://twitter.com/malwrhunterteam/status/1648601223245725696
# Reference: https://www.virustotal.com/gui/file/6bab11d9561482777757f16c069ebef3f1cd6885dbef55306ffde30037a41d48/detection

xn--vn4b27hka971hbue.kr

# Reference: https://www.virustotal.com/gui/file/1ec4d60738a671f00089a86eeba6cb13750bce589e84fd177707718a4cc7d8f1/detection

partybbq.co.kr

# Reference: https://twitter.com/malwrhunterteam/status/1653682472163368960
# Reference: https://www.virustotal.com/gui/file/8cc66e4069a30885202b0328407ff167671133a1a539808c48f12928348744e0/detection

inspa.studioguy.com/bbs/data/bbs15/context.php
inspa.studioguy.com/bbs/data/bbs15/inquire.php
/bbs/data/bbs15/context.php
/bbs/data/bbs15/inquire.php

# Reference: https://www.sentinelone.com/labs/kimsuky-evolves-reconnaissance-capabilities-in-new-global-campaign/

mitmail.tech
newshare.online
rfa.ink
yonsei.lol
/bio234567890rtyui/
/bio433ertgd12/

# Reference: https://twitter.com/h2jazi/status/1658133904618934272
# Reference: https://www.virustotal.com/gui/file/76b2f8df4578d65d5b6d57af8784584c1bcf86402d964b567db58e63723b636c/detection
# Reference: https://www.virustotal.com/gui/file/bbcfcc719190f0a2c687778d5d2fd5c6e345d64f44a01b26d33b7df20e099d6f/detection

com-port.space
file.com-port.space

# Reference: https://www.virustotal.com/gui/ip-address/61.195.126.150/relations

blog.de-file.online
cf-health.click
com-def.asia
com-otp.click
com-people.click
com-port.space
com-price.space
com-www.click
de-file.online
kr-angry.click
kr-me.click
mid.navers.blog.de-file.online
navers.blog.de-file.online
navers.com-otp.click
navers.com-price.space
navers.de-file.online
nld.navers.de-file.online
uid.navers.com-price.space
uld.navers.com-otp.click

# Reference: https://www.virustotal.com/gui/ip-address/157.7.184.26/relations

bid.cyberestate.de-bat.click
bld.cyberestate.de-bat.click
blog.mpevalr.com-def.asia
com-coffee.click
com-def.asia
com-port.space
cyberestate.de-bat.click
de-bat.click
de-two.website
k-ac.net
logins.nlfty.com-coffee.click
mpevalr.com-def.asia
navers.blog.mpevalr.com-def.asia
nld.navers.blog.mpevalr.com-def.asia
nlfty.com-coffee.click
point.com-def.asia
smart.com-coffee.click
smart.de-bat.click
sniperman.click
view.sniperman.click

# Reference: https://www.virustotal.com/gui/file/fd63e26bd09fd13d86d4505d9aa53c4bf599f9de954e7bccfa01179fd644d218/detection

trusteer.ink

# Reference: https://twitter.com/malwrhunterteam/status/1656946771053150208
# Reference: https://www.virustotal.com/gui/file/42f76f37742103bd599a68ef508b515efeb9e9ffddbfdcc43eb552b70b2440e9/detection
# Reference: https://www.virustotal.com/gui/file/cca4e9fc00647b644d334b2bab03d1a9acb23f7492c7c5aa2d283be78b87d67d/detection

jeannecampos.com/wp-includes/certificates/ca-bundle.php

# Reference: https://twitter.com/StopMalvertisin/status/1669259390237708291
# Reference: https://www.virustotal.com/gui/file/de2fd62fafe61f46ad967c84dd7fbca80d31ad4729fed051d527d9ba45857fd6/detection

sendlucky.scienceontheweb.net

# Reference: https://twitter.com/StopMalvertisin/status/1669379338691837953
# Reference: https://twitter.com/StopMalvertisin/status/1669379341820792832
# Reference: https://www.virustotal.com/gui/file/2763ddf592130cd80198fb60546dfb28de5f647df34522e4ab58a8bf5e63b769/detection
# Reference: https://www.virustotal.com/gui/file/0d19cf462bd2b5f84a7525575031de032db6df30925ef86ac1a9f4441ecce9f3/detection

greenspace1.com
html.gethompy.com
well-story.co.kr
/gnuboard4/bbs/pnger/
/gnuboard4/bbs/pnger/main.php
/gnuboard4/bbs/pnger/stdio.php

# Reference: https://asec.ahnlab.com/en/55145/

getara1.mygamesonline.org
pikaros2.r-e.kr

# Reference: https://twitter.com/0x0v1/status/1683434522413547521

bandi.tokyo
one.bandi.tokyo

# Reference: https://www.virustotal.com/gui/file/928e61590b2c4acf3991bd4327c5107c1cfd2604d992647c4e63bd1d620ff636/detection

partner24.kr/mokozy/hope/kk.php
/mokozy/hope/kk.php

# Reference: https://twitter.com/tiresearch1/status/1686258180819730432

3group-view.click
3group-view.space
appfile.click
com-file.space
db-wine.click
direct-million.online
file-hide.click
file-vip.space
go-wt.space
mi-eve.click
mufg.wiki
nr-token.space
otp-kr.space
toss-tree.click
wide-org.click

# Reference: https://twitter.com/ThreatBookLabs/status/1686363399679029249

com-in.asia
file-mango.space
ne-point.space
value-domain-com.site

# Reference: https://www.sentinelone.com/labs/kimsuky-new-social-engineering-campaign-aims-to-steal-credentials-and-gather-strategic-intelligence/
# Reference: https://otx.alienvault.com/pulse/64805aad021906141c79aec0

nknews.pro
staradvertiser.store

# Reference: https://twitter.com/tiresearch1/status/1688552033245409280

mz-ftp.online
net-doc.click

# Reference: https://twitter.com/tiresearch1/status/1691131020517707776

do-can.click
mz-follia.space

# Reference: https://twitter.com/ginkgo_g/status/1692029899094274388
# Reference: https://www.virustotal.com/gui/file/470027cf8dd33b201b465b109a9876d0a75667be907af770eb76ff5798496ae4/detection

grekop.online

# Reference: https://twitter.com/ginkgo_g/status/1692068693113737630
# Reference: https://www.virustotal.com/gui/file/c676e9b009913bf55372fc756c6d7a19b51528e2f20ff598be2f953e5f78c754/detection

steeringsvr.online

# Reference: https://asec.ahnlab.com/en/54678/
# Reference: https://otx.alienvault.com/pulse/649304a4045008836f16efac

vndjgheruewy1.com

# Reference: https://twitter.com/tiresearch1/status/1694250245486748033

no-one.click

# Reference: https://twitter.com/souiten/status/1697515866148270249
# Reference: https://www.virustotal.com/gui/file/821b43f3151e568ebf436a05928909968ace706049e09feeec448a3efe9af67c/detection

http://43.201.69.58
43.201.69.58:8080

# Reference: https://twitter.com/ginkgo_g/status/1702242436632945025
# Reference: https://www.virustotal.com/gui/file/1426269940ef6036941ccfbf68b0b65259bc72918f30481465a11d8b97250f07/detection

isujeil.co.kr/pg/adm/img/upload1/list.php

# Reference: https://www.virustotal.com/gui/ip-address/104.168.219.12/relations
# Reference: https://www.virustotal.com/gui/ip-address/142.11.205.109/relations

navemorp.cloud
naver-centre.com
naver-email.report
navercorp.tech
navercorpv2.email
naverhelp.cloud
naverquery.host

# Reference: https://twitter.com/ginkgo_g/status/1703583960461402223
# Reference: https://www.virustotal.com/gui/file/59a0b32c22c79e7e48614add0e5cdf846f50d38d46201077309534a093a723ac/detection

00701111.000webhostapp.com

# Reference: https://twitter.com/tiresearch1/status/1703715668368240708
# Reference: https://twitter.com/tiresearch1/status/1703811837719142890

com-atw.click
com-bss.click
com-cbw.fun
com-condor.click
com-condor.website
com-cyb-seed.click
com-data.click
com-final.click
com-first.click
com-gpt.click
com-mns.click
com-mns.fun
com-nfi.click
com-nft.click
com-nfw.space
com-ntw.site
com-renewal.click
com-second.click
com-seoul.website
com-share.click
com-smt.click
com-will.click
com-will.online
com-will.pw
medicert.click
navers.site
navserves.com
net-off.online

# Reference: https://twitter.com/tiresearch1/status/1708511711878340625

ad-naver.com
navercorps24.com

# Reference: https://twitter.com/tiresearch1/status/1708528528344670643

naver-clouds.com
naver-drives.com
naver-notices.com

# Reference: https://x.com/asdasd13asbz/status/1818519143026762046
# Reference: https://asec.ahnlab.com/en/57873/

5.61.59.53:14276
5.61.59.53:2086
onessearth.online
powsecme.co
/up/upload_dotm.php

# Reference: https://twitter.com/tiresearch1/status/1717799289198674086

co-eu.info
com-log.in.net
com-mode.in.net
invoice.navers.com-mode.in.net
mn-tr.click
navers.com-log.in.net
navers.com-mode.in.net
nid.navers.com-log.in.net

# Reference: https://twitter.com/MichalKoczwara/status/1718637997002809395
# Reference: https://www.virustotal.com/gui/ip-address/27.255.75.154/relations
# Reference: https://www.virustotal.com/gui/ip-address/27.255.81.108/relations
# Reference: https://www.virustotal.com/gui/ip-address/27.255.81.120/relations
# Reference: https://www.virustotal.com/gui/ip-address/27.255.81.82/relations

aaarior.online
aioeo.site
arakyaly.eu
bbbrior.website
bnire.store
boardmgr.info
ccciro.store
cloudown.store
cnnail.info
cornass.info
dddero.site
eeeiro.xyz
fffiro.store
gggiro.online
hummedaroundput.com
iiiior.website
jiorer.website
jjjior.shop
kakaocorp.info
kakaodownload.eu
kakaomail.site
kakaomailer.eu
kakaon.store
kakaopaey.info
mailcorp.eu
namcho.homes
navemail.space
naver.com.bz
navercoxp.com
navercrop.com
navercrp.com
navercrup.com
naveredoc.com
navermail.click
navermail.live
naveroriae.eu
naverpwd.com
naverscorp.info
nmior.shop
opiretyu.website
orsiu.online
uansilne.site
usage.store
usance.online
voanews.store
webfatory.eu
weekbootseey.com
werbineor.online
weudsfhue.shop
xchireo.website
zrrorer.online
0vym.mailcorp.eu
8fkn.mailcorp.eu
accountsbinance.navermail.click
accountseoke.cookiemanager.online
accountserok.usance.online
accountseuoe.naveroriae.eu
accountseuok.kakaopaey.info
activedirectory.msoffic.homes
airwatch.msoffic.homes
aw.msoffic.homes
book.mailcorp.eu
campaign.mailcorp.eu
client.msoffic.homes
cloud.msoffic.homes
com.mailcorp.eu
community.msoffic.homes
configmgrenroll.msoffic.homes
console.msoffic.homes
cookiemanager.online
cs.mailcorp.eu
delivery.msoffic.homes
dnerok.usance.online
emv1.cookiemanager.online
enrollment.msoffic.homes
find.msoffic.homes
fsvoa.voanews.store
hadoop.msoffic.homes
help.navercrop.com
helpids.ncookieclear.homes
helpnaver.msoffic.homes
helpsec.ncookieclear.homes
jenkins.msoffic.homes
jira.msoffic.homes
link.msoffic.homes
logingns.arakyaly.eu
maillo.arakyaly.eu
mailpo.arakyaly.eu
mdmds.msoffic.homes
media.weekbootseey.com
mi.msoffic.homes
mobility.msoffic.homes
mon.msoffic.homes
msoffic.homes
mta2.msoffic.homes
ncookieclear.homes
nid.navercrop.com
nid.naverpwd.com
nidcl.kakaopaey.info
nidlgn.namcho.homes
nidnaver.msoffic.homes
nidpos.namcho.homes
nidroue.naveroriae.eu
nids.ncookieclear.homes
nidsess.ncookieclear.homes
nlgin.ncookieclear.homes
ns4.msoffic.homes
nsec.ncookieclear.homes
nsight.navercrop.com
nuid.navermail.click
oct.msoffic.homes
onedrive.msoffic.homes
origin-www.msoffic.homes
outlook.msoffic.homes
owa.msoffic.homes
p.msoffic.homes
pdu.msoffic.homes
public.hummedaroundput.com
resource.msoffic.homes
sslids.ncookieclear.homes
sslnaver.msoffic.homes
sslsec.ncookieclear.homes
stat_tiaraerok.usance.online
stg-www.msoffic.homes
stream.msoffic.homes
t1_daumcdnerok.usance.online
transfer.msoffic.homes
www1.msoffic.homes
wwwcorpids.ncookieclear.homes
wwwcorpnaver.msoffic.homes
wwwcorpsec.ncookieclear.homes
wwwlgin.ncookieclear.homes
wwwsec.ncookieclear.homes
wwwsess.ncookieclear.homes
zenworks.msoffic.homes

# Reference: https://asec.ahnlab.com/en/57873/
# Reference: https://otx.alienvault.com/pulse/65312ede507158b7c49f8e87

superpcparts.com

# Reference: https://twitter.com/tiresearch1/status/1719617997168660766

xn--3e0b39ycvbh9d.p-e.kr
xn--939a1gynmpm0ukuoxtbq59g.r-e.kr
eid.xn--939a1gynmpm0ukuoxtbq59g.r-e.kr
mood.xn--3e0b39ycvbh9d.p-e.kr

# Reference: https://twitter.com/tiresearch1/status/1719985431687917799

kakaoaccouts.store

# Reference: https://asec.ahnlab.com/wp-content/uploads/2023/10/20231101_Kimsuky_OP.-Covert-Stalker.pdf

1-z.never.com.ru
a1ive.info
aa.goooglesecurity.com
aadcdnmsauthdose.certuser.info
aadcdnmsauthmicrosoftharvard.certuser.info
aadcdnmsftauthdose.certuser.info
aadcdnmsftauthmicrosoftharvard.certuser.info
accdaum.login.mail.pl
account.googlernails.com
account.goooglesecurity.com
accountdose.certuser.info
accountmicrosoftharvard.certuser.info
accounto.afgvillage.eu
accounts.daums.pro
accounts.googlernails.com
accounts.goooglesecurity.com
accounts.guser.eu
accounts.navernnail.com
accountseuok.kakaocore.eu
accountskakao.login.mail.pl
accountskakao.navernnail.com
accountsleu.kakaoreug.info
accountsmil.kakaoreug.info
accountsmt.certuser.info
ads-twitterbybit.navernnail.com
afgvillage.eu
aire.p-e.kr
analyticsbybit.navernnail.com
apisbybit.navernnail.com
app.cjphoto.ga
app.firmware.o-r.kr
app.iptimes.o-r.kr
app.saferzone.ml
app.tookit.r-e.kr
assambly.atwebpages.com
assambly.mypressonline.com
assambly.mywebcommunity.org
auth.worksmobile.kro.kr
blog.nidcorp.site
bluemotion.co.kr/cheditor4/insert_link.php
bstill.kr/gnuboard4/bbs/view_coma.php
cadorg.p-e.kr
cc.navernnail.com
cc.never.com.ru
cc.nidcorp.site
cc.weataxs.site
cclg.never.com.ru
cclogin.navernnail.com
cdnbybit.goooglesecurity.com
cdnbybit.navernnail.com
cengroup.kro.kr
cimoon.ga
cjphoto.ga
client.coreavpn.kro.kr
cmonunt.online
connectfacebookbybit.goooglesecurity.com
connectfacebookbybit.navernnail.com
coreavpn.kro.kr
csma.certuser.info
da.infocheck.cf
dadrollbybit.navernnail.com
daum.otp-system.p-e.kr
daum.otpsystem.p-e.kr
daum.protect-mail.p-e.kr
daum.protectmail.p-e.kr
daums.pro
dmail.p-e.kr
dnleu.kakaoreug.info
dstent04.co.kr/wp-includes/SimplePie/Items.php
extparts.info
firmware.o-r.kr
g00gledrive.atwebpages.com
g00gledrive.mywebcommunity.org
g00gledrive.sportsontheweb.net
generalparts.info
github.ne.kr
goaffecbybit.navernnail.com
googlernails.com
goooglesecurity.com
guser.eu
gw.yottatech.r-e.kr
hao.lantian.p-e.kr
hellosnbybit.navernnail.com
hi.ncgncg.p-e.kr
hiwi.o-r.kr
hiwi.p-e.kr
hotlook.jonga.ml
huitadfsharvard.certuser.info
hyper.cadorg.p-e.kr
iishtt.p-e.kr
infoauth.shop
infocheck.cf
infrabybit.goooglesecurity.com
infrabybit.navernnail.com
iptimes.o-r.kr
it-ace.r-e.kr
joongang.site
jsadsrvrbybit.navernnail.com
june.lovelyclient.ml
kakaocore.eu
kakaoreug.info
keyharvard.certuser.info
koreaglobal.atwebpages.com
koreaglobal.mypressonline.com
koreaglobal.mywebcommunity.org
koreailmin.atwebpages.com
koreailmin.mypressonline.com
koreailmin.mywebcommunity.org
krhome.ga
lantian.p-e.kr
lcs.navernnail.com
lcs.never.com.ru
lcs.nidcorp.site
lcs.weataxs.site
lcslogin.navernnail.com
listmember.info
live.com.cm
logcheck.ga
login.microsftonline.tk
login.org.ro
logindose.certuser.info
loginmicrosoftharvard.certuser.info
logins.daums.pro
loginsdose.certuser.info
loginsma.certuser.info
loginsmicrosoftharvard.certuser.info
lovelyclient.ml
m1ma.certuser.info
m2_daumcdnmt.certuser.info
mail.it-ace.r-e.kr
mail.masters-login.r-e.kr
mail.masterslogin.r-e.kr
mail.never.com.ru
mail.nidcorp.site
mail.yoonseul.kro.kr
maildose.certuser.info
mailis.extparts.info
mailis.walock.info
mailma.certuser.info
mailmicrosoftharvard.certuser.info
mailnts.goooglesecurity.com
mailsr.walock.info
mailweb.afgvillage.eu
managerbybit.navernnail.com
masterslogin.r-e.kr
matchbybit.goooglesecurity.com
matchbybit.navernnail.com
mcyandexbybit.navernnail.com
memberma.certuser.info
mi.never.com.ru
microsftonline.tk
mlcrst.p-e.kr
msoharvard.certuser.info
mxndu.r-e.kr
myinfo.nsupport.ml
naver-logs.r-e.kr
naver.nidcorp.site
naver.weataxs.site
navercopr.co
navercopr.ml
navercopr.tk
naverlogs.r-e.kr
ncgncg.p-e.kr
never.com.ru
ngrok.p-e.kr
nid.logcheck.ga
nid.navercopr.co
nid.navercopr.ml
nid.navercopr.tk
nid.navernnail.com
nid.never.com.ru
nidcorp.site
nidlog.never.com.ru
nidlogin.navernnail.com
nidm.navernnail.com
nihaiji.p-e.kr
nmail.p-e.kr
objects.n-e.kr
omtom.r-e.kr
osupdate.r-e.kr
otp-system.p-e.kr
otp.r-e.kr
otpsystem.p-e.kr
outlookdose.certuser.info
outlookmicrosoftharvard.certuser.info
peer.o-r.kr
playnto.afgvillage.eu
playnts.googlernails.com
playnts.goooglesecurity.com
policyma.certuser.info
preview.p-e.kr
protect-mail.p-e.kr
protectmail.p-e.kr
proxy.ngrok.p-e.kr
qingli.o-r.kr
regular.winupdate.kro.kr
rok.my.to
sadrollbybit.navernnail.com
sadxiobybit.navernnail.com
saferzone.ml
sdfwerwer.sbs
servicebybit.navernnail.com
sftp.r-e.kr
signaler.goooglesecurity.com
sire.r-e.kr
sjkdfuiowe.p-e.kr
smart-alyac.r-e.kr
snaplicdnbybit.navernnail.com
spi_mapsmt.certuser.info
ss_mt.certuser.info
sslnts.goooglesecurity.com
stat_tiaraleu.kakaoreug.info
stat_tiaramt.certuser.info
stat_tiaraosi.kakaoreug.info
static-sg.goooglesecurity.com
staticbybit.navernnail.com
staticnid.navernnail.com
staticnid.never.com.ru
support.github.n-e.kr
support.github.ne.kr
syncoutbrainbybit.goooglesecurity.com
synctaboolabybit.goooglesecurity.com
t1_daumcdneuok.kakaocore.eu
t1_daumcdnkakao.navernnail.com
t1_daumcdnleu.kakaoreug.info
t1_daumcdnmt.certuser.info
t1ma.certuser.info
test.mydomainisok.kro.kr
tookit.r-e.kr
topfwz1mailbybit.navernnail.com
track_tiara_daummt.certuser.info
track_tiara_kakaomt.certuser.info
ucmdjwer.lol
uieosdj.r-e.kr
update-online.p-e.kr
update.naver-logs.r-e.kr
update.naverlogs.r-e.kr
update.p-e.kr
usesignal.info
vitual.p-e.kr
vlnk.ga
voanews.one
waesme.shop
walock.info
weataxs.site
webmail.cellivery.ml
webmail.cengroup.kro.kr
wetaxces.online
wgbybit.goooglesecurity.com
wgbybit.navernnail.com
wgsnto.afgvillage.eu
winupdate.kro.kr
worksmobile.kro.kr
wwkakao.goooglesecurity.com
wwmt.certuser.info
wwwbybit.goooglesecurity.com
wwwbybit.navernnail.com
wwwdose.certuser.info
wwwma.certuser.info
wwwmicrosoftharvard.certuser.info
wwwnto.afgvillage.eu
wwwnts.googlernails.com
wwwnts.goooglesecurity.com
xinzhong.r-e.kr
xx.navernnail.com
y-cloud.never.com.ru
yoonseul.kro.kr
yottatech.r-e.kr
youtubnts.goooglesecurity.com
/ewf43fewfwf4tfw4/
/ewf43fewfwf4tfw4/wf7weyr892hfwogewgsfg3.php
/tygygvftsfx8g68Gu8x7s78gsvseidj6.php
/tygygvftsfx8g68Gu8x7s78gsx6.php
/tygygvftsfx8g68Gu8x7s78gsx6519.php
/tygygvftsfx8g68Gu8x7s78gsxueidj6.php
/wf7weyr892hfwogewgsfg3.php

# Reference: https://app.validin.com/axon?find=27.102.106.48&type=ip

governments.pro
nidnaver.space
nidscorp.site
nps-home.store
nps-news.store
nps-service.store
nps-services.store
weataxc.site

# Reference: https://app.validin.com/axon?find=27.10.16.4&type=ip

wetax-io.store

# Reference: https://www.virustotal.com/gui/ip-address/141.164.50.204/relations
# Reference: https://app.validin.com/axon?find=141.164.50.204&type=ip

applc.site
bilfstakecooke.site
chainsflix.net
check-youtube.info
check-youtube.online
confirmes-youtebu.com
documentviews.com
drivesgooglce.site
emv1.documentviews.com
emv1.securiteams.info
emv1.sharedboxview.online
exchange-birances.com
ftc-home.space
gocgle.site
googlc.site
googlces.site
googlcs.site
homestex.info
kftc-cert.site
linekdin.online
linkdlin.ink
little-stars.site
myidentifitesrv.site
nlvdcp9p2d.sharedboxview.online
nps-alert.site
nps-services.info
post-binarianse.info
rememberapp.site
rememberapps.info
s1.documentviews.com
s1.securiteams.info
s1.sharedboxview.online
sarnsung-mail.info
sarnsung.store
securecenters.site
securiteams.info
service.documentviews.com
service.securiteams.info
service.sharedboxview.online
services-dosi.world
sharedboxview.online
wetac.store
weatacs.site
wetacx.store
wetaxs.lol
wetacx.xyz
wetaczx.lol
wetaczx.site
wetaczx.xyz
wetaex.site
wetax-io.xyz
wetaxce.online
wetaxcs.site
wetaxs.xyz
wetaxz.xyz
wetazx.space
weteax.site
xn--policy-linkedn-dmb.com
youtube-ex.site
youtube-in.site

# Reference: https://app.validin.com/axon?find=141.164.52.102&type=ip

bilfstakecooke.site
check-lnkedin.site
check-youtuibe.site
confirms-linkeclein.info
confirrns-linkeclin.site
extend-gooqlie.site
goooleclouds.site
goooleclrive.online
goooleclrive.site
goooleclrives.site
goooledrivs.com
goooledrivs.info
gooqle.site
govenment24.site
hornestax.site
linkeclein.site
linkecleins.site
myacountsinfo.com
niclvaldates.site
rememberapp.fun
rememberapp.online
sarnsung.store
seumtax.website
vve-tax.site
vvetax.store
we-tax.site
xn--check-linkedn-7ib.com

# Reference: https://app.validin.com/axon?find=158.247.227.83&type=ip

belluster.com
homestax.info
exchange-dosi.world
kakaologins.com
rimbacell.store

# Reference: https://twitter.com/asdasd13asbz/status/1725337231949459834
# Reference: https://www.virustotal.com/gui/file/97df5304f53fec6a5d2d2bd75b9310a3747b681520fe45d2961bc4df86e556d7/detection

rscnode.dothome.co.kr

# Reference: https://twitter.com/asdasd13asbz/status/1727856931635872121
# Reference: https://www.virustotal.com/gui/ip-address/84.32.131.87/relations
# Reference: https://www.virustotal.com/gui/file/b6e1351f1767a2cacb3fc7515f0a67691bbd8b9274a26c2953ba898ba879ebea/detection

offlinedocument.site
nav.offlinedocument.site

# Reference: https://asec.ahnlab.com/ko/59460/ (# RftRAT)

152.89.247.57:52390
172.93.201.248:52390
172.93.201.248:8083
192.236.154.125:50108
209.127.37.40:52390
23.236.181.108:52390
91.202.5.80:52030
brhosting.net
splitbusiness.com
techgolfs.com
theservicellc.com
topspace.org

# Reference: https://twitter.com/tiresearch1/status/1734110501008024064
# Reference: https://app.validin.com/axon?source=DNS&limit=100&type=ip&find=141.164.60.65

blockmedia.site
dewhales-capital.website
gocgles.com
linkcline.info
linkdeln.site
linkdien.site
linkdien.store
linkdien.website
moiss.site
notify-linkcldines.com
nps-center.space
nps-ebook.site
nps-ebook.space
nps-ebook.store
nps-emails.site
nps-main.store
nps-notice.site
nps-notice.space
nps-notice.store
nps-notify.site
nps-notify.space
nps-notify.store
nps-post.space
nps-posts.site
nps-posts.space
nps-posts.store
nps-report.site
nps-views.site
nps-views.space
nps-views.store
npsmsg.space
nts-go.site
nts-go.store
nts-home.space
nts-home.store
nts-inform.site
nts-msg.site
nts-post.site
nts-post.store
ntsemail.site
ntshome.site
ntshome.space
ntsmails.site
ntsnews.site
private-center.site
qoooqle.site
qoooqledrive.site
naver.moiss.site
naver.nps-posts.store
naver.nps-views.space
naver.nps-views.store
naver.nts-email.store
naver.ntshome.site
naver.private-center.site

# Reference: https://twitter.com/tiresearch1/status/1734887415633060265
# Reference: https://app.validin.com/axon?source=DNS&type=ip&find=185.160.27.92

binarice.info
dosi-info.world
fanaticsretailgroup.site
identitychecks.info
ir-service.online
ir-service.site
irspost.site
naverhelps.info
naverscorp.com
naversystem.autos
nft-dosi.world
nidmembnscorp.site
nidnaver.club
nidusrnacorp.site
nidusrshcorp.site
nidusrsncorp.site
nidusrsvcorp.site
nidusrszcorp.online
nidvenify.site
notice-dosi.world
nps-inform.site
nts-email.space
naver.nidusrsncorp.site

# Reference: https://twitter.com/tiresearch1/status/1735211111123923345

aceenign.click
arakte.click
auridab.click
clindoc.link
inklmo.click
iaxevar.click
kakaologin.info
kkruelo.link
leurnteke.link
natelogin.homes
natelogin.info
natelogin.site
nates.lat
nates.store
natesign.site
ntsinfo.space
pelmpusse.link
rpriseber.click
scenaeco.click
scourt-kr.site
strutute.click
wetax.site

# Reference: https://www.virustotal.com/gui/ip-address/208.73.209.42/relations

1stsufi.click
5bioresearch.click
aboladmi.click
abortionnc.click
abourned.click
absadvi.click
accesssof.click
accianc.click
accounem.click
ackexpertsope.click
ackiloverrd.click
activequic.click
additioeak.click
adeciil.click
admissiph.click
adopouch.click
adsparc.click
aemoyoi.click
aerobook.click
aeropetsc.click
aevofim.click
affsimi.click
afterioi.click
ageegigi.click
ahldjwa.click
aiantarprisasa.click
airpetrom.click
airstate.click
aldirectorygem.click
alestechnic.click
algebraagei.click
algebraheroi.click
algebraquizi.click
alpalob.click
alphastateibi.click
althmoexch.click
amafixlog.click
amawturk.click
amayok.click
amplappe.click
anbint7.click
angeadventurec.click
anglpoc.click
anywireul.click
aokpag.click
appeypak.click
aratedc.click
aresahiai.click
argmenidi.click
arppacktheexce.click
arrangpateh.click
arrayexi.click
arroganth.click
arrowrfe.click
arsgeostra.click
artauctiondi.click
artknowledgef.click
asokesf.click
aspectvec.click
asylumba.click
ataptwatuhi.click
attiavi.click
autocoachi.click
autoopenmore.click
avenuevi.click
avexehe.click
awareta.click
awortak.click
azkidorsal.click
azphatigeri.click
backghea.click
bairlif.click
balcarve.click
bariak.click
barkkom.click
bdusted.click
belongad.click
benmetl.click
bestelipite.click
betttiveagei.click
biigband.click
biizinc.click
biopiilyred.click
birmerricdi.click
bisgasc.click
bisysofta.click
bitdepotma.click
bizardall.click
bizconsulting.click
bizfirmmobil.click
bizkingdom.click
blastave.click
bliogfull.click
bloegiresearch.click
bloodipl.click
bollehe.click
bonusistream.click
booekifreak.click
bookcatssim.click
bookexpertbl.click
bookurde.click
bouskaji.click
bouzeik.click
bramovieexperience.click
brazome.click
breakfpti.click
breeermi.click
brellaish.click
brendmeg.click
bringji.click
bronzcke.click
buitroa.click
bunzscape.click
burstna.click
businessball.click
busiyspace.click
butwzl.click
calculateenergyi.click
calculatelofti.click
camerical.click
canceba.click
candire.click
carvfan.click
casrbel.click
casthec.click
censubi.click
chaneel.click
changinc.click
chaoticpci.click
cheaplookturrearle.click
cheessil.click
chemisacc.click
chiefhad.click
choimark.click
choioesiefund.click
choocomi.click
choosegram.click
choosehea.click
choosqua.click
chorcem.click
cinewif.click
circlewarehouse.click
circzeshowsi.click
cleavoice.click
clinoffi.click
cloudityhall.click
cloudrack.click
clpueze.click
clubing.click
clubpurei.click
comepe.click
comforfiguh.click
commandpackage.click
commibri.click
communund.click
compaief.click
compchal.click
compleioki.click
complexpartyi.click
comuterul.click
conditmem.click
confineuna.click
confusedpublishingi.click
confusedtubei.click
confusionactivei.click
conteete.click
cooeliguide.click
cooktri.click
coolkick.click
coozjengzei.click
cottahine.click
cottgoa.click
coununda.click
couragsi.click
coutescea.click
covoxidel.click
creamsna.click
creativepalace.click
creditvid.click
credworm.click
creepsa.click
creradi.click
critcire.click
criteic.click
criticcom.click
criticorb.click
crosswrea.click
cryptoomiidebugi.click
culaesc.click
cumclube.click
cunnincha.click
curvebra.click
cutebybeh.click
dangersib.click
darkblind.click
dataedusoul.click
delayfil.click
deletea.click
denarye.click
depaipre.click
depraveline.click
descenoffsc.click
detairepl.click
detaoffi.click
detecsel.click
detewell.click
develtfie.click
deviatdib.click
dgteltdeete.click
dialecte.click
dichagh.click
didefronti.click
difficra.click
digiibyte.click
digiimed.click
directepe.click
directspeak.click
direigamei.click
dirtegai.click
discefe.click
discovedia.click
dishush.click
dismcia.click
disminic.click
distinctall.click
diveduf.click
dividefe.click
doiriectfield.click
domesund.click
doorsym.click
dramnte.click
drawerf.click
dreammartope.click
drienced.click
drwatche.click
dugatte.click
duperlifedrylei.click
ealmatuppa.click
ealunitedi.click
earchhireanyti.click
earthmaj.click
eartnci.click
easiysafe.click
eastode.click
easyrech.click
ebearmobil.click
ebtaicb.click
eceskid.click
ecrueza.click
editlash.click
eenetierprise.click
eenhide.click
eginspi.click
eisable.click
ejedavi.click
elbmrbj.click
electroni.click
elemdeca.click
elemenhemd.click
elimnaed.click
emasjab.click
embomri.click
emgradee.click
emotscra.click
enagcal.click
encpttonei.click
encrypttonei.click
enestintale.click
enigmaminei.click
enlaara.click
enlsuse.click
ensenzavala.click
ependhirri.click
epictrecki.click
eprodra.click
equaedi.click
erbavaa.click
erfectbearmag.click
errellzimme.click
ervaaie.click
etamole.click
ethscra.click
etifcem.click
euthemi.click
euthymul.click
evereduca.click
excesfi.click
excharec.click
execam.click
exileped.click
exishave.click
expanntc.click
expartrank.click
experala.click
experibel.click
experipdata.click
expertbea.click
expertsthereal.click
explenfi.click
explodte.click
exquisitelittle.click
extreti.click
factnsi.click
fallmeile.click
fastse.click
feeliite.click
feelinine.click
feetelevisionfractiong.click
fenceoje.click
feverom.click
fieblind.click
figureove.click
fillpolla.click
financte.click
findpictarese.click
finidengine.click
finistrike.click
firsttaxi.click
flekene.click
fleuota.click
flexipre.click
flooddiag.click
flourcumi.click
flowerfie.click
flyftra.click
flyimobile.click
flywayfoodca.click
foirwarmerce.click
foodoldcloud.click
foodprotecti.click
footbanic.click
fopassyoudock.click
forbidna.click
formaga.click
formalyci.click
formulpri.click
forrice.click
freezismil.click
frequeian.click
freshcare.click
fullhousefeature.click
fulllifte.click
furspeede.click
gaffeicl.click
gaffesodi.click
gamingcool.click
gapetog.click
gaworem.click
geimrich.click
geograpick.click
geokeeiwantunited.click
geowayini.click
getaidventure.click
getyoarplaunch.click
getyoningneatme.click
getyoualthwinra.click
giababk.click
glessel.click
globetra.click
goaletck.click
gocapital.click
goiodsmith.click
goldchicg.click
golidwork.click
goodcloud.click
goterriek.click
gotowesk.click
gotriek.click
gownpuh.click
gratefjul.click
gravelem.click
greeaitjournal.click
greeisd.click
grieatdeck.click
grieatspeak.click
grimacpeanh.click
gtilrla.click
guejova.click
guestfem.click
gulomaze.click
hallhal.click
hallmode.click
hapepiyom.click
harassmi.click
harbcalm.click
hardratingsi.click
harnessmag.click
headlanch.click
heallfci.click
helliowealth.click
hellipee.click
higginstessawe.click
hirllolock.click
hirllorircord.click
histessicietese.click
histstudiosa.click
horoscnab.click
horsackl.click
horseresi.click
hotdognec.click
hoveora.click
hseiref.click
humorface.click
ibusine.click
ickbymoregram.click
icrotracksanytim.click
ideapacbetterlook.click
ideaspring.click
ideavilla.click
ightresource.click
iglanedatati.click
ikebuddiesmrme.click
ilightite.click
ilikeinfoini.click
imagera.click
imagetpack.click
imaguff.click
importood.click
impossibleservei.click
impulssha.click
incapacom.click
incssure.click
indiibl.click
indrecodc.click
infoboxi.click
infodowersmile.click
injefasc.click
inkimpalace.click
inkstandmappa.click
insisteca.click
insitsd.click
inspunch.click
insuraeka.click
insureesc.click
intecti.click
internetcollectiveibi.click
internetoff.click
investream.click
ionfioscape.click
irenmta.click
isolaticre.click
isquaid.click
issystem.click
itjungnwheel.click
itmeeid.click
iwaenittable.click
iwanittrade.click
izapi.click
izetnb.click
jelldra.click
jeweihb.click
jezvila.click
jobifue.click
jobreytalre.click
joystslab.click
jumbleclocki.click
jumblehandi.click
jumblemenui.click
justzene.click
karmafzighti.click
kentara.click
keyireai.click
killwha.click
kitstopone.click
klfask.click
kloedil.click
kmestick.click
knehole.click
knifatte.click
knotmastersi.click
kolinic.click
kreitivepine.click
labbanki.click
labirol.click
labislandi.click
labotic.click
lackrobotsnapg.click
ladatoi.click
lageing.click
langible.click
lariga.click
lawyeagra.click
layyoung.click
ldenintpopdem.click
leadeach.click
leadicafe.click
leadunive.click
leaireniunited.click
lealarmexpe.click
leascng.click
lefebank.click
lentcol.click
lesabul.click
liabiland.click
licatia.click
lifefan.click
lifeigarage.click
lifetrgem.click
lifiboerd.click
limitock.click
linarti.click
linenorre.click
linkferulle.click
linkfood.click
livefriend.click
lngonib.click
lobburi.click
locaaac.click
locatfire.click
locatnsid.click
logicchampi.click
lossachusettle.click
loudkickwhatsc.click
loverpri.click
lozavrb.click
lsajaba.click
lutisul.click
machoodcodeg.click
macwiracepulse.click
magicdata.click
magichcomactive.click
magssing.click
mairketid.click
maiurizai.click
maixsuite.click
mallwife.click
mantheme.click
marcrice.click
markeei.click
marketramail.click
marksfacecapitali.click
markspre.click
markstele.click
mastertane.click
maxiilaunch.click
mbersei.click
mebiebaucte.click
meexperti.click
megaipark.click
megatruth.click
megefectirye.click
menalwh.click
messvague.click
metnrfishi.click
micbuag.click
midostaff.click
migcorc.click
milofastik.click
minodra.click
minuterme.click
mirsinak.click
miserabnea.click
mislata.click
mispa.click
missucage.click
miwabwaya.click
mixturre.click
mocruernch.click
momenlend.click
moothbrothersa.click
moregsri.click
morganold.click
morscirc.click
morselbasic.click
motorrea.click
movieraceibi.click
mrlighting.click
mubifurlifae.click
muboom.click
mudsea.click
muipboti.click
mybistsuli.click
nanioclub.click
nanoconsultini.click
nblride.click
ncekeytui.click
ndgoldhotswitc.click
neatcatsi.click
needletra.click
neopanelh.click
netgood.click
nextsafetye.click
nfoforceprojec.click
ngesera.click
niathawka.click
niceconceptse.click
nicenatione.click
nicererhse.click
niiceb.click
nityadace.click
nivloyli.click
normnowh.click
notebooil.click
nowicei.click
nshineack.click
nuancma.click
numbsif.click
nypagesrepad.click
obesepai.click
obistandmcacc.click
objectiiti.click
occupoff.click
octemal.click
odeesupb.click
oeponam.click
oextrae.click
officreal.click
ogamparee.click
olidconsultadm.click
olidinsura.click
oliwrsm.click
ollchollenwe.click
olrunshare.click
omgaimagi.click
omrufozi.click
oncngial.click
onestopsee.click
onetoeprice.click
ongndoc.click
onilylaunch.click
onlineboxa.click
onlinesell.click
onliytravel.click
onlyikid.click
onlyvienture.click
onovaheywheel.click
ontinihotdingsi.click
onwardbounce.click
oodpollwintwee.click
opdigitallif.click
openwde.click
operaele.click
opposnih.click
orditing.click
orkmojoknowle.click
osumcek.click
ouracge.click
ourneatboutique.click
ourradiosi.click
outeventuitui.click
outhmrepic.click
outimag.click
outsidential.click
overcha.click
overeahe.click
overeai.click
overwhacc.click
ovesna.click
oviehutmediach.click
owconsulti.click
owerfullsearch.click
passwheal.click
passwordhunteri.click
passwordinteractivei.click
patiefool.click
pauseoh.click
pcmobforum.click
peakpage.click
peaktouch.click
pecomnce.click
percencl.click
perfectqeazityi.click
perigri.click
permansta.click
personalizedtoalied.click
pesonde.click
pettyfra.click
photomispla.click
pickcrunch.click
pickkidsibi.click
picklehati.click
picnarrol.click
pillartwe.click
pissgrid.click
pitraki.click
pittgromi.click
pitydel.click
planaic.click
planeinc.click
planirtzoom.click
planstimetraffici.click
playwordsim.click
pleerate.click
plugreg.click
plumicoak.click
pluscompl.click
plusrantil.click
pneuerf.click
poetryab.click
poianituniverse.click
politetpa.click
polleag.click
pollmoanywhere.click
pollutkta.click
polprog.click
popitag.click
posique.click
posittone.click
postgodele.click
poweand.click
poweraste.click
powertera.click
powlarida.click
ppguystopm.click
ppodeliask.click
pptisfa.click
presscypresslea.click
privateexamsurrive.click
procraftth.click
prodpa.click
profanwebking.click
profitgeb.click
projectiqi.click
promori.click
prosewallated.click
protrigh.click
provuai.click
psitesmarketb.click
purpnteruniversityi.click
puzzlelocatori.click
qeuivul.click
quemsol.click
queueti.click
quieghf.click
quotaia.click
rachaad.click
raciserda.click
radoimi.click
ragaece.click
rancaugh.click
randrepea.click
rassoficiel.click
raveleyesi.click
ravelised.click
ravocloudsinwa.click
readerti.click
rearach.click
reatnote.click
rebeffai.click
receeti.click
receptipai.click
recommape.click
recommcul.click
recopack.click
recruirea.click
recyclebea.click
redeeski.click
redsptspace.click
refertc.click
refuseaca.click
refuste.click
regitce.click
reheasm.click
rekongse.click
relatehe.click
remesla.click
reminpi.click
replacka.click
repponse.click
reprtic.click
reptitle.click
requesdiffb.click
resciorg.click
resortda.click
revedyb.click
revengwi.click
reviseal.click
revoude.click
rezrak.click
rhackerunilog.click
riceadd.click
richaracteria.click
ridtutori.click
rigahf.click
rightstora.click
rilokid.click
ritualma.click
rmfirearmdefenc.click
rokcvze.click
romeetnetable.click
roprofessi.click
routita.click
rpoieha.click
rrshesf.click
ruerentaltrue.click
runeventc.click
sabinte.click
safarhie.click
saftmind.click
saiami.click
salvatira.click
sboetome.click
schoolth.click
scobadi.click
seasonta.click
sefeheree.click
sellecha.click
sellorge.click
sensitgre.click
senspab.click
sepacati.click
serconsulting.click
seriteci.click
sessabb.click
severframe.click
shamenc.click
shapeick.click
sharmki.click
shattish.click
shiftove.click
sicetite.click
signbtai.click
siliverpie.click
silverya.click
simplyhqa.click
sisterdig.click
sitadvi.click
skredel.click
sloganngd.click
smartmemill.click
smilemark.click
smilepi.click
snaipguide.click
snowrealha.click
sociaiosredpanel.click
solidware.click
sotapa.click
sourpean.click
spacefue.click
spacemueateauean.click
sparkbag.click
speechri.click
spitzag.click
sporool.click
spricra.click
spyseload.click
squabare.click
ssivcla.click
staffnicema.click
standtrea.click
stanuba.click
starlfirstled.click
starseasoc.click
starstpad.click
startsitei.click
startstaff.click
steakrec.click
steseva.click
stnereti.click
stormcod.click
storodi.click
stortui.click
straian.click
straifad.click
strencom.click
studiorock.click
sufferra.click
summertef.click
sunfcksm.click
sunmayond.click
suntalil.click
supircontocti.click
survunre.click
suspdomi.click
sycaresunnybla.click
symbolbazaari.click
symbolck.click
symbolutc.click
syndrtre.click
tablemacfood.click
tamarob.click
tapecook.click
tdiiamb.click
teamsomelead.click
technologiesab.click
techsavera.click
teemaid.click
teenici.click
telerdi.click
teletowna.click
telllead.click
tendalue.click
testcha.click
tfulzendb.click
theririrm.click
thevill.click
thienikmine.click
thinkace.click
thinkjiob.click
thinkssi.click
thratelec.click
thrutfe.click
tiablaa.click
timeatch.click
timeeaoptionsi.click
timerental.click
tiomuntimitidi.click
tipsmobiwell.click
tjasme.click
tkarmaedudi.click
tlinetirte.click
tmekede.click
tongdiff.click
tooacc.click
topchtoname.click
topisteam.click
topresearc.click
traceasa.click
tradedquote.click
trapslime.click
trearefe.click
trendded.click
tripgha.click
trobeli.click
trodrome.click
truieresource.click
tryweeklye.click
ttrendimball.click
tuscome.click
tvtheoybestactive.click
twistskillsi.click
twitgca.click
txticec.click
uaafixi.click
udesaeye.click
ueregeedi.click
ukenata.click
ulltrustle.click
ultancyitbee.click
umbresta.click
unfairlel.click
uniforpe.click
uniirank.click
unilird.click
uningclubb.click
unonlinecloudh.click
unpopulating.click
uoneati.click
uoptxe.click
urbanfilesibi.click
ureraiam.click
urgencynoe.click
usaseaid.click
ushoppang.click
usmoprice.click
ustonteage.click
ustweetbonuspa.click
uthondemandsa.click
utoavesideawi.click
vguaceli.click
videomate.click
vingcre.click
vruvesui.click
vusimbi.click
wandereh.click
wanthsaveya.click
waterele.click
wayssafesec.click
weareckl.click
webabc.click
weforeveril.click
weiglre.click
welcweig.click
wellgraph.click
wesomestatepea.click
whiphei.click
whohicsolidcase.click
whynerd.click
winnpref.click
withtiff.click
wkritie.click
worilde.click
wowcaveskillsi.click
wowprice.click
wowrojecti.click
wreswide.click
writegra.click
writoma.click
wupemstrenc.click
xjoufeg.click
xpibeh.click
yandafe.click
ycreatoristyl.click
yinmine.click
ypidnve.click
yvistaquickfl.click
zariagonf.click
zerkine.click
zmezate.click
zonezid.click

# Reference: https://twitter.com/asdasd13asbz/status/1735180272000475366

namsouth.com/access-darrell/Access%20Denied.php
namsouth.com/access-timothy/Access%20Denied.php
namsouth.com/access-weidner/Access%20Denied.php

# Reference: https://asec.ahnlab.com/en/59590/
# Reference: https://otx.alienvault.com/pulse/6579b3e780b08a7717b8e895

ciso2ciso.com
prohomepage.net

# Reference: https://twitter.com/tiresearch1/status/1736447996139798978
# Reference: https://www.virustotal.com/gui/ip-address/27.102.134.69/relations
# Reference: https://app.validin.com/axon?source=DNS&type=ip&find=27.102.134.69
# Reference: https://app.validin.com/axon?source=DNS&type=ip&find=85.239.53.121

ctp-forms.site
dewhales-capital.online
nps-ctrl.site
nps-email.store
nps-form.site
nps-host.site
nps-inform.store
nps-main.site
nps-messages.info
nps-post.site
nps-report.online
nts-email.site
nts-emails.site
nts-home.site
nts-info.site
nts-info.store
nts-mail.info
nts-mail.site
nts-mail.store
nts-message.info
nts-news.site
nts-news.space
nts-news.store
nts-notice.info
ntsmail.site

# Reference: https://www.virustotal.com/gui/ip-address/158.247.246.192/relations
# Reference: https://app.validin.com/axon?source=DNS&type=ip&find=158.247.246.192

kepco.site
npscom.site
npsnews.space
nts-mails.site
nts-mails.space
nts-msg.space
ntsemail.space
ntsinf.space
ntsmails.space
ntsmsg.site
ntsnews.space

# Reference: https://www.virustotal.com/gui/ip-address/75.2.0.44/detection

1636.site
1661-0241-call.site
1666-7797.site
1800-7804-call.site
1800-7804-callcenter.site
1person-corperation.site
79artproject-part79.site
85tech-yoon.site
85yoons-channel.site
absofficial.site
aiactuary.site
all-pass.site
annainfo.site
antichilgok.site
antiseongju.site
aportal.site
artproject-part79.site
artproject79-part79.site
batterymonster.site
bisiness.site
bongbongmall.site
bookmaker-korea.site
brightedu.site
busineess.site
businness.site
buybit-cafe33.site
cafe-cahrtlab.site
cafe-chartcoin70.site
cafe-chartcoin82.site
cafe-coinchart80.site
cafe-coinchart90.site
cafe-ffree.site
cafe-ffreedom.site
cafe-investminjok.site
cafe-minjok8003.site
cafe-moneylab.site
cafe-naver-jyp.site
cafe-success.site
cafe-teamkim.site
cafe-tech25financial.site
cafe-winners-cu.site
cafe-winners.site
cafenaver-public.site
cafenaver-richbangbang.site
cashad.site
ch-kakao-jsi.site
chart-yoojinportfoli.site
chart119-portfolio.site
chart58-number58.site
chart72-portfolio73.site
cheongung.site
co-ex.site
coinwolrd100.site
comodono.site
coway1004.site
csj-kakao.site
csj-katalk.site
csj24-kakao.site
dcinside.site
decentraland.site
dogcatkalma24.site
drumdays.site
dukk.site
eamest-project.site
ehvvv.site
endlesspools.site
enrui.site
ethnic-invest.site
everyday-chekpoint.site
fianlss.site
fiestaholdings.site
finalasset.site
finance-yooneyportfolio.site
financial-factory.site
financial-navercafe.site
firegin.site
first-coin100.site
flower-portfolio77.site
fr-kakao.site
gkausehos.site
goldclass-sj.site
goldclassss.site
goldclassss79.site
goseoul.site
hallyu.site
hanjinboryeong.site
healstory.site
health-letter.site
healthguardiangel.site
healthinfor.site
healthinform.site
healthinformation.site
healthletter.site
healtytech-2011.site
heathletter.site
hletter.site
hodorl1988-tech.site
holroog.site
holybible.site
iberico.site
investing-life.site
investor-onepick.site
investor-people.site
jelq.site
jennieheo.site
jlcoupasmall.site
johnyoon.site
juanbandoubora.site
jypf.site
kakao-channel85yoon.site
kakao-coin2021.site
kakao-coinchart.site
kakao-cyj.site
kakao-goldgold.site
kakao-justit.site
kakao-mb365.site
kakao-mtk.site
kakao-sj.site
kakaotalk-br.site
kakaotalk-ch2020317.site
kimsoyeon.site
klip.site
kosdaq-portfolio.site
kospi-yusuhn.site
kospi3000-magazine.site
ksy-kakao.site
ksy-kakaotalk.site
ksy-katalk.site
l2loyal.site
leaserent.site
leehana-investment.site
leesj-kospicheck.site
limseong.site
littlekorea.site
liveing.site
lofni.site
lolproteam.site
lovvy.site
lqeiu.site
masksale.site
matched.site
maybeyo.site
metaplatform.site
miso-smartinvest.site
misojtec-magazine.site
misostock.site
mom-kakaotalk.site
moneychart33.site
moneyproject.site
naiver.site
naver-cafe2ace.site
navercafe-no1.site
navercafe-public.site
neever.site
neiver.site
newmisojt-rich.site
nolround.site
para10.site
paragon05.site
paragon10.site
pds79.site
pf-kakaotalk-cu.site
pf-kakaotalk-ku.site
pf-kakaotalk.site
pf1-kakaotalk.site
phallosan.site
pnguf.site
pokerace.site
powergin.site
prugio.site
rntpsxl.site
scrooge-coin.site
scrooge-finacial.site
sentmusic.site
sercont.site
shop-portfolio.site
sj-kakao.site
sj12-kakao.site
sj123-kakao.site
sj24-kakao.site
sj321-kakao.site
sj365-kakao.site
sjsj-kakao.site
snore.site
source-in25.site
success-tech.site
tam24.site
teamwork-upandup.site
tech-chartlist2000.site
tech-coinlist3000.site
tech-yhc85school.site
tech119sj-2017.site
techking.site
tfgse.site
totalrental.site
trandnjob.site
up-kakaotalk.site
volume-chartyoon.site
webcctv.site
winners-naver.site
wisdomwood.site
wonnetwork-asset.site
worldbit365.site
yeahaea.site
yoari.site
yooilhan.site
yooneymoney-coin.site
yooneymoney-investment.site
yoosuhyeonproject.site
zigum.site

# Reference: https://twitter.com/tiresearch1/status/1737044959780647342
# Reference: https://www.virustotal.com/gui/ip-address/27.102.106.60/relations

nhis-news.store
nps-alert.space
nps-alert.store
nps-center.site
nps-center.store
nps-co.site
nps-co.store
nps-ctrl.space
nps-email.site
nps-home.site
nps-host.store
nps-inf.store
nps-io.space
nps-lib.site
nps-lib.store
nps-msg.site
nps-msg.store
nps-notices.site
nps-or.site

# Reference: https://www.virustotal.com/gui/ip-address/27.102.118.96/relations

nps-inf.site
nps-src.site
npsmsg.site

# Reference: https://www.virustotal.com/gui/ip-address/27.102.107.122/relations

naverzcope.com
nhis-news.site
upbits.site
naver.nhis-news.site
naver.nps-center.store
naver.upbits.site

# Reference: https://www.virustotal.com/gui/ip-address/141.164.58.132/relations

disquiet.site
gocgler.com
nts-alert.space
nts-emails.space
nts-homes.site
nts-homes.space
nts-homes.store
nts-mails.store
nts-tax.site
nts-tax.store
nts-views.space
ntsinf.site
ntsinfo.site
ntsmsg.space

# Reference: https://www.virustotal.com/gui/ip-address/141.164.43.213/relations
# Reference: https://app.validin.com/axon?source=DNS&type=ip&find=141.164.43.213

npshome.site
npsmsgs.site
npsnews.site
npstax.site
ntsgov.site
wetax-mail.site

# Reference: https://www.virustotal.com/gui/ip-address/158.247.242.154/relations
# Reference: https://app.validin.com/axon?source=DNS&type=ip&find=158.247.242.154

npsalert.site
npshomes.site
npsnew.site
npsnew.space
nts-inf.website
nts-mail.website
ntsboard.space
ntsbook.store
ntsbox.site
ntscustom.site
ntscycle.site
ntsemail.homes
ntsgo.site
ntshomes.space
ntsinf.website
ntsinfo.store
ntsmailer.homes
ntsmailer.website
ntsmailing.store
ntspayment.site
ntspays.site
ntspolicy.site
ntsports.site
ntspost.homes
ntspost.space
ntspost.website
ntsposting.homes
ntsreport.homes
ntsreport.store
ntsreviews.site
ntstaxes.site
ntsview.website
emv1.hometax.space
emv1.npsalert.site
emv1.ntsmailer.homes
emv1.ntsmailer.website
emv1.ntsmailing.store
emvl.ntsmailer.website
lcs.ntspost.website
mta-sts.npsalert.site
mta-sts.ntsemail.homes
mta-sts.ntsmailer.website
mta-sts.ntsmailing.store
naver.ntspayment.site
naver.ntspost.website
nidss.ntstaxes.site
shop.ntsemail.homes
shop.ntsposting.homes
smtpauth.ntsmailing.store
smtpmail.ntsmailing.store
vqqniarm.hometax.space
websitmta-sts.ntsgo.site

# Reference: https://www.virustotal.com/gui/ip-address/158.247.224.52/relations
# Reference: https://app.validin.com/axon?source=DNS&type=ip&find=158.247.224.52

nts-alert.website
nts-home.website
nts-new.website
nts-poster.store
ntsinforms.website

# Reference: https://www.virustotal.com/gui/ip-address/141.164.60.65/relations
# Reference: https://app.validin.com/axon?source=DNS&type=ip&find=141.164.60.65

nts-alert.site
nts-email.store
nts-go.space
nts-inf.site
nts-info.space
nts-inform.space
nts-inform.store
nts-mail.space
nts-youtueb.site

# Reference: https://www.virustotal.com/gui/ip-address/27.102.118.140/relations

nts-inf.space
naver.nts-inf.space
naver.nts-inform.space
naver.nts-mail.space

# Reference: https://www.virustotal.com/gui/ip-address/158.247.222.75/relations

nts-notice.site
mid.nidscorp.site
naver.nts-tax.site

# Reference: https://www.virustotal.com/gui/ip-address/158.247.255.171/relations

nts-alert.store
nts-inf.store
nts-notice.store
naver.nts-inf.store
naver.nts-tax.store

# Reference: https://www.virustotal.com/gui/ip-address/27.102.129.79/relations

flyasianer.info
nps-view.site

# Reference: https://www.virustotal.com/gui/ip-address/27.102.130.51/relations

haishang.site
nps-news.site
nps-server.site
nps-service.site
nps-services.site
nps-view.store
weataxs.store

# Reference: https://www.virustotal.com/gui/ip-address/27.102.128.40/relations

navercorpe.com
nps-news.info
nps-post.store
uniteogram.live
webuniteogram.live

# Reference: https://www.virustotal.com/gui/ip-address/27.102.115.86/relations

nps-info.space

# Reference: https://www.virustotal.com/gui/ip-address/27.102.128.244/relations

fss-info.site
nhis-info.site
nps-info.site
nps-news.space
nps-service.xyz
weataxes.site
weataxs.space
youtubein.store
naver.nps-services.info
naver.weataxs.space

# Reference: https://www.virustotal.com/gui/ip-address/27.102.114.69/relations

crosscert.site
epeople.space
govenments24.site
haeshang.store
niduserunzcorp.site
weatax.site
weatecs.store
wetacs.site
wetacxs.online
wetacxs.site
wetaxc.store
wetaxces.site
wetazx.online

# Reference: https://www.virustotal.com/gui/ip-address/27.102.128.230/relations

ftcs.store
haeshang.site
linkedlri.site
wetacx.lol
wetacxs.club
wetax-home.lol
wetaxc.homes
wetaxce.store
wetazx.xyz
youtubein.online
youtubs.site
naver.check-youtube.info
naver.wetacxs.club
naver.wetaczx.lol
naver.youtubein.online
naver.youtubs.site

# Reference: https://www.virustotal.com/gui/ip-address/27.102.128.231/relations

wetax-home.space
wetax-io.space
wetaxc.beauty
wetaxcs.store
wetaxe.site
wetaxs.store
wetazx.website

# Reference: https://www.virustotal.com/gui/ip-address/27.102.132.182/relations

naverscope.com
nps-docs.space
nps-look.space
nps-report.space
naver.nps-docs.space
naver.nps-posts.store

# Reference: https://www.virustotal.com/gui/ip-address/95.164.44.60/relations

acountcorp.info
rememberapp.website

# Reference: https://www.virustotal.com/gui/ip-address/27.102.102.245/relations

nidconfirmes.site
nidnavescorp.online
nidvenify.online
userchecks.info
cc.nidvenify.online
lcs.nidvenify.online
myinfo.nidvenify.online

# Reference: https://www.virustotal.com/gui/ip-address/27.102.127.156/relations

drivesview.site
homtax.info
minwons24.info
nidnavecenter.info
nidnaver.homtax.info
niduserae.site
niduseran.site
niduseren.site
nidusernd.site
nidusernv.site
nidusracorp.site
nidusrnvcorp.site
nidusrsurcorp.site
xn--googls-7ua.com
lcs.niduseran.site
naver.niduseran.site
naver.niduseren.site
naver.nidusrsurcorp.site

# Reference: https://www.virustotal.com/gui/ip-address/27.102.102.67/relations

kakaoviwer.com
navearsuser.info
naveasuser.help
naverascorp.help
navrascorp.info
nidnaveainfo.help
nidnaverscorp.com
nidusernavers.help
accountkkcdn.kakaoviwer.com
accounts.kakaoviwer.com
ccountkkcdn.kakaoviwer.com
ibasrugpiah.kakaoviwer.com
lcs.naverascorp.help
nid.naverascorp.help
nid.nidnaveainfo.help
nid.nidnaverscorp.com
stat_tiarakakao.kakaoviwer.com
t1_daumcdnkakao.kakaoviwer.com

# Reference: https://www.virustotal.com/gui/ip-address/210.92.18.184/relations

gatensign.com
kakaosecure.com
natelogin.com
homemail.natelogin.com

# Reference: https://www.virustotal.com/gui/ip-address/61.97.251.243/relations

nate.com.ro
naver-settings.com
simcard-korea.com
mail.naver-settings.com
mgrkrpreview.naver-settings.com
mvideo.naver-settings.com
nklqnremote.naver-settings.com
preview.naver-settings.com
remote.naver-settings.com
srv.simcard-korea.com

# Reference: https://www.virustotal.com/gui/ip-address/27.102.67.154/relations

naveare.com
nid.naveare.com

# Reference: https://www.virustotal.com/gui/ip-address/27.102.102.237/relations

naevear.com
noticenate.com

# Reference: https://www.virustotal.com/gui/ip-address/165.154.230.146/relations

check-click.com
cookeechck.com
naver-url.com
noticeurl.com
redir-dns.com
sessionchck.com
sireonwar9.info

# Reference: https://www.virustotal.com/gui/ip-address/165.154.230.211/relations

driversgoogle.com
haenmaii.net

# Reference: https://www.virustotal.com/gui/ip-address/27.102.127.115/relations

chinakoreanews.com
driverqooqle.com
mybox-navers.com
naversinfo.help

# Reference: https://www.virustotal.com/gui/ip-address/27.102.106.109/relations

drivergoogles.com
exchange-bybit.com
kakaologin.com
kakaotearn.com
naveraecorp.online
nidnaverauser.help
nidnavescorp.help
account.kakaologin.com
cc.naveasuser.help
cc.nidnaverauser.help
lcs.naveasuser.help
lcs.nidnaverauser.help
lcs.nidnavescorp.help
nid.naveasuser.help
nid.naveraecorp.online
nid.nidnaverauser.help
nid.nidnavescorp.help
rcaptchanid.nidnaverauser.help

# Reference: https://www.virustotal.com/gui/ip-address/27.102.130.113/relations

infonavera.com
naeverscorp.com

# Reference: https://www.virustotal.com/gui/ip-address/27.102.66.162/relations

global-bybit.com
gooogledocsview.com

# Reference: https://www.virustotal.com/gui/ip-address/108.177.235.15/detection
# Reference: https://www.virustotal.com/gui/ip-address/172.93.201.25/relations

acc-center.site
corpnavcenter.site
corprsecurity.tech
corpseccenter.site
havcorp.site
havecorp.link
havecorp.tech
haveecorp.site
haveorcorp.tech
havercorp.tech
havercorpteam.site
haverocorp.link
havoocorp.online
havoocorp.tech
havorcorp.link
havorcorp.online
havorcorp.site
havorcorp.tech
mailcorpcenter.online
mailcorpcenter.site
mailportalcenter.online
mailscropcenter.site
mailservicecenter.site
mailservicecenters.site
nauercorp.website
nauercorpteam.website
navaccountcenter.online
navcenter.xyz
navcorp.host
navcorp.link
navcorp.space
navcorp.website
navcorpctr.site
navcorpmanage.site
navcorpmanager.website
navcorpportal.xyz
navcorps.site
navcorpservice.site
navcorpservice.website
navcorpteam.website
navcrtr.online
navctrv.site
navcvcorp.online
naveacorp.tech
naveccorp.link
navecorp.online
navecorp.website
naveeccorp.tech
naveecorp.link
naveecorp.online
naveecorp.site
naveecorp.xyz
naveeecorp.site
naveeoocorp.link
naveeorcorp.tech
naveeoteam.site
naveercorp.online
naveloga.online
navelosa.host
naveoccorp.link
naveoccorp.online
naveocenter.link
naveocop.link
naveocorp.link
naveocorp.online
naveocorp.site
naveocorp.tech
naveoecorp.tech
naveogains.tech
naveologs.online
naveooccorp.online
naveoocorp.link
naveoocorp.online
naveoocorp.site
naveoocorp.xyz
naveorcorp.link
naveorcorp.online
naveorcorp.site
naveorcorp.tech
naveorteam.site
naveoscorp.link
naveoteam.online
naveoteam.site
naverocorp.online
naverocorp.tech
naveroocorp.link
naveroocorp.site
naverooteam.site
naverooteam.tech
naverorteam.online
naveroscope.tech
naveroteam.online
naveroteam.tech
navevcorp.link
navevcorp.online
navevcorp.site
navmailcenter.site
navocorp.link
navocorp.site
navocorp.tech
navoercorp.site
navoocorp.link
navoocorp.online
navoocorp.site
navoorcorp.link
navoorcorp.online
navoorcorp.site
navorcorp.link
navorcorp.xyz
navovcorp.online
navovcorp.site
navovcorp.tech
navpcenter.online
navpcenter.site
navportalcorp.site
navportalsec.site
navportalservice.site
navrcenter.site
navrcorp.tech
navrcorp.xyz
navrpcenter.site
navrrcorp.tech
navseccorp.link
navsecncenter.site
navsecnet.online
navsecorg.tech
navsecportal.tech
navsecportals.tech
navsecsite.tech
navsecteam.tech
navsecuritycenter.site
navsecuritycenter.tech
navsecuritycorp.link
navsecuritycorp.site
navsecurityportal.online
navsecvcorp.online
navservicecenter.xyz
navservicescenter.online
navserviceteam.site
navserviceucenter.site
navservicevcenter.site
navsvcorp.tech
navvccenter.online
navvcorp.host
navvcorp.link
navvcorp.online
navvcorp.site
navvctr.link
navveoocorp.online
navvocorp.online
navvrcorp.site
navvsecurity.site
navvtrs.site
nevercorp.site
nidnavcenter.site
nidseccenter.host
seccenter.online
secnavportal.digital
secportal.digital
secportal.link
securitycenter.link
securitycenter.space
setcenter.store

# Reference: https://www.virustotal.com/gui/ip-address/108.177.235.82/relations

aswxvn.site
cnnav.site
docnav.site
documentmanager.site
docvcenter.site
docvmanager.site
docvnac.site
gnasxa.site
mwnoer.tech
nanw.tech
nasverteam.tech
nasvwx.site
naswner.tech
nasws.site
nasxn.site
nasxws.site
navccteam.site
navcctr.online
navcerteam.site
navcestr.site
navcnx.site
navcorps.link
navcreteam.site
navcrtvr.site
navcrvrteam.site
navcrvsteam.site
navcstr.online
navcsvrr.site
navcsvteam.site
navcsvteam.tech
navcteam.online
navcteam.site
navctr.tech
navcvtr.site
navdoc.site
navectr.site
naveeteam.tech
naveocorps.link
naveocorpteam.tech
naveorrcorp.site
naveosteam.site
naverocorp.link
naverocorp.site
naverocteam.site
naverosteam.site
navevvteam.site
navewteam.tech
navmgr.site
navnrteam.site
navnteam.site
navnvrteam.tech
navoercorp.link
navoewcorp.online
navorcop.site
navrcorpteam.site
navrctrv.site
navreteam.tech
navsctr.site
navsdoc.site
navsecportal.site
navser.tech
navseteam.online
navsrteam.site
navssecurity.store
navstvr.site
navvnteam.site
navvocorp.site
navvrteam.site
navvsctr.site
navvsecurity.tech
navvteam.online
navvteam.tech
navxna.online
navxteam.tech
nawerteam.tech
nawsnx.site
nawxr.site
naxver.tech
ncwer.tech
neaver.tech
nevercorp.online
nevercorp.tech
neverrcorp.tech
newner.tech
nexwna.online
ngsxna.site
nidnavocorp.site
nresxn.xyz
nrexas.tech
nrexva.site
nrsxaw.site
nsverteam.tech
nsvn.tech
nswner.site
nswxn.site
nsxangs.online
nsxawsx.tech
nsxes.site
ntwsx.site
nvctr.tech
nvnana.site
nvnanmx.site
nvnans.site
nvnateam.site
nvnaxv.site
nvnnans.site
nvns.tech
nvnxa.tech
nvnxr.tech
nvswa.site
nvwna.online
nvwnna.site
nvwns.site
nvwxvr.site
nvwxwa.site
nwaener.tech
nwaxana.site
nwener.tech
nwner.tech
nwnsn.site
nwnsn.tech
nwnsna.site
nwnwer.tech
nwnx.site
nwnxn.tech
nwnxr.tech
nwnxs.site
nwrnr.tech
nwsax.site
nwscn.tech
nwsvxn.site
nwsvxn.tech
nwsxa.site
nwsxasdv.site
nwsxca.tech
nwsxn.site
nwsxns.site
nwxcvsa.online
nwxns.tech
nwxnvs.tech
nwxnw.site
nwxve.site
nwxxna.site
nxana.site
nxmnv.site
nxwener.tech
nxwesx.site
nxwn.tech
snwasdc.online
tksnxa.online
vmwna.site
vnwxna.site
vsxna.site
vvwsaman.site
vwxns.site
wasxxv.site
wnawx.site
wnvnxs.site
wredxas.site
wsaxns.site
wsnvx.site
wsxena.site
wsxna.site
wsxnxa.site
wsxvx.site
wxnsav.site
nid.navcctr.online
nid.navcter.site
nid.navcvtr.site
nid.navvrctr.site
ns.navscr.site

# Reference: https://www.virustotal.com/gui/ip-address/108.62.12.95/relations

anxines.tech
boxmcorp.tech
boxnavteam.tech
cloudalarm.space
cloudalarm.tech
cloudalarm.xyz
corpcenternav.site
corpsecnav.site
docnco.online
docnscorp.site
mailportalcenter.site
mvsenwas.tech
nacersa.tech
nacmnr.tech
nacner.xyz
naconavcenter.tech
nacsmr.site
nacsner.online
nacsnvr.online
nacsxr.online
nacxma.online
namcner.tech
namnr.online
namnvcr.xyz
namsnr.site
nanscr.tech
naoneos.site
naosnr.site
naosoner.online
naovser.online
nascver.online
nascxnr.online
nasmnar.site
nasmnr.online
nasmnsar.online
nasncar.site
nasvnr.site
naswnas.xyz
naswxnas.online
nasxmna.online
nasxnar.online
nasxnas.site
nasxne.online
nasxners.site
nasxnos.online
nasxnw.tech
nasxnwsa.online
nasxvnw.site
navcenterportal.site
navcmr.site
navcnsr.tech
navconr.site
navcorpcenter.site
navcorpctr.online
navcorpscenter.site
navcorpsecurity.site
navcorpserver.site
navcorpsite.online
navcorpssec.tech
navcorpsuppot.site
navcos.online
navcter.site
navcveteam.site
navcvteam.site
navcxna.site
naveccorp.site
navecorp.host
navecter.site
naveecorp.tech
navemr.online
navensv.tech
naveolink.online
naveoorcorp.link
naveoorteam.site
naveorrcorp.online
naveorrcorp.tech
naverorcorp.tech
naverovocorp.site
naverteam.tech
naverves.online
naverves.site
navfteam.site
navlinkcorp.online
navmailserver.site
navmser.xyz
navnxnr.xyz
navocsop.online
navoercorp.host
navorcorp.online
navportalcenter.site
navportalvcenter.link
navscvvr.site
navseccenter.site
navseccorp.online
navseccorp.site
navserveportal.site
navservicecenter.site
navsnnda.xyz
navsop.xyz
navswnsd.tech
navswnteam.online
navsxnw.online
navsxnws.xyz
navteamcorp.site
navvctr.tech
navvtr.site
navvtrr.site
navvtrw.site
navwsxn.online
nawmr.xyz
naxsmr.online
ncxmas.xyz
neasomr.xyz
necmas.tech
necomos.xyz
necxna.tech
nemrner.site
nemxna.site
nensoner.xyz
neocsr.tech
neodocteam.site
neomsa.tech
neoner.site
neonons.online
neonosa.tech
neonso.site
neoscope.site
neosmar.xyz
neosmn.site
neosmr.tech
neosn.online
neosn.xyz
neosnamr.tech
neosncr.online
neosner.site
neosnow.site
neosnr.online
neosnr.site
neosvn.site
nermner.online
neromr.site
neronr.site
nerosma.online
nerosma.tech
nerosmar.xyz
nerosmwr.tech
nerosn.site
nerosno.online
nerosno.xyz
neroso.site
nerosv.tech
nersmn.site
nersmw.site
nersnor.xyz
nersxna.online
nersxnas.online
nervesa.online
nesam.site
nesamar.site
nesamr.xyz
nesamw.site
nesamws.tech
nesans.site
nesansa.tech
nesanw.site
nesanx.tech
nesawos.site
nescoop.online
nesmar.site
nesmnaw.online
nesmnr.site
nesmnsr.xyz
nesmvr.online
nesmwsn.tech
nesnoas.site
nesnonr.tech
nesnop.site
nesnor.online
nesnor.xyz
nesnxma.tech
nesomar.xyz
nesomer.site
nesomnr.online
nesomnr.site
nesomwn.online
nesonor.xyz
nesvnx.site
neswmar.site
nesxamw.site
nesxga.site
nesxmos.site
nesxnar.online
nesxnas.online
nesxnw.online
nevesvr.tech
nevonr.online
nevosn.site
nevoxs.site
nevsoma.online
newnmr.site
newoner.online
nexams.online
nexmso.tech
nexner.tech
nexomo.online
nexoms.online
nexvnr.tech
ngnsxm.online
ngoner.tech
ngsxna.tech
nidcenter.online
nidnaverco.com
nidnavercorp.com
nidnavportal.site
nioner.online
nocmer.site
nocomer.tech
noesnas.xyz
noewrsxa.tech
nomaser.tech
nomasner.tech
nomoer.site
nomsna.tech
nomsner.xyz
nomvnr.tech
nomxn.tech
nomxna.online
nonosnas.online
nooconer.site
noosavo.xyz
noosxna.online
normer.xyz
norner.tech
nornvs.site
norosor.site
norosr.xyz
nosamer.tech
nosano.site
nosaomr.xyz
nosawner.online
nosdocvcorp.online
nosmaner.tech
nosmaner.xyz
nosmanr.tech
nosmer.site
nosmner.online
nosmnr.online
nosmoa.online
nosmoner.site
nosodmer.online
nosomr.xyz
nosvmer.site
noswms.site
nosxmo.site
nosxmoa.online
nouers.site
noumer.site
noumsr.online
nouonos.tech
nousmer.site
nownas.tech
noxmer.tech
nresxnas.site
nrexnas.online
nrnaror.online
nrosmw.online
nrosunr.xyz
nrsoma.tech
nrsxna.site
nrsxona.site
nsamnvar.site
nsaoner.tech
nsaonx.site
nscvcoop.online
nsmner.online
nsmwas.tech
nsnaso.tech
nsnmer.online
nsoma.online
nsomer.online
nsomer.tech
nsomor.site
nsvcorp.site
nswnexa.site
nsxndaas.site
nsxnso.online
nsxomar.online
nsxoner.online
nvacse.site
nvcxnz.tech
nvmsnw.online
nvnxer.tech
nvswsna.site
nvxner.xyz
nvxnos.xyz
nwnams.xyz
nwnerans.online
nwsnar.online
nwsxnas.site
nwxma.site
nxcnas.tech
nxmsiner.site
nxnnosna.online
scientisttest.digital
secmanageteam.site
secportaslnav.site
sndaxnds.tech
wsxnasv.online

# Reference: https://www.virustotal.com/gui/ip-address/23.82.128.163/relations

narrctr.site
nauermanager.website
navcen.site
navcorpvtr.site
navcrsteam.site
navcrteam.site
navcrvteam.site
navcsteam.tech
navcsvr.site
navcvr.site
navcvtr.online
naveteam.tech
navncenter.site
navrcteam.site
navrrteam.site
navrsteam.site
navscteam.site
navsecvrteam.site
navsecvteam.site
navsteam.site
navvctr.online
navvctr.site
navvctvr.site
navvrsctr.site
navvsctr.online
navvteam.site
navxteam.site
naxteam.site

# Reference: https://www.virustotal.com/gui/ip-address/23.106.124.4/relations

dmnscorp.xyz
nacnmcsa.tech
nacnvscorp.online
namcgmt.xyz
namcgst.link
namnscop.site
namvncgst.xyz
namvncs.site
namvncs.store
namvncst.xyz
nancsvcorp.tech
nanmsncorp.tech
nansamsncoasrp.site
nansamsncoassrp.site
napcorteam.site
navmncsas.online
navmncsas.site
navmncsavorp.online
navmncsavorps.online
navrnsvrp.online
nismnvcopa.shop
nismnvcorp.tech
nismnvscorp.tech
nismnvscorps.site
nismvnco.site
nmasncorp.online
nmnvcorp.site
nsmansps.xyz
nsmansva.xyz
nsmansvcorp.online
nsmansvcorp.site
nsmansvcorpav.online
nsmansvcorpavs.xyz
nsmncoteam.online
nsmnvsco.online
nsnvcorp.site

# Reference: https://www.virustotal.com/gui/ip-address/23.106.124.25/relations

namnvncorp.tech
nanmsncorp.site
navmncvorp.tech
navmnvcorp.online
navmonscorp.site
navmscorp.online
nismnvcop.shop
nismnvcop.tech
nisnavmco.tech
nsmanvcorp.site
nsmanvcorps.online
nsvmavcorp.online
nvnacorp.site
nvnacorp.tech
secportalnav.tech

# Reference: https://www.virustotal.com/gui/ip-address/23.106.124.26/relations

navnaver.com
nidnavern.com
nidnavero.com

# Reference: https://asec.ahnlab.com/ko/59933/
# Reference: https://otx.alienvault.com/pulse/658c565578c6361b0ed9617a

104.168.145.83:993
107.148.71.88:993
159.100.6.137:993
38.110.1.69:993
45.114.129.138:33890
45.114.129.138:5500
bitburny.kro.kr
bitthum.kro.kr
doma2.o-r.kr
dongdongdong.r-e.kr
my.dongdongdong.r-e.kr
my.topton.r-e.kr
nobtwoseb1.n-e.kr
octseven1.p-e.kr
tehyeran1.r-e.kr
topton.r-e.kr
update.ahnlaib.kro.kr
update.doumi.kro.kr
update.onedrive.p-e.kr
yes24.r-e.kr

# Reference: https://twitter.com/asdasd13asbz/status/1742105472466117032

http://122.155.191.33

# Reference: https://twitter.com/asdasd13asbz/status/1744279858778456325
# Reference: https://www.virustotal.com/gui/ip-address/216.189.159.197/relations
# Reference: https://app.validin.com/axon?source=DNS&limit=100&type=ip&find=216.189.159.197
# Reference: https://www.virustotal.com/gui/file/2e0ffaab995f22b7684052e53b8c64b9283b5e81503b88664785fe6d6569a55e/detection
# Reference: https://www.virustotal.com/gui/file/f8ab78e1db3a3cc3793f7680a90dc1d8ce087226ef59950b7acd6bb1beffd6e3/detection

aerosp.p-e.kr
bananat.p-e.kr
daysol.p-e.kr
ilnas.n-e.kr
kimyy.p-e.kr
kostin.p-e.kr
limsjo.p-e.kr
mexico.p-e.kr
namutech.p-e.kr
negapa.p-e.kr
netup.p-e.kr
olixa.p-e.kr
rotsis.r-e.kr
ssungmin.p-e.kr
winters.r-e.kr
zosua.o-r.kr
sefud.csproject.org
shocloud.awiki.org
aa.olixa.p-e.kr
ai.kostin.p-e.kr
ai.limsjo.p-e.kr
ai.namutech.p-e.kr
ai.negapa.p-e.kr
ar.kostin.p-e.kr
ca.bananat.p-e.kr
ce.aerosp.p-e.kr
er.mexico.p-e.kr
li.ssungmin.p-e.kr
main.winters.r-e.kr
ol.negapa.p-e.kr
pe.daysol.p-e.kr
qi.limsjo.p-e.kr
sa.netup.p-e.kr
uo.zosua.o-r.kr
ve.kimyy.p-e.kr
vm.rotsis.r-e.kr
vn.ilnas.n-e.kr

# Reference: https://twitter.com/malwrhunterteam/status/1745227981281231108
# Reference: https://twitter.com/asdasd13asbz/status/1746783476702158941
# Reference: https://www.virustotal.com/gui/file/84f4f2e77b6e59c1fe54360842821fbfc6cdab039f197147b30876ed7da3647c/detection

nmailapp.n-e.kr
sign.nmailapp.n-e.kr

# Reference: https://twitter.com/malwrhunterteam/status/1749549318766219485
# Reference: https://www.virustotal.com/gui/ip-address/173.214.164.75/relations
# Reference: https://www.virustotal.com/gui/ip-address/205.209.99.26/relations
# Reference: https://www.virustotal.com/gui/ip-address/79.133.51.174/relations
# Reference: https://www.virustotal.com/gui/file/35ddb63c0729a7e3019c026865ea195607a51943d8867607a26c006f0df6e594/detection

acopfvy.store
acrob.shop
binavers.site
bindeo.tech
bnlopdlc.shop
cmytfvga.shop
corenavered.site
docloakc.online
docpoc.online
fomhl.fun
kololphcnv.shop
lfpa.website
locslf.website
lopaswec.shop
lopdgv.fun
mailcorp.tech
malilsopx.fun
mclvhoc.shop
mlodkf.online
moldoep.website
molgono.tech
mollcocmd.tech
mollsovop.fun
molsycl.shop
motivenaver.site
navei.online
naverpro.online
necxo.tech
nicorps.website
nidcorp.fun
obmonspc.online
octos.store
olcocmsl.tech
ploslacv.website
poskoca.shop
proteco.fun
riavercorped.site
sedlco.online
socrpa.store
soduci.online
solep.online
supwlmall.online
wedwec.online
wobsodm.tech
xclosldp.shop
/pkg/qsuw.php
/pkg/qsuw.php?cgimo=
/pkg/xyce.php
/pkg/xyce.php?mtahp=

# Reference: https://www.virustotal.com/gui/ip-address/216.219.80.170/relations

btcstack.site
naver-config.site
naver-delivers.site
naverservice.site
nidcorp.online
nidnaver.info
nidnavercorp.site
mail.naverservice.site

# Reference: https://www.virustotal.com/gui/ip-address/27.255.75.153/relations

aderto.store
afixer.store
ahesus.store
aiaitu.store
akites.site
aluces.site
baconer.site
berysu.site
bolun.site
cafung.online
cedoras.store
civilarys.store
cutagor.store
dacrorns.store
decasy.store
ghosfun.site
ghosteak3bordnhlp.shop
gproctecn3amckop.website
kionetaorg39hoaker.icu
kransfer349omeha.online
mksilencoa03coon.online
navecorps.com
naveralarm.com
naveralert.com
navercafe.info
nhopess.com
nidnaver.help
nidnaver.info
psetuplgmog0lan.online
zobkoreanck320fernst.website
api-talks.cedoras.store
emv1.akites.site
lcscorn.cedoras.store
mailcorn.cedoras.store
nid.cafung.online
nid.civilarys.store
nidcorn.cedoras.store
nidpilk.cedoras.store
nidpon.cedoras.store
sslcorn.cedoras.store
staticnidcorn.cedoras.store

# Reference: https://app.validin.com/axon?source=DNS&type=ip&find=27.255.75.158

asdzxcvbn.tech
bnxzsfgh.website
cananet.pe.kr
cvnnhbgvf.fun
emailservice.email
erdfcvwsx.fun
ertrfvcvb.tech
ertyuio.tech
fdgjksfiewr.tech
frgthyjuki.tech
gfhyfhg.shop
ghosfun.site
heros.sbs
hujikolp.fun
irony.cyou
kakaoservice.info
ktsp3.cananet.pe.kr
lmkjnhbgv.fun
logingmail.shop
lpokijmnuhb.tech
media-zabbix.xyz
mexcc.website
mnbvcxzasd.tech
navacallteam.shop
naverecenter.store
navernail.com
naverscorp.shop
navincteam.shop
nbmjhkgtb.tech
phealth.shop
ptighfeng.shop
pweicsd.shop
qbaby.shop
qecgfuteproas.shop
qweoifnc.shop
ranvocenart.store
registration-account.xyz
reinosdpool.site
reoncoao.store
revfdsvoino.store
rfvsdfghj.website
riocnsodea.store
rovnsaudcbiae.store
rtfgvbtyghbn.tech
sacnasopmn.store
sgoicaoe.store
sheocnsap.shop
sivnsdufe.shop
spoiencioser.shop
swenfdovin.shop
trueserver.art
trueserver.today
trygfhgf.website
ujmikolp.fun
vbnmtyu.website
wrcnsodfan.shop
xvcbgfrd.fun
yeivnsdke.shop
yhnujmikl.online

# Reference: https://app.validin.com/axon?source=DNS&type=ip&find=61.97.251.248

activemq.usage.store
akcunta22cooles.online
apache.activemq.usage.store
cocalex.store
dauo3mgoepcio.store
dianers.store
docsuris.store
ecoresar0minsites.icu
goedp4radnm.website
gproctecn3amckop.website
hdoaunem39dster.site
kakaoteam.site
kdouatr7hocnop.site
kl2dac0anploert.icu
makeverify.store
makinstac9aants.store
mc0nfaimstarknete.site
mdikcoad0m.store
mida23netkolcam.site
mitusbish3chinm.website
mksilencoa03coon.online
mofamail.homes
mofamail.shop
nastre0eakmavop.site
naverteam.center
nehoinv0icekom.site
nerdrtkpoamnder.site
nodkcl32doalkna.icu
org.apache.activemq.usage.store
sapraned90cnzla.store
uhda0pmaverpos.online

# Reference: https://app.validin.com/axon?source=DNS&type=ip&find=27.255.81.73

cawer.store
chosunmail.com
civilary.online
cogay.store
daurm.net
kakaoteam.site
navrcops.com
mail.daurm.net

# Reference: https://app.validin.com/axon?source=DNS&type=ip&find=27.255.81.77

acnura.store
aehuji.store
asrto.store
fogray.cfd
navers.co

# Reference: https://app.validin.com/axon?source=DNS&type=ip&find=61.97.251.246

ajoyable.store
busment.site
ducksale.store
naver.com.ro

# Reference: https://app.validin.com/axon?source=DNS&type=ip&find=27.255.81.113

ajoyable.store
akaysun.store
alohery.store
bisus.site
eaches.online
havercorp.com
ladacy.site
lucase.site
lusbow.site
cert.p-e.kr
countrysvc.p-e.kr
delcoo.o-r.kr
mail.havercorp.com
mail.navercom.org
mail.navercorp.ca
navercom.org
navercorp.ca
navers.cc
nid.cert.p-e.kr
filter.nsync.r-e.kr
login.countrysvc.p-e.kr
name.nprofi1e.kro.kr
ncore.o-r.kr
nprofi1e.kro.kr
nsync.r-e.kr
steps.ncore.o-r.kr
ttk.delcoo.o-r.kr

# Reference: https://app.validin.com/axon?source=DNS&type=ip&find=165.154.240.117

check-vhost.com
host-cookie.com
host-session.com
mail-urls.com
mailurlck.com
naver-cert.com
naver-click.com
naver-proxy.com
sites-domain.com
taryxo8a9b.info

# Reference: https://app.validin.com/axon?source=DNS&type=ip&find=210.92.18.165

naverdoc.com
navernotice.center
naverscan.com
oncloudvip.com

# Reference: https://app.validin.com/axon?source=DNS&type=ip&find=210.92.18.188

daum.net.ru
navernotice.center
naverscan.in.net
naverteam.net
onnostore.eu

# Reference: https://app.validin.com/axon?source=DNS&type=ip&find=61.97.251.235

kakaocop.eu
kr101483.in.net
kr410126.in.net
kr681730.in.net
navercop.eu
office8349.in.net
oksite.eu

# Reference: https://app.validin.com/axon?source=DNS&type=ip&find=61.97.243.42

kakaoccrp.com
naver-defend.com
naver-filter.com
naver-pages.com
naver-publish.com
naver-security.center
naver-teams.com
naver-vhost.com
navercorp.com.co

# Reference: https://app.validin.com/axon?source=DNS&type=ip&find=61.97.243.40

nate-files.com
naver-master.center
naver-profile.com
naver-protect.center
naverccrp.co
naverprivacy.center

# Reference: https://app.validin.com/axon?source=DNS&type=ip&find=61.14.211.149

haenmail.net
naver-links.com
naver-pdf.com
navercenter.com
navercorq.com
nid-check.ml

# Reference: https://app.validin.com/axon?source=DNS&type=ip&find=27.255.81.114

downloademaeil.com

# Reference: https://app.validin.com/axon?source=DNS&type=ip&find=27.255.79.204

dlive.ga
mail.dlive.ga
member.nidlogin.kro.kr
naveradmin.com.co
navernotice.com
naverpolicy.pw
naversupport.com.co
navor.co.com
nidlogin.kro.kr

# Reference: https://app.validin.com/axon?source=DNS&type=ip&find=211.104.160.81

cc.navermails.com
edaum.online
hostmaster.navermails.com
lcs.navermails.com
mail.naverccrp.org
mail.navermails.com
mail.naverteam.org
navar.co.cm
navar.com.co
naverccrp.org
navermails.com
naverpolicy.info
naverprotect.com
naversupport.net
naverteam.org
nid-otp.navermails.com
nid.navermails.com
nids.navermails.com
sslpstaticnet.navermails.com
staticnid-otp.navermails.com

# Reference: https://twitter.com/ArbaaWahidhamsa/status/1752346762759610558
# Reference: https://www.virustotal.com/gui/ip-address/45.58.52.104/relations

cert-auth.p-e.kr
cert-login.n-e.kr
file-cloud.r-e.kr
file-sec.n-e.kr
firterswer.r-e.kr
goldmelon.n-e.kr
gomplay.n-e.kr
jeonpriter2.r-e.kr
macdonald.n-e.kr
nanymanda.n-e.kr
nestros1.n-e.kr
operasik2.r-e.kr
ostras1.p-e.kr
peras1.n-e.kr
portgirl.r-e.kr
safeguard.r-e.kr
servicesheduler.p-e.kr
whalenvapp.n-e.kr
check.servicesheduler.p-e.kr
neer.firterswer.r-e.kr
sign.whalenvapp.n-e.kr
update.jeonpriter2.r-e.kr

# Reference: https://twitter.com/tiresearch1/status/1752713847033729176
# Reference: https://app.validin.com/axon?source=DNS&type=ip&find=141.164.49.199

koreanair.website
nts-inform.website
npsnews.website
ntsalert.website
ntshomes.website
ntsinform.store
ntsinform.website
ntsmailing.homes
ntsnews.store
ntsnews.website
ntsview.homes
ntsviewer.homes
ntsviewer.store
ntsviews.homes

# Reference: https://app.validin.com/axon?source=DNS&type=ip&find=158.247.197.219

nts-email.website
nts-homes.website
nts-msg.website
nts-viewer.website
ntsalert.space
ntsapps.space
ntscope.space
ntsctrls.space
ntscustomer.site
ntshelp.space
ntsinform.space
ntsmailer.site
ntsmailing.space
ntsoffer.shop
ntsoffer.site
ntsoffer.store
ntspayer.space
ntspays.space
ntspolicy.store
ntsports.space
ntsposter.space
ntsposting.website
ntsposts.store
ntsviewer.space
secure-center.site
wetax-home.site

# Reference: https://twitter.com/tiresearch1/status/1752968430880469031
# Reference: https://app.validin.com/axon?source=DNS&type=ip&find=141.164.62.12
# Reference: https://app.validin.com/axon?source=DNS&type=ip&find=158.247.204.87
# Reference: https://app.validin.com/axon?source=DNS&type=ip&find=158.247.208.76
# Reference: https://app.validin.com/axon?source=DNS&type=ip&find=158.247.214.14
# Reference: https://app.validin.com/axon?source=DNS&type=ip&find=158.247.239.225
# Reference: https://app.validin.com/axon?source=DNS&type=ip&find=158.247.242.154
# Reference: https://app.validin.com/axon?source=DNS&type=ip&find=158.247.247.162
# Reference: https://app.validin.com/axon?source=DNS&type=ip&find=27.102.128.79

authuser.online
checkpermission.cloud
com-flight.space
gcogle.site
hometax-post.site
hometax.space
hometaxcs.site
hometaxctrl.site
hometaxes.space
hometaxes.store
hometaxs.site
inetpost.site
les-girls.top
navarcope.space
npsauth.site
npscare.site
npscmd.site
npsnote.site
npsnotice.site
npsrule.site
npssign.site
nts-kr.site
nts-mail.homes
nts-post.homes
ntsadmin.site
ntsalert.site
ntsapp.site
ntsapp.store
ntsapps.site
ntsapps.store
ntsbox.space
ntscard.site
ntscart.site
ntscenter.site
ntscenter.space
ntscentre.site
ntscentre.space
ntscontact.site
ntscope.online
ntscope.site
ntscorp.site
ntscorp.space
ntscustom.space
ntsdocs.site
ntsdocs.space
ntsdocs.store
ntsgo.space
ntshelps.space
ntshelps.store
ntshomes.shop
ntshomes.site
ntsinform.site
ntsinforms.site
ntsjob.site
ntslogin.site
ntslogin.store
ntsmail.space
ntsmailing.site
ntsmain.site
ntsmain.space
ntsmid.site
ntsnew.homes
ntsnew.site
ntsnew.space
ntsnew.store
ntsnews.homes
ntsnotice.site
ntsoffer.space
ntsorder.site
ntsorg.site
ntsorg.space
ntsorg.store
ntspayable.site
ntspayer.site
ntspc.site
ntspolicy.space
ntsports.store
ntspost.shop
ntsposter.homes
ntsposter.site
ntsposting.store
ntsreport.shop
ntsreviews.space
ntsroom.site
ntssign.site
ntssign.space
ntstaxes.space
ntstel.space
ntsto.site
ntsto.space
ntsusers.site
ntsusers.store
ntsviewer.site
ntsviews.shop
ntsviews.space
ntsward.site
ntsxhome.site
profuso.life
safecenter.site
sinsa.online
tnt-home.site
tossbenk.online
lcs.ntsposter.site
naver.ntsmailing.site
naver.ntsposter.site

# Reference: https://app.validin.com/axon?source=DNS&type=ip&find=27.102.129.48

myconferms.info
securitygooqles.com
service-googlces.info

# Reference: https://www.virustotal.com/gui/ip-address/27.102.106.66/relations

memconfirm.info
nidconfirms.info
nidcorp.info
nidcorpmember.info
nidmember.info
nidmemcorp.info
niduserna.site
nidusersncorp.site
nidusertn.site
nidusrecorp.site
nidusrnscorp.site
nidusrstecorp.site
shares-view.com
transfer-dosi.world
userconfs.info
cc.userchecks.info
lcs.userchecks.info
lcs.userconfs.info
naver.nidcorp.info
naver.nidusrecorp.site
naver.userchecks.info
naver.userconfs.info
wa11ets.transfer-dosi.world

# Reference: https://twitter.com/tiresearch1/status/1754407046873784592
# Reference: https://www.virustotal.com/gui/ip-address/27.102.101.26/relations

naaverascorp.com
navearcorps.help
nidnaavers.com
nidnaveasrv.help
nidnavesecorp.help
ninavaracorp.site
nts-info.website
nts-mailer.website
nts-news.website
nts-poster.website
nts-viewer.store
ntsmailing.website
ntsmails.store
ntsviews.store
api.infonavera.com
cc.naversinfo.help
cc.nidnavescorp.help
cc.nidnavesecorp.help
ccid.infonavera.com
cs.kakaocop.eu
dev.infonavera.com
idv.kakaocop.eu
lcs.navearcorps.help
lcs.naversinfo.help
lcs.nidnavesecorp.help
lcsid.infonavera.com
login.infonavera.com
m.infonavera.com
mailid.infonavera.com
mailid.nidnaavers.com
nid.infonavera.com
nid.navearcorps.help
nid.naversinfo.help
nid.nidnaavers.com
nid.nidnavesecorp.help
nid.ninavaracorp.site
sslid.infonavera.com
stage.infonavera.com
staticnidid.nidnaavers.com

# Reference: https://twitter.com/RexorVc0/status/1753322889716084823
# Reference: https://mp.weixin.qq.com/s?__biz=Mzg2NjgzNjA5NQ==&mid=2247522061&idx=1&sn=22e56ee213d9e5229371ad3e082ebfab&chksm=ce461c1df931950b245134a250b6bf4bea489d75b556cb450548569c0c6d50d3bacc00a8efe0&scene=178&cur_album_id=2867627575890837505#rd

ek.com/js/sub/aos/dull/down1/r_enc.bin
ek.com/js/sub/aos/dull/down1/show.php
kyungdaek.com/js/sub/aos/dull/down1/123.hwp
kyungdaek.com/js/sub/aos/dull/down1/lib.php
kyungdaek.com/js/sub/aos/dull/down1/list.php
kyungdaek.com/js/sub/aos/dull/down1/r_enc.bin
meatalk.com/pg/adm/tdr/upi/down0/lib.php
meatalk.com/pg/adm/tdr/upi/down0/list.php
meatalk.com/pg/adm/tdr/upi/down0/r_enc.bin
meatalk.com/pg/adm/tdr/upi/down0/show.php
siloamclinic.com/js/slick/up/down0/lib.php
siloamclinic.com/js/slick/up/down0/list.php
siloamclinic.com/js/slick/up/down0/show.php
siloamclinic.com/js/slick/up/down1/r_enc.bin
vwellpain.com/js/sub/up/down1/r_enc.bin

# Reference: https://twitter.com/tiresearch1/status/1755116984235114701
# Reference: https://app.validin.com/axon?source=DNS&type=ip&find=158.247.194.199
# Reference: https://www.virustotal.com/gui/ip-address/141.164.35.7/relations
# Reference: https://www.virustotal.com/gui/ip-address/141.164.50.24/relations
# Reference: https://www.virustotal.com/gui/ip-address/141.164.41.218/relations
# Reference: https://www.virustotal.com/gui/ip-address/141.164.59.224/relations
# Reference: https://www.virustotal.com/gui/ip-address/141.164.61.162/relations
# Reference: https://www.virustotal.com/gui/ip-address/158.247.194.199/relations
# Reference: https://www.virustotal.com/gui/ip-address/158.247.200.209/relations
# Reference: https://www.virustotal.com/gui/ip-address/158.247.248.158/relations
# Reference: https://www.virustotal.com/gui/ip-address/158.247.254.237/relations

acckr.online
acckr.store
ackr.link
ackr.online
belieview.com
cenv.space
cenv.store
cnkr.online
cnkr.store
ecnv.site
edcloud.store
edkcloud.cloud
edkcloud.online
edoc-kr.online
edocs-kr.cloud
edocs-nv.online
edocs-nv.space
edocs-nv.store
escnv.online
estnv.online
estnv.space
estnv.store
fscns.xyz
gemnv.online
gemnv.space
hlnv.store
hnsc.space
krcp.online
krcp.store
maillive.click
mailsvc.fun
mngkr.cloud
mngkr.fun
mngkr.host
mnksc.cloud
mnksc.host
mnsvc.icu
mnsvc.tech
mnvsc.online
mnvsc.store
nbkr.online
nbkr.space
nckr.space
ncloud.click
ncloud.host
ncloud.uno
ncplus.click
ncplus.site
ncvsr.tech
ncvts.online
ncvts.store
ndoc-kr.host
ndoc-kr.info
ndoc-kr.site
ndoc-kr.space
ndoc-kr.store
ndoc.digital
nhis-cloud.online
nhis-cloud.site
nhis-doc.store
nhis-edoc.cloud
nhiskr.cloud
nhiskr.fun
nhiskr.online
nhiskr.site
nhiskr.space
nhiskr.tech
nhissvc.cloud
nhissvc.space
nhskr.online
nhskr.space
nhskr.store
nldoc-kr.cloud
nmsvc.icu
nmsvc.online
nqcloud-edoc.site
nscentre.online
nskr.online
nskr.space
nskr.store
nsrv.link
nsrv.store
ntskr.cloud
ntskr.online
nvclup.link
nvclup.online
nvclup.space
nvclup.store
nvdocs.store
nvkr.link
nvkr.space
nvkr.store
nvpr.info
nvpro.art
nvpro.host
nvpro.info
nvsc.cloud
nvsc.press
prodocs.cloud
prodocs.tech
psnv.store
pvnr.online
pvnr.store
scenv.cloud
scnr.store
sdoc-kr.cloud
sdoc-kr.host
sdoc.cloud
shnvr.store
sknet.space
sknet.store
srcnv.icu
ssnv.cloud
stnv.online
stnv.site
xvideos-kr.com
bakingschool.belieview.com
bobae.belieview.com
cpanel.ncloud.host
daum.belieview.com
dev.ndoc-kr.space
dmarc.edoc-kr.online
edocs.acckr.online
edocs.acckr.store
edocs.cenv.store
edocs.cnkr.online
edocs.cnkr.store
edocs.ecnv.site
edocs.krcp.online
edocs.krcp.store
edocs.nbkr.space
edocs.nckr.space
edocs.nscentre.online
edocs.nskr.space
edocs.nvclup.store
edocs.nvkr.store
edocs.nvpr.info
edocs.nvpro.art
edocs.nvpro.info
edocs.nvsc.cloud
edocs.nvsc.press
edocs.sdoc.cloud
edocs.shnvr.store
edocs.stnv.online
emv1.prodocs.tech
mta-sts.prodocs.tech
naver.belieview.com
ncentral.ncloud.host
noc.ncloud.host
ns1.ncloud.host
ns2.ncloud.host
owa.mngkr.fun
postgresql.edkcloud.cloud
postmaster.edkcloud.cloud
quasarzone.belieview.com
shop.sdoc-kr.host
superset.mnksc.host
tsc.estnv.online
tsc.estnv.store
tsc.gemnv.online
tsc.hnsc.space
tsc.mnvsc.online
tsc.ncloud.host
tsc.ncloud.uno
tsc.ncvts.online
tsc.ncvts.store
view.edkcloud.cloud
view.edocs-nv.space
view.mngkr.cloud
view.mngkr.fun
view.mngkr.host
view.mnsvc.icu
view.mnsvc.tech
view.nhis-cloud.online
view.nhis-cloud.site
view.nhis-doc.store
view.nhis-edoc.cloud
view.nhiskr.cloud
view.nhiskr.online
view.nhiskr.site
view.nhiskr.tech
view.nhissvc.space
view.nhskr.online
view.nldoc-kr.cloud
view.nmsvc.online
view.nqcloud-edoc.site
view.nsrv.link
view.nsrv.store
view.ntskr.online
view.nvclup.online
view.nvclup.space
view.nvclup.store
view.nvdocs.store
viewer.edkcloud.cloud
webdisk.ncloud.host

# Reference: https://twitter.com/hypen1117/status/1755502188078755857
# Reference: https://medium.com/s2wblog/kimsuky-disguised-as-a-korean-company-signed-with-a-valid-certificate-to-distribute-troll-stealer-cfa5d54314e2

coolsystem.co.kr

# Reference: https://www.virustotal.com/gui/ip-address/158.247.200.183/relations

fsceit.cloud
fscsies.info
navnsrc.cloud
navserv.cloud
nhitalk.online
nhseco.store
nqcloud-edoc.site
ntihosp.site
mail.navserv.cloud
motu.nhseco.store
nhos.nhseco.store
view.fsceit.cloud
view.navnsrc.cloud
view.navserv.cloud
view.nhitalk.online

# Reference: https://www.virustotal.com/gui/ip-address/158.247.232.100/relations

dlndocs.site
heisof.mom
htxpost.site
moecsxet.fun
moschck.store
mossrv.site
moxcei.online
niddocs.site
nidedoc.cloud
ntcloud-edoc.site
ntcloude.site
ntidocs.site
ntihosp.site
oiwoske.store
secdoc.site
settingdirect.org
uugirl.vip
emv1.dlndocs.site
emv1.htxpost.site
emv1.ntcloud-edoc.site
emv1.secdoc.site
gvidfaas.htxpost.site
hostmaster.secdoc.site
ldrssbkg.htxpost.site
mail.htxpost.site
motu.moecsxet.fun
motu.moschck.store
mta-sts.dlndocs.site
mta-sts.htxpost.site
mta-sts.ntcloud-edoc.site
view.dlndocs.site
view.htxpost.site
view.moecsxet.fun
view.moschck.store
view.mossrv.site
view.niddocs.site
view.nidedoc.cloud
view.ntcloud-edoc.site
view.ntcloude.site
view.secdoc.site

# Reference: https://www.virustotal.com/gui/ip-address/31.220.76.170/relations

htxpost.site
navedocs.site
navnsrc.cloud
navsvcs.cloud
niddocs.site
nidedoc.cloud
ntcloudn.site
ntcloudo.site
ntclouds.cloud
ntclouds.site
ntsvc-edoc.cloud
ntsview.store

# Reference: https://www.virustotal.com/gui/ip-address/158.247.210.44/relations

bstsba.store
cotnek.store
eabtaa.store
edocs-mid.site
edocs-moseid.site
gov24-kr.site
gyufy.site
hlomein.store
hokimc.store
hrnksel.store
kemtkao.store
mois-daot.site
mois-view.site
monews.store
mosgov.site
mpas-kr.site
mtpeck.store
nhosrv.site
ntaview.site
sadbta.site
sceasnse.store
seltsnb.click
ssbee.store
stisent.fun
tsaehne.cfd
tsnua.site
emv1.mosgov.site
mosi.ntsvc-edoc.cloud
mosi.ntsview.store
mta-sts.mosgov.site
si.ntsvc-edoc.cloud
view.ntcloudo.site
view.ntsvc-edoc.cloud

# Reference: https://www.virustotal.com/gui/ip-address/141.164.62.17/relations

abyocs.store
ayjaent.bond
btinah.lol
edocs-center.site
etockmid.site
hmktsc.store
hodcts.store
hsects.store
htsseh.store
konctw.lol
moedocs.store
mois-kite.site
moishlwkt.site
moscheck.site
moscloud.online
mosiview.online
mosplay.fun
mpas-kr.site
navedocs.site
nmsvc-edoc.cloud
ntcloudn.site
ntclouds.site
shymh.lol
sydsh.store
ujdyph.lol
vrteocs.store
mosi.mosiview.online
mosi.ntclouds.site
post.navedocs.site
read.hsects.store
read.moedocs.store
view.mosplay.fun
view.navedocs.site
view.nmsvc-edoc.cloud
view.ntcloudn.site

# Reference: https://www.virustotal.com/gui/ip-address/158.247.254.159/relations

nts-post.website
ntshome.website
ntsinfo.website
ntsmail.website
ntsmailer.store
ntsmsg.website
ntsposter.website
emv1.ntshome.website
emv1.ntsmail.website
emv1.ntsposter.website
lcgwihug.ntsposter.website
mta-sts.ntshome.website
mta-sts.ntsinfo.website
mta-sts.ntsmailer.store

# Reference: https://www.virustotal.com/gui/ip-address/158.247.239.225/relations

authuser.website
checkhuman.site
checkpermission.site
checkpermission.website
documentsvievv.com
fssorg.site
gocgledrive.store
goglesign.site
goocgles.com
googlces.com
hankyung.site
koreariair.space
kvoting-home.online
kvoting-send.online
nhis-org.site
nhismailing.site
nts-doc.online
ntsctrls.store
ntshelp.site
ntsmailer.space
ntsmailing.site
ntsposter.site
ntsposting.space
ntsviewer.site
phonemanagers.info
rememberapp.cloud
so-team.cloud
so-unlock.online
so-unlock.website
team11.website
user-manage.site
lcs.ntsnews.space
mta-sts.ntsmails.space
shop.ntsboard.space
shop.ntspost.space
store.ntspost.space
websitmta-sts.ntsgov.site
ntsmail.websitmta-sts.ntsgov.site

# Reference: https://www.virustotal.com/gui/ip-address/158.247.226.241/relations

npsposter.site
npsposter.space
npsviewer.site
npsviewer.space
ntsinforms.space
emv1.npsviewer.site
mta-sts.npsviewer.site

# Reference: https://twitter.com/asdasd13asbz/status/1758007194963071067
# Reference: https://www.virustotal.com/gui/ip-address/45.195.69.28/relations

45.195.69.28:14275
binace.homes
binaces.homes
masnail.shop
aas.com/inc/basl/up1/show.php

# Reference: https://twitter.com/tiresearch1/status/1758443520405184764
# Reference: https://www.virustotal.com/gui/ip-address/64.176.225.245/relations

navarcope.site
news-nps1.site
nps-sends.site
npsnote.site
npsreview.site
npssign.space
ntsadv.site
ntscorp.store
ntsgrp.site
ntsmid.space
ntspage.space
ntsroom.store
rskey.buzz
wetax-notice.site
wetax-notice.space
wetax-pay.online
wetax-pay.site
wetax-pay.space
wetax-pay.store
emv1.npsnote.site
emvl.npsnote.site
naver.wetax-pay.online

# Reference: https://twitter.com/tiresearch1/status/1762039064528908737

edocs-all.site
edocs-high.site
edocs-hope.site
edocview.online
edsafety.online
nhiskr.store
nhkr-docs.online

# Reference: https://www.virustotal.com/gui/ip-address/158.247.210.247/relations

fscns.online
nhis-doc.space
nscentre.cloud
nsrv.space
nvdocs.online
dev.nvdocs.online
emv1.nhis-doc.space
emv1.nscentre.cloud
emv1.nvdocs.online
mta-sts.nvdocs.online
view.nhis-doc.space
view.nhiskr.store
view.nsrv.space
view.nvdocs.online

# Reference: https://twitter.com/JangPr0/status/1761961131319681453
# Reference: https://twitter.com/asdasd13asbz/status/1762014640274637280
# Reference: https://www.virustotal.com/gui/file/f262588c48d2902992ffd275d2be6362fe7f02e2f00a44ab8c75ac1a2827c6e9/detection

dgartway.kr

# Reference: https://twitter.com/asdasd13asbz/status/1762382877638160789

ncallserveiqnxme.store
/teamnavcorphost/enzmenaiexz/ajemzneij/team.php
/teamnavcorphost/enzmenaiexz/
/ajemzneij/team.php?suseeid=

# Reference: https://twitter.com/tiresearch1/status/1762743004601921709

apcorp.homes
kapacloud.homes
memavers.pics

# Reference: https://www.virustotal.com/gui/ip-address/141.164.39.174/relations

abyiase.store
cmseny.store
criaoeh.store
heinsk.online
hoscke.store
koetle.store
ktstore.store
menoks.online
mois-kr.site
reaotnd.store
sdcey.store
tockeam.store
tsceeh.store
viewer.mois-kr.site

# Reference: https://www.virustotal.com/gui/ip-address/158.247.215.195/relations

agsbte.store
cdktne.store
csebte.store
ekdotns.site
htchoc.store
mois-com.site
mois-env.site
moisnews.site
moissctic.site
sctseit.store

# Reference: https://community.emergingthreats.net/t/ruleset-update-summary-2024-02-22-v10538/1399

civilizations.store
countrysvc.pe.kr
navigation.cc
navermail.online.korea
newnotification.server.korea
ned.newnotification.server.korea
nmail.navermail.online.korea
nsvc.mail.server.korea
taxservice.pe.kr
upbit-service.pe.kr
upbit2024.re.kr

# Reference: https://www.virustotal.com/gui/ip-address/45.66.249.5/relations

dosi-team.world
indeede-checks.site
indeede-confirm.online
indeede-homes.site
membersecure.online
notice-irshome.site
notify-bestbuy.site
pay-dosi.world
services-ledqer.info
usercheckonlines.site
usersinfocheck.site
shop.ntsemail.space

# Reference: https://twitter.com/Cyberteam008/status/1765624539273183623

accoints-google.com-guide.site
accounts-google.com-guide.site
accounts-gooqle.com-guide.site
accounts.o-r.kr
accountsdon.kakaoaccouts.store
accountseses.mofamail.shop
accountsnot.kakaoaccouts.store
accountsuey.kakaoaccouts.store
add-contact.p-e.kr
afoinoin.shop
aieiqyeizniqopao.store
allowlogin.shop
allrecieve.online
api-talks.memavers.pics
bd.n-blog.o-r.kr
billions168.com
ccalo.memavers.pics
cnbvhuiop.fun
com-guide.site
dev.kakaoteam.site
dndon.kakaoaccouts.store
dneses.mofamail.shop
domainkey.cloudown.store
dsaewqcxz.website
eaziaieoqyzmdiaotea.store
emv1.docsuris.store
emv1.mofamail.homes
emv1.mofamail.shop
emv1.usage.store
eoquqowizateua.store
httpswwwalo.memavers.pics
jr168jr.com
lcsalo.memavers.pics
lcspene.mofamail.shop
link.new-doc.p-e.kr
mailalo.memavers.pics
mta-sts.docsuris.store
mta-sts.makeverify.store
mta-sts.usage.store
naizieoqiaeyua.store
naizjeiqmzoeha.store
naizmehzosaxolawiq.store
naizmeoqnaizeoaosier.store
naizoqiayzoaijae.store
ncyberteamcall.store
new-doc.p-e.kr
nguardteam.store
nid-naver.memavers.pics
nid.add-contact.p-e.kr
nidalo.memavers.pics
nidpele.mofamail.shop
nidper.navecorps.com
nidporn.cloudown.store
nidporn.kakaoaccouts.store
nids.memavers.pics
nie.nts-news.p-e.kr
ntinfo.o-r.kr
nts-news.p-e.kr
nziqoaiqozniws.store
oiequziqiwery.store
pcvnbduie.tech
poeiqyaizoeiaywoaise.store
poilkjmnb.fun
qwaszxedc.tech
qwaszxqaz.online
qwerfdsa.online
qwertyu.fun
rzdzociaoeaieoqnzid.store
server.add-contact.p-e.kr
smaths.lat
sslalo.memavers.pics
stat_tiaraeses.mofamail.shop
staticnidalo.memavers.pics
t1_daumcdneses.mofamail.shop
talktalk.emailservice.email
unc.ntinfo.o-r.kr
vbfgrtyhn.website
vghfjrui.site
wazioajieitoquazoeis.store
werqasdf.website
wwwalo.memavers.pics
youtube.accounts.o-r.kr
zieiqyueoaizneoqiwer.store
zneiqmzieniaie.store

# Reference: https://www.virustotal.com/gui/ip-address/27.255.75.138/relations
# Reference: CERT_FINGERPRINT-HOST: 2a0612870a6fc14d4a9579f96bf8a0f1b2b762e2

accoouts.online
alal.online
api-talks.naverscorp.shop
apps.navecorps.com
ccid.navincteam.shop
ccpon.naverscorp.shop
compnservice.store
confirmin.shop
emv1.naverscorp.shop
gcogle.online
gfp.veta.naverscorp.shop
itgnorsg.wrcnsodfan.shop
lcspon.naverscorp.shop
makeauth.biz
minggamevies.com
nahostpresssec.store
nasecteamcall.store
navacallsim.shop
navacallteam.store
navasyssecteam.shop
navcallservteam.shop
navctrcentrecall.shop
naveraccomngr.shop
naveraccount.store
navercompany.shop
navercompany.store
naverconfirm.store
naverconsol.store
navercorpcom.store
navercorps.store
navercyberteam.store
naverereact.store
naveresecurity.shop
navereservice.store
naverguard.store
naverinc.shop
naverinc.store
naverscorp.store
naverscropsecurity.store
naversecurity.store
naverservice.store
naverservicehuck.store
naversscorp.shop
naverteam.store
navmakesecteam.shop
navsecservicesee.shop
navteamsol.shop
ncallservaeiwoq.store
ncompcyberdef.store
ncompcyberteam.store
ncompcyble.store
ncompgover.store
ncompservice.store
ncompservteam.store
ncorpservaieaiw.store
ncropsecteam.shop
ncussoc.shop
ncussol.shop
ncustcol.shop
ncustomseccenter.store
ncustomsecteam.store
ncyberdefender.store
ncyberguard.store
ncyberteam.store
ncybfeaceteam.store
ncyblecenter.shop
ncybleteamhelp.store
ndefenseteamsol.shop
ndomainservsec.store
nedrsecteamservice.store
ngoverteam.store
nhelpaccountcenter.store
nhelpcenter.store
nhostmailtan.store
nhostservicecmo.store
nhostservmarktet.store
nid.navercompany.shop
nid.naverecenter.store
nid.naverscorp.shop
nid.naverservice.store
nid.navincteam.shop
nid.ncustomsecteam.store
nid.nsechelpteam.store
nidhelpcenter.shop
nidnaverservice.shop
nidnaverteam.shop
nidnavteamtanu.shop
nidnservice.shop
nidnteamcall.shop
nidpon.nsechelpteam.store
nincsecteamcall.store
nmservicecompany.store
npresscorp.store
nsabteamseccall.store
nsafehelpcenter.online
nseccenterpress.store
nsechelpteam.store
nsecservice.store
nsecteamcall.shop
nsecteamservice.shop
nsecteamservice.store
nsecuteamservice.store
nseicmzneizmeiqnx.store
nservcompaie.store
nservhostmark.store
nservhostwordsec.store
nservicecalleianze.shop
nservicecenter.store
nservicecompany.store
nservicehelp.store
nservicehelpcenter.store
nservicemanager.store
nserviceprice.store
nserviceseccenter.store
nservicesecteam.store
nservicetallship.store
nserviceteamhost.store
nserviceteamsec.store
nservicetoolsec.store
nservsectran.store
nservteamsellaie.store
nsolsimhelpserv.store
nteamservpress.store
nteamservtool.store
nthdefteam.shop
ntreanservicesec.store
orignauth.lol
peace.gcogle.online
policy.navincteam.shop
retry.today
rnvosdinrgf.sacnasopmn.store
secteamofnava.store
soundcaptchanidid.navincteam.shop
sslpon.naverscorp.shop
tivan.naverscorp.shop
uaefnoi.shop
ubasncos.shop
ucaeoinmo.shop
udoirfno.shop
unikorea.go.ci
veta.naverscorp.shop
wwwcorpid.navincteam.shop
wwwid.navincteam.shop

# Reference: https://www.virustotal.com/gui/ip-address/61.97.251.247/relations

dapacloud.store
kdiacloud.store
ncorpserver.online
ncushelpserver.top
ndefenderhome.store
nfeaceteamhelp.store
nfrayteam.top
nhelpcentercall.store
nhelpcenterserver.store
nhelpservercom.store
nsafehomeservice.store
nsheriffcom.store
nid.ncorpserver.online

# Reference: https://www.virustotal.com/gui/ip-address/210.92.18.172/relations

naveracc.com
naveraccount.info
naverhelp.org
navermail.net
sunrnail.com
tiktikcdn.site
auth.navermail.net
imap.navermail.net
mail.navermail.net
mail1.navermail.net
mx.navermail.net
nid.naveraccount.info
nid.naverhelp.org
nid.navermail.net
pop.navermail.net
pop3.navermail.net

# Reference: https://www.virustotal.com/gui/ip-address/61.97.251.236/relations

naverccrp.com
naverpw.com
nca.naverccrp.com
nid.naverccrp.com
nid.naverpw.com
nidpron.cloudown.store
verifyseprise.store
xn--nid-mo0a.naverccrp.com

# Reference: https://www.virustotal.com/gui/ip-address/61.97.251.244/relations

check2.download
com2.download
nid2-naver.date
accounts.kakao.com-user.pw
accountsetse.mofamail.shop
daum.net-confirm.com-user.pw
kakao.com-user.pw
live.bwimg.net
logins.daum.net-confirm.com-user.pw
named.kim53.com
naver.com-user.pw
net-confirm.com-user.pw
nid.naver.com-user.pw

# Reference: https://www.virustotal.com/gui/ip-address/27.255.81.76/relations

accountseros.usage.store
accountskakao.mailcorp.eu
accountsoka.kakaocops.info
accountsosi.kakaocops.info
accountsotik.kakaorg.info
accountsute.kakaoaccouts.store
accoutskakao.mailcorp.eu
ahost.galleryleebae.com
btym.mailcorp.eu
cafe.mailcorp.eu
cclogin.navermail.click
comic.mailcorp.eu
google.notifi.o-r.kr
helpnaver.mailcorp.eu
horang.info
kakaocops.info
kakaorg.info
kin.mailcorp.eu
land.mailcorp.eu
lcslogin.navermail.click
mail.mailcorp.eu
maillogin.navermail.click
mailnaver.mailcorp.eu
map.mailcorp.eu
morase.info
ms.knn24.com
mybox.mailcorp.eu
netmg.info
news.mailcorp.eu
nidlogin.navermail.click
nidnaver.mailcorp.eu
noti.mailcorp.eu
notifi.o-r.kr
section.cafe.mailcorp.eu
sh.kakaocops.info
sports.news.mailcorp.eu
ssllogin.navermail.click
sslnaver.mailcorp.eu
stat_tiarakakao.mailcorp.eu
staticlogin.navermail.click
staticnidnaver.mailcorp.eu
stock.mailcorp.eu
t1_daumcdnkakao.mailcorp.eu
toran.info
uuzd.mailcorp.eu
vbqs.mailcorp.eu
weather.mailcorp.eu
webmail.navermail.click
wwwnaver.mailcorp.eu

# Reference: https://www.virustotal.com/gui/ip-address/27.255.81.75/relations

navercrrp.com
nid.naverc0rp.com
nids.navercrrp.com

# Reference: https://www.virustotal.com/gui/ip-address/165.154.240.149/relations

mofamail.eu
officmail.homes

# Reference: https://www.virustotal.com/gui/ip-address/154.90.63.220/relations

accounthome.store
accountsign.store
accountsinfo.shop
accountsuser.store
asigninfo.store
authenpotal.click
connectserver.store
yescerse.store
emv1.wrcnsodfan.shop

# Reference: https://www.virustotal.com/gui/ip-address/159.100.29.38/relations

documentstoreservice.store
rtyyhnfghvb.shop

# Reference: https://www.virustotal.com/gui/ip-address/27.255.75.156/relations

foundaterity.quest
logingmail.homes
login.gcogle.online
login.logingmail.homes

# Reference: https://www.virustotal.com/gui/ip-address/27.255.75.163/relations

corpskoredunet.online
niduser2cops.tech

# Reference: https://www.virustotal.com/gui/ip-address/8.218.16.183/relations

antivmailnets.website
bnmbn.fun
bnmbnm.fun
cibersecploices.tech
ciberuser2cops.online
corpskoredunet.online
ebooksgumkrn.online
ekorbookhomes.tech
elibalertkorn.website
erer.online
erer.shop
ertedcrfv.fun
forkmaniolibs.shop
grpciberuserns.online
gukmindown.online
gukminyeongum.website
har5libsntola.website
invocedown.tech
invoicee.online
jonghui.online
kukmindown.website
logginnldsignup.tech
maverbooksio.tech
mcorp.website
mewvict0korps.tech
mingukdown.tech
minkukdown.online
mkinkibrarys0n.store
navorrnailcorps.tech
navur2userkinfs.site
nhisloggonin.tech
nidcops.tech
nidenvoicekr.online
nidsignin.online
niduser2cops.tech
nkoruserinfo.website
nkrop.online
nkropsnet.tech
nldelibscenter.shop
nldgggnnn.fun
nldlogggon.online
nldlogginon.website
nldloggonin.fun
nldloggonin.tech
nldlogin.online
nldsingin.shop
npkrbooknets.website
npkrlibs.online
npsebooklibs.online
nuser2guardman.website
nuser2secinfos.tech
nuserguards.website
onlinbookshome.online
onlynsis.website
pkrodmorps.tech
popogh.online
qwewsxzxc.tech
qwqw.website
reconlong.site
rfvedcdfg.fun
ri0tgmhostpn.cloud
thermclvergard1c.site
tyty.tech
tyuyhnghj.tech
uiui.shop
vcvcmn.website
vnvnlioe.fun
yeongumkornet.online
yhnujmtyu.tech
znznloey.online

# Reference: https://www.virustotal.com/gui/ip-address/45.192.162.121/relations

ekorguidecom.website
invoicenid.tech
kraccntsbooks.shop
miduserinfo.website
ncorpsinfos.online
nidusecorps.online
ninfokrops.online
nkidsecorps.tech
npkoruserconf.tech

# Reference: https://twitter.com/wwp96/status/1338460606983237638
# Reference: https://www.virustotal.com/gui/ip-address/23.106.122.194/relations

account-live.p-e.kr
edoc.linkpc.net
edoc.p-e.kr
gdiver.store
gdiver.website
invo1ce.p-e.kr
m-nidlogin.n-e.kr
m-nidlogin.o-r.kr
m-nidlogin.r-e.kr
m-nidlogin.work.gd
mlogin.p-e.kr
mybox.p-e.kr
n1dlogin.p-e.kr
narerlogin.p-e.kr
naver-edoc.kro.kr
nband.p-e.kr
nid1ogin.p-e.kr
nidiogin.kro.kr
nidiogin.p-e.kr
nidnarver.p-e.kr
nldconfirm.p-e.kr
nldiogin.p-e.kr
nldlogin.o-r.kr
nldlogin.p-e.kr
notify-mybox.p-e.kr
nps.p-e.kr
onedrive.linkpc.net
onedrive.n-e.kr
onedrive.p-e.kr
postgresql.gdiver.store
postman.gdiver.store
postmaster.gdiver.store
uidlogin.p-e.kr
upbitmain.online
update-mybox.r-e.kr
wetax.p-e.kr

# Reference: https://www.virustotal.com/gui/ip-address/185.177.59.180/relations

inv0ice.p-e.kr
mybox.p-e.kr
naver-verify.n-e.kr
naver1ogin.p-e.kr
nidnarver.n-e.kr
nmybox.p-e.kr
npay.r-e.kr
rnybox.n-e.kr
rnybox.p-e.kr
uidlogin.kro.kr
uidlogin.n-e.kr
uidlogin.r-e.kr

# Reference: https://twitter.com/asdasd13asbz/status/1768465386931200203
# Reference: https://pastebin.com/GBPMY2qH

a-dam79.com/adm/mail/img/poll/auto_n.php
aftkor.com/gnuboard4/adm/img/ttttt/auto_n.php
aismedu.com/gnuboard4/adm/img/pill/auto_n.php
bestallblue.com/gnuboard4/adm/img/pill/auto_n.php
blackboxas.net/gnuboard4/adm/img/poll/auto_n.php
blueheart8.com/gnuboard4/adm/img/ttttt/auto_n.php
bookthemiracle.com/gnuboard4/adm/img/ttt/auto_n.php
bstill.kr/gnuboard4/adm/img/poll/auto_n.php
bumyoungkorea.co.kr/gnuboard4/adm/img/poll/auto_n.php
canaanwood.com/adm//mail/img/pill/auto_n.php
cgm-korea.com/gnuboard4/adm/img/ttttt/auto_n.php
cheilcorp.com/gnuboard4/adm/img/pill/auto_n.php
cicctv.co.kr/gnuboard4/adm/img/poll/auto_n.php
cnsspirits.com/adm/mail/img/poll/auto_n.php
daeilefc.co.kr/gnuboard4/adm/img/poll/auto_n.php
daero8488.com/gnuboard4/adm/img/poll/auto_n.php
dbcsc.net/gnuboard4/adm/img/poll/auto_n.php
dils.co.kr/gnuboard4/adm/img/poll/auto_n.php
dmcpvd.co.kr/gnuboard4/adm/img/poll/auto_n.php
donkatsu.co.kr/gnuboard4/lib/pill/auto_n.php
dooroolove.com/gnuboard4/adm/mail/img/pill/auto_n.php
dynamic-auto.co.kr/gnuboard4/adm/img/pill/auto_n.php
eatondesignlap.com/gnuboard4/adm/img/poll/auto_n.php
ejufamily.com/gnuboard4/adm/img/pill/auto_n.php
gaonled.com/gnuboard4/adm/img/pill/auto_n.php
gluckesearch.com/adm/mail/img/poll/auto_n.php
hanaimfood.com/gnuboard4/adm/img/ttt/auto_n.php
hanatps.com/gnuboard4/adm/img/ttttt/auto_n.php
hangangindustry.com/gnuboard4/adm/img/ttttt/auto_n.php
harangpro.com/gnuboard4/adm/img/pill/auto_n.php
hbe-food.com/gnuboard4/adm/img/ttt/auto_n.php
hgcns.com/gnuboard4/adm/img/pill/auto_n.php
hnkai.com/gnuboard4/adm/img/pill/auto_n.php
hwajinsystem.com/gnuboard4/adm/img/pill/auto_n.php
hyokwang.com/gnuboard4/adm/img/ttttt/auto_n.php
i-jadeview.com/gnuboard4/adm/img/poll/auto_n.php
ifixle.com/gnuboard4/adm/img/ttttt/auto_n.php
ilec.co.kr/gnuboard4/adm/img/pill/auto_n.php
jungdamfs.com/gnuboard4/adm/img/ttttt/auto_n.php
khomestory.com/gnuboard4/adm/img/poll/auto_n.php
koharich.com/gnuboard4/adm/img/pill/auto_n.php
kolabs.kr/gnuboard4/adm/img/poll/auto_n.php
kotfa.org/gnuboard4/adm/img/poll/auto_n.php
kunyoungtsc.com/gnuboard4/adm/img/pill/auto_n.php
kyungin119.com/gnuboard4/adm/img/ttt/auto_n.php
lgensolsamunozo.com/adm/mail/img/poll/auto_n.php
madephotostudio.com/adm//mail/img/pill/auto_n.php
minervaauctionedu.com/adm/mail/img/poll/auto_n.php
misugum.com/gnuboard4/adm/img/pill/auto_n.php
munjungday.net/gnuboard4/adm/img/poll/auto_n.php
nainenc.com/gnuboard4/adm/img/ttt/auto_n.php
nanovalley.co.kr/gnuboard4/adm/img/poll/auto_n.php
ouscompany.com/gnuboard4/adm/img/ttt/auto_n.php
pjk.co.kr/gnuboard4/adm/img/poll/auto_n.php
reujin.com/gnuboard4/adm/img/pill/auto_n.php
revolutionenm.com/adm/mail/img/poll/auto_n.php
segangenc.com/gnuboard4/adm/img/pill/auto_n.php
shin-ji.com/gnuboard4/adm/img/ttttt/auto_n.php
simsansc.com/gnuboard4/bbs/adm/img/pill/auto_n.php
sisileae.com/gnuboard4/adm/img/pill/auto_n.php
smartonecnd.co.kr/gnuboard4/adm/img/poll/auto_n.php
soltechkorea.co.kr/adm/img/poll/auto_n.php
soridesignart.com/gnuboard4/adm/img/pill/auto_n.php
ssglnd.com/gnuboard4/adm/img/pill/auto_n.php
stayattwenty.com/gnuboard4/adm/img/pill/auto_n.php
studionewgimmick.com/gnuboard4/adm/mail/img/auto_n.php
sungsimmh.com/gnuboard4/adm/img/pill/auto_n.php
tes30.com/gnuboard4/adm/img/pill/auto_n.php
thevanart.com/gnuboard4/adm/img/pill/auto_n.php
uriveservicecenter.com/gnuboard4/adm/img/ttt/auto_n.php
vkoreaent.com/adm/mail/img/poll/auto_n.php
yunwoo-tech.com/gnuboard4/adm/img/ttt/auto_n.php
zurifilm.com/gnuboard4/adm/img/ttt/auto_n.php
/adm//mail/img/pill/auto_n.php
/adm/img/poll/auto_n.php
/adm/mail/img/poll/auto_n.php
/gnuboard4/adm/img/pill/auto_n.php
/gnuboard4/adm/img/poll/auto_n.php
/gnuboard4/adm/img/ttt/auto_n.php
/gnuboard4/adm/img/ttttt/auto_n.php
/gnuboard4/adm/mail/img/auto_n.php
/gnuboard4/bbs/adm/img/pill/auto_n.php
/gnuboard4/lib/pill/auto_n.php

# Reference: https://twitter.com/lazarusholic/status/1768842172332409052
# Reference: https://mp.weixin.qq.com/s?__biz=MzUyMjk4NzExMA==&mid=2247495843&idx=1&sn=7965885f6dc8503c7fc49b7002816d13&chksm=f9c1c3aaceb64abcf4ee0b127600eed9c4013a3aaa1a7af7fb3d222b9264b365eed9fb475028&scene=178&cur_album_id=1915287066892959748#rd
# Reference: https://www.virustotal.com/gui/file/ec2289a3a53f7979c88d17eb20fed48ba79a9ff7ee448a0dc7c7d2e5a21a2338/detection

http://165.154.230.24
ba-reum.co.kr/adm/status/down/
ba-reum.co.kr/adm/status/down/lib.php
ba-reum.co.kr/adm/status/down/show.php

# Reference: https://www.virustotal.com/gui/ip-address/64.176.228.101/relations

nhwmcis.cloud
account.nhwmcis.cloud
view.nhwmcis.cloud

# Reference: https://www.virustotal.com/gui/ip-address/158.247.201.192/relations

hometaxctrl.online
hometaxsc.site
nidsign.info
nidsigns.info
ntsapp.space
ntscarts.site
ntsctrls.site
ntscustoms.store
ntsgroups.site
ntshelps.site
ntslogin.shop

# Reference: https://www.virustotal.com/gui/ip-address/156.67.74.68/relations

nts-notics.site

# Reference: https://www.virustotal.com/gui/ip-address/145.14.153.49/relations

nts-notice.online
ntshomes.online

# Reference: https://twitter.com/blackorbird/status/1770708478908141762
# Reference: https://asec-ahnlab-com.translate.goog/ko/62117/?_x_tr_sl=auto&_x_tr_tl=en&_x_tr_hl=en&_x_tr_pto=wapp

http://210.16.120.210
fitting-discrete-lemur.ngrok-free.app
real-joey-nicely.ngrok-free.app
minish.wiki.gd

# Reference: https://www.genians.co.kr/blog/threat_intelligence/dropbox

aymdtt.co.kr
dddon.kr
gbionet.com
iso3488.co.kr
regard.co.kr
strehab.com

# Reference: https://www.virustotal.com/gui/ip-address/27.102.118.175/relations

airsbnb.site
custom-center.online
goocgle.site
ntsauth.info
ntsauth.shop
ntsauth.site
ntscheck.info
ntscheck.site
ntslog.cloud
ntsxhome.site
ntsxhome.space
polarisoffice.site
safe-guard.world
saramin.cloud
accountkkcdn.ntsxhome.space
accounts.ntscheck.info
accounts.ntsxhome.space
daumcdnkakao.ntscheck.info
daumcdnkakao.ntsxhome.space
stat_tiarakakao.ntscheck.info
stat_tiarakakao.ntsxhome.space
t1_daumcdnkakao.ntscheck.info
t1_daumcdnkakao.ntsxhome.space
tiarakakao.ntscheck.info
tiarakakao.ntsxhome.space

# Reference: https://www.virustotal.com/gui/ip-address/154.205.138.62/relations

hometaxnews.site
ntsadv.shop
ntsapp.shop
ntshome.shop
ntspage.shop
ntsreview.shop
ntsreview.site
naver.hometaxnews.site
smtp.ntspage.shop

# Reference: https://www.virustotal.com/gui/ip-address/154.90.63.180/relations

hometaxpost.site
ntsactive.store
ntsmail.shop
securemails.site

# Reference: https://www.virustotal.com/gui/ip-address/154.90.63.85/relations

ntsposts.shop
wetax-app.store
wetax-news.store
wetax-post.shop
wetaxnews.store
wetaxpost.site

# Reference: https://www.virustotal.com/gui/ip-address/154.205.138.144/relations

custom-centre.site
hometaxalert.site
nts-mail.shop
ntsactive.shop
ntsemail.shop
ntsmails.shop
ntsposting.shop
ntstax.shop

# Reference: https://twitter.com/Cyberteam008/status/1782322894649045403

centes.info
documentview.site
memberslogin.info
paintboard.icu
rememberesapp.info
taxsevices.online
tradingvievv.website
usermanagers-confirmation.site
userscheck.info
zebracalculator.cloud
cc.ntsoffer.shop
emv1.memberslogin.info
emv1.npscmd.site
emv1.ntsxhome.site
gov.taxsevices.online
lcs.ntsapps.space
lcs.ntsoffer.shop
naver.hometaxctrl.online
naver.ntsapps.space
naver.ntsoffer.shop
naver.ntsoffer.site
oatviemv1.npsnews.website
outlook.memberslogin.info
outlook.usermanagers-confirmation.site
qkbimemv1.npsnews.website

# Reference: https://twitter.com/asdasd13asbz/status/1783715045576421574
# Reference: https://www.virustotal.com/gui/ip-address/152.32.243.152/relations

nabsouer.store
nasaer.online
nasaer.pro
accountsmil.nasaer.pro

# Reference: https://twitter.com/tiresearch1/status/1783772091827048670
# Reference: https://www.virustotal.com/gui/ip-address/154.90.63.167/relations

nts-views.shop
wetax-app.shop
wetax-app.site
wetax-app.space
wetax-news.shop
wetax-news.space
wetaxapp.site
wetaxnews.shop
wetaxnews.space
wetaxpost.shop
wetaxpost.space

# Reference: https://www.virustotal.com/gui/ip-address/84.32.84.32/relations

wetax-app.cloud

# Reference: https://twitter.com/peterkruse/status/1783780154407354370
# Reference: https://www.virustotal.com/gui/ip-address/101.36.114.180/relations

cblmq.space
dretubvcn.cc
gkjoiup.store
gmasalk.store
gnodona.store
gplokio.site
jaasdvc.cc
jsgqkjz.cn
kadaomal.site
npmhxx.top
oknghbvn.cc
zzddwzm.cn

# Reference: https://twitter.com/ValidinLLC/status/1783799879422050349
# Reference: https://twitter.com/ValidinLLC/status/1783802467987144777
# Reference: https://www.virustotal.com/gui/ip-address/154.205.138.216/relations
# Reference: https://www.virustotal.com/gui/ip-address/154.205.138.224/relations
# Reference: https://www.virustotal.com/gui/ip-address/154.90.63.152/relations

credtmail.site
flyasiana.online
koreaair.site
koreaair.store
koreanairs.site
koreansair.shop
koreansky.site
nts-mail.xyz
ntsapps.shop
ntscheck.org
ntsmail.xyz
ntsmailers.site
ntsmailers.space
ntsmailings.shop
ntsmailings.store
rememberapp.info
rememberapp.shop
rememberapp.space
wetaxmailer.shop
wetaxmailer.site
wetaxnote.site
cc.ntsmailings.shop
lcs.ntsmailings.shop
mail.ntsmailings.shop
naver.ntsmailings.shop

# Reference: https://twitter.com/ValidinLLC/status/1785403121323090320
# Reference: https://www.virustotal.com/gui/ip-address/154.205.138.75/relations

koreaair.shop
linkedlri.cloud
nexons.shop
saramin.site
wetax.online
wetax-check.site
wetax-check.space
emv1.koreaair.shop
emv1.linkedlri.cloud
emv1.nexons.shop
lcs.koreaair.shop
naver.koreaair.shop
ww1.wetax.online
ww12.wetax.online
ww7.wetax.online

# Reference: https://twitter.com/ValidinLLC/status/1785405519684923887
# Reference: https://app.validin.com/detail?type=ip&find=91.236.230.63#tab=resolutions
# Reference: https://www.virustotal.com/gui/ip-address/91.236.230.63/relations

home-id.me
indeed-main.info
linkedlri.cloud
linkedlri.info
moneysupersmarket.info
octopurs.energy
revoults.online
tradingsveiw.com
trandingveiws.com

# Reference: https://twitter.com/ValidinLLC/status/1785409099397583043
# Reference: https://www.virustotal.com/gui/ip-address/147.45.116.49/relations
# Reference: https://app.validin.com/detail?type=ip&find=27.255.81.112
# Reference: https://app.validin.com/detail?find=38.181.23.5&type=ip4&ref_id=80fcc8fd69b#tab=resolutions
# Reference: https://www.virustotal.com/gui/ip-address/27.255.81.112/relations

ac.dll.r-e.kr
accountsmil.mysnu.info
alert.wiki
corn.city
daurn.in.net
dll.r-e.kr
dnmil.mysnu.info
dongfan.r-e.kr
erro.live
fbtws.xyz
fc1aax.top
fc1aqw.top
fc1cvc.top
fc1dgc.top
fc1eee.top
fc1hgre.top
fc1hhg.top
fc1wef.top
fc1zs.top
fc1zxl.top
ffx1aax.top
ffx1aqw.top
ffx1cvc.top
ffx1dgc.top
ffx1eee.top
ffx1hgre.top
ffx1hhg.top
ffx1wef.top
ffx1zs.top
ffx1zxl.top
ffx2aax.top
ffx2aqw.top
ffx2cvc.top
ffx2dgc.top
ffx2eee.top
ffx2hgre.top
ffx2hhg.top
ffx2wef.top
ffx2zs.top
ffx2zxl.top
ffx3aax.top
ffx3aqw.top
ffx3cvc.top
ffx3dgc.top
ffx3eee.top
ffx3hgre.top
ffx3hhg.top
ffx3wef.top
ffx3zs.top
ffx3zxl.top
ffx4aax.top
ffx4aqw.top
ffx4cvc.top
ffx4dgc.top
ffx4eee.top
ffx4hgre.top
ffx4hhg.top
ffx4wef.top
ffx4zs.top
ffx4zxl.top
ffx5aax.top
ffx5aqw.top
ffx5cvc.top
ffx5hgre.top
ffx5wef.top
ffx5zs.top
ffxxaax.top
ffxxaqw.top
ffxxcvc.top
ffxxdgc.top
ffxxeee.top
ffxxhgre.top
ffxxhhg.top
ffxxwef.top
ffxxzs.top
ffxxzxl.top
fxxcaax.top
fxxcaqw.top
fxxccvc.top
fxxcdgc.top
fxxceee.top
fxxchgre.top
fxxchhg.top
fxxcwef.top
fxxczs.top
fxxczxl.top
jx3kked.top
jx3mndf.top
rwy5asw.top
rwy5cww.top
rwy5dff.top
rwy5qwf.top
rwy5zxs.top
kgrnail.cloud
kmr.o-r.kr
mail.alert.wiki
mb.newspaper.o-r.kr
md.kmr.o-r.kr
md.notebook.n-e.kr
messge.info
mybox.website
mysnu.info
nabercorp.download
navkatok.eu
nehelp.es
newspaper.o-r.kr
hani.nabercorp.download
nid.navkatok.eu
nislo.life
notebook.n-e.kr
ns1.rwy5dff.top
olpop.store
ps.newspaper.o-r.kr
relogin.pro
sd.kmr.o-r.kr
up-api1-kage.mysnu.info

# Reference: https://twitter.com/cyberwar_15/status/1788723681981776203
# Reference: https://www.genians.co.kr/blog/threat_intelligence/facebook
# Reference: https://www.virustotal.com/gui/file/0edde253fb0ade6700fdeb278b33eeecfd470e4fc72503158854f3a18ee5665a/detection

rapportdown.lol
brandwizer.co.in
makeoversalon.net.in

# Reference: https://twitter.com/blackorbird/status/1790589046663889113
# Reference: https://mp.weixin.qq.com/s/5dYkd9ZpjllHoUK31DywJg

nid.oksite.eu

# Reference: https://x.com/asdasd13asbz/status/1791390914038149339
# Reference: https://www.virustotal.com/gui/ip-address/94.131.120.80/relations
# Reference: https://www.virustotal.com/gui/file/ce97a3e7a8c964a3300ebc940fdbed335c55f008afafc5cfc3f6661b5a5a4446/detection
# Reference: https://www.virustotal.com/gui/file/3314b6ea393e180c20db52448ab6980343bc3ed623f7af91df60189fec637744/detection
# Reference: https://www.virustotal.com/gui/file/24a42a912c6ad98ab3910cb1e031edbdf9ed6f452371d5696006c9cf24319147/detection

uberlingen.com
download.uberlingen.com
dihl-defence.o-r.kr
uberlingen.n-e.kr
viewers.r-e.kr
ecloud.uberlingen.n-e.kr
online.viewers.r-e.kr
share.dihl-defence.o-r.kr

# Reference: https://x.com/MichalKoczwara/status/1792925748568756258

216.189.159.34:443

# Reference: https://www.virustotal.com/gui/ip-address/216.189.159.34/relations

ac0unt.p-e.kr
altool.p-e.kr
app.awiki.org
banditool.kro.kr
etherap.kro.kr
etherlab.kro.kr
lincom.co.kr
melony.n-e.kr
nidnhnlogin.kro.kr
nidnhnv.kro.kr
nvcert.kro.kr
onedriver.n-e.kr
serviceinfo.p-e.kr
slmgr.r-e.kr
telegramer.n-e.kr
yes24service.n-e.kr
app.lincom.co.kr
login.etherap.kro.kr
login.etherlab.kro.kr
m.nidnhnlogin.kro.kr
m.nidnhnv.kro.kr
nid.nhncert.p-e.kr
sign.ac0unt.p-e.kr
sign.nvcert.kro.kr

# Reference: https://thehackernews.com/2024/05/kimsuky-apt-deploying-linux-backdoor.html
# Reference: https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/springtail-kimsuky-backdoor-espionage
# Reference: https://www.virustotal.com/gui/file/30584f13c0a9d0c86562c803de350432d5a0607a06b24481ad4d92cdf7288213/detection

http://216.189.159.34

# Reference: https://x.com/1ZRR4H/status/1793873968471970214
# Reference: https://www.virustotal.com/gui/ip-address/67.217.62.219/relations
# Reference: https://www.virustotal.com/gui/file/cca1705d7a85fe45dce9faec5790d498427b3fa8e546d7d7b57f18a925fdfa5d/detection
# Reference: https://www.virustotal.com/gui/file/5b3cc9cced1ef0cb0bba5549cc2ac09c49ae10554d2409ea16bc5e118d278c15/detection

imagedownload.ignorelist.com
share-defence.uberlingen.com

# Reference: https://asec.ahnlab.com/ko/65918/

http://104.36.229.179
http://38.110.1.69
http://91.228.218.7
103.20.235.113:1433
104.36.229.179:1521
104.36.229.179:53
109.248.151.179:53
45.95.18.100:1433
45.95.18.14:3306
45.95.18.14:53
91.228.218.7:53
aslark.kro.kr
aslark1.kro.kr
devf.n-e.kr
gokr.hopto.org
kelton.myftp.org
kepir.p-e.kr
kevinblog.ddns.net
lazor.kro.kr
lfgu.n-e.kr
luvb.n-b.kr
my.shoping.kro.kr
navver.o-r.kr
shoping.kro.kr
w3.navver.o-r.kr
yah00.o-r.kr

# Reference: https://x.com/Syndikalist/status/1795580218524209537
# Reference: https://app.validin.com/detail?find=%3A%3A%3A%22author%22%3A%22MXMMCCCXLV%22&type=raw&ref_id=61b5fc3677e#tab=host_pairs_v2

alphadex.io
blockworks.one
plutonians.tech
tokenworks.io
wanblibang.com.cn
i.wanblibang.com.cn
labs.plutonians.tech

# Reference: https://x.com/MichalKoczwara/status/1795741150675976207

atlanticacouncil.org.youramys.com
atlanticcouncil.youramys.com
drive.wilsoncenter.0rg.us
drive.wilsoncenter.port0.org
drives.youramys.com
mnlp.quest
naververify.p-e.kr
note.iiiii.info
oso-usps.com
signin-ym.quest
uidlogin.o-r.kr
wilsoncenter.0rg.us
wilsoncenter.port0.org

# Reference: https://github.com/blackorbird/APT_REPORT/blob/master/kimsuky/2024-05-28-kimsuky-webshell.pdf
# Reference: https://www.virustotal.com/gui/ip-address/220.73.161.81/relations

dgms.or.kr
lkh.co.kr/eng/data/ncdos
lkh.co.kr/eng/data/myid.php

# Reference: https://x.com/ginkgo_g/status/1796111368346636743
# Reference: https://www.virustotal.com/gui/file/0538e16bef5fc9f4ab0ed0b370601ae3bc5d184e75d3be678c98e6a60bf533b9/detection
# Reference: https://www.virustotal.com/gui/file/0538e16bef5fc9f4ab0ed0b370601ae3bc5d184e75d3be678c98e6a60bf533b9/detection

orientedworld.com/wp-content/plugins/health-check/pages/gorgon1/

# Reference: https://x.com/k3yp0d/status/1796124876975071247
# Reference: https://www.virustotal.com/gui/file/c1f1ce81115bed45c594aeeb92adb687bb04478cb40bb9dab538277d0c8cc13e/detection

orbotech.info
customer.orbotech.info
ns1.orbotech.info

# Reference: https://x.com/k3yp0d/status/1796125023570141321
# Reference: https://www.virustotal.com/gui/file/cfdc7747b716be5817ce1bc76decfb3e1b27113545a01558ed97ab5fd024c53e/detection

comisioffline.com
visioffline.comisioffline.com

# Reference: https://x.com/k3yp0d/status/1796125289623244963
# Reference: https://www.virustotal.com/gui/file/e5fbaab1270deb86b419abb348f19c2b9afd6e5c2e151c4d0869f6c5d889e029/detection

visioffline.com

# Reference: https://www.virustotal.com/gui/ip-address/154.90.63.7/relations

flyasiane.online
koreanaire.online
nts-check.site
nts-doc.cloud
nts-home.cloud
nts-home.online
nts-korea.cloud
nts-note.cloud
nts-note.site
nts-post.online
ntskorea.cloud
ntskr.site
ntspost.cloud
cc.nts-check.site
cc.nts-home.cloud
cc.ntscheck.org
cc.rememberapp.info
lcs.nts-check.site
lcs.nts-home.cloud
lcs.ntscheck.org
lcs.rememberapp.info
lcs.wetax.online
mail.ntscheck.org
mait.nts-check.site
mait.nts-home.cloud
mait.ntscheck.org
mait.rememberapp.info
mid.ntscheck.org
naver.nts-check.site
naver.nts-home.cloud
naver.ntskorea.cloud
naver.rememberapp.info

# Reference: https://x.com/Cyberteam008/status/1797456640305922243
# Reference: https://x.com/asdasd13asbz/status/1797564135468859613
# Reference: https://www.virustotal.com/gui/file/000e2926f6e094d01c64ff972e958cd38590299e9128a766868088aa273599c7/detection
# Reference: https://www.virustotal.com/gui/file/cca1705d7a85fe45dce9faec5790d498427b3fa8e546d7d7b57f18a925fdfa5d/detection

accounts.login.idm.uberlingen.com
apphelloworld.crabdance.com
download-attachments.mooo.com
en.uberlingen.com
ns1.uberlingen.com
ns3.uberlingen.com
paypal.uberlingen.com
playboys.chickenkiller.com

# Reference: https://x.com/JangPr0/status/1798144205128392774

http://152.32.139.83

# Reference: https://www.virustotal.com/gui/ip-address/141.164.37.141/relations

apideb.site
gmsta.store
lifegoeson.pics
ntskorea.online
ntsmsg.online
uboam.com
apis.lifegoeson.pics
myaccount.lifegoeson.pics

# Reference: https://www.virustotal.com/gui/ip-address/108.181.51.101/relations

fsc-notify.info
kdca.site
kisa-home.site
emv1.kisa-home.site

# Reference: https://www.virustotal.com/gui/ip-address/38.54.88.5/relations
# Reference: https://app.validin.com/detail?find=38.54.88.5&type=ip4&ref_id=37a81bfc5ea#tab=resolutions

custom-team.com
nts-help.cloud
nts-view.cloud
ntsalert.cloud
ntsalerts.cloud
ntsctrl.cloud
ntsctrl.icu
ntsctrls.icu
ntsdoc.icu
ntsdocs.cloud
ntsdocs.online
ntshelp.cloud
ntshelp.icu
ntshelp.online
ntshelps.cloud
ntshome.icu
ntshome.online
ntshomes.icu
ntspost.icu
ntsposts.icu
ntstax.cloud
ntsview.cloud
ntsview.icu
ntsview.online
ntsviews.cloud
cc.ntsalert.cloud
cc.ntsdocs.cloud
emv1.custom-team.com
emv1.nts-view.cloud
emv1.ntsalert.cloud
emv1.ntsdoc.icu
emv1.ntsdocs.cloud
emv1.ntsdocs.online
emv1.ntshelp.icu
emv1.ntsview.icu
lcs.ntsalert.cloud
lcs.ntsdocs.cloud
naver.ntsalert.cloud
naver.ntsdoc.icu
naver.ntsdocs.cloud
naver.ntshome.icu

# Reference: https://www.virustotal.com/gui/ip-address/108.181.51.101/relations

koreansair.cloud
noution.co
ntshome.cloud
ntsmail.cloud
wetaxc.cloud

# Reference: https://x.com/Huntio/status/1827010159597728157
# Reference: https://www.virustotal.com/gui/ip-address/38.60.212.156/relations
# Reference: https://app.validin.com/detail?type=ip&find=38.60.212.156#tab=resolutions

idchecks.online
jma-earthquake.info
kuronekoyamarto.shop
nortions.info
odhistory-shopping.info
paypay-corp.info
rakutean.info
traningviews.com
userschecker.com
usersvalidaition.com

# Reference: https://www.virustotal.com/gui/ip-address/91.236.230.63/relations

linkdlri.site

# Reference: https://x.com/asdasd13asbz/status/1803944724308595090
# Reference: https://www.virustotal.com/gui/file/2c3066d84a1942c8a7d0873d6863e47b73dca05a07283e52e567533447a7afc9/detection
# Reference: https://www.virustotal.com/gui/file/4dfc09bfab1e813c8122d6f8c3d83966346fe676464497ce100e8c385fe5e5f9/detection

image.ionexusa.com

# Reference: https://twitter.com/suyog41/status/1725500179829436655
# Reference: https://twitter.com/suyog41/status/1765277622777307566
# Reference: https://x.com/malwrhunterteam/status/1805282813819699452
# Reference: https://www.virustotal.com/gui/ip-address/47.244.44.175/relations
# Reference: https://www.virustotal.com/gui/ip-address/52.221.191.170/relations
# Reference: https://www.virustotal.com/gui/ip-address/79.133.51.91/relations
# Reference: https://www.virustotal.com/gui/file/4ceb53129adc4783ff5510c7279c655d6451d52353d41b8cedc7873902a0caf6/detection
# Reference: https://www.virustotal.com/gui/file/dd2b2215977ca4822769a16487e4c22b331ac1fb09791cbde6ee98ae72408137/detection
# Reference: https://www.virustotal.com/gui/file/57b7c01f1ce238d2aa37c62d5c09bb35894798bdb3412e7588204838f2705ddb/detection

accounts.hgfdsa.cloudns.cl
accounts.qocqle.cloudns.cl
asgasfe.online
attachnent.online
bnbn.online
bnbnmdownl.tech
cbcbupdownload.tech
cvcv.online
cvcv.tech
datadown1.shop
dcfvgb.space
derftg.space
dfdf.website
dfgrwe.shop
docunemt.online
donwfileupton.fun
downloadfum.shop
downloadmar.online
edcrfv.tech
ertrfvcvb.fun
filenal.cloudns.cl
gdfeud.online
ghjklf.space
goqgoqle.space
hgfdsa.cloudns.cl
hyrfbg.shop
jmujyh.shop
kgisdsjd.online
kijuyh.online
lendborrow.online
loadfiledown.shop
logendownlaod.shop
logginnld.tech
lokiju.space
mangole.space
markumin.shop
mauernid.space
mauri.website
mjhngb.online
mnbmnb.fun
myclean.fun
myhappy.online
naaaver.online
naaverr.space
nadaral.shop
naders.online
naevuer.website
naeyver.shop
namavr.online
nauver.space
navam.online
navav.online
navev.cloudns.cl
navor-cloud.tech
naxxer.space
nbmndonwload.tech
nbnb.online
nbvcxz.online
neuver.online
neyvaer.online
nghjuy.online
nhjmbg.online
nhygvb.space
nhytgb.space
nid.navev.cloudns.cl
njikmh.space
nldlogdowload.tech
nldloggin.online
nldloggin.tech
nldnldlog.shop
nmnm.online
nmnmdown.tech
nnnnaver.online
nocver.online
nsupersend.online
nvavar.shop
nvhfgt.shop
nwenwe.online
oknjiuj.shop
olkimj.online
poiujk.online
qazwsxedc.tech
qocqle.cloudns.cl
qoooglle.space
qwaszx.space
rfvdfgcvb.online
rtgfhy.online
rtrtdown.online
samsungcoard.tech
seural.online
signonsuccess.website
sporiyt.space
tgbhuj.shop
tgbhuy.online
tsetes.online
ujgtyh.online
upblt.tech
utut.online
vbfhgy.online
vbnfhg.space
vbvbdownload.tech
vfhby.online
vjfhan.online
vnbhfg.space
vnvnupload.website
vvfbgnh.online
wsedfr.shop
wsx.filenal.cloudns.cl
wsxedcrfv.fun
xbxbonwer.fun
yghjhy.online
yhnujm.tech
ytytdown.shop
yuyudownload.tech
yuyuinfu.website
yyttiidown.online
zsedcx.shop
zxcasd.fun
zxzx.website
/tlee43/bad/info.php
/tlee43/bad/shake.php
/tlee43/bad/welcome.php
/tlee43/good/common.php
/tlee43/good/redirect.php
/tlee43/bad/
/tlee43/good/

# Reference: https://www.virustotal.com/gui/ip-address/61.97.251.231/relations
# Reference: https://app.validin.com/detail?find=61.97.251.231&type=ip4&ref_id=e9b6d4dff01#tab=resolutions

cloudkr2net.website
etrcompug0nar.online
gccqle.online
gukminhealthkr.fun
klepler0ncoprs.tech
korbklineducat9.tech
korbookgrpsio.website
kordom2userna.website
koredunegukminc.website
maboosk5kstores.site
nalrmkorbooks.online
ncloud2usernet.tech
nedfiuser2enfos.shop
nkedunemunso.tech
nkrcloudguardteam.online
nohauwebse2c.online
normkpbost7nets.website
pnidlibnor2in.tech

# Reference: https://www.virustotal.com/gui/ip-address/31.172.83.193/relations
# Reference: https://app.validin.com/detail?find=31.172.83.193&type=ip4&ref_id=e9b6d4dff01#tab=resolutions

qccggle.online
qcocgle.online

# Reference: https://www.virustotal.com/gui/ip-address/27.255.75.142/relations
# Reference: https://app.validin.com/detail?find=27.255.75.142&type=ip4&ref_id=140fa1f1335#tab=resolutions

gccqqle.shop
qscesz.online
qwoasd.online

# Reference: https://www.virustotal.com/gui/ip-address/27.255.81.118/relations
# Reference: https://app.validin.com/detail?find=27.255.81.118&type=ip4&ref_id=4b8862d4e94#tab=resolutions

aa10pdpaoaiajidjaoaisdf.cfd
aa12aodoiaaa.cfd
aa13diaoaoaa.cfd
aa14daiaoao.cfd
aa17aiaiaia.cfd
aa18aiaoaoa.cfd
aa19doaoaooa.cfd
aa1aiadozieaizoao.cfd
aa20aoaoaoal.cfd
aa2aiaoaoeia.cfd
aa3aiaozooaisodfa.cfd
aa4aoiaopaasdf.cfd
aa5aiaoaozidoasfasdf.cfd
aa6daodaoaioasdf.cfd
aa7aoaopaoaoai.cfd
aa8paoaoaoa.cfd
aa9aiaoaaiasdf.cfd
ariws01zvxjdrsvzedffqi.cfd
ariws02giqfxumjxuoyojs.cfd
ariws03dlercwhswciprbz.cfd
ariws04ciupnrvtmmpleug.cfd
ariws05qvlpfvkicwswhir.cfd
ariws06uvkhbudwtmiskxm.cfd
ariws07tskaxqbldgfboau.cfd
ariws08ulkzkfldvyktpdb.cfd
ariws09eihlbfbkfscjhnd.cfd
ariws10pgbblhmtrdnujlg.cfd
ariws11wujsjiawatdxzfo.cfd
ariws12kfmyhpbtgtndsaw.cfd
ariws13pzfsmcluqludcrq.cfd
ariws14hjbkrurxibvvxqg.cfd
ariws15buvwpdvmziqjzpi.cfd
ariws16uabsjyajcmxklpe.cfd
ariws17kuoodsqmymkufok.cfd
ariws18sadzgpynckifkak.cfd
ariws19zamcgwecynzhyfg.cfd
ariws20kjdcyvhvharvwrh.cfd
ariws21abnhykvrpirubon.cfd
ariws22hyxsqdmdgwjuvnt.cfd
ariws23rgxmjoqjakerxqn.cfd
ariws24wwamnanmzclaenj.cfd
ariws25xmwzpcgsguzsvou.cfd
ariws26fkvxifinsviibjp.cfd
ariws27kiyehrgblkruivh.cfd
ariws28zjrsajxttjebnmo.cfd
ariws29wqaudmoizxvunob.cfd
ariws30edzwovygrcspyvq.cfd
ariws31jmdntppbxxhcrfv.cfd
ariws32ceiiulbglmaahot.cfd
ariws33yowjpcjsfjxrazp.cfd
ariws34biyttxflolzcfcz.cfd
ariws35vyywatidjxzjcdl.cfd
ariws36mclblzorliuypaa.cfd
ariws37fapktteeivlxgtg.cfd
ariws38sdgiwdtcosubwut.cfd
ariws39dohaxbtelmiwnsh.cfd
ariws40uwcurwqmpgidbco.cfd
ariws41zmtumvmcnciafel.cfd
ariws42rejrodigsiwhxqg.cfd
ariws43dlfjrcnnkbiqozi.cfd
ariws44cvdzyjdzaeyciet.cfd
ariws45jowzuxkwkhgebra.cfd
ariws46vymtjprzzwviyio.cfd
ariws47gghitommsmoybwv.cfd
ariws48buydzllhzsiwzcw.cfd
ariws49tkfeualaxabvsoh.cfd
ariws50ccjzkhscsrcfotf.cfd
cdadifjaisdfzczc.cfd
comsysmails.store
gocoqie.online
ko01qityghlwig.cfd
ko02jybsjqlpyn.cfd
ko04trojuznwsm.cfd
ko06eeptqbmfnr.cfd
ko07vacfsdpcoq.cfd
ko08jzwnaoedpm.cfd
ko10qlcxozjrwj.cfd
ko11gkcgqbqoqw.cfd
ko12yexuzzkeso.cfd
ko13xgppzphhim.cfd
ko14bvbgmnfvzd.cfd
ko15cllpujiupe.cfd
ko18vqhzlwhshg.cfd
ko19owzlqmxgus.cfd
ko23qxjacebvfk.cfd
ko24etamedjlqr.cfd
ko25rkpvhuauis.cfd
ko26nalkkgujnt.cfd
ko29xntwgnrcok.cfd
ko30ijxrbfjggj.cfd
ko31frapiemowm.cfd
ko32wvpmnfgroe.cfd
ko33dracnweqdl.cfd
ko35nsirpnrdab.cfd
ko40szhgeshfdo.cfd
ko41njtsjvbkom.cfd
ko42iuktuybape.cfd
ko43giztrpcktk.cfd
ko44hmfsnselmh.cfd
ko46eipmxwonxj.cfd
ko48nkrwzmfmol.cfd
ko49aghyojnkya.cfd
ko51nwjdwelibh.cfd
ko53xcfoyckbis.cfd
ko54hnafuwhfzf.cfd
ko55rexazhdrma.cfd
ko56pkqussapan.cfd
ko58lgfntbrvas.cfd
ko59iaogyiuaaw.cfd
kor01egxkz.cfd
kor02dunte.cfd
kor03jataw.cfd
kor04yzdvd.cfd
kor05yjzeu.cfd
kor06jsqpw.cfd
kor07wrwne.cfd
kor08gwusi.cfd
kor09tcrah.cfd
kor10dxzky.cfd
kor11sszif.cfd
kor12gqpdh.cfd
kor13ungli.cfd
kor14kyvbc.cfd
kor15risls.cfd
kor16wmomj.cfd
kor17zumlp.cfd
kor18dknuw.cfd
kor19diqpv.cfd
kor20qwsef.cfd
kor21fqchu.cfd
kor22qdzky.cfd
kor23xtrky.cfd
kor24snetf.cfd
kor25hggvo.cfd
kor26varwt.cfd
kor27degfw.cfd
kor28dtbhm.cfd
kor29fomjp.cfd
kor30iiqyl.cfd
kor31pkyxq.cfd
kor32ktdqh.cfd
kor33ribih.cfd
kor34ejnkt.cfd
kor35thlgq.cfd
kor36lrypb.cfd
kor37tssyz.cfd
kor38dxfja.cfd
kor39gsoxl.cfd
kor40vgpfg.cfd
kor41cfoyq.cfd
kor42qotfi.cfd
kor43hqrct.cfd
kor44vxglk.cfd
kor45aynqg.cfd
kor46lyilv.cfd
kor47ebgqm.cfd
kor48thfrn.cfd
kor49kkymr.cfd
kor50jeftg.cfd
kor51fochj.cfd
kor52jqczw.cfd
kor53fmvtf.cfd
kor54fmhga.cfd
kor55loxvl.cfd
kor56kekqa.cfd
kor57ejelv.cfd
kor58mkltc.cfd
kor59xsjqw.cfd
kor60pqyck.cfd
kor61owapf.cfd
kor62fgliw.cfd
kor63kdsij.cfd
kor64jymgj.cfd
kor65wrfhw.cfd
kor66ghlvn.cfd
kor67dngai.cfd
kor68motks.cfd
kor69dbcrm.cfd
mz02laebnrqdil.cfd
mz03vjsehtrzae.cfd
mz04cgaqwfwtlx.cfd
mz05asbcdbjpka.cfd
mz06kelmrrmpyd.cfd
mz07szmojwevos.cfd
mz08frapjgnqma.cfd
mz09lgxmbracnq.cfd
mz10zjhrdpnyun.cfd
mz11jffyqffmxq.cfd
mz12zmpdmfjqem.cfd
mz13axibvekakc.cfd
mz14qeddpsisjs.cfd
mz16epnaegduwj.cfd
mz18cvnogwwvok.cfd
mz19krypimesfs.cfd
mz22ptetqijnzt.cfd
mz23rayhevpjwk.cfd
mz24vaaxlyoayq.cfd
mz25yjhthlhoml.cfd
mz26yxcifcrmyy.cfd
mz27vaimurucxb.cfd
mz28mhnrfymryd.cfd
mz31xcmdpujwbj.cfd
mz35nzjuqhwukk.cfd
mz36eiovaujpdk.cfd
mz38lsgkadzole.cfd
mz40vdypwfjcec.cfd
mz41khhehgnqxt.cfd
mz43tltxpmvhmg.cfd
mz45xjtnpixlwe.cfd
mz46rsfxsbifvr.cfd
mz47mkgwpygzzg.cfd
mz49cywkcvpngo.cfd
mz50hxzzkoxsre.cfd
naccountsservice.store
nasdjf.shop
nbjfhg.online
nbvcxz.shop
ncmails.store
ncnetman.store
ncomails.store
ncomonline.store
ncomorgan.store
ncomsec.store
ncomsecury.store
ncomsmal.store
ncomstay.store
ncomsystem.store
ncoremail.store
ncosec.store
ncteams.store
ncustomerservice.store
neeuoer.shop
netcoms.store
netdaily.store
netfray.store
netmails.store
netonlines.store
netsay.store
netsecuremails.store
netsecures.store
netshoot.store
netsmail.store
netsonline.store
nk10aoidoaooze.cfd
nk11aidozud.cfd
nk12aidoaieuq.cfd
nk13aidoaiei.cfd
nk14aoeiqoeia.cfd
nk15aoaieiqoadfa.cfd
nk1aidoqiwoa.cfd
nk2aidoaoeaiz.cfd
nk3aidoqiea.cfd
nk4iaodiqueia.cfd
nk5aieoaieoqiea.cfd
nk6auduaieuq.cfd
nk7aoeiqoqia.cfd
nk8eiqoaidjia.cfd
nk9aoaicyuaoize.cfd
nm01smgjhdstbc.cfd
nm02oaldlkaltw.cfd
nm03otlhirkjyk.cfd
nm04fdqkqfoisx.cfd
nm05lxekvcezyd.cfd
nm06htbqwvjzbe.cfd
nm07upuqvjbzui.cfd
nm08xyfuxejgpi.cfd
nm09eqbpddgdkm.cfd
nm10tsmdqnusnt.cfd
nm11jnvczetugz.cfd
nm12lgrobcqjtv.cfd
nm13csgopffsqy.cfd
nm15izojzirfra.cfd
nm16ngrefwqqnk.cfd
nm17flcsifqlpv.cfd
nm18wpdyadmihy.cfd
nm19cveemhthlg.cfd
nm20lcjfqfsior.cfd
nm21hswykgacuf.cfd
nm22jznrsfpzqn.cfd
nm24hcdllclerk.cfd
nm25tzowdnkooq.cfd
nm26qvvtkarnpx.cfd
nm28sgrwrfowpi.cfd
nm29kyahmrdeyd.cfd
nm30eyeklqiiut.cfd
nm31rizlkwqlyi.cfd
nm32kvowhgnhln.cfd
nm33tvccqxhcdx.cfd
nm34mxsakppgsm.cfd
nm35mcbmsaelkb.cfd
nm36yjhxwvedon.cfd
nm37pefkonwehe.cfd
nm38hrpdgnjbwl.cfd
nm39zwjakqatvw.cfd
nm40zzbyragwhi.cfd
nm41ordbvdfgzo.cfd
nm42jumxllebxu.cfd
nm43vyihguzlbg.cfd
nm44dtrmdoqmkz.cfd
nm45xdyizhdgsp.cfd
nm46vbulyzvdmx.cfd
nm47puvgnjfnby.cfd
nm48zilqjymzyt.cfd
nm49ybrhrlwfbu.cfd
nm50ehfkarwclr.cfd
nm51micvyomaas.cfd
nm52zwgwyfzeyc.cfd
nm54bnfsusgxky.cfd
nm55qippqtwybl.cfd
nm56ofqsrkhfnd.cfd
nm57dhyolfqtbg.cfd
nm58cbhdvpytjs.cfd
nm59vpttusqvtp.cfd
nm60ofssyzxvam.cfd
nm61dssbibjiwe.cfd
nm62nintyiqxmy.cfd
nm63bfmwlsbcyp.cfd
nm65zwbnoctxwk.cfd
nm66zctslerrex.cfd
nm67iwsqkzwmpp.cfd
nm68rjilxbcfgw.cfd
nm69hqkzgkgmtl.cfd
nm70ujgorztewl.cfd
nmailday.store
nmailers.store
nmailhostsecurity.store
nmailhostserver.store
nmailhostservice.store
nmailonlinecomhost.store
nmailonlineserverhost.store
nmailorg.store
nmailsecure.store
nmailserveronlinehost.store
nmailserveronlinehostcom.store
nmailserveronlinehosting.store
nmailseureteam.store
nmailsorig.store
nmailsupport.store
nmailteam.store
nmailweb.store
nmanagers.store
nnoticemail.store
nonlinesupport.store
ns10daiaodasfjie.cfd
ns11aieoakz.cfd
ns12idozoialz.cfd
ns13zidozldiaoer.cfd
ns14aidozalzia.cfd
ns15aoaozidioa.cfd
ns16aizodoiao.cfd
ns17aidoaozid.cfd
ns18aiodzodia.cfd
ns19aoapzoa.cfd
ns1aieoqoweiruioqwueasdoif.cfd
ns20aidozlia.cfd
ns2aiaoeiqoeiasodfjzclao.cfd
ns3aidoemkazoeoa.cfd
ns4dioaieapzpodoaer.cfd
ns5dizozodifuiaoisdfa.cfd
ns6aoepqoerpoaskosdf.cfd
ns7ajiaisodier.cfd
ns8doapeopqkopkeaer.cfd
ns9diaoeia.cfd
nsecmail.store
nsecman.store
nseconlines.store
nsecurely.store
nsecuremail.store
nsecureman.store
nsecures.store
nsecuresupport.store
nsecwebman.store
nsemail.store
nsmailer.store
nsonlines.store
nsteam.store
nsteamanger.store
nvcenter.store
nvcom.store
nvcomanager.store
nvcomaner.store
nvmail.store
nvmails.store
nvmanager.store
nvsays.store
nvschain.store
nvscom.store
nvsecmail.store
nvsecteam.store
nvsecure.store
nvsigned.store
nvsigner.store
nvsmailnet.store
nvsmails.store
nvsmailsnet.store
nvsmailteam.store
nvsmanage.store
nvsonlines.store
nvsonlinesec.store
nvteam.store
nvteamager.store
nvteamer.store
nvvxxer.online
op02pidpaqahru.cfd
op03aqldxpgpyw.cfd
op04kelwnhpjzn.cfd
op05vysgiinztz.cfd
op06akfgqadvwk.cfd
op08ofovsbxrgx.cfd
ourcalendarupdate.cfd
qcxqocle.online
qoocqlle.online
qsdifgle.online
quugule.online
securityonsupport.store
wons01hezzpccnislznqz.cfd
wons02ffbrgaxulkoqzvm.cfd
wons03lyjogycxouwmuec.cfd
wons04ciyslfofhklxfor.cfd
wons05xfqatsjvhwchxdk.cfd
wons06zsxfguzxztxcreb.cfd
wons07kkpzgtabwwsjeru.cfd
wons08glvivipryhvmcrg.cfd
wons09sfcsrbdmshsuzus.cfd
wons10tedhbwdjuxmkojm.cfd
wons11mobxbsfxndfxcba.cfd
wons12aodenvcftaltrad.cfd
wons13mmkovrtfuchxkas.cfd
wons14jgbjgyvhqbifgaq.cfd
wons15cdnhdirntfegghq.cfd
wons16fsfpjbkirpncuwq.cfd
wons17rofbierzqfnqmal.cfd
wons18rlggdgeqnineihb.cfd
wons19riisybjyliadrzc.cfd
wons20adqzvgjyttorksp.cfd
wons21yiwipewhbokivhs.cfd
wons22kyrtnalquvnocwp.cfd
wons23gkytchpvyvhorjg.cfd
wons24cvdvycuiaokmhcs.cfd
wons25oybyhqajnbhnutg.cfd
wons26giyraqhqibenkoq.cfd
wons27hnaamwsdzhbvavc.cfd
wons28wgpbtnwfnysjczu.cfd
wons29bautopribwdsqkg.cfd
wons30rugavoilbfpgaiu.cfd
wons31avwadxfwfuodqmi.cfd
wons32cssfyrzmbnvxzai.cfd
wons33vdynupwabkqhiso.cfd
wons34jkgdhotltsjhury.cfd
wons35vcentaelvnemjdg.cfd
wons36ahnufsoprdmiocc.cfd
wons37plyotjchbszxjdn.cfd
wons38weuhgopwrohobaz.cfd
wons39lcvcjgyolzkjlqr.cfd
wons40shhjgashawiwmra.cfd
wons41pmisibdadylijft.cfd
wons42bsptbzpwreegfyp.cfd
wons43tikhdojbjzsgjqp.cfd
wons44gzgypxyumdbtbcl.cfd
wons45xtzpxsfsiixmwio.cfd
wons46riitffqnentdren.cfd
wons47xriaacgjfphixiv.cfd
wons48twhqqplegzqsabo.cfd
wons49qoqimyyjtcfvlra.cfd
wons50ijquqwnlvjkdhql.cfd
ccsol.nmailonlineserverhost.store
lcssol.nmailonlineserverhost.store
nidsim.nmailserveronlinehosting.store
nidsol.nmailonlineserverhost.store
sslsol.nmailonlineserverhost.store
staticnidsol.nmailonlineserverhost.store
wwwsim.nmailserveronlinehosting.store

# Reference: https://x.com/Cyberteam008/status/1805796115196883025

ahxsrbbs.ondepedalar.com
askuser.o-r.kr
askuser.p-e.kr
attach.cbu.net
authsecond.diskedge.o-r.kr
auththird.diskedge.n-e.kr
bigfile.pkzz.org
contactus.kstar.us
daumalert.r-e.kr
discus.p-e.kr
diskedge.o-r.kr
fontstore.ix.tc
gmx.networkguru.com
id.ionexusa.com
imageproxy.p-e.kr
informat.mylogin.p-e.kr
interception.computersforpeace.net
joien.iiiii.info
linkdein.linkin.tw
linkedin.hs.vc
linkedin.ix.tc
linkedin.r-e.kr
logins.microacces.ro
logo.imageproxy.p-e.kr
mast.csproject.org
microacces.ro
mylogin.p-e.kr
n-drive.o-r.kr
nasa.home.kg
natemall.farted.net
naver.company.09614082-c6ef-4ddd-9ebd-f25cf423492f.suporte.n-e.kr
neimat.r-e.kr
nid.naver.company.09614082-c6ef-4ddd-9ebd-f25cf423492f.suporte.n-e.kr
nkfkbwebdisk.corisco.ind.br
nosparn.askuser.o-r.kr
nosparn.askuser.p-e.kr
pkzz.org
ssoverify.discus.p-e.kr
steam.soon.it
suporte.n-e.kr
veradom.p-e.kr

# Reference: https://x.com/asdasd13asbz/status/1806561339604877609
# Reference: https://www.virustotal.com/gui/file/4f9ef9f4b90d8e0928a36369e90d912b1f4a3b5afc173cddecb1790aa06cdc74/detection

komico.or.kr
market.gumi.go.kr
airgreensystem.com/DB_command/gallery/bbs_list.php
/DB_command/gallery/bbs_list.php
/eng/sub3/index8.asp
/m/sub1/sub5.asp

# Reference: https://www.zscaler.com/blogs/security-research/kimsuky-deploys-translatext-target-south-korean-academia
# Reference: https://www.virustotal.com/gui/file/d78e83f97f400660ec157fbcfb5a98e2514ff6ca6a5a20edd651dcaada469b02/detection

jinakoa.000webhostapp.com
ney.r-e.kr
onewithshare.blogspot.com
sdfa.liveblog365.com
webman.w3school.cloudns.nz

# Reference: https://x.com/asdasd13asbz/status/1808047304714473623

evangelia.edu/img/503/outlook/1outlook
evangelia.edu/img/503/outlook/2outlook

# Reference: https://www.virustotal.com/gui/ip-address/104.194.152.22/relations
# Reference: https://www.virustotal.com/gui/file/557a99a746bb1d89189f6c12fe5fb756f17e2778523dd2e6521781bcc159ff6e/detection

104.194.152.22:7744
cctestname.cfd
freeserver.buzz
goverteamsol.shop
kyzservice.cfd
luzin.site
mstallsys.shop
nservercom.store
pannaservice.cfd
pbakaservice.cfd
pgfox.online
pkakaservice.cfd
pkikatona.cfd
pkikiservice.cfd
pkingtiger.cfd
pkokakoku.cfd
pkolaservice.cfd
psonaservice.cfd
ptitanoa.cfd
repairservice.store
sajadzebel.online
sycnoiewe.shop
syncallinfo.site
teamgover.shop
wasday.online
weoinsdsoia.shop
wiausbe.shop
wolfcalender.cfd

# Reference: https://x.com/JangPr0/status/1810167039627346003
# Reference: https://www.virustotal.com/gui/file/78eeed270b399bc426ca67b22bf89e5e41d3abb7403a0a1dfa966fac627ca8b0/detection

asdofji.ev
cnb39.com
32984.cnb39.com
asdlfkj.asdofji.ev

# Reference: https://x.com/ValidinLLC/status/1810255376991879575
# Reference: https://www.virustotal.com/gui/ip-address/154.90.62.237/relations
# Reference: https://app.validin.com/detail?type=ip&find=154.90.62.237#tab=resolutions

koreagov24.site
myboxapp.site
ntsapp.cloud
ntsflag.site
ntsform.site
ntslook.site
ntsnotice.online
ntstool.site
ntswide.site
polarisoffice.store
wetaxapp.cloud
wetaxapp.online
wetaxapp.website
lcs.ntsflag.site
naver.ntsflag.site

# Reference: https://www.virustotal.com/gui/ip-address/77.37.34.164/relations
# Reference: https://app.validin.com/detail?find=77.37.34.164&type=ip4&ref_id=e34c346a9be#tab=resolutions

benhammourugs.shop
bestpils.shop
egleoho.online
elitewagers.site
engavomusic.online
flyasiane.cloud
fourterealty.site
gpt-wizard.site
kitchensecrets.online
koreaairs.cloud
miniplantestudio.shop
miniplantestudio.site
moviemoxie.online
ntsalert.online
ntsapp.online
ntsbill.site
ntscom.site
ntsdoc.cloud
ntsdoc.online
ntshosts.site
ntsmsg.cloud
ntsobj.site
ntsoffice.site
ntspay.site
ntsposts.site
ntspro.cloud
ntsref.site
ntsreport.cloud
ntsreport.site
ntsshare.cloud
ntssign.cloud
ntssys.site
ntsteam.cloud
ntstxt.site
ntsuser.cloud
ntsview.shop
ntsweb.cloud
pirie.site
rememberapp.tech
rememberapps.cloud
rememberapps.website
repossessedrides.online
romaninorocosi.online
toptierwager.site
traveliland.site
zipfiledwload.cloud

# Reference: https://x.com/ValidinLLC/status/1810257217091727697
# Reference: https://www.virustotal.com/gui/ip-address/154.90.63.162/relations
# Reference: https://app.validin.com/detail?type=ip&find=154.90.63.162#tab=resolutions

assembly-kr.site
basescan.website
dmcut.xyz
dongwon-mil.site
eeuzt.xyz
epeople-kr.site
goocgles.site
kmbxt.icu
kr-gov24.site
main-alarm.space
mois-gov.site
nice-creclit.website
nicecreclit.site
nonqt.icu
nts-alarms.icu
nts-alarms.online
nts-alarms.space
nts-alarms.store
nts-alerts.space
nts-alerts.store
nts-center.icu
nts-center.space
nts-doc.cfd
nts-doc.cyou
nts-doc.fun
nts-doc.sbs
nts-doc.site
nts-doc.space
nts-doc.store
nts-doc.uno
nts-doc.website
nts-docs.cfd
nts-docs.icu
nts-docs.site
nts-docs.space
nts-docs.store
nts-docs.website
nts-guide.icu
nts-guide.space
nts-guide.website
nts-guides.icu
nts-guides.space
nts-guides.store
nts-guides.website
nts-letter.cfd
nts-letter.cyou
nts-letter.fun
nts-letter.sbs
nts-letter.site
nts-letter.space
nts-letter.uno
nts-letter.website
nts-msgs.icu
nts-msgs.site
nts-msgs.space
nts-msgs.store
nts-msgs.website
nts-news.cfd
nts-news.cyou
nts-news.fun
nts-news.sbs
nts-news.uno
nts-notifier.icu
nts-notifier.online
nts-notifier.site
nts-notifier.store
nts-notifying.icu
nts-notifying.site
nts-notifying.space
nts-notifying.store
ntsdoc.site
ntsdoc.space
ntsdoc.store
ntsdoc.website
ntsguide.online
ntsguide.site
ntsguide.store
ntsguide.website
ntsmsgs.icu
ntsmsgs.online
ntsmsgs.site
ntsmsgs.website
ntsnews.icu
ntsnews.online
open-ai.website
ppjht.icu
qooqlesec.site
userscheck.site
wetaxalimi.icu
wetaxalimi.space
wndtt.icu
zxfyx.top
autodiscover.ntsnews.online
cdn-0.ntsnews.online
cpanel.ntsnews.online
cpcalendars.ntsnews.online
cpcontacts.ntsnews.online
ecpufitl.open-ai.website
emv1.nicecreclit.site
emv1.ntsapps.site
emv1.ntsapps.store
emv1.open-ai.website
ezmail.ntsnews.online
mail.ntsnews.online
uqslmwpq.open-ai.website
webdisk.ntsnews.online
webmail.ntsnews.online

# Reference: https://x.com/malwrhunterteam/status/1808148631972618263
# Reference: https://www.virustotal.com/gui/file/9c9df2d90602c915005811aabf444653f55024080c61845029f75da758b27320/detection
# Reference: https://www.virustotal.com/gui/file/ee439dbabe7301bdf9d9dfdf01d2c790ab8d8758f05732bb798eb24b2d5054f6/detection
# Reference: https://www.virustotal.com/gui/file/f3a3ee7f757f819ae1ae7fcca8a9d1ad41f2de61328c887c8214651e14ac7777/detection

79.133.56.173:6527

# Reference: https://x.com/byrne_emmy12099/status/1810587547237531827
# Reference: https://www.virustotal.com/gui/file/a100d0e1e83078249a91cca57eaa3f61726a33b3389c3b3b44b2607ec5dfef4b/detection
# Reference: https://www.virustotal.com/gui/file/3f059dae6c24232c16f2ca1af51a1f36413e1a9e8db52976e9f59960417a0564/detection
# Reference: https://www.virustotal.com/gui/file/d2aadc2c69cea62fa451744b5d7d718dcb277b70832424e0c14642c3d5900451/detection

79.133.56.173:6626
79.133.56.173:7003

# Reference: https://www.virustotal.com/gui/file/d8a926f81a900fa9ebf6e1ac0a6e18ba86786ce3dbf812b857bc7dac5667149e/detection

79.133.56.173:5667

# Reference: https://app.validin.com/detail?type=ip&find=79.133.56.173#tab=resolutions

moncieutheeracg.site
nodesferghiwuchpaq.icu
ostruvqopkmlvmxnk.website
projevduwykamc.website
quoticnstyeycvbs.icu
rostranfeiucyghdaf.store

# Reference: https://x.com/Cyberteam008/status/1833694571257278836
# Reference: https://app.validin.com/detail?find=74.50.94.47&type=ip4&ref_id=0a8ef7e1a8d#tab=resolutions

billingserver.online
bindmailsvr.website
cnu-ac.website
coliov.shop
hestianw.online
ierosc.shop
iosua.online
jipyong.site
nidcrop.online
nsso-snu.icu
oiuvolc.online
olsiop.shop
omlinel.shop
onlinenavecosp.site
opentickcorp.icu
oyesc.store
siteofnidcosp.online
smartmailbox.online
softmailneed.site
zukaivaris.click
/asdqe1312sadgasdasbasdsaxsa.rar

# Reference: https://x.com/JangPr0/status/1790925168250118180
# Reference: https://www.virustotal.com/gui/file/21900e37d1184093e2333fe7931a8a5c217aa5fd24cfd7650bc6fadbb31f7d8a/detection

glonalcnielmxc.mywebcommunity.org

# Reference: https://x.com/OpenSecCopilot/status/1811599790427505107
# Reference: https://secai.ai/share?threadId=3f2eb0a3650d4b96878980dd1e9a719b

mail-service.r-e.kr
http-cdoc.mail-service.r-e.kr
http-ndoc.mail-service.r-e.kr
https-cdoc.mail-service.r-e.kr
https-ndoc.mail-service.r-e.kr

# Reference: https://x.com/byrne_emmy12099/status/1811752604046864477
# Reference: https://www.virustotal.com/gui/file/4dcf742b02386c7ed4a2b4582de9bf3f073ef3b92ce6b668e66c504af78a202d/detection

com-coffee.click
smart.com-coffee.click

# Reference: https://x.com/suyog41/status/1813473634519810525
# Reference: https://www.virustotal.com/gui/file/ee088f55e7cbc5d797c5b030f880b96708d86103e60d2e89fbc6b8bf2cdf6130/detection
# Reference: https://www.virustotal.com/gui/file/d79f4ac802c50c40ecdba1aa505ed08e489524d23f7e30cce8599dbf9fcbf520/detection
# Reference: https://www.virustotal.com/gui/file/57ebd0e955497c34ade52f5313305a287a101330f2dbc5808afbf73a829fba64/detection
# Reference: https://www.virustotal.com/gui/file/5214b558c6596c9e9df91c6c0b018bf61970138acb4f9b837e5d25879195cd49/detection

koreaillmin.mypressonline.com

# Reference: https://www.virustotal.com/gui/ip-address/158.247.215.12/relations
# Reference: https://app.validin.com/detail?find=158.247.215.12&type=ip4&ref_id=7e3725cc29c#tab=resolutions

accounts.google-policy.com
accounts.goolqe.com
apis.google-policy.com
apis.goolqe.com
ccnspv.live
content.google-policy.com
content.goolqe.com
drive.goolqe.com
eceenc.cloud
edocs.fnsc-kr.online
edocs.ncc-fs.online
eicslkea.click
eisdfe.space
emsta.xyz
enternhisserver.store
eomnsvc.online
eucids.online
file.goolqe.com
fnsc-kr.online
fnsc-law.art
fnsc-online.site
fssc-edocs.site
fssc-kr.online
fssc-kr.site
fsscloud.store
google-policy.com
goolqe.com
hostingnhisserver.store
hostnhiserver.store
jnhl.online
jnhl.work
myaccount.google-policy.com
myaccount.goolqe.com
ncc-fs.online
ndocs.lat
ndocs.xyz
netnv.site
new.goolqe.com
nvcees.xyz
play.google-policy.com
play.goolqe.com
s1.goolqe.com
sadoces.site
scnvv.store
secns.info
security.google-policy.com
ssl.google-policy.com
ssl.goolqe.com
staticfonts.goolqe.com
staticgoolqe.com
ueicxws.site
verify.security.google-policy.com
view.fscsies.info
viewer.secns.info
visit01aaacwerh2.cfd
visit02aaak3en3r.cfd
visit03aaagh1x8l.cfd
visit04aaaymgzrh.cfd
visit05aaahjwydg.cfd
visit06aaao0bctc.cfd
visit07aaaplouuo.cfd
visit08aaaryy0la.cfd
visit09aaaphotmr.cfd
visit100aaacaoem9.cfd
visit10aaatffptl.cfd
visit11aaaag4dlf.cfd
visit12aaaxej4to.cfd
visit13aaaypgr3v.cfd
visit14aaatmlbkp.cfd
visit15aaaktl6gj.cfd
visit16aaawnicfw.cfd
visit17aaasuiztb.cfd
visit18aaafvqi7t.cfd
visit19aaagxvyhu.cfd
visit20aaaqvbahz.cfd
visit21aaaldpslh.cfd
visit22aaalq0vfo.cfd
visit23aaabat1nt.cfd
visit24aaayfl10e.cfd
visit25aaarg8uqn.cfd
visit26aaaaufw7j.cfd
visit27aaagg9hvv.cfd
visit28aaaohetoz.cfd
visit29aaapv9osa.cfd
visit30aaanosub3.cfd
visit31aaavqkdtm.cfd
visit32aaasf1nsg.cfd
visit33aaagxtyiw.cfd
visit34aaaethwsq.cfd
visit35aaaavwfbn.cfd
visit36aaalryakp.cfd
visit37aaaiivng3.cfd
visit38aaaw3wkqs.cfd
visit39aaarazebr.cfd
visit40aaakn1z54.cfd
visit41aaadknfmd.cfd
visit42aaa0payiz.cfd
visit43aaas1sj7t.cfd
visit44aaa4rcrp8.cfd
visit45aaaacjkbm.cfd
visit46aaaizsdup.cfd
visit47aaakflcwp.cfd
visit48aaajf0c1u.cfd
visit49aaacd2hqr.cfd
visit50aaangfq85.cfd
visit51aaazskcyr.cfd
visit52aaajakcyd.cfd
visit53aaaulq8ii.cfd
visit54aaavass9k.cfd
visit55aaao8wuin.cfd
visit56aaa2hpzi1.cfd
visit57aaadvqh07.cfd
visit58aaa7waklt.cfd
visit59aaa8alp7y.cfd
visit60aaarh3qpe.cfd
visit61aaa6gzoc5.cfd
visit62aaa1ubcet.cfd
visit63aaa12crag.cfd
visit64aaazgbqd5.cfd
visit65aaabuccur.cfd
visit66aaahynvbu.cfd
visit67aaa3wfp8j.cfd
visit68aaamy8ycn.cfd
visit69aaahwmdbc.cfd
visit70aaaqbs5rm.cfd
visit71aaab2rz1r.cfd
visit72aaaoim7m4.cfd
visit73aaa7ozeqc.cfd
visit74aaajrs6tn.cfd
visit75aaarwxnqb.cfd
visit76aaal9bu0p.cfd
visit77aaa64mejo.cfd
visit78aaakmoqma.cfd
visit79aaankyzbh.cfd
visit80aaaiknssm.cfd
visit81aaa83zsre.cfd
visit82aaajpxmz3.cfd
visit83aaappvyxa.cfd
visit84aaakgkgnk.cfd
visit85aaah3qwuz.cfd
visit86aaak6agzx.cfd
visit87aaajcq0m7.cfd
visit88aaaclf7it.cfd
visit89aaagy9qqc.cfd
visit90aaarhd6tg.cfd
visit91aaaet2wny.cfd
visit92aaabhgff7.cfd
visit93aaa17yfff.cfd
visit94aaa3hmglv.cfd
visit95aaawdsrmx.cfd
visit96aaaviflem.cfd
visit97aaazzgesl.cfd
visit98aaa27zlor.cfd
visit99aaapv9pqq.cfd
wesdeas.hair
youtube.google-policy.com
youtube.goolqe.com

# Reference: https://x.com/lazarusholic/status/1815363714075500879
# Reference: https://wezard4u.tistory.com/429236
# Reference: https://www.virustotal.com/gui/ip-address/152.32.243.136/relations

audko.store
avist.store
nlsie.store
nusiu.live
osihi.store
simos.online
sorsi.online
wodods.online
wodods.xyz

# Reference: https://x.com/r3dbU7z/status/1816075984283566588
# Reference: https://x.com/byrne_emmy12099/status/1816096332718956698
# Reference: https://www.virustotal.com/gui/ip-address/193.149.185.36/relations
# Reference: https://www.virustotal.com/gui/file/950e19f9e804db0b246a36fa01ef7cbc30c72168392ecac9a391756ca634d807/detection

downloadha.online
smartcert.store
templatehub.shop
veridrvs.host
wuyouhe.shop
ms.veridrvs.host

# Reference: https://www.virustotal.com/gui/ip-address/141.164.48.124/relations

accountlive.store
crack-download.store
kakacentre.com
misakass.top
narercorp.space
naveclip.com
navemid.host
navemlive.store
naverbox.com
navesdrv.site
navmails.com
ncvcrlive.store
nibcent.com
nidcenter.com
nilcrap.com
onclouds.host
themesdrv.site
docs.naverbox.com
naverclouds.cckr.store
nid.accountlive.store
nid.narercorp.space
nid.navemid.host
nid.navemlive.store
nid.navesdrv.site
nid.ncrop.org
nid.ncvcrlive.store
nid.nidcenter.com
nid.onclouds.host
nid.themesdrv.site
nid.veridrvs.host
store.navemid.host

# Reference: https://x.com/StrikeReadyLabs/status/1816091548838138125
# Reference: https://www.virustotal.com/gui/ip-address/77.73.69.166/relations
# Reference: https://www.virustotal.com/gui/file/36db29fbdf98b123fcbdcbd93c0bfc7f5b1cd80cf8357ddc1c92fafb26f55560/detection

1oqinservice.serviinform.kro.kr
717studio.n-e.kr
acccoount.qooqle.kro.kr
afcafe.kro.kr
attacch.bigfiile-down.r-e.kr
autoeupdate.p-e.kr
bigfiie-downserver.kro.kr
bigfiile-down.r-e.kr
bigfile-serverdown.kro.kr
bing.seamon.kro.kr
bnbnnkh.n-e.kr
boxapp-downfilesss.n-e.kr
cafent-signatere.kro.kr
certificateapp.n-e.kr
certify.n-e.kr
certify.pay-goole.p-e.kr
certifynvapp.n-e.kr
cetify-information.n-e.kr
check.autoeupdate.p-e.kr
check.certify.n-e.kr
cloud-boxserver.kro.kr
cloud-serverfile.n-e.kr
cloudbox-file.kro.kr
cnauafild.p-e.kr
device.home.kg
down-boxfile.n-e.kr
down-myboxappfile.kro.kr
down-myboxappfile.n-e.kr
down-myboxappfile.p-e.kr
drive-certifycafe.n-e.kr
eo-m-health.kro.kr
file-cloudbox.kro.kr
file-drive.kro.kr
file-saver.n-e.kr
filecloud-saver.n-e.kr
filecloud.n-e.kr
gigimode.fin-tech.com
hongguk.n-e.kr
inform.certificateapp.n-e.kr
informalservice.kro.kr
informsecurrity.n-e.kr
inservicesinform.kro.kr
kftcpg.n-e.kr
loggin-grnaiil.n-e.kr
loqin.nhgigi.crabdance.com
loqinfoservicce.n-e.kr
loqinseviceeinfo.kro.kr
loqinseviceeinform.kro.kr
loqonservice.kro.kr
m.nhnsignaturer.kro.kr
m.nidnhnsign.serverpit.com
mackocacola.n-e.kr
mobil-signn.kro.kr
nhgigi.crabdance.com
nhnlogin.minecraftnoob.com
nhnsignaturer.kro.kr
nid.nhnlogin.minecraftnoob.com
nidln.loqonservice.kro.kr
nidnhnsign.serverpit.com
nld.loqinfoservicce.n-e.kr
nld.loqinseviceeinfo.kro.kr
nld.loqinseviceeinform.kro.kr
nllid1n.siggigiloqinserve.kro.kr
nmodelogging.69.mu
nrnail.cnauafild.p-e.kr
nsign.gigimode.fin-tech.com
pay-goole.p-e.kr
pmlroma.kro.kr
qooqle.kro.kr
saver-cloud.n-e.kr
seamon.kro.kr
server-filedown.n-e.kr
servicesdownnfile.p-e.kr
serviinform.kro.kr
siggigiloqinserve.kro.kr
siggn-sys.n-e.kr
sign-cetifyinform.n-e.kr
sign-secuicentry.n-e.kr
sign.nmodelogging.69.mu
signcaffe.n-e.kr
signin.certifynvapp.n-e.kr
signin.informsecurrity.n-e.kr
siqnin.inservicesinform.kro.kr
siqnln.informalservice.kro.kr
sktving.kro.kr
sktybmupdate.kro.kr
sleman.ultimit.kro.kr
tripcom.n-e.kr
ultimit.kro.kr
update.farted.net
update.mine.bz
update.punked.us
update.sktving.kro.kr
veraport.n-e.kr
verynat-cetify.n-e.kr
wslideae.kro.kr
yourphoneapp.kro.kr

# Reference: https://x.com/byrne_emmy12099/status/1816477711877202366
# Reference: https://app.validin.com/detail?type=ip&find=103.172.79.128#tab=resolutions
# Reference: https://app.validin.com/detail?type=ip&find=152.32.139.79#tab=resolutions
# Reference: https://app.validin.com/detail?find=152.32.243.208&type=ip4&ref_id=770ddaf193d#tab=resolutions
# Reference: https://www.virustotal.com/gui/file/7c52f371547f58c42eb322c2f77cad4cf5c3de2f2365daa88939f37748c5cb02/detection

ltmlc.fun
mopuiasxzc.top
nahsopyer.site
napana.online
napana.store
nersde.store
nmsdoper.store
noliper.store

# Reference: https://x.com/malwrhunterteam/status/1816524339514343446
# Reference: https://www.virustotal.com/gui/file/96e32ff5d24ed023c55e00556cedaada45db32f94229cf9d33f55a2886ac0c69/detection

apollo-blue7.kro.kr
nid.apollo-blue7.kro.kr

# Reference: https://www.virustotal.com/gui/ip-address/152.32.138.167/relations
# Reference: https://www.virustotal.com/gui/file/a173a425d17b6f2362eca3c8ea4de9860b52faba414bbb22162895641dda0dc2/detection

apollo-page.kro.kr
apollo-page.n-e.kr
apollo-page.r-e.kr
apollo-star7.kro.kr
mois-viewer.o-r.kr
viewer-server.p-e.kr
090.apollo-page.kro.kr
123.apollo-page.n-e.kr
mail.apollo-page.r-e.kr
ndilogin.apollo-page.r-e.kr
nidlogin.apollo-page.r-e.kr
vic.apollo-star7.kro.kr

# Reference: https://www.virustotal.com/gui/ip-address/118.193.69.97/relations

hogmasil.lol
nadaser.store
namecope.online
nsmoll.store
skq.asia

# Reference: https://www.virustotal.com/gui/ip-address/152.32.139.48/relations

doithe.top
kortiosdfp.lol
nakosd.store
sdoprio.lol
siu.homes
toplopsdfj.lol
api.doithe.top

# Reference: https://www.virustotal.com/gui/ip-address/118.194.248.172/relations

nahsuio.store
accountsmil.nahsuio.store

# Reference: https://www.virustotal.com/gui/ip-address/152.32.243.49/relations

kinfguve.cc
nadfoi.store
sfjhgikjei.cc
zxcdsav.cc

# Reference: https://x.com/byrne_emmy12099/status/1817798187236950221
# Reference: https://www.virustotal.com/gui/ip-address/104.194.154.71/relations

gobro.space
download.gobro.space

# Reference: https://x.com/byrne_emmy12099/status/1818113597677223969
# Reference: https://www.virustotal.com/gui/file/6ff5ae0860290f57862f8918e0509c27649ac381ee70a5cb20d6416ec07b4ad5/detection
# Reference: https://www.virustotal.com/gui/file/15c7f27b140bf1c4841f68eeee76edc9234090ead8c832c9259d7b71e90a2dd7/detection
# Reference: https://www.virustotal.com/gui/file/dd0bb4c7b41a775ec4426fb74a80d995fde39c87197b8c19b8391139e17491fd/detection

79.133.56.173:7016

# Reference: https://www.virustotal.com/gui/ip-address/118.194.249.75/relations

loggin.lol
opresi.info
osyst.life

# Reference: https://www.virustotal.com/gui/ip-address/210.92.18.162/relations

beeneas.xyz
kerasin.store
koraser.store
naver.com.ng
navercafe.eu
osyst.cloud
poluh.shop
qmodiscord.xyz
rabyse.store
rainsbow.store
refery.store
sig.quest
ssounited.store
ujiora.store
yoiroyse.store
accoshmal.nislo.life
accosnksj.opresi.info
accountsmil.nislo.life
dnhmal.nislo.life
dnnksj.opresi.info
manhattan-c1othing.naver.com.ng
nid.naver.com.ng
nidples.osyst.life
nids.naverdoc.com
outlookmember.rabyse.store
up-api1-kage.nislo.life
yoonnets.naver.com.ng

# Reference: https://www.virustotal.com/gui/ip-address/172.86.97.243/relations

arhayo.store
blairy.store
fpolicy.store
harviwo.store
jebario.store
katoryse.store
kimepekz.store
laurapose.store
ncafptary.store
nessacine.store
satony.store
vaeouri.store
yonoma.store
ness.nessacine.store

# Reference: https://x.com/byrne_emmy12099/status/1818639909806391347
# Reference: https://x.com/byrne_emmy12099/status/1831243259185672523
# Reference: https://www.virustotal.com/gui/ip-address/202.141.233.4/relations
# Referennce: https://www.virustotal.com/gui/file/fd2c6aa42264f7d555e4f1c8194f8c293ab02bc416e43b448cbd09912833d5cf/detection

http://202.141.233.4
dest.kro.kr
mcgnu.kro.kr
nawer.p-e.kr
publish.kro.kr
zmting.kro.kr
hwp.publish.kro.kr
main.zmting.kro.kr
nid.nawer.p-e.kr
mem.mcgnu.kro.kr
mxd.dest.kro.kr

# Reference: https://x.com/alex_lanstein/status/1793677450683269329
# Reference: https://x.com/StrikeReadyLabs/status/1793675350037148033
# Reference: https://x.com/StrikeReadyLabs/status/1818827583410389431
# Reference: https://ti.qianxin.com/blog/articles/UTG-Q-010-Targeted-Attack-Campaign-Against-the-AI-and-Gaming-Industry-EN/
# Reference: https://www.virustotal.com/gui/file/a69693dc1a62e49853ba5eb40999f24e340faf1a087e56f9a21c4622d297c861/detection
# Reference: https://www.virustotal.com/gui/file/732a6bf2345e9cc40b9a6a1164dc2e823955cbc56a5d3750e675d1c4db7f7415/detection
# Reference: https://www.virustotal.com/gui/file/4a371c04b3a52139ccfc82062f228284467a7d3c06d3b9313b62f6f2a6e68b75/detection
# Reference: https://www.virustotal.com/gui/file/6a3f3521f812b3186ff9e2347631fe9865d643321a301058f894cf6ca6953dd3/detection
# Reference: https://www.virustotal.com/gui/file/bb491aa8acd52ebe41e593804477991676e8a816c64bfe3a16443dd4feb44fda/detection

http://94.138.192.147
156.224.22.247:443
gangtao.live
ioskaishi.live
malaithai.co
phmdbad.live
chemdl.gangtao.live
chemdl.ioskaishi.live
conn.phmdbad.live
/lasjdflakdsjf.pdf
/public/jsp/lasjdflakdsjf.pdf

# Reference: https://x.com/Cyberteam008/status/1820652443514073188

aeomeio.n-e.kr
apps.imagelogger.o-r.kr
boomerat.r-e.kr
chorteo.r-e.kr
deta2.n-e.kr
download.paradon.n-e.kr
download.pdfconvert.n-e.kr
file-drive.n-e.kr
g-cloud.r-e.kr
imagelogger.o-r.kr
imgconverter.p-e.kr
montera.o-r.kr
nero1.r-e.kr
ns.zavic.kro.kr
ns.zavid.kro.kr
paradon.n-e.kr
pdfconvert.n-e.kr
viewer.imgconverter.p-e.kr
werasocs.r-e.kr
yerahom.p-e.kr
zavic.kro.kr
zavid.kro.kr
zeratos.o-r.kr

# Reference: https://x.com/Thisism23567356/status/1820786152686661857
# Reference: https://www.virustotal.com/gui/file/f7e29ad2b0d3da5c2a9fa8f54629cdd7b5b890a04b7408c7bdbd02e5772c5103/detection

handhygieneforhealth.org/.well-known/acme-challenge/0802/
/.well-known/acme-challenge/0802/d.php
/.well-known/acme-challenge/0802/upload_dotm.php

# Reference: https://x.com/ValidinLLC/status/1820823041925841365
# Reference: https://app.validin.com/detail?type=ip&find=195.85.250.22#tab=resolutions

xn--220b95u7jdkyicjm.xn--yq5b.xn--3e0b707e
xn--910b050bu5a.xn--oi2b61z32a.xn--3e0b707e
xn--950bt9stjai8zqxc.xn--2i0b10rqve.xn--3e0b707e
xn--h49a2p279auzk.xn--2i0b10rqve.xn--3e0b707e
xn--le5b23b8lz6c.xn--oi2b61z32a.xn--3e0b707e
xn--on3bi6mq2ao9n.xn--9i1b01onwqqzd.xn--3e0b707e

# Reference: https://app.validin.com/detail?find=192.64.81.23&type=ip4&ref_id=ee670af8204#tab=resolutions

xn--220bn6pm6ip9b.xn--2i0b10rqve.xn--3e0b707e
xn--h32b29iq8f57j.xn--2i0b10rqve.xn--3e0b707e
xn--hg3b1r23r0we99j.xn--hk3b17f.xn--3e0b707e
xn--on3b21ee3emyo.xn--2i0b10rqve.xn--3e0b707e
xn--zb0b93v7zf0yr.xn--9i1b01onwqqzd.xn--3e0b707e
xn--zb0b93vmoa643b.xn--yq5b.xn--3e0b707e

# Reference: https://app.validin.com/detail?find=166.88.194.226&type=ip4&ref_id=ee670af8204#tab=resolutions

xn--zb0b93v7zf0yr.xn--9i1b01onwqqzd.xn--3e0b707e
file-center.p-e.kr

# Reference: https://app.validin.com/detail?find=95.164.62.157&type=ip4&ref_id=ee670af8204#tab=resolutions

clearcheck.r-e.kr
cloud-file.o-r.kr
file-clear.o-r.kr
iptime-upgrade.r-e.kr
xn--h32b11c06kbkc.xn--oi2b61z32a.xn--3e0b707e
xn--h32b21ccvorra.xn--oi2b61z32a.xn--3e0b707e
xn--h32b93rxub7a38cq45d.xn--oi2b61z32a.xn--3e0b707e
xn--on3b11fg6drvc910a.xn--2i0b10rqve.xn--3e0b707e
xn--zb0b93v7pcl4f61fvwu.xn--oi2b61z32a.xn--3e0b707e
xn--zb0b93v7zf0yr.xn--9i1b01onwqqzd.xn--3e0b707e

# Reference: https://app.validin.com/detail?find=89.221.224.145&type=ip4&ref_id=ee670af8204#tab=resolutions

accountqoogle.r-e.kr
authqooqle.n-e.kr
download-file.o-r.kr
mitsdj.p-e.kr
n-checker.n-e.kr
nate-accounts.o-r.kr
safe-down.o-r.kr
safefile-store.n-e.kr
secu-center.n-e.kr
security-file.o-r.kr
xn--2e0bw9ye9s.xn--yq5b.xn--3e0b707e
xn--2i0b10r3wdxxk7xc.xn--hu5b25b77nvwc.xn--3e0b707e
xn--3e0bk66b.xn--oi2b61z32a.xn--3e0b707e
xn--910bs4k2b903c.xn--oi2b61z32a.xn--3e0b707e
xn--989amm089aqzk.xn--9i1b01onwqqzd.xn--3e0b707e
xn--c79ak52c.xn--hk3b17f.xn--3e0b707e
xn--h32b21c06kokc.xn--h32bi4v.xn--3e0b707e
xn--h32b23ax6ukic99m.xn--oi2b61z32a.xn--3e0b707e
xn--h32b93vna29s.xn--2i0b10rqve.xn--3e0b707e
xn--i49alo503a1hj91qiwd.xn--oi2b61z32a.xn--3e0b707e
xn--i49aloj21bx7h.xn--hu5b25b77nvwc.xn--3e0b707e
xn--ly5b17v.xn--2i0b10rqve.xn--3e0b707e
xn--oi2b43d22m.xn--oi2b61z32a.xn--3e0b707e
xn--ok0by38c.xn--yq5b.xn--3e0b707e
xn--on3bi6m.xn--hu5b25b77nvwc.xn--3e0b707e
xn--oy2b23yvwh.xn--hk3b17f.xn--3e0b707e
xn--sn3b25qa01t.xn--yq5b.xn--3e0b707e
xn--vf4b150a.xn--hu5b25b77nvwc.xn--3e0b707e
xn--zb0b93v.xn--hu5b25b77nvwc.xn--3e0b707e
xn--zb0b93v7pcuvq.xn--2i0b10rqve.xn--3e0b707e
xn--zb0bjsl3wqkbsx1b.xn--oi2b61z32a.xn--3e0b707e
xn--zj4b17e9vcn8n.xn--hu5b25b77nvwc.xn--3e0b707e

# Reference: https://app.validin.com/detail?find=45.58.52.104&type=ip4&ref_id=ee670af8204#tab=resolutions

xn--289aqc003dx7h.xn--oi2b61z32a.xn--3e0b707e
xn--c79ao69ad3e0kc.xn--9i1b01onwqqzd.xn--3e0b707e
xn--hg3b15whlf.xn--2i0b10rqve.xn--3e0b707e
xn--le5b84c.xn--hk3b17f.xn--3e0b707e
xn--on3b95m.xn--h32bi4v.xn--3e0b707e

# Reference: https://x.com/eastside_nci/status/1821021927357751361

navel.r-e.kr
lcs.navel.r-e.kr
tivan.navel.r-e.kr
veta.navel.r-e.kr
nam.veta.navel.r-e.kr

# Reference: https://www.cyberresilience.com/threatintel/apt-group-kimsuky-targets-university-researchers/
# Reference: https://github.com/arceo-labs/iocs/blob/main/APT/Kimsuky/domains.txt

dorray.site
gkjoiup.site
penlu.or.kr

# Reference: https://x.com/StrikeReadyLabs/status/1822942402258080183
# Reference: https://x.com/Thisism23567356/status/1822970394007019675
# Reference: https://www.virustotal.com/gui/ip-address/152.32.138.182/relations
# Reference: https://www.virustotal.com/gui/ip-address/165.154.171.72/relations
# Reference: https://www.virustotal.com/gui/ip-address/216.128.147.226/relations
# Reference: https://www.virustotal.com/gui/file/3e0f4eaf3db754160f8c012a94772bf05b20823806962836fd0d32e0f160b916/detection
# Reference: https://www.virustotal.com/gui/file/86ef578ca5923119e65049f3d26bff7ea41cea12f8c425f06786b406c8dfaf9a/detection

easygooglecloud.com
googlesharepoint.com
htc-llc.net
microsoft-host.com
twittertips.com
xbox-app.com
checker.jetos.com
gemini.ns01.info

# Reference: https://blog.talosintelligence.com/moonpeak-malware-infrastructure-north-korea/
# Reference: https://www.virustotal.com/gui/ip-address/104.194.152.251/relations

104.194.152.251:443
104.194.152.251:8936
pumaria.store
go.pumaria.store

# Reference: https://www.virustotal.com/gui/ip-address/27.255.80.162/relations

barerby.store
brayoier.store
fandorin.store
ratoriu.store
santora.store
slardar.store

# Reference: https://www.virustotal.com/gui/ip-address/27.255.80.163/relations

megadown.store

# Reference: https://x.com/asdasd13asbz/status/1823625652626710578
# Reference: https://x.com/JangPr0/status/1858654555158065593
# Reference: https://www.virustotal.com/gui/file/d11b41aee220b451393598677d7e62b4ff8fb1989bcdea4a9a25a6d207c5aa39/detection

bit-albania.com/config.php
bit-albania.com/inc.php
bit-albania.com/templates/hacker/css.php

# Reference: https://x.com/JangPr0/status/1824232312915333325
# Reference: https://www.virustotal.com/gui/file/b13201957eec1248b3d91f2fd5a0b5d999c0c77644810f4aa28c9ecd0faf8828/detection

0x0.st/XO5m.txt

# Reference: https://x.com/StrikeReadyLabs/status/1825868401337565226
# Reference: https://www.virustotal.com/gui/file/6b660666f031843a36225e791f6564983c2c8cabf85d2216f0617702a978c838/detection

dr0pb0xapi.com
api.dr0pb0xapi.com
content.dr0pb0xapi.com

# Reference: https://app.validin.com/detail?type=ip&find=210.92.18.158

ko27hovkuqymlx.cfd
ko61prrdlueqct.cfd
ko64teljoibilm.cfd
ko70xxapysvemq.cfd
nm53nvgpzydpxi.cfd

# Reference: https://x.com/eastside_nci/status/1826907909768278163
# Reference: https://app.validin.com/detail?type=ip&find=210.92.18.142#tab=resolutions

account-naver.com
alska37navorcom.website
anewloipopkstar.cloud
dauo3mgoepcio.store
eodanatiodnd09dan.store
haier30chainmgov.website
holadnneioa9mar.online
keyodga90studian.site
krnavedunpsgrps.site
ldadomstka3727noghyp.xyz
login-naver.com
mail-naver.com
miaot32kdnetso.online
msikocanatgioan3c.store
mufaktisi23nbacoam.site
ngenecdoemai3dn.site
nodkcl32doalkna.icu
nuttopsseafe30gud.icu
parenkocl23netkor.online
pidnca3ohackabom.website
qurotdua3ncane.cloud
sapedlcybernav.online
security-naver.com
signin-naver.com
thirda0partysnm.website
wordorg30dnckson.website

# Reference: https://x.com/eastside_nci/status/1826907912565821728
# Reference: https://app.validin.com/detail?type=ip&find=210.92.18.183#tab=resolutions

arrice.store
avackacmzei3cm.store
edaue3dkstring.icu
enorpen.space
krmouse3hacaka.icu
laoschnavgat0in.store
mcafegroupc3sk.store
meardkcsa0ndbox.online
messhoek2sdkn.site
navercorp.center
navor.online
nevor.store
nid-naver.info
podlaenca0dla.online
sakuran320netisxm.xyz
taranagmccoprs.website
transnave0ccoaprs.website
webnavit0incom.online
whitehorse.website
zabrdca3gopex.site
zootoepaic0cat.online

# Reference: https://x.com/eastside_nci/status/1826907914918912293

2022laicai.com
2c8b3f19-0325-4acc-a3dd-31a918e4dbf5.random.osyst.life
3yik.caidao188.com
aperfection3cos.site
arsakray.store
bgptools-wildcard-confirmed.inserverncorpservice.store
bgptools-wildcard-confirmed.nmailcorponlinehost.store
bgptools-wildcard-confirmed.nmailteam.store
bzfafa888.com
caidao188.com
eager-goldwasser.210-92-18-176.plesk.page
gemevog.com
ghfjqle.icu
guytr.store
hanhwa.site
images.kkuac.org
inserverncorpservice.store
inservicenmail.store
js.caiyuandao888.com
laoschnavgat0in.store
mailsecurityncorp.store
nasdfg.website
nbgfvr.icu
nbvfghr.online
nbvhftr.store
ndfghj.store
ndfsdk.website
nervous-hawking.210-92-18-188.plesk.page
nghtyr.online
nghytr.space
ngjhry.icu
ngjhur.website
ngjrur.online
ngjuer.store
nhgujfr.shop
nhgybf.xyz
nhgyt.shop
nhjklr.icu
nhygbh.xyz
nirroaed5nesicm.store
njfghr.store
njgher.site
njghfr.site
njghuer.online
njguht.shop
njguyh.space
njhgd.cloud
njhgu.website
njhuy.website
njhuyr.online
njikmh.site
nkgier.website
nmailcorphost.store
nmailcorponlinehost.store
nmailhostingonline.store
nmailhostingonlinecom.store
nmailhostsecurityonline.store
nmailonlineserverhosting.store
nmailsecurityhost.store
serverncorpmail.store
serverncorpmailonline.store
servernmailcenter.store
servernmailcorp.store
servernmailservice.store
vcljs.com
whe0tmcopsra.site
zootoepaic0cat.online

# Reference: https://x.com/Huntio/status/1827010159597728157
# Reference: https://app.validin.com/detail?type=ip&find=27.102.130.181#tab=resolutions

goocgle.cloud

# Reference: https://www.rapid7.com/globalassets/_pdfs/whitepaperguide/rapid7-Kimsukys-Phishing-and-Payload-Tactics_wp.pdf
# Reference: https://github.com/rapid7/Rapid7-Labs/blob/main/IOCs/Kimsuky_Phishing_Payload_Tactics_IOCs.txt

accounts.ukr.net.userscheck.info
app.userscheck.info
blog.userscheck.info
chat.userscheck.info
dev.userscheck.info
forums.app.userscheck.info
fr.userscheck.info
i.ua.userscheck.info
meta.ua.userscheck.info
micbns.documentview.site
net.userscheck.info
passport.meta.ua.userscheck.info
passports.i.ua.userscheck.info
phpmyadmin.userscheck.info
support.userscheck.info
ua.userscheck.info
ukr.net.userscheck.info

# Reference: https://x.com/ValidinLLC/status/1827015254821253281
# Reference: https://app.validin.com/detail?type=ip&find=154.205.138.23#tab=resolutions

ntskorea.site
ntsletter.site
ntsmail.online
ntsmail.store
ntspost.online
ntsposting.site
ntsshare.site
ntsteam.store
ntsweb.store
cc.ntsmail.online
cc.ntsposting.site
lcs.ntsmail.online
lcs.ntsmail.store
lcs.ntsposting.site
naver.ntskorea.site
naver.ntsletter.site
naver.ntsmail.store
naver.ntsposting.site
naver.ntsweb.store

# Reference: https://app.validin.com/detail?find=173.211.70.97&type=ip4&ref_id=d5d8772dd63#tab=resolutions
# Reference: https://app.validin.com/detail?find=185.126.148.8&type=ip4&ref_id=d5d8772dd63#tab=resolutions

chaosknight.site
cute-fox.online
fuckv3.site
futurismlabs.site
linesmanagement.fun
lovely4u.nl
mediumtechview.info
mediumtechview.site
memberscheck.info
naverline.cloud
needrelax.site
noticements.website
scm-portal.site
scv250227.website
secure-cps.nl
sessioncheck.site
simplegame.store
supernovagroup.site

# Reference: https://app.validin.com/detail?find=210.92.18.187&type=ip4&ref_id=fed3f04f9c8#tab=resolutions

naverlogin.com
nproxr.store
nsfder.store

# Reference: https://app.validin.com/detail?find=210.92.18.185&type=ip4&ref_id=fed3f04f9c8#tab=resolutions

boarmanc90genmc.xyz
cokrmstehomeb09ks.xyz
com-change.info
comerpl0starli.site
cordns77navgations.icu
coumcyberlib3n.online
daurnmail.com
ehcoasnet8home.store
golpit0matery.online
gonwet1boedy.site
hotmail.com-change.info
hotrnail.com-change.info
krdaumcokm0a.cloud
mc0rpsadmenp.cloud
mcafe090korpxs.online
microsoft.com-change.info
msky05bookscom.shop
n09ccafestopcm.website
naver.com-change.info
navers.com-change.info
navor.com-change.info
newdoma7navgtes.store
nidauti0korpsm.online
packnavorkps12attn.store
qour8dakservers.website
saramine5estchn.website
t0ngbirsmirn.cloud
ytube23comk.website

# Reference: https://app.validin.com/detail?find=210.92.18.181&type=ip4&ref_id=fed3f04f9c8#tab=resolutions

aget0mkcoilp.store
albokkstr0nets.store
ckrnpoekai12sg.online
csilentabooksites.website
diom2bolbooks.cloud
gksisfle.website
gqwert.space
guekgle.shop
gythu.site
hamtopredio3n.website
jobckr23contp.site
jobkrnetsiom3nva.cloud
naverhelp.center
navesgn.info
nm14hwjsddxdab.cfd
npiramid00grps.xyz
outlook-kr.com
pla0iistocktbls.cloud
refidn09netapols.icu
urhost30bomlibs.site
vitual7murps.online
vituo5plomontuers.store
weoidius98netstv.store

# Reference: https://app.validin.com/detail?find=210.92.18.169&type=ip4&ref_id=fed3f04f9c8#tab=resolutions

aa11iaiaoaodiasdf.cfd
aa15daoaoaa.cfd
aa16auaiaia.cfd
gg01aa8d.cfd
gg02diad.cfd
gg03dddd.cfd
gg04jaid.cfd
gg05odpz.cfd
gg06vjzn.cfd
gg08vnzm.cfd
gg09icuy.cfd
gg10vncc.cfd
gg117hvu.cfd
gg12vvzc.cfd
gg13vvcz.cfd
gg14dvcz.cfd
gg15mmnc.cfd
gg16ijnc.cfd
gg17nbcj.cfd
gg18yctz.cfd
gg19vnzn.cfd
gg20qqzn.cfd
gg21abcd.cfd
gg22kieu.cfd
gg23uydc.cfd
gg24erud.cfd
gg25vmzn.cfd
gg26ppdd.cfd
gg27ytdc.cfd
gg28erud.cfd
gg29wdic.cfd
gg30qncj.cfd
gg31vmcc.cfd
gg32ddid.cfd
gg33ecbc.cfd
gg34bcjd.cfd
gg35tdfd.cfd
ghusfe.online
guhdfe.store
gythu.site
insecurityncorp.store
inservernmail.store
inservernmailcorp.store
inservicenmailcorp.store
inservicenmailsecurity.store
joinupvts.org
kk02diaoa.cfd
kk04ooiiz.cfd
kk05jjizo.cfd
ko03bumpunpkkj.cfd
ko05oiwgznlfez.cfd
ko09iihldlmpue.cfd
ko16krddlgrnqc.cfd
ko17zouzamjbna.cfd
ko20klrhisaghe.cfd
ko21hkerjkbwdk.cfd
ko22hkqwqzhfor.cfd
ko28dhdlhpwdoq.cfd
ko34ertusbpxwo.cfd
ko36jvrpmmdinr.cfd
ko37dosnkzvkgk.cfd
ko38muxaclxtyi.cfd
ko39sksjjgqoxc.cfd
ko45bvsvhykbec.cfd
ko47lbeoonhzch.cfd
ko50abihxzlzpx.cfd
ko52duaqxyjgcy.cfd
ko57jlttjllkri.cfd
ko60ydekzyztby.cfd
ko62naixkvajsb.cfd
ko63mzeususgdb.cfd
ko65mktttgloce.cfd
ko66epaeekyygx.cfd
ko67fowwqjblxu.cfd
ko68mlsiftaimg.cfd
ko69rykrwqqvtb.cfd
mailncorpsecurity.store
mz01gnzcsqyxvh.cfd
mz15wiqsuekibc.cfd
mz17zthmologal.cfd
mz20nvegiecnlg.cfd
mz21ecesmpinht.cfd
mz29qdyvhgkjmw.cfd
mz32evjttfqehe.cfd
mz33samchzvpbf.cfd
mz34kmoqtbsccp.cfd
mz37qfwnzdboqn.cfd
mz39msrxqvgwds.cfd
mz42vdwrbyzpuy.cfd
mz44hhmwmdsebg.cfd
mz48ccndurjvpt.cfd
nm14hwjsddxdab.cfd
nm23yrmupctcjh.cfd
nm27zcijazfmnm.cfd
nm64cmdaulibqc.cfd
nm71wibkcuxqir.cfd
nmailcorpsecurityhost.store
nmailhostingcom.store
nmailhostingserver.store
nmailhostingservice.store
nmailhostonline.store
nmailhostonlineserver.store
nmailhostserveronline.store
nmailonlinehost.store
nmailonlinehosting.store
nmailonlinehostingserver.store
nmailsecurityhosting.store
nmailsecurityonlinehosting.store
nmailserverhosing.store
onlinenmailcorpservicecom.store
onlinenmailcorpserviceenter.store
onsecuritynmail.store
onsecuritynmailcorp.store
op01ytuackbjgp.cfd
op07kzvwwbuysj.cfd
qq01aiao.cfd
qq03aiai.cfd
qq04aiai.cfd
qq08zzdi.cfd
qq09mzkc.cfd
servernmail.store
servernmailcenteronline.store
servernmailonline.store
servernmailonlinecom.store
ss2siaoeiqoao.cfd
ss8diaoaidia.cfd
ss9diaudiaa.cfd
wr01dzt.cfd
wr02lqw.cfd
wr04yst.cfd
wr15ffe.cfd
wr16kah.cfd
wr24dwr.cfd
wr26zky.cfd
wr27hjm.cfd
wr31unj.cfd
wr32qcy.cfd
wr33kmx.cfd
ww01aaa.cfd
ww02bbb.cfd
ww03ccc.cfd
ww04ddd.cfd
ww05eee.cfd
ww06fff.cfd
ww07ggg.cfd
ww08iii.cfd
ww09qqq.cfd
ww10fid.cfd
ww11dia.cfd
ww12vmn.cfd
ww13nmv.cfd
ww14cnm.cfd
ww15nvd.cfd
ww16fjf.cfd
ww17oio.cfd
ww18vnc.cfd
ww19jjd.cfd
ww20vnc.cfd
ww21ccc.cfd
ww22jjc.cfd
ww23mvn.cfd
ww24ncc.cfd
ww25nnc.cfd
ww26nnk.cfd
ww27iol.cfd
ww28nnb.cfd
ww29nnc.cfd
ww30kjc.cfd
ww31ncc.cfd
ww32nnc.cfd
zz09iinic.cfd
zz13iijnc.cfd
zz14ppiuc.cfd
zz16ajndd.cfd
zz20hjcic.cfd
zz21ticic.cfd
zz23aeeec.cfd

# Reference: https://app.validin.com/detail?find=210.92.18.161&type=ip4&ref_id=fed3f04f9c8#tab=resolutions

accounts.serviceprotect.eu
enternmailaccounts.store
enternmailaccountscom.store
enternmailaccountsserver.store
enternmailcorpsecurity.store
enternmailsecurity.store
enternmailserver.store
gg04jaid.cfd
gg05odpz.cfd
gg07pcoi.cfd
gg08vnzm.cfd
gg09icuy.cfd
gg10vncc.cfd
gg117hvu.cfd
gg13vvcz.cfd
gg14dvcz.cfd
gg15mmnc.cfd
gg16ijnc.cfd
gg18yctz.cfd
gg19vnzn.cfd
gg20qqzn.cfd
gg21abcd.cfd
gg22kieu.cfd
gg23uydc.cfd
gg25vmzn.cfd
gg26ppdd.cfd
gg27ytdc.cfd
gg28erud.cfd
gg29wdic.cfd
gg30qncj.cfd
gg31vmcc.cfd
gg32ddid.cfd
gg33ecbc.cfd
gg34bcjd.cfd
gg35tdfd.cfd
innmailserver.store
innserversite.online
innservicecomserver.store
inservicecom.store
kk02diaoa.cfd
kk04ooiiz.cfd
kk05jjizo.cfd
ko03bumpunpkkj.cfd
ko05oiwgznlfez.cfd
ko09iihldlmpue.cfd
ko16krddlgrnqc.cfd
ko17zouzamjbna.cfd
ko20klrhisaghe.cfd
ko21hkerjkbwdk.cfd
ko22hkqwqzhfor.cfd
ko28dhdlhpwdoq.cfd
ko34ertusbpxwo.cfd
ko36jvrpmmdinr.cfd
ko37dosnkzvkgk.cfd
ko38muxaclxtyi.cfd
ko39sksjjgqoxc.cfd
ko45bvsvhykbec.cfd
ko47lbeoonhzch.cfd
ko50abihxzlzpx.cfd
ko52duaqxyjgcy.cfd
ko57jlttjllkri.cfd
ko60ydekzyztby.cfd
ko62naixkvajsb.cfd
ko63mzeususgdb.cfd
ko65mktttgloce.cfd
ko66epaeekyygx.cfd
ko67fowwqjblxu.cfd
ko68mlsiftaimg.cfd
ko69rykrwqqvtb.cfd
loginnmailcorpserver.store
mailncorpsecurity.store
mz01gnzcsqyxvh.cfd
mz15wiqsuekibc.cfd
mz17zthmologal.cfd
mz20nvegiecnlg.cfd
mz21ecesmpinht.cfd
mz29qdyvhgkjmw.cfd
mz30nnqnbxgboi.cfd
mz32evjttfqehe.cfd
mz33samchzvpbf.cfd
mz34kmoqtbsccp.cfd
mz37qfwnzdboqn.cfd
mz39msrxqvgwds.cfd
mz42vdwrbyzpuy.cfd
mz44hhmwmdsebg.cfd
mz48ccndurjvpt.cfd
navcomserver.store
navservicecenter.store
ncompanylogin.store
ncompanymailserver.store
ncompanyserver.store
ncompanyservice.store
ncorpmailingserver.store
ncorpmailsecurity.store
ncorpmailsecuritycom.store
ncorpmailsecurityonline.store
ncorpmailservercom.store
ncorpmailservicecom.store
ncorpmailsystem.store
ncorponline.store
ncorponlineserver.store
ncorporationmail.store
ncorporationsecurity.store
ncorporationserver.store
ncorporationservice.store
ncorpsecuritycom.store
ncorpsecuritycomsite.store
ncorpsecurityservice.store
ncorpserveronline.store
ngroupmailserver.store
ngroupmailservice.store
nhtgfr.online
nhuygr.shop
njhbgd.online
njhug.online
nm14hwjsddxdab.cfd
nm23yrmupctcjh.cfd
nm27zcijazfmnm.cfd
nm64cmdaulibqc.cfd
nm71wibkcuxqir.cfd
nmailcentercom.store
nmailinconline.store
nmailincserver.store
nmailingserver.store
nmailingservice.store
nmailservercomsystem.store
nmailserversystem.store
nmailservicecom.store
nmailsystemsecurity.store
nmailsystemserver.store
nonlinecenter.store
nonlinemailservercom.store
nonlineservce.store
nonlineserver.store
nonlineserversite.store
nonlineservicesite.store
nsecuritygroupmail.store
nsecuritygroupservice.store
nsecuritymailing.store
nsecurityservicesystem.store
nserviceonline.store
nserviceonlineserver.store
onlinenavservice.store
onlinencompany.store
onlinencorpaccounts.store
onlinencorpmailsecurity.store
onlinencorpsecurity.store
onlinencorpsecuritycom.store
onlinencorpserver.store
onlinenmailaccounts.store
onlinenmailaccountsservice.store
onlinenmailcorpcom.store
onlinenmailcorpserver.store
onlinenmailcorpservice.store
onlinenmailserver.store
onlinenmailservice.store
onlinenservicecenter.store
onlinenservicecom.store
onnmailcorpsecurity.store
onnmailservercom.store
onnmailservice.store
onsecuritynmail.store
onsecuritynmailcorp.store
op01ytuackbjgp.cfd
op07kzvwwbuysj.cfd
qq01aiao.cfd
qq03aiai.cfd
qq04aiai.cfd
qq05wiwo.cfd
qq06jzoz.cfd
qq08zzdi.cfd
qq09mzkc.cfd
servicemember.info
serviceprotect.eu
ss12aidiaodia.cfd
ss13aidoaias.cfd
ss2siaoeiqoao.cfd
ss6qiaosidiao.cfd
ss8diaoaidia.cfd
ss9diaudiaa.cfd
wr01dzt.cfd
wr02lqw.cfd
wr03skl.cfd
wr04yst.cfd
wr05mmy.cfd
wr06guh.cfd
wr07pxi.cfd
wr08dxk.cfd
wr09vjo.cfd
wr10jdh.cfd
wr11idy.cfd
wr12xej.cfd
wr13fsd.cfd
wr14xpn.cfd
wr15ffe.cfd
wr16kah.cfd
wr17uvl.cfd
wr18pfu.cfd
wr19xpc.cfd
wr20jyu.cfd
wr21udy.cfd
wr22pch.cfd
wr23vul.cfd
wr24dwr.cfd
wr25rkg.cfd
wr26zky.cfd
wr27hjm.cfd
wr28gmv.cfd
wr29dnt.cfd
wr30tey.cfd
wr31unj.cfd
wr32qcy.cfd
wr33kmx.cfd
ww01aaa.cfd
ww02bbb.cfd
ww03ccc.cfd
ww04ddd.cfd
ww05eee.cfd
ww06fff.cfd
ww07ggg.cfd
ww08iii.cfd
ww09qqq.cfd
ww10fid.cfd
ww11dia.cfd
ww12vmn.cfd
ww13nmv.cfd
ww14cnm.cfd
ww15nvd.cfd
ww16fjf.cfd
ww17oio.cfd
ww18vnc.cfd
ww19jjd.cfd
ww20vnc.cfd
ww21ccc.cfd
ww22jjc.cfd
ww23mvn.cfd
ww24ncc.cfd
ww25nnc.cfd
ww26nnk.cfd
ww27iol.cfd
ww28nnb.cfd
ww29nnc.cfd
ww30kjc.cfd
ww31ncc.cfd
ww32nnc.cfd
zz02wqiam.cfd
zz04diaod.cfd
zz07zivnc.cfd
zz09iinic.cfd
zz10ojvnd.cfd
zz11ijvnc.cfd
zz12jmnjd.cfd
zz13iijnc.cfd
zz14ppiuc.cfd
zz16ajndd.cfd
zz17iiinv.cfd
zz18ppivn.cfd
zz20hjcic.cfd
zz21ticic.cfd
zz22bcjcd.cfd
zz23aeeec.cfd
zz25ioonc.cfd
zz26fiiid.cfd

# Reference: https://app.validin.com/detail?find=210.92.18.140&type=ip4&ref_id=fed3f04f9c8#tab=resolutions

nbjghy.space
nbjhf.space
ngjud.online
ngtyr.online
nmbjgh.store

# Reference: https://app.validin.com/detail?find=210.92.18.38&type=ip4&ref_id=fed3f04f9c8#tab=resolutions

beplay787.com
gouwan.asia
izhido.com
manbet.vip
manbetx.pw
manbetx123.net
manbetx1688.com
manbetx888.net
opebet7788.com
wanbo.asia
wanbotiyu.com
wanboyazhou.com

# Reference: https://app.validin.com/detail?find=210.92.18.180&type=ip4&ref_id=fed3f04f9c8#tab=resolutions

activateall.store
air000sorricesnets.shop
boarac32kcahane.online
bon3homeskopn.site
domaepd0casemp.shop
echoakop0can.website
euroq0utcoja.store
halmcopl2coms.icu
humiolcaplia.website
ikornv7bomska.site
jobkrb0netsner.online
krinstan3acheom.icu
laun093nettvm.cloud
lomaberkcops.icu
meaech0libryarys.website
mewcafenidkporn.website
moistu30uesrnetna.online
naithech3studin.website
navcorphelpserver.store
navcorpteam.store
naverhelp.info
naverhelp.net
navermail.info
navhelpteam.store
navig0tion23s.online
navinc.store
navsercuricom.store
nbookafat0rys.cloud
nidao23matnerb.icu
nrefe0ncenotdap.icu
nvbmb.shop
plocafenav0tinar.online
recoverpotal.online
recoveryrequest.store
requestall.store
skornhomeokls0o.online
synchronizeall.store
threm0shortvo.site
todarayon20ncv.xyz
transfckinea0mons.store
verificationmail.store
wero908shinhan.icu

# Reference: https://app.validin.com/detail?find=210.92.18.164&type=ip4&ref_id=fed3f04f9c8#tab=resolutions

auser.eu
cmember.eu
kakaocop.com
kakaocorps.com
mailuser.info
natescorp.com
psuser.eu
quser.info
thnuhbyhn.tech
mail.auser.eu

# Reference: https://app.validin.com/detail?find=210.92.18.168&type=ip4&ref_id=fed3f04f9c8#tab=resolutions

callsvcauction.online
discoveriner.sbs
dovmansec.cfd
helpagencyall.site
mailnaverio.store
mainoutband.store
mallkrservice.site
nativeauction.sbs
navmontin.store
navnamemode.cfd
navsold.site
nbvhgc.online
necolasec.shop
netserviceml.sbs
nghuy.store
nidnewsmain.site
njguhr.website
njjkgr.shop
nkijfr.icu
nsjhfu.space
nsscontens.store
popularmap.cfd
scorenidmain.bond
sendletters.site
a.discoveriner.sbs
captchanidin.helpagencyall.site
captchanidin.scorenidmain.bond
captchanidinbox.popularmap.cfd
captchanidlink.navnamemode.cfd
captchanidmail.scorenidmain.bond
captchanidmail.sendletters.site
captchanidmain.netserviceml.sbs
captchanidmall.navsold.site
captchanidporn.discoveriner.sbs
captchanidporn.dovmansec.cfd
captchanidporn.nativeauction.sbs
captchanidpostm.nativeauction.sbs
captchanidsvc.navmontin.store
ccin.helpagencyall.site
ccin.scorenidmain.bond
ccinbox.popularmap.cfd
cclink.navnamemode.cfd
ccmail.scorenidmain.bond
ccmail.sendletters.site
ccmain.netserviceml.sbs
ccmall.navsold.site
ccporn.discoveriner.sbs
ccporn.dovmansec.cfd
ccporn.nativeauction.sbs
ccpostm.nativeauction.sbs
ccsvc.navmontin.store
cloudin.helpagencyall.site
cloudin.scorenidmain.bond
cloudinbox.popularmap.cfd
cloudlink.navnamemode.cfd
cloudmail.scorenidmain.bond
cloudmail.sendletters.site
cloudmain.netserviceml.sbs
cloudmall.navsold.site
cloudporn.discoveriner.sbs
cloudporn.dovmansec.cfd
cloudporn.nativeauction.sbs
cloudpostm.nativeauction.sbs
cloudsvc.navmontin.store
contactin.helpagencyall.site
contactin.scorenidmain.bond
contactinbox.popularmap.cfd
contactlink.navnamemode.cfd
contactmail.scorenidmain.bond
contactmail.sendletters.site
contactmain.netserviceml.sbs
contactmall.navsold.site
contactporn.discoveriner.sbs
contactporn.dovmansec.cfd
contactporn.nativeauction.sbs
contactpostm.nativeauction.sbs
contactsvc.navmontin.store
helpin.helpagencyall.site
helpin.scorenidmain.bond
helpinbox.popularmap.cfd
helplink.navnamemode.cfd
helpmail.scorenidmain.bond
helpmail.sendletters.site
helpmain.netserviceml.sbs
helpmall.navsold.site
helpporn.discoveriner.sbs
helpporn.dovmansec.cfd
helpporn.nativeauction.sbs
helppostm.nativeauction.sbs
helpsvc.navmontin.store
lcsin.helpagencyall.site
lcsin.scorenidmain.bond
lcsinbox.popularmap.cfd
lcslink.navnamemode.cfd
lcsmail.scorenidmain.bond
lcsmail.sendletters.site
lcsmain.netserviceml.sbs
lcsmall.navsold.site
lcsporn.discoveriner.sbs
lcsporn.dovmansec.cfd
lcsporn.nativeauction.sbs
lcspostm.nativeauction.sbs
lcssvc.navmontin.store
mail.callsvcauction.online
mail.navsold.site
mailin.helpagencyall.site
mailin.scorenidmain.bond
mailinbox.popularmap.cfd
maillink.navnamemode.cfd
mailmail.scorenidmain.bond
mailmail.sendletters.site
mailmain.netserviceml.sbs
mailmall.navsold.site
mailporn.discoveriner.sbs
mailporn.dovmansec.cfd
mailporn.nativeauction.sbs
mailpostm.nativeauction.sbs
mailsvc.navmontin.store
naver.callsvcauction.online
naver.mailnaverio.store
naver.mainoutband.store
naver.mallkrservice.site
navermail.callsvcauction.online
navermail.mainoutband.store
navermail.mallkrservice.site
nid.mailnaverio.store
nidin.helpagencyall.site
nidin.scorenidmain.bond
nidinbox.popularmap.cfd
nidlink.navnamemode.cfd
nidlogin.mallkrservice.site
nidmail.scorenidmain.bond
nidmail.sendletters.site
nidmain.netserviceml.sbs
nidmall.navsold.site
nidporn.discoveriner.sbs
nidporn.dovmansec.cfd
nidporn.nativeauction.sbs
nidpostm.nativeauction.sbs
nids.discoveriner.sbs
nids.dovmansec.cfd
nids.helpagencyall.site
nids.nativeauction.sbs
nids.navmontin.store
nids.navnamemode.cfd
nids.navsold.site
nids.netserviceml.sbs
nids.popularmap.cfd
nids.scorenidmain.bond
nids.sendletters.site
nidsvc.navmontin.store
publish.sendletters.site
rcaptchanidin.helpagencyall.site
rcaptchanidin.scorenidmain.bond
rcaptchanidinbox.popularmap.cfd
rcaptchanidlink.navnamemode.cfd
rcaptchanidmail.scorenidmain.bond
rcaptchanidmail.sendletters.site
rcaptchanidmain.netserviceml.sbs
rcaptchanidmall.navsold.site
rcaptchanidporn.discoveriner.sbs
rcaptchanidporn.dovmansec.cfd
rcaptchanidporn.nativeauction.sbs
rcaptchanidpostm.nativeauction.sbs
rcaptchanidsvc.navmontin.store
soundcaptchanidin.helpagencyall.site
soundcaptchanidin.scorenidmain.bond
soundcaptchanidinbox.popularmap.cfd
soundcaptchanidlink.navnamemode.cfd
soundcaptchanidmail.scorenidmain.bond
soundcaptchanidmail.sendletters.site
soundcaptchanidmain.netserviceml.sbs
soundcaptchanidmall.navsold.site
soundcaptchanidporn.discoveriner.sbs
soundcaptchanidporn.dovmansec.cfd
soundcaptchanidporn.nativeauction.sbs
soundcaptchanidpostm.nativeauction.sbs
soundcaptchanidsvc.navmontin.store
sslin.helpagencyall.site
sslin.scorenidmain.bond
sslinbox.popularmap.cfd
ssllink.navnamemode.cfd
sslmail.scorenidmain.bond
sslmail.sendletters.site
sslmain.netserviceml.sbs
sslmall.navsold.site
sslporn.discoveriner.sbs
sslporn.dovmansec.cfd
sslporn.nativeauction.sbs
sslpostm.nativeauction.sbs
sslsvc.navmontin.store
staticnidin.helpagencyall.site
staticnidin.scorenidmain.bond
staticnidinbox.popularmap.cfd
staticnidlink.navnamemode.cfd
staticnidmail.scorenidmain.bond
staticnidmail.sendletters.site
staticnidmain.netserviceml.sbs
staticnidmall.navsold.site
staticnidporn.discoveriner.sbs
staticnidporn.dovmansec.cfd
staticnidporn.nativeauction.sbs
staticnidpostm.nativeauction.sbs
staticnidsvc.navmontin.store
publish.sendletters.site
wwwcorpin.helpagencyall.site
wwwcorpin.scorenidmain.bond
wwwcorpinbox.popularmap.cfd
wwwcorplink.navnamemode.cfd
wwwcorpmail.scorenidmain.bond
wwwcorpmail.sendletters.site
wwwcorpmain.netserviceml.sbs
wwwcorpmall.navsold.site
wwwcorpporn.discoveriner.sbs
wwwcorpporn.dovmansec.cfd
wwwcorpporn.nativeauction.sbs
wwwcorppostm.nativeauction.sbs
wwwcorpsvc.navmontin.store
wwwin.helpagencyall.site
wwwin.scorenidmain.bond
wwwinbox.popularmap.cfd
wwwlink.navnamemode.cfd
wwwmail.scorenidmain.bond
wwwmail.sendletters.site
wwwmain.netserviceml.sbs
wwwmall.navsold.site
wwwporn.discoveriner.sbs
wwwporn.dovmansec.cfd
wwwporn.nativeauction.sbs
wwwpostm.nativeauction.sbs
wwwsvc.navmontin.store

# Reference: https://app.validin.com/detail?find=210.92.18.159&type=ip4&ref_id=fed3f04f9c8#tab=resolutions

chasina.store
grendeu.store
katerage.store
naver.com.ru
nid.naver.com.ru

# Reference: https://app.validin.com/detail?find=210.92.18.171&type=ip4&ref_id=fed3f04f9c8#tab=resolutions

checkapis.com
naveradmin.com
orwou.store
ai.checkapis.com
bot.checkapis.com
api.checkapis.com
naverhelp.in.net
naverhelp.co.in
secure.checkapis.com

# Reference: https://app.validin.com/detail?find=210.92.18.176&type=ip4&ref_id=fed3f04f9c8#tab=resolutions

daun.o-r.kr
accountskakao.daun.o-r.kr

# Reference: https://app.validin.com/detail?find=210.92.18.166&type=ip4&ref_id=fed3f04f9c8#tab=resolutions

naverocrp.com

# Reference: https://app.validin.com/detail?find=210.92.18.178&type=ip4&ref_id=fed3f04f9c8#tab=resolutions

daum.net.in
happy-carver.210-92-18-178.plesk.page
kakao.com.co
kts1.stgame.pe.kr
navercorp.city
navercrcp.com
stgame.pe.kr

# Reference: https://app.validin.com/detail?find=210.92.18.145&type=ip4&ref_id=fed3f04f9c8#tab=resolutions

ipcheckapi.com
naverrer.com
naverrnail.com
updateplug.net

# Reference: https://app.validin.com/detail?find=210.92.18.190&type=ip4&ref_id=fed3f04f9c8#tab=resolutions

account-google.info
nate.com.in
naverhost.in.net
naverscan.org
naverteam.info
siren24.info
mail.account-google.info

# Reference: https://app.validin.com/detail?find=210.92.18.167&type=ip4&ref_id=fed3f04f9c8#tab=resolutions

mid-naver.com
natesupport.com
signin.mid-naver.com

# Reference: https://app.validin.com/detail?find=210.92.18.170&type=ip4&ref_id=fed3f04f9c8#tab=resolutions

naver.host
naver.in.net
naveraccount.com

# Reference: https://app.validin.com/detail?find=210.92.18.146&type=ip4&ref_id=fed3f04f9c8#tab=resolutions

ictcvip.com

# Reference: https://app.validin.com/detail?find=210.92.18.163&type=ip4&ref_id=fed3f04f9c8#tab=resolutions

naxer-mobile.com
never-clouding.com
mail.naxer-mobile.com
mail.never-clouding.com

# Reference: https://app.validin.com/detail?find=210.92.18.189&type=ip4&ref_id=fed3f04f9c8#tab=resolutions

microsoft-profile.info

# Reference: https://app.validin.com/detail?find=210.92.18.157&type=ip4&ref_id=fed3f04f9c8#tab=resolutions

tolig.pe.kr
kttest1.tolig.pe.kr

# Reference: https://app.validin.com/detail?find=27.255.79.225&type=ip4&ref_id=1e1733dd7f7#tab=resolutions

maeilbox.com
st0746.net
upbit-kr.com

# Reference: https://x.com/byrne_emmy12099/status/1829013167940481140

handhygieneforhealth.org/wp-includes/css/song/dist.php

# Reference: https://x.com/VirITeXplorer/status/1829109307322904629
# Reference: https://www.virustotal.com/gui/ip-address/202.141.233.4/relations
# Reference: https://app.validin.com/detail?type=ip&find=202.141.233.4#tab=resolutions
# Reference: https://www.virustotal.com/gui/file/8028b918d06cf3635e7e77d29cb0a4622d8cf4ee30881fb297435f7328ff45e4/detection

zoorn.site
login.zoorn.site
ussc.zoorn.site
desbros.kro.kr
meetings.kro.kr
secbesm.kro.kr
zoom-meeting.kro.kr
zoom.meetings.kro.kr
bklis.desbros.kro.kr
client.publish.kro.kr
drequsm.secbesm.kro.kr
rem.zoom-meeting.kro.kr
/0829_pprb/d.php

# Reference: https://app.validin.com/detail?find=145.14.151.87&type=ip4&ref_id=1a3f4c9180c#tab=resolutions

afyoncekici.site
altinmaske.site
antalyacekici.site
antalyacekicim.site
antalyapeyzaj.site
koubasvuru.site

# Reference: https://x.com/eastside_nci/status/1829413692372586570
# Reference: https://app.validin.com/detail?type=ip&find=183.111.125.44#tab=resolutions
# Reference: https://app.validin.com/detail?type=ip&find=185.203.119.14#tab=resolutions

accounts.kakkao.com
driver.crabdance.com
kakkao.com
mailer.neomail.kr
mydrive.home.kg
naveor.3utilities.com
nid-naver.ddnsking.com
store.notici.as
ymail.notici.as

# Reference: https://app.validin.com/detail?find=8d5de7ecb18c720b5723d23de8b56da4&type=hash&ref_id=877f65306be#tab=host_pairs_v2

acount.notici.as
mailsystem.sumibi.org
manage-myinfo.smelly.cc
myaccount-verify.nard.ca
users.allisons.org
users.annaffiare.org

# Reference: https://app.validin.com/detail?find=5.182.210.210&type=ip4&ref_id=8ca70ccef65#tab=resolutions

mail-daum.ddns.net
nid1-naver.servehttp.com
nid-naver.serveirc.com
xo-nate-com.ml

# Reference: https://x.com/byrne_emmy12099/status/1901525189374185624
# Reference: https://app.validin.com/lookalikes?mode=full&timeout=30&lookback=7&find=nid-naver
# Reference: https://app.validin.com/detail?find=104.200.67.212&type=ip4&ref_id=28344b7ed2b#tab=resolutions
# Reference: https://app.validin.com/detail?find=131.153.13.235&type=ip4&ref_id=fe7a551c5d5#tab=resolutions
# Reference: https://app.validin.com/detail?find=38.180.193.61&type=ip4&ref_id=4c8401c777e#tab=resolutions
# Reference: https://www.virustotal.com/gui/file/9e4e45e8f12db94997767bd3899968b9bc147bf08c062d3caea7f0864a67ea2c/detection
# Reference: https://www.virustotal.com/gui/file/8b0b62a31b348c5a2337ee69cfd3f68a427466539484f55f1cd2910237b59700/detection
# Reference: https://www.virustotal.com/gui/file/4b87b775cdb265ecd872a71be810d7816d0d8b54663b3c536862db098874f288/detection
# Reference: https://www.virustotal.com/gui/file/3cc47aea39c48aa22fbf246f11cd4aaa8179efa48bb1c3e30fbf70541fe2cf87/detection

http://131.153.13.235
nid-naver.icu
nid-naver.xyz
nid-naver.site
nid-naver.download
nid-naver.blogg.host
nidnaver.cf
nidnaver.co
nidnaver.ml
secdownserv.com
nid-naver.secdownserv.com
nid-naverset.ddnsking.com
acccounnts-gooqle.serveftp.com
acccounnts-qooqle.myvnc.com
acccounts-gocgle.serveftp.com
acccounts-google.onthewifi.com
acccounts-gooogle.servebeer.com
acccounts-gooogle.servemp3.com
acccounts-gooogle.servequake.com
acccounts-qooqle.serveftp.com
accoouunt-gooqle.servehttp.com
accounnts-google.3utilities.com
accounnts-google.onthewifi.com
accounnts-google.servequake.com
accounnts-gooogle.serveftp.com
accounnts-gooogle.servehttp.com
accounnts-gooogle.servepics.com
accounnts-qooqle.myvnc.com
accounnts-qooqle.serveftp.com
accounnts-qooqle.servequake.com
accounts-google.servemp3.com
accounts-google.servepics.com
accounts-gooogle.onthewifi.com
accounts2-gooogle.servebeer.com
accounts2-gooogle.servehttp.com
accouunnts-gooogle.servequake.com
accouunnts-goooqle.myvnc.com
accouunts-google.servegame.com
accouunts-google.servehttp.com
accouunts-google.servemp3.com
accouunts-googlsec.onthewifi.com
accouunts-gooogle.serveftp.com
accouunts-gooqle.servebeer.com
accouut-gooqle.serveftp.com
accouuts-googlsec.myvnc.com
accouuts-gooqle.servequake.com
accouuts-qooqle.myvnc.com
accouuts-qooqle.servepics.com
dwn.zapto.org
google-secs.ddnsking.com
gooogle-sec.ddnsking.com
gooqle.servequake.com
gsecurity.ddnsking.com
hvmeyq.viewdns.net
lntzz.hopto.org
myaccouunt-google.3utilities.com
pkkfbv.webhop.me
qokfqb.freedynamicdns.org
qooqle.ddnsking.com
rbmmkv.gotdns.ch
secservice.ddns.net
srvdown.ddns.net
uanoak.sytes.net
ugpfoe.freedynamicdns.org
wrdsj.bounceme.net

# Reference: https://app.validin.com/detail?find=79.133.57.36&type=ip4&ref_id=0989d8ab1a4#tab=resolutions

bitservercom.cfd
calendarserver.cfd
newsservercom.cfd
noteupdateserver.cfd
s10diaoioerqoiwueriooiqizer.buzz
s5zdoqueyaoizmdiqowoaiwse.buzz
serverooocom.cfd
ssiqoqyaizmdoaieots.buzz
tianserver.cfd

# Reference: https://app.validin.com/detail?find=173.211.46.158&type=ip4&ref_id=0989d8ab1a4#tab=resolutions

dataserveronline.cfd
matswolfserver.cfd
mydataserveronline.cfd
nonlineservicein.cfd
onlinekoniserver.cfd
onlineswolfserver.cfd
onlineswolfservice.cfd
policeservicecom.cfd
pswolfservice.cfd
ptotoservice.cfd
serveronlineinstall.site
serviceupdatemon.cfd
swolfserveroncony.cfd
swolfserveronkonycom.cfd
uawing977.cfd
updateservercom.cfd

# Reference: https://app.validin.com/detail?find=95.164.86.148&type=ip4&ref_id=0989d8ab1a4#tab=resolutions

aminnetworkstar.online
nitrogin.xyz
kh.aminnetworkstar.online
kharej.aminnetworkstar.online
server.aminnetworkstar.online

# Reference: https://app.validin.com/detail?find=79.110.52.198&type=ip4&ref_id=9984cef0f75#tab=resolutions

accounts2.download
help2.info
nid-naver.date
nid2-naver.online

# Reference: https://x.com/JangPr0/status/1831211999168196617
# Reference: https://www.virustotal.com/gui/file/fd2c6aa42264f7d555e4f1c8194f8c293ab02bc416e43b448cbd09912833d5cf/detection

/0821_pprbss/d.php

# Reference: https://x.com/byrne_emmy12099/status/1831236265599001062

communiquer.be/modules/mod_users_latest/src/Helper/0902_pprb/d.php
/0902_pprb/d.php

# Reference: https://x.com/byrne_emmy12099/status/1831591937310331065
# Reference: https://x.com/JangPr0/status/1834078674850906599
# Reference: https://www.virustotal.com/gui/file/57e9b7d1c18684a4e8b3688c454e832833e063019ed808fd69186c4e20df930a/detection

petssecondchance.larcity.dev
/modules/mod_custom/tmpl/andy/css.php
/modules/mod_custom/tmpl/kndu/dist.php

# Reference: https://x.com/byrne_emmy12099/status/1831827701814251742

mofa.bio

# Reference: https://wezard4u.tistory.com/429269
# Reference: https://www.virustotal.com/gui/file/b0963f531da46ce600c26de41c229edbf1cdf7389e0f998cfc8d9056f200a76d/detection
# Reference: https://www.virustotal.com/gui/file/bd017c642fcd0b46fb1201f22d395edbf16221ebbcb660f7329fb76067164d07/detection

hondes.getenjoyment.net

# Reference: https://www.virustotal.com/gui/ip-address/158.247.202.152/relations
# Reference: https://www.virustotal.com/gui/ip-address/50.114.5.159/relations

appclouds.store
appstart.store
appview.site
appviewer.store
mail.appstart.store
wwwappa.appclouds.store
wwwicda.appclouds.store

# Reference: https://app.validin.com/detail?find=9497a1195f9ae6cc249b25131eab4b37&type=hash&ref_id=fe7abc05664#tab=host_pairs_v2
# Reference: https://app.validin.com/detail?find=9497a1195f9ae6cc249b25131eab4b37&type=hash&ref_id=de46da0d79e#tab=host_pairs (# 2025-07-24)

asanpolicy.lol
asdop.live
barpashop.ir
faorg.site
faraorg.store
hosek.club
jaylose.store
kishe.click
lkjhg.site
luckym.store
nmaveseo.lol
okiyho.store
qweop.site
resolveissue.org
rnofa.store
scorpmansday.site
securitycloud.store
sejongcloude.store
siekn.online
sogangteam.click
zxcop.store
kru2gs6007-r7l702-origin.zlongame.co.kr
mail.resolveissue.org
manage.barpashop.ir

# Reference: https://app.validin.com/detail?find=118.193.68.80&type=ip4&ref_id=6840f27ea05#tab=resolutions

bnxzcwdasde.top
drlopachildcare.com
fcklewc.top
muvkoec.cc
paj541.com
slh8.cn
wmvbh.space
xxdakuopra.top
xxdasjwqpe.top
xxdaskljpwq.top
xxdhsaowo.top

# Reference: https://app.validin.com/detail?find=27.255.81.107&type=ip4&ref_id=ca4b70e8eda#tab=resolutions

gooqle.com.co
namail.eu
accounts.gooqle.com.co
apis.gooqle.com.co
content.gooqle.com.co
myaccount.gooqle.com.co
play.gooqle.com.co
ssl.gooqle.com.co
youtube.gooqle.com.co

# Reference: https://app.validin.com/detail?find=27.255.81.109&type=ip4&ref_id=d08fd4e6a3e#tab=resolutions

naveer.r-e.kr
naven.n-e.kr
nhnlogin.kro.kr
nhnuser.r-e.kr
account.nhnlogin.kro.kr
mail.naveer.r-e.kr
mail.nhnuser.r-e.kr
nidlogin.naven.n-e.kr

# Reference: https://app.validin.com/detail?find=27.255.81.110&type=ip4&ref_id=d08fd4e6a3e#tab=resolutions

accoutatify.store
blogaccout.n-e.kr
ipapercloud.com
kakaoverify.lol
lorinsdbvnre.shop
navcaer.com
naveircorps.shop
nawercorp.store
nidclouds.com
nservicemail.online
severifyticate.store
ucloudpay.net
wonderstacks.com
mail.wonderstacks.com
ng.blogaccout.n-e.kr

# Reference: https://app.validin.com/detail?find=27.255.81.111&type=ip4&ref_id=d08fd4e6a3e#tab=resolutions

mycelp.store
myhelpp.store
mysecp.store
wemeng.store
cwtol.pe.kr
ktsp2.cwtol.pe.kr

# Reference: https://app.validin.com/detail?find=211.253.25.181&type=ip4&ref_id=7b4c4611581#tab=resolutions

vipchina.pe.kr
kts12.vipchina.pe.kr

# Reference: https://app.validin.com/detail?find=45.249.90.101&type=ip4&ref_id=7b4c4611581#tab=resolutions

cdn-naver.com
whocast.pe.kr
ktsp5.whocast.pe.kr
ssl2.cdn-naver.com

# Reference: https://app.validin.com/detail?find=45.249.90.107&type=ip4&ref_id=7b4c4611581#tab=resolutions

whocast2.pe.kr
ktsp7.whocast2.pe.kr

# Reference: https://app.validin.com/detail?find=158.247.200.44&type=ip4&ref_id=7b4c4611581#tab=resolutions

meconnect.info

# Reference: https://app.validin.com/detail?find=27.255.81.80&type=ip4&ref_id=fdbbb3cd229#tab=resolutions

fw388517.info
gudjqlo.shop
gvsdils.shop
gx191978.info
hr755982.info
iw943147.info
kz431311.info
navercorup.site
nbhfjg.online
nhbgvf.shop
nhgjb.online
njghhn.online
njgudd.shop
njhkmb.shop
njhuger.space
njkgvr.online
njkmb.online
njkuer.shop
nkgjhu.space
nmbvcr.shop
nmjhgt.space
nmjhkn.online
nodfvar.online
nvhfbg.shop
nvjsjer.online
nyvjer.online
service-info.co
webmanagger.info

# Reference: https://x.com/asdasd13asbz/status/1833383376658543001

drive-yonsei-ac-kr.bit-albania.com

# Reference: https://x.com/malwrhunterteam/status/1833248658831335691
# Reference: https://www.virustotal.com/gui/file/209f3ae75c872f204f7230f787662979edac2f26654e211778e349ec7e012311/detection

/0904_hck/d.php

# Reference: https://app.validin.com/detail?find=2555eeb04dcd940bcb6db530a0504da7&type=hash&ref_id=6840f27ea05#tab=host_pairs_v2

karaagego.com
packland7.asuscomm.com
packman.mydns.jp
payment.unsika.ac.id
wwwwwwwwxx.packman.mydns.jp

# Reference: https://x.com/malwrhunterteam/status/1805943410106225105
# Reference: https://app.validin.com/detail?find=216.107.137.73&type=ip4&ref_id=9bf3e886966#tab=resolutions
# Reference: https://www.virustotal.com/gui/file/a65e1416735cefb370a04c01364a8816d284eb6b59e31150ddc235c4c059d275/detection

216.107.137.73:6516
adyw.shop
apolsx.online
asowesmc.store
eocdsol.xyz
hyunlaw.site
nialdosx.xyz
o3slc.shop
oawslx.xyz
olopsma.cloud
oolpasc.shop
ozaiku.shop
q7u8o0.online
qeoqwo.shop
qeowsc.site
qowlsga.online
sodlspa.shop
tolpa.shop
zioap.shop

# Reference: https://app.validin.com/detail?find=mx.naver.com&type=dom&ref_id=f49320ac47f#tab=dns

am0erpld.website
aopliofrdms.store
aqolsmcps.website
awelopsc.online
back-face.com
bocvg.website
brabnuio.online
golchalst.store
kiuk.shop
kopldc.website
l0psmx9cls.online
loapssmcix.site
loasom890.shop
loomnb.shop
lophjc.store
m90kpl.site
maps03lx.shop
masterbank.org
monolpscwoe.online
mp-sloa.store
niclc0rp.icu
nodndvnpcmqx.cloud
nodplsa.icu
nolibo.icu
olidmslciwo.icu
oloolo4.site
olpa-msok.store
omzplai2bo.store
opldialc.site
opm9dm.cloud
opqlaodb.site
opsscos.site
osaedop.site
poeratoe.site
polnmcufs.online
qiloq.store
qolpamcb.shop
rodop.store
sadpor.shop
so-pola.cloud
solp-mcn.online
soomk90.website
uslodma.cloud
vocmo.shop
vuiol.cloud
wleos.shop
x0lspcoo.website
x0plsm.site
yolpfjc.site

# Reference: https://app.validin.com/detail?find=79.133.51.174&type=ip4&ref_id=fce6632dac6#tab=resolutions

aloicps.online
aplosm.store
cafemolsop.store
capneno.shop
holui.shop
llopsmi.cloud
mailnicorp.shop
maisevr.tech
mallnalvec.fun
mebvop.online
melomp.shop
memcocp.site
meoslpx.online
milomac.cloud
mlopmooox.store
mopkxsb.shop
mxopl.site
nacc.store
nailcorp.autos
nicmalloc.store
nidcorpev.online
nidnavrcop.tech
nidscorp.website
nobol.store
nodlpamm.site
nolglok.store
olpls.cloud
oprls.shop
opsld.site
pelom.cloud
qmloas.website
safelcg.tech
secpldo.store
soplr.online
speolacn.site
splaos.site

# Reference: https://x.com/StrikeReadyLabs/status/1834412449291706503
# Reference: https://www.virustotal.com/gui/file/e0b4e3f7d35c182ca48c49c635138ab343c4415dae32a086ba19c0ecaf41936e/detection
# Reference: https://www.virustotal.com/gui/file/01c3e4114427cce7ab6bf90cfa72164a8cfd37dcadddb69817c31679e12fd263/detection

serverprotect.online
captcha.serverprotect.online

# Reference: https://x.com/JangPr0/status/1835682416738054190
# Reference: https://www.virustotal.com/gui/file/c4aba442d881cfa112fe3a6b1d2381b089cbe163828cfdb2d57abba95737a07d/detection
# Reference: https://www.virustotal.com/gui/file/963af57641c094df6b5656552daaafd5ced0a1435261e612a4640604d023ebca/detection
# Reference: https://www.virustotal.com/gui/file/41cf6298a41c27357ee5f70d8cd1c0bd48698fc30c4255fad6a91798286e5229/detection

64.49.14.181:7031
64.49.14.181:7032
64.49.14.181:8014

# Reference: https://x.com/0xmh1/status/1835900052679872688

member-apples.info

# Reference: https://x.com/eastside_nci/status/1836494626489774188
# Reference: https://app.validin.com/detail?find=1.214.206.78&type=ip4&ref_id=0d6a8e1c204#tab=resolutions

lnvoice.r-e.kr
nidiogln.o-r.kr
nidiogln.p-e.kr
nldiogin.o-r.kr

# Reference: https://www.virustotal.com/gui/ip-address/154.90.63.101/relations
# Reference: https://app.validin.com/detail?type=ip&find=154.90.63.101#tab=resolutions

fsc-notify.site
lnkedein.site
notion-notify.site
crfjpocslgdjmf6ddui0.ntscustoms.store
emv1.kdca.site
htp-out.wetax-pay.online
http-naver.hometaxctrl.online
http-naver.wetax-pay.online
http-out.wetax-notice.site
http-out.wetax-pay.online
http-out.wetax-pay.site
http-relay.wetax-notice.space
https-naver.hometaxctrl.online
https-naver.wetax-pay.online
https-out.wetax-notice.site
https-out.wetax-pay.online
https-out.wetax-pay.site
https-relay.wetax-notice.space
hxxp-naver.wetax-pay.online
hxxp-out.wetax-notice.site
hxxp-out.wetax-pay.online
hxxp-out.wetax-pay.site
hxxp-relay.wetax-notice.space
hxxps-naver.wetax-pay.online
hxxps-out.wetax-notice.site
hxxps-out.wetax-pay.online
hxxps-out.wetax-pay.site
hxxps-relay.wetax-notice.space
naver.wetax-pay.store
out.wetax-pay.site
smtp.wetax-pay.site

# Reference: https://x.com/byrne_emmy12099/status/1838137788870570058
# Reference: https://app.validin.com/detail?find=66.57.33.100&type=ip4&ref_id=c170e72b192#tab=resolutions
# Reference: https://www.virustotal.com/gui/file/6aa86e6c5ca97af149bf22c4deb7b0456727a4c5e67b508c9518e8c8e1b79795/detection

ermisco.online
mngrdp.site
admin.mngrdp.site

# Reference: https://www.virustotal.com/gui/ip-address/45.14.246.53/relations

mxportal.p-e.kr
login.mxportal.p-e.kr

# Reference: https://x.com/0xmh1/status/1838474248182206942
# Reference: https://x.com/byrne_emmy12099/status/1838481636889116709

sqiesbob.com
evangelia.edu/img/503/doc/d.php

# Reference: https://x.com/eastside_nci/status/1838687293214757165
# Reference: https://www.virustotal.com/gui/ip-address/91.194.160.13/relations

apple-stores.shop
iclouad.store

# Reference: https://x.com/byrne_emmy12099/status/1838719300288512213
# Reference: https://www.virustotal.com/gui/file/fd65c7a42458d05219cd6dad15b8ba28712a2d52e2f10a2060341aa03aedbab8/detection

http://121.66.72.110
121.66.72.110:8000
69.10.133.141:8000
ads.kseme.kro.kr
dkwis.kro.kr
gagos.genmobon.kro.kr
genmobon.kro.kr
kiskmain.kro.kr
kseme.kro.kr
main.dkwis.kro.kr
newrdp.kro.kr
rdp.newrdp.kro.kr
remotemng.site
sertme.kiskmain.kro.kr
/0918_uri_skle/dksleks?na=
/0918_uri_skle/dksleks
/0918_uri_skle/dksdlf?na=
/0918_uri_skle/dksdlf
/0918_uri_skle/
/dksleks
/dksdlf

# Reference: https://x.com/0xmh1/status/1839173077818814740
# Reference: https://x.com/0xmh1/status/1839463862057439266
# Reference: https://www.virustotal.com/gui/ip-address/101.36.114.91/relations

cagebye.store
kinhos.online
narasima.store
pollario.store
radiofreeasia.blog
rfa.lol
rfatotal.one
seoulforum.store
unorg.store
ww12.rfa.lol

# Reference: https://x.com/Syndikalist/status/1839580890961252849
# Reference: https://search.censys.io/hosts/167.88.170.199

drive-viewer.online
documents.drive-viewer.online
ns1.drive-viewer.online
ns2.drive-viewer.online

# Reference: https://x.com/byrne_emmy12099/status/1839419824595952066
# Reference: https://www.virustotal.com/gui/file/342c285efb8798fcba80d695cafc9ae1e097cecc72e01f25df85e4210e9fd638/detection

atlanwelt.de/modules/mod_articles_category/tmpl/0910_simba/denyhg.php
atlanwelt.de/modules/mod_articles_category/tmpl/0910_simba/dfef.php
atlanwelt.de/modules/mod_articles_category/tmpl/0910_simba/dvbhe.php
atlanwelt.de/modules/mod_articles_category/tmpl/0910_simba/dvfh.php
/0910_simba/
/0910_simba/denyhg.php
/0910_simba/dfef.php
/0910_simba/dvbhe.php
/0910_simba/dvfh.php

# Reference: https://x.com/byrne_emmy12099/status/1839697468625494142
# Reference: https://x.com/byrne_emmy12099/status/1899789292026962067
# Reference: https://www.virustotal.com/gui/ip-address/103.76.228.204/relations

http://103.76.228.204
103.76.228.204:443
absera.p-e.kr
eislef.r-e.kr
ioes.kro.kr
watsme.kro.kr
aos.watsme.kro.kr
erts.absera.p-e.kr
opes.eislef.r-e.kr
soe.ioes.kro.kr
/0304_pprb/d.php
/0905_pprb/d.php
/0304_pprb/
/0905_pprb/

# Reference: https://x.com/blackorbird/status/1839610696113459551
# Reference: https://x.com/Syndikalist/status/1839922986591101192
# Reference: https://unit42.paloaltonetworks.com/kimsuky-new-keylogger-backdoor-variant/

bitjoker2024.000webhostapp.com

# Reference: https://app.validin.com/detail?find=158.247.215.96&type=ip4&ref_id=4bd84937ada#tab=resolutions
# Reference: https://app.validin.com/detail?find=84.246.85.175&type=ip4&ref_id=40e6ef58f0c#tab=resolutions

kfshop.lol
ncorpmail.site
ncorpservice.site
ncservice.site
nmailteam.site
npalarm.store
npmails.site
npmanage.site
npnote.site
npsec.site
npsecure.store
npview.site
nviews.site
nviewsec.site
nwebmailcheck.site
nwebmails.site
nwebmans.store
nwebstay.store
nwebview.store
susi-susi.site
vpn.kfshop.lol

# Reference: https://app.validin.com/detail?find=89.187.28.147&type=ip4&ref_id=3503e360c03#tab=resolutions

applesec.site

# Reference: https://app.validin.com/detail?find=154.90.63.209&type=ip4&ref_id=9894aec55a6#tab=resolutions

bdasugiofahf.top

# Reference: https://app.validin.com/detail?find=156.244.19.95&type=ip4&ref_id=4a136f9cbb0#tab=resolutions

applcs.cloud

# Reference: https://app.validin.com/detail?find=192.121.162.82&type=ip4&ref_id=cd9d3bec7bc#tab=resolutions
# Reference: https://app.validin.com/detail?find=194.68.27.24&type=ip4&ref_id=cd9d3bec7bc#tab=resolutions

applesec.info
members-apple.com
s-clouds.top

# Reference: https://x.com/unpacker/status/1840575374939549769
# Reference: https://www.virustotal.com/gui/ip-address/67.217.60.68/relations
# Reference: https://app.validin.com/detail?type=ip&find=67.217.60.68#tab=resolutions

pkzz.org
bigfile.pkzz.org
cloud.adoubleu.de
linkdin.o-r.kr
downloadimage.mooo.com
accouts.linkdin.o-r.kr
share-defence.ohbah.com
share-defence.verymad.net

# Reference: https://app.validin.com/detail?find=74.48.150.189&type=ip4&ref_id=36d8005fa39#tab=resolutions

kerasin.store
telecomtm.life

# Reference: https://app.validin.com/detail?find=202.131.233.167&type=ip4&ref_id=a37a70f2294#tab=resolutions

ipinst.store
janskinmn.lol
japanmofa.co
pdfstore.store
somal.shop
somelmark.store
view-hwp.kro.kr
my.view-hwp.kro.kr

# Reference: https://search.censys.io/search?resource=hosts&sort=RELEVANCE&per_page=25&virtual_hosts=INCLUDE&q=services.banner_hashes%3D+%60sha256%3Afc773ddd38bdea1da844a4da0966438408d738b7600a42dfb8afd598ebfcb2e7%60

nmailsrv.site
nsecsupport.site

# Reference: https://x.com/Huntio/status/1840711527927849053
# Reference: https://app.validin.com/detail?type=ip&find=158.247.206.36#tab=resolutions
# Reference: https://app.validin.com/detail?type=ip&find=158.247.254.187#tab=resolutions

01onlinen.cfd
02onlinen.cfd
03onlinen.cfd
04onlinen.cfd
05onlinen.cfd
06onlinen.cfd
07onlinen.cfd
08onlinen.cfd
09onlinen.cfd
10onlinen.cfd
11onlinen.cfd
12onlinen.cfd
13onlinen.cfd
14onlinen.cfd
15onlinen.cfd
16onlinen.cfd
17onlinen.cfd
18onlinen.cfd
19onlinen.cfd
20onlinen.cfd
21onlinen.cfd
22onlinen.cfd
23onlinen.cfd
24onlinen.cfd
25onlinen.cfd
26onlinen.cfd
27onlinen.cfd
28onlinen.cfd
29onlinen.cfd
30onlinen.cfd
activegserver.store
activeonlineserver.store
activeserviceonline.store
aliveonlinerecover.store
aliveonlineserver.store
alivesiteserver.store
cancelrecoveronline.store
cancelrecoverservice.store
comrecoverserver.store
enter01aaa6n4xxz.cfd
enter02aaa69seoh.cfd
enter03aaahrm3hy.cfd
enter04aaa1t3nqv.cfd
enter05aaapsicia.cfd
enter06aaal9x4d5.cfd
enter07aaat95u3r.cfd
enter08aaa6q7vqq.cfd
enter09aaal1s3p6.cfd
enter10aaadopee9.cfd
enter11aaanjwhp8.cfd
enter12aaamf92xb.cfd
enter13aaaznk4ed.cfd
enter14aaa9a1i4g.cfd
enter15aaaq4958f.cfd
enter16aaajlqvtk.cfd
enter17aaa77ujds.cfd
enter18aaaphyjfc.cfd
enter19aaa4cfx1c.cfd
enter20aaab1b7zd.cfd
enter21aaa0ub39z.cfd
enter22aaaklr7pf.cfd
enter23aaaqijf8o.cfd
enter24aaakt709e.cfd
enter25aaa9tdhus.cfd
enter26aaajw0tvl.cfd
enter27aaavr3494.cfd
enter28aaaradcbl.cfd
enter29aaaowevvu.cfd
enter30aaainq4u3.cfd
enter31aaartpxk6.cfd
enter32aaa4wncrs.cfd
enter33aaagwfnqd.cfd
enter34aaabuj3zn.cfd
enter35aaadobseq.cfd
entergonlinerecover.store
enteronlinerecover.store
enterrecoveronline.store
enterrecoverservice.store
grecoveronlineservice.store
onactivereqonlinecom.store
onlineactiverequest.store
onlinelivecom.store
onrequestserver.store
recmaservice.store
recserviceonline.store
req01avziemzc.cfd
req02ajajznvzc.cfd
req03jjmnzccv.cfd
req04zovbnzc.cfd
req05iiizncccla.cfd
req06jaivnzccc.cfd
reqons01hyush2.cfd
reqons02eg7dr9.cfd
reqons037610nq.cfd
reqons045e5yxs.cfd
reqons05bj9vy5.cfd
reqons0623oplv.cfd
reqons07n7qmfd.cfd
reqons08274jg0.cfd
reqons09maqun7.cfd
reqons10hapwp4.cfd
reqons11y48b0e.cfd
reqons121gdvu5.cfd
reqons1385xxp9.cfd
reqons140x6gym.cfd
reqons15u54pc6.cfd
reqons165ecpq9.cfd
reqons17wmxeqf.cfd
reqons18lblnyp.cfd
reqons19xtcqwf.cfd
reqons202gokmp.cfd
requsetliveserver.store
sendactiverequest.store
sendreqestonline.store
serverrecoveronline.store
servicegaccount.store
servicegonline.store
sirecoverserver.store
siteaccountlive.store
sitealivecomservice.store
sitealiveserver.store
siteonlinerecover.store
siteonlinerecovercom.store
siterecoveronline.store
siterecoverservice.store
soactivecomserver.store
stawb01gn0wis.cfd
stawb02np9xva.cfd
stawb03jsf615.cfd
stawb04sgrzfj.cfd
stawb05zfelp0.cfd
stawb06w44vp6.cfd
stawb0793wkzx.cfd
stawb086n5nqp.cfd
stawb091onxxc.cfd
stawb10thx69e.cfd
stawb11zibyxr.cfd
stawb12rxy4od.cfd
stawb13hhjij2.cfd
stawb144fh5z4.cfd
stawb15q9x8mb.cfd
stawb16d9jor9.cfd
stawb177t52b8.cfd
stawb18nkj77h.cfd
stawb192yt6zm.cfd
stawb207dusgy.cfd
stawb21bl4qrm.cfd
stawb22kneus3.cfd
stawb23hliaul.cfd
stawb24u70y20.cfd
stawb25nl3bq9.cfd
stawb26bs0nww.cfd
stawb277jl796.cfd
stawb28ie0uhc.cfd
stawb29dwc8kw.cfd
stawb30vrdi53.cfd
stawb31ps6gs1.cfd
stawb320csitg.cfd
stawb33m9tcia.cfd
stawb34ryer9k.cfd
stawb35vlu7za.cfd
stawb368logok.cfd
stawb37ur1b3o.cfd
stawb38bn6i55.cfd
stawb39p3o67w.cfd
stawb403v9zdu.cfd
stawb416tr4on.cfd
stawb42dz14p5.cfd
stawb43dnnytx.cfd
stawb4472ekh2.cfd
stawb45ytmrej.cfd
stawb466scgiy.cfd
stawb474p5wpx.cfd
stawb48han4hk.cfd
stawb4908udlz.cfd
stawb50e92u4m.cfd
useactiveonline.store
visitghostingonline.store
visitghostingserver.store
visitghostserver.store
visitrecoverserver.store

# Reference: https://www.virustotal.com/gui/ip-address/114.55.89.54/relations

http-nid.naverc0rp.com
http-nidiogin.naverc0rp.com
http-nidlogin.naverc0rp.com
http-www.naverc0rp.com
https-nid.naverc0rp.com
https-nidiogin.naverc0rp.com
https-nidlogin.naverc0rp.com
https-www.naverc0rp.com

# Reference: https://x.com/byrne_emmy12099/status/1841807065330893123
# Reference: https://x.com/StrikeReadyLabs/status/1842160937358278796
# Reference: https://www.virustotal.com/gui/file/aaecb10ca453bec3bb95bedac6d773a593ea984509845eb7b15d8894d4b385ad/detection
# Reference: https://www.virustotal.com/gui/file/e4062c414dde41e9d50ea6fcdda096d79afdf9d99ef8b5c27a0fd8e75e05edd1/detection

206.206.127.152:7031
206.206.127.152:7032
206.206.127.152:9002
206.206.127.152:9027

# Reference: https://x.com/MichalKoczwara/status/1841893397461877222
# Reference: https://www.virustotal.com/gui/ip-address/154.90.63.72/relations

flyasian.online
korean-air.cloud
nts-app.cloud
nts-mail.cloud
ntshomes.info
ntshomes.store
ntsinf.cloud
ntsxapp.site
wetaxio.site
wetaxio.store
cc.nts-mail.cloud
korea11.2x1.top
korea22.2x1.top
lcs.nts-mail.cloud
lcs.ntsxapp.site
naver.korean-air.cloud
naver.nts-mail.cloud
naver.ntsxapp.site
naver.wetaxio.site

# Reference: https://x.com/lazarusholic/status/1842014336791019890
# Reference: https://www.genians.co.kr/blog/threat_intelligence/blueshark

cafe24.pro
dh00386.com
jinsungm.com
lopin.space
mailplug.shop
nzzstore.site
plutg.shop
poiuyt.store
temuco.xyz
mail.poiuyt.store

# Reference: https://www.virustotal.com/gui/ip-address/52.177.14.24/relations

http-accounts.fixcool.net
http-all.com-password.link
http-nid.moue.naver-active.online
http-nid.naver-active.online
http-nid.neaply.naver-active.online
http-pood.navers.com-password.link
http-www.fixcool.net
http-www.nid-login.com
http-www.o365.fixcool.net
http-www.smtper.org
https-accounts.fixcool.net
https-all.com-password.link
https-moue.naver-active.online
https-mybox.com-password.link
https-navors.com-password.link
https-neaply.naver-active.online
https-nid.moue.naver-active.online
https-nid.naver-active.online
https-nid.neaply.naver-active.online
https-pood.navers.com-password.link
https-www.fixcool.net
https-www.nid-login.com
https-www.o365.fixcool.net
https-www.smtper.org

# Reference: https://x.com/eastside_nci/status/1843741402775404590
# Reference: https://search.censys.io/hosts/5.253.41.86

documenthomes.online
iclodues.store
iclodus.info
kuroneakoyarmato.shop
nta-taxes.com
userdetailer.site
userdetails.online
userscheck.com
5g.iclodues.store
apple.iclodus.info

# Reference: https://x.com/0xmh1/status/1843884882055049690

delivrto.me
files.delivrto.me
/wp-content/plugins/health-check/pages/gorgon1/d.php

# Reference: https://x.com/eastside_nci/status/1829413694323020040
# Reference: https://app.validin.com/detail?find=23.27.202.204&type=ip4&ref_id=5b9e1c020c1#tab=resolutions
# Reference: https://app.validin.com/detail?type=ip&find=63.250.44.85#tab=resolutions
# Reference: https://search.censys.io/search?resource=hosts&sort=RELEVANCE&per_page=25&virtual_hosts=INCLUDE&q=services.banner_hashes%3D%22sha256%3A14309ae76fa5485d6498b8cda9c17e4f9e0e0a58a4fe98c47656b80bc5e6bc09%22

arabia.reviews
cj7778.top
docstore.n-e.kr
docstore.p-e.kr
workcenter.p-e.kr
my.docstore.n-e.kr
my.docstore.p-e.kr
nid.workcenter.p-e.kr
kemop.cj7778.top
ccc.mdr-dns.ddns.net
cs.moi.gov.sa.waps.bio
crt.wtf
cvc.services
dnss.world
prttcol.world
waps.bio
gov.sa.crt.wtf
gov.sa.dnss.world
gov.sa.prttcol.world
gov.sa.waps.bio
mdr-dns.ddns.net
mo.moi.gov.sa.crt.wtf
mofa.gov.sa.crt.wtf
mofa.gov.sa.dnss.world
mofa.gov.sa.waps.bio
moi.gov.sa.crt.wtf
moi.gov.sa.dnss.world
moi.gov.sa.prttcol.world
moi.gov.sa.waps.bio
mw.moi.gov.sa.crt.wtf
pro.visa.mofa.gov.sa.dnss.world
prote.moi.gov.sa.dnss.world
protection.moi.gov.sa.dnss.world
sa.crt.wtf
sa.dnss.world
sa.prttcol.world
sa.waps.bio
saudi.arabia.reviews
scs.visa.mofa.gov.sa.dnss.world
visa.mofa.gov.sa.crt.wtf
visa.mofa.gov.sa.dnss.world
visa.mofa.gov.sa.waps.bio

# Reference: https://www.virustotal.com/gui/ip-address/64.20.49.246/relations
# Reference: https://www.virustotal.com/gui/file/190306e4f45b68c981af01b203ef67a58b1c503a82d66c98d57af8b7841cc124/detection

hell0world.r-e.kr
download.hell0world.r-e.kr

# Reference: https://x.com/TLP_R3D/status/1844803543267471606
# Reference: https://urlscan.io/search/#hash%3A9b43f670273b6a12b2b6894a9e29157c1859717594e98ccc5fb3eea05e71f4ed

accountskk.certuser.info
dneros.usage.store
emv1.kakaoaccouts.store
fneros.usage.store
googlmeil.com
kakao.com.cm
komale.eu
kr-sw.serverinfo.site
live-kr.com
mailcorp.center
main.in.net
natemail.info
oncloudvip.eu
poseides.store
serverinfo.site
toauthman.biz
yahoo-jp.center

# Reference: https://x.com/0xmh1/status/1844650735746810362
# Reference: https://app.validin.com/detail?type=ip&find=158.247.217.236#tab=resolutions

apporigin.store
appstoragesdkorg.store
kedocfollow.store
kedoctome.store
kerelateall.store
kerelativemoon.store
kesdos.xyz
keucis.beauty
kobookall.store
koedocmens.store
koedocserve.store
koservdocs.store
sellura.store
siedsocs.lat

# Reference: https://x.com/TLP_R3D/status/1844759980676694030
# Reference: https://app.validin.com/detail?find=45.125.64.221&type=ip4&ref_id=b92a81ed464#tab=resolutions
# Reference: https://app.validin.com/detail?find=156.244.19.95&type=ip4&ref_id=b92a81ed464#tab=resolutions

appallus.store
applcs.site
applecenter.cloud
goocglc.cloud
goolgc.cloud
goolgce.cloud
goolgcs.cloud
goolges.cloud
lotteonbellygom.top
ntsxapp.cloud

# Reference: https://app.validin.com/detail?find=141.164.51.224&type=ip4&ref_id=16907679d5c#tab=resolutions

brookingauth.store
interbate.store
utilitauth.store

# Reference: https://app.validin.com/detail?type=ip&find=45.125.67.250#tab=resolutions

bananabuffet.store
hwmailchn.p-e.kr

# Reference: https://app.validin.com/detail?find=156.244.19.175&type=ip4&ref_id=35117e21469#tab=resolutions

myboxapp.online
nts-app.online
nts-app.shop
nts-mails.cloud
nts-main.cloud
nts-news.cloud
nts-notify.cloud
ntsapp.icu
ntsapplication.cloud
ntsapps.cloud
ntsapps.icu
ntsemail.icu
ntsgov-kr.cloud
ntsgov.cloud
ntshelp.shop
ntshome-kr.cloud
ntshometax.cloud
ntsinfrom.cloud
ntskor.cloud
ntslawfirm.cloud
ntsmail.icu
ntsmails.icu
ntsnews.shop
ntsposting.icu
ntstaxes.icu
ntsxmail.shop
ftp.myboxapp.online

# Reference: https://x.com/eastside_nci/status/1847785065935192113
# Reference: https://x.com/byrne_emmy12099/status/2027362636669812866
# Reference: https://search.censys.io/hosts/107.189.15.105
# Reference: https://search.censys.io/hosts/107.189.16.65
# Reference: https://www.virustotal.com/gui/ip-address/107.189.15.105/relations
# Reference: https://www.virustotal.com/gui/file/1fd4cdad8d32dc17513b4e4a79f42c9d616e5268d63ed497a43aea0669e50c00/detection
# BANNER_0_HASH-HOST=e4231f7e164db31dab419357887d4a5a

107.189.16.65:3389
107-189-24-28.cprapid.com
107.189.24.28.sslip.io
airportcloseindoor.site
appleplus.shop
conform.site
contras.site
ecolekeonig.top
file-explorer-aerocenter.org
flip3doc-33.org
gyvan3-ppfhg.link
h3-yzk3we.top
layer5043.space
mintaliked.link
present-info.org
schulen-horw.com
securitymid.com
shelby-cp-ecole.org
topseven.top
vinetro.info
websites.ink
wrightechltd.link
admin.contras.site
api.contras.site
api.websites.ink
app.contras.site
backend.contras.site
demo.contras.site
demo.websites.ink
dev.contras.site
invoice.securitymid.com
itamaraty.securitymid.com
maver.securitymid.com
nidlogin.securitymid.com
outlook.securitymid.com
staging.contras.site

# Reference: https://search.censys.io/search?resource=hosts&sort=RELEVANCE&per_page=25&virtual_hosts=INCLUDE&q=services.banner_hashes%3D%22sha256%3A813ca5c780472f08bc50280e8e646e0b8b454bc33bd82e7188e921b673e5970d%22&cursor=eyJhbGciOiJFZERTQSJ9.eyJub25jZSI6ImEvaXlqSFhHc205NHhTelJoOStpK1c1V0RVS0lKYUhIQ3RYZXMxRXE5Y0kiLCJwYWdlIjo2LCJyZXZlcnNlZCI6ZmFsc2UsInNlYXJjaF9hZnRlciI6WzE0LjMzMDk0NCwxNzI5MjAzMjA4MzgyLCIxNTguMjQ3LjIzOC4xNTUiLCI4OW5zZXJ2ZXJjYy5jZmQiXSwic29ydCI6W3siX3Njb3JlIjp7Im9yZGVyIjoiZGVzYyJ9fSx7Imxhc3RfdXBkYXRlZF9hdCI6eyJtaXNzaW5nIjoiX2xhc3QiLCJtb2RlIjoibWluIiwib3JkZXIiOiJkZXNjIn19LHsiaXAiOnsibWlzc2luZyI6Il9sYXN0IiwibW9kZSI6Im1pbiIsIm9yZGVyIjoiYXNjIn19LHsibmFtZS5fX3JhdyI6eyJtaXNzaW5nIjoiX2xhc3QiLCJtb2RlIjoibWluIiwib3JkZXIiOiJhc2MifX1dLCJ2ZXJzaW9uIjoxfQ.NUQJAealZkovLjlkSJAbTi3vLwoK7UZjGaYrIynbBemft5VWMu9mh6qWxq_h80G6MuEVPSFJSLMnkWJ5Go9wCQ

059879e5-b2e8-4f58-aa46-95f69d92aa34.random.onlinenhiscomservice.store
2c8b3f19-0325-4acc-a3dd-31a918e4dbf5.random.enternhisserver.store
33nservercc.cfd
51nservercc.cfd
55nservercc.cfd
57nservercc.cfd
58nservercc.cfd
61nservercc.cfd
62nservercc.cfd
63nservercc.cfd
64nservercc.cfd
65nservercc.cfd
67nservercc.cfd
68nservercc.cfd
70nservercc.cfd
71nservercc.cfd
72nservercc.cfd
75nservercc.cfd
76nservercc.cfd
77nservercc.cfd
78nservercc.cfd
79nservercc.cfd
80nservercc.cfd
81nservercc.cfd
82nservercc.cfd
83nservercc.cfd
84nservercc.cfd
85nservercc.cfd
86nservercc.cfd
87nservercc.cfd
88nservercc.cfd
89nservercc.cfd
90nservercc.cfd
94nservercc.cfd
952cd7f5-55c2-472f-bc9d-08487ef75661.random.fornmailcorphost.store
952cd7f5-55c2-472f-bc9d-08487ef75661.random.nvcees.xyz
95nservercc.cfd
96nservercc.cfd
97nservercc.cfd
98nservercc.cfd
99nservercc.cfd
activemail.store
bgptools-wildcard-confirmed.enternhisserver.store
bgptools-wildcard-confirmed.onlinenhiscomservice.store
censslwasonline.site
ep02dhldzmeijbjyx.sbs
ep03faobgtnvptsdx.sbs
ep07wnxpbesobcpzz.sbs
ep08yurnxpioiwjvg.sbs
ep09njaxmhnlypaql.sbs
ep13gktcdodbtdxhx.sbs
ep19zwxltasmhvkgn.sbs
ep23skcdmsriziyuj.sbs
ep24vvrehjgldphit.sbs
ep25nsmmbqzvbcrhm.sbs
ep26woknuxksemquw.sbs
ep30pgtlsycprnroh.sbs
everyconnect.store
fnsc-law.info
fornmailcorphost.store
fornmailcorphosting.store
fornmailcorponline.store
fornmailcorpserver.store
fornmailcorpservice.store
fornmailserver.store
hostnmailcorpserver.store
hostnmailcorpservice.store
hostnmailserver.store
invesslonlinesite.store
neallisewell.site
neallowseal.site
nehappyday.site
nepopup.site
netimeline.site
neweblove.site
nextonlinecom.store
nhaihis.site
nhbook.site
nhhaowell.site
nhhopesee.site
nhwelldone.site
niadinweb.site
nicheck.site
niprogress.site
nitiemesend.site
nkfaraway.site
nkfindme.site
nkforever.site
nksnow.site
nktakeme.site
nuaccounts.site
nunu2.tv
nunu3.tv
nurepair.site
nuserviser.site
nuwebmin.site
onlinehostnmail.store
onlinehostnmailcorp.store
onlinehostnmailserver.store
onlinehostnmailservice.store
onlinenextserver.store
onlinenhiscomservice.store
onlinenhisserver.store
random.enternhisserver.store
random.fornmailcorphost.store
random.nvcees.xyz
random.onlinenhiscomservice.store
rnoeuvivzsonvmrunvzteakvziiou.site
safeallowsite.store
sigcallonline.site
signnextserver.site
tnzcallsig.site
visitnhisonline.store
vvianxomvnzvfnrowdenfa.site

# Reference: https://hunt.io/blog/dprk-phishing-targets-naver-apple-domain-spoofing
# Reference: https://app.validin.com/detail?find=158.247.238.155&type=ip4&ref_id=620b77cfe73#tab=resolutions

http://158.247.238.155
158.247.238.155:443
01nservercc.cfd
02nservercc.cfd
03nservercc.cfd
04nservercc.cfd
05nservercc.cfd
06nservercc.cfd
07nservercc.cfd
08nservercc.cfd
09nservercc.cfd
100nservercc.cfd
10nservercc.cfd
11nservercc.cfd
12nservercc.cfd
13nservercc.cfd
14nservercc.cfd
15nservercc.cfd
16nservercc.cfd
17nservercc.cfd
18nservercc.cfd
19nservercc.cfd
20nservercc.cfd
21nservercc.cfd
22nservercc.cfd
23nservercc.cfd
24nservercc.cfd
25nservercc.cfd
26nservercc.cfd
27nservercc.cfd
28nservercc.cfd
29nservercc.cfd
30nservercc.cfd
31nservercc.cfd
32nservercc.cfd
34nservercc.cfd
35nservercc.cfd
36nservercc.cfd
37nservercc.cfd
38nservercc.cfd
39nservercc.cfd
40nservercc.cfd
41nservercc.cfd
42nservercc.cfd
43nservercc.cfd
44nservercc.cfd
45nservercc.cfd
46nservercc.cfd
47nservercc.cfd
48nservercc.cfd
49nservercc.cfd
50nservercc.cfd
52nservercc.cfd
53nservercc.cfd
54nservercc.cfd
56nservercc.cfd
59nservercc.cfd
60nservercc.cfd
66nservercc.cfd
69nservercc.cfd
73nservercc.cfd
74nservercc.cfd
91nservercc.cfd
92nservercc.cfd
93nservercc.cfd
akeboancall.site
allowsafesigcall.store
bista.rest
coolfun.xyz
daibn.pics
fomdtw5.preview.coolfun.xyz
fpas.rest
fwqqgfkomdtw5.getx.cafe
getx.cafe
hostingnhislogin.store
hostnmailservice.store
img.getx.cafe
mail.pomabrush.vip
mntia-docu.pics
nextjson0190a4qk.cfd
nextjson02c4ey1s.cfd
nextjson0389pgss.cfd
nextjson04d5587j.cfd
nextjson053mn2sl.cfd
nextjson06sdusda.cfd
nextjson076dk23t.cfd
nextjson085vn0zu.cfd
nextjson098qomdl.cfd
nextjson107herr0.cfd
nextjson114qh7h7.cfd
nextjson12xie0xi.cfd
nextjson13wtacjr.cfd
nextjson14znq3ph.cfd
nextjson15ioqi5r.cfd
nextjson165r2k1r.cfd
nextjson17ulip99.cfd
nextjson18a53hel.cfd
nextjson19rrlk2a.cfd
nextjson20u2cpz2.cfd
pomabrush.vip
preview.coolfun.xyz
rokis.bond
stia-view.hair
tz9jhsx2xfeur.getx.cafe
vcc019vy500jd0c.cfd
vcc02clan23u2zm.cfd
vcc03e58xzbnkrr.cfd
vcc04rnyphdascj.cfd
vcc05uku9x2ypld.cfd
vcc0644609bkquu.cfd
vcc07vo082wd0tl.cfd
vcc08q4ecdof91x.cfd
vcc098sl1p81yyi.cfd
vcc104ddykbn0m2.cfd
vcc111yllwppsts.cfd
vcc12gmfwxpfrwy.cfd
vcc13c299bj3c3p.cfd
vcc14fpfw7nahxq.cfd
vcc152mmjqaxhj8.cfd
vcc1600dkfakand.cfd
vcc1725u00fueij.cfd
vcc18cqsaybx5vh.cfd
vcc1954wdr9niim.cfd
vcc200pprldzu80.cfd
vcc21hi1i2enpyq.cfd
vcc22ezxibhxb4n.cfd
vcc23hp99prk7sf.cfd
vcc249sv865tkxu.cfd
vcc25cz3pmmtzof.cfd
vcc269ajbinfaf9.cfd
vcc27y7lg7yk2gf.cfd
vcc28wwnj7c14vs.cfd
vcc29rhlk0m9sra.cfd
vcc3049dpo7my7g.cfd
vcc31h61wr7rdfq.cfd
vcc325ps8o1bvq4.cfd
vcc339t6l0yy9il.cfd
vcc348ot34o89y7.cfd
vcc35ai58zrybff.cfd
vcc36hhg6o68fkr.cfd
vcc37lt8xq1xyes.cfd
vcc38n1f4rj83aa.cfd
vcc392yy9upmexh.cfd
vcc40eq4rq81zxc.cfd
vcc41v6j5pzpcfl.cfd
vcc4211b70cemu1.cfd
vcc43os8ky66ucd.cfd
vcc44vwdwidobf1.cfd
vcc45fuy4quyfxg.cfd
vcc46awgib96xxx.cfd
vcc47lsnp1v7ebv.cfd
vcc48485tfvvdfn.cfd
vcc49bh2q15j9lq.cfd
vcc50w96lvad9xk.cfd
vcc51y95co7modt.cfd
vcc52b5kgisskco.cfd
vcc53m0xrjoitqx.cfd
vcc54y015dmgwsd.cfd
vcc550ogs9ho3im.cfd
visitnhisserver.store

# Reference: https://hunt.io/blog/dprk-phishing-targets-naver-apple-domain-spoofing
# Reference: https://app.validin.com/detail?find=154.221.29.102&type=ip4&ref_id=10fae19e805#tab=resolutions
# Reference: https://app.validin.com/detail?find=185.239.0.40&type=ip4&ref_id=aad29970d48#tab=resolutions
# Reference: https://app.validin.com/detail?find=185.239.0.42&type=ip4&ref_id=759c41538ff#tab=resolutions
# Reference: https://app.validin.com/detail?find=185.239.0.43&type=ip4&ref_id=759c41538ff#tab=resolutions
# Reference: https://app.validin.com/detail?find=5.63.23.83&type=ip4&ref_id=4578c0d4fbe#tab=resolutions
# Reference: https://app.validin.com/detail?find=84.47.233.82&type=ip4&ref_id=759c41538ff#tab=resolutions
# Reference: https://app.validin.com/detail?find=84.47.233.83&type=ip4&ref_id=06b0cd20ba8#tab=resolutions
# Reference: https://app.validin.com/detail?find=84.47.233.84&type=ip4&ref_id=759c41538ff#tab=resolutions

appleplus.info
appleplus.online
appleplus.pro
appleplus.sbs
appleplus.site
appleplus.space
appleplus.store
appleplus2.site
dnbaletmigardam.top
ecolekoenig.top
hydadhybidad2.xyz
janejahan.shop
janeman.one
madarjan.site
memberadd.xyz
mobiletapp.sbs
niatell.shop
pasargad.fun
pasargad.homes
pasargad.pw
profilepictures.shop
speedvps.fun
tarifaconcursodeacreedores.top
westwindmotorinn.xyz
yadeayam.online
yarzzk.link
applelplus1.hydadhybidad2.xyz
appleplus.dnbaletmigardam.top
sub.appleplus.store
ulta.appleplus.store

# Reference: https://x.com/MichalKoczwara/status/1848632253129048261
# Reference: https://www.virustotal.com/gui/ip-address/158.247.201.165/relations
# Reference: https://app.validin.com/detail?type=ip&find=158.247.201.165#tab=resolutions

marriotth.com
nhebooksend.site
nhnote.site
nisentmail.site
treeofgod.site
about.marriotth.com
cchealth.nepopup.site
dallas.treeofgod.site
lcshealth.nepopup.site
lcshealth.netimeline.site
lcshealth.nhebooksend.site
lcshealth.nitiemesend.site
nidhealth.nepopup.site
nidhealth.netimeline.site
nidhealth.nhebooksend.site
nidhealth.nhhaowell.site
nidhealth.nitiemesend.site
sslhealth.nepopup.site
sslhealth.netimeline.site
sslhealth.nhebooksend.site
sslhealth.nitiemesend.site
staticnidhealth.nepopup.site
staticnidhealth.netimeline.site
staticnidhealth.nhebooksend.site
staticnidhealth.nitiemesend.site

# Reference: https://x.com/ValidinLLC/status/1848754999246950562
# Reference: https://app.validin.com/detail?type=ip&find=158.247.225.78#tab=resolutions

ntclockwork.site
ntgotiming.site
nthereweare.site
ntspotview.site
nunu4.tv
nunu5.tv
nunu6.tv
nunutv1.me
nv01awyclthvk.sbs
nv02kqrxuojcp.sbs
nv03tceoclgrr.sbs
nv04bpcrsfcre.sbs
nv05ymtvktylc.sbs
nv06yhqmidiak.sbs
nv07mmobtqlzi.sbs
nv08orelntknp.sbs
nv09tpzhcyrfe.sbs
nv10meqykmvsj.sbs
nv11neivcerdj.sbs
nv12hnslmrdha.sbs
nv13ouwphifwy.sbs
nv14biapevwfj.sbs
nv15otookjrul.sbs
nv16ysekthzyc.sbs
nv17fedzraywl.sbs
nv18njhyxgido.sbs
nv19whkblnuam.sbs
nv20usqaacgte.sbs
nv21fzrdgptrh.sbs
nv22uccrqouhg.sbs
nv23ffdelksai.sbs
nv24iabatyfee.sbs
nv25unbuasdoy.sbs
nv26mfqrhpvvp.sbs
nv27iphharjey.sbs
nv28vqkgzdivw.sbs
nv29qjbtcqftr.sbs
nv30cldwdnxby.sbs
nv31dzagkeyze.sbs
nv32lpagbvbxa.sbs
nv33xqvtzpfol.sbs
nv34ktpfbdlpg.sbs
nv35dfxedfphk.sbs
nv36vgzytvvmf.sbs
nv37cvlenbsuk.sbs
nv38wpjssnevp.sbs
nv39uvmvtkmss.sbs
nv40pjexbsxwr.sbs
xvideos-k1.com
info.nunu4.tv
info.nunu6.tv
up.nunu6.tv

# Reference: https://app.validin.com/detail?find=158.247.199.185&type=ip4&ref_id=e3f9316944d#tab=resolutions

ep01xmsisorelgqee.sbs
ep04eqooecrgtiwfq.sbs
ep05uggicuxklehpj.sbs
ep06bhlwolbivyrzj.sbs
ep10gqmfkhtthnwcu.sbs
ep11nebvbydvotdoy.sbs
ep12imrjiejxtronp.sbs
ep14fsxnzjudaztvz.sbs
ep15qryzulkfcmxgl.sbs
ep16gmxwjpoosaiaz.sbs
ep17qkdsrmviapqij.sbs
ep18rlqelgwebslzk.sbs
ep20ouxyknswarnfe.sbs
ep21gavhdpgnpcdjb.sbs
ep22wgqsixgwlpknr.sbs
ep27thcxhhjzugurm.sbs
ep28mlfqwjoqndrre.sbs
ep29vxwhmgbdjcoml.sbs
nehomeday.site
nehostme.site
nhmiss.site
nkheart.site
nkmountain.site
nksongto.site

# Reference: https://app.validin.com/detail?find=158.247.237.186&type=ip4&ref_id=b5eea0cb2c6#tab=resolutions

ccmsnv.site
ccnspv.online
csencv.xyz
csnveo.info
encsv.cloud
eomnsvc.biz
fnsc-law.online
fnsc.pro
ncc-fs.xyz
necsv.site
niloinmast.site
nisecueall.site
niweballow.site
scnvff.art
skccnv.store

# Reference: https://x.com/ValidinLLC/status/1849023544212013550
# Reference: https://www.virustotal.com/gui/ip-address/154.90.62.152/relations

cc.homestaxs.info
cc.ntsflag.site
cc.ntstool.site
emv1.ntsapp.cloud
emv1.ntstool.site
eposting.site
fasopfegnb.top
gduasgdkabad.top
homestaxs.info
lcs.homestaxs.info
lcs.ntshomes.info
lcs.ntskeep.site
lcs.ntstool.site
naver.homestaxs.info
naver.nts-notice.shop
naver.ntsapps.online
naver.ntscheck.online
naver.ntshomes.info
naver.ntsinbox.site
naver.ntskeep.site
naver.ntsreport.cloud
naver.ntstool.site
nts-notice.cloud
nts-notice.shop
ntsapps.online
ntscheck.online
ntsdraft.site
ntsinbox.site
ntskeep.site
saramin.online

# Reference: https://x.com/ValidinLLC/status/1849037034943328642
# Reference: https://app.validin.com/detail?find=2a02%3A4780%3A2b%3A1633%3A0%3A1d47%3Ab9f8%3A0%2F124&type=ip&ref_id=d84560c58e8#tab=resolutions

bigsharksea.site
bitstampout.site
fmailyalbumview.site
generaltransport.site
gloriouszoo.store
ntsread.site
srcfiledownload.site
strategyhome.shop

# Reference: https://app.validin.com/detail?find=154.90.63.121&type=ip4&ref_id=e2c7b06673f#tab=resolutions

ntscontact.cloud
ntsgate.site
ntshome.xyz
ntsinfo.xyz
ntslog.site
ntspost.xyz
ntspro.site
ntsshare.online
ntstask.site
ntswall.site
saredloemail.shop

# Reference: https://app.validin.com/detail?find=101.36.114.88&type=ip4&ref_id=c0a63c4d30b#tab=resolutions

tranquiltrade.tech

# Reference: https://app.validin.com/detail?find=101.36.114.94&type=ip4&ref_id=c0a63c4d30b#tab=resolutions

empaiothongkong.tech

# Reference: https://www.virustotal.com/gui/ip-address/27.255.80.170/relations

acause.info
agellar.info
anause.info
goodsjobs.eu
googlemoons.info
naverite.info
necsgn.info
netsgn.info
nid-security.com
omsuk.info
wabsaic.info
wabsaik.info

# Reference: https://app.validin.com/detail?find=141.164.63.142&type=ip4&ref_id=0ace6b4321b#tab=resolutions

checkuser.website

# Reference: https://app.validin.com/detail?find=118.193.69.53&type=ip4&ref_id=71ea494f09d#tab=resolutions

antiranue.site
bureopen.store
fundora.site
githuse.store
muslime.store
nirso.ink
xwczxupas.top
xwxcpoiaz.top
yzadapapwt.top

# Reference: https://app.validin.com/detail?find=118.36.192.211&type=ip4&ref_id=06afbd1c956#tab=resolutions (# 2024-11-23)

goodemail.info
goqqle.eu
live.co.cm
mail.never.com.de
mycloud.never.com.de
never.com.de
news.info.ro
unescos.news.info.ro

# Reference: https://x.com/0xmh1/status/1860945321272180931
# Reference: https://app.validin.com/detail?type=ip&find=158.247.201.113#tab=resolutions

emabssyload.store
embassycheck.store
gotera.site
realiycheck.store
ssoutilye.store

# Reference: https://www.genians.co.kr/blog/threat_intelligence/kimsuky-cases

cookiemanager.n-e.kr
nidiogln.n-e.kr
naverbox.p-e.kr
covd.2kool4u.net
ned.kesug.com
wud.wuaze.com
owna.loveslife.biz

# Reference: https://app.validin.com/detail?find=61.97.243.32%2F28&type=ip&ref_id=5b3593f547a#tab=resolutions

awaiians.info
havattle.com
kakao-notice.com
korea-sign.kro.kr
naeveor.com
nate.com.mx
navarcorp.com
naveear.com
naver-deploy.com
naver-domain.com
naver-domains.com
naver-eml.com
naver-firewall.com
naver-host.com
naver-hosts.com
naver-ipcheck.com
naver-master.com
naver-mxcheck.com
naver-noreply.com
naver-notice.center
naver-notice.com
naver-notify.com
naver-privacy.center
naver-private.com
naver-project.com
naver-protect.com
naver-protocol.com
naver-provider.com
naver-query.com
naver-rule.com
naver-sites.com
naver-team.center
naver-trust.com
naver-vaccine.com
naver-virtual.com
naver-virutal.com
naver-whale.com
naverccorp.com
navercheck.com
naverclouds.com
navercorp.click
navercorp.co.com
naverdefend.com
naverlinks.com
navermail.center
navermybox.com
naverprotect.center
naverprovider.com
naverquery.com
naverwhale.com
sogou-info.com
mail.korea-sign.kro.kr

# Reference: https://x.com/asdasd13asbz/status/1864483777701138629
# Reference: https://www.virustotal.com/gui/file/7689f8c2bfff6262a5885f3e5afc5442dc8a60bfa463da821e348b095d45e362/detection

http://72.14.155.62
memconfirms.online
odhistory-shoppings.info

# Reference: https://x.com/byrne_emmy12099/status/1866361211291660359
# Reference: https://www.virustotal.com/gui/file/e6bcdb402999f6f35351c0b9a1be84345aea88c3f662ba27341d7857aeb8cc39/detection

nasweir.com

# Reference: https://app.validin.com/detail?find=156.244.19.38&type=ip4&ref_id=d113af9aeee#tab=resolutions

ntsdash.cloud
ntsguest.cloud
ntsmanager.cloud
ntsplus.cloud
ntsservice.cloud
ntsxteam.cloud
uppbit.cloud

# Reference: https://x.com/cyberwar_15/status/1873869713773924825
# Reference: https://x.com/cyberwar_15/status/1873880914222317626
# Reference: https://www.virustotal.com/gui/file/c43507b6f2c2cb033d3f55229b20adfde9cda4dfb93dc3db45556847638ec7f8/detection

accountprotection.info
googlauth.com
kakao-auth.com
kakauth.com
navauth.com
naver-auth.com
review.accountprotection.info

# Reference: https://www.virustotal.com/gui/ip-address/203.96.177.116/relations

googlkids.shop
husband.n-e.kr

# Reference: https://x.com/byrne_emmy12099/status/1876505616124162071
# Reference: https://www.virustotal.com/gui/ip-address/23.137.249.245/relations

sublayers.org
subnodes.info
subscheme.info

# Reference: https://x.com/byrne_emmy12099/status/1876515884044546164
# Reference: https://www.virustotal.com/gui/file/4cd7e92ac6a3d068683d41beabd82d82267d97aa89603c708c0dd4af637d6d67/detection

accessrxhealth.com

# Reference: https://x.com/StrikeReadyLabs/status/1878602113397502290
# Reference: https://www.virustotal.com/gui/file/2f63594b4cd9cea2d1f6fa555e05c65a2f4565468d4de03320055fe9ff006f9d/detection

http://213.248.132.108

# Reference: https://x.com/StrikeReadyLabs/status/1878783929114591321
# Reference: https://www.virustotal.com/gui/file/d7367d9cc84d794ff73e90dd3cc936b18158bac8935ea4c5f1b7fddd821af430/detection

elmer.com.tr/modules/mod_finder/src/Helper/1212_pprb_all/dksleks
/modules/mod_finder/src/Helper/1212_pprb_all/dksleks
/1212_pprb_all/dksleks

# Reference: https://x.com/byrne_emmy12099/status/1879112142718431525
# Reference: https://x.com/StrikeReadyLabs/status/1879141990731768019
# Reference: https://www.virustotal.com/gui/file/a1b67cfb080f4d1e4cbb0019a30259cb291f56c0ada02e2ca1028f675b187727/detection

fantasiasognorealta.com/wp-includes/js/src/list.php
raleighice.com/wp-includes/js/inc/get.php

# Reference: https://x.com/StrikeReadyLabs/status/1879866055423898064
# Reference: https://www.virustotal.com/gui/file/97bc3dd9fc2cb82d31377a716eea60b64635fff1e65bf6f30832a2a2d65729f8/detection

evangelina.edu/img/503/expres.php

# Reference: https://x.com/byrne_emmy12099/status/1881628810451501169
# Reference: https://www.virustotal.com/gui/file/060f2208be86e098bc6da0b46a4eb437142b26915e1cc756e36c379ba8edd33e/detection

marymount.pixelflyte.com/wp-admin/js/src/list.php
marymount.pixelflyte.com/wp-admin/js/src/upload.php
teamfuels.com/index.php/en/modules/inc/get.php

# Reference: https://x.com/ShadowChasing1/status/1882299213687734726
# Reference: https://www.virustotal.com/gui/ip-address/118.194.249.171/relations

auth-check.o-r.kr
authurize.niduser.info.dns.cloud.check-info.o-r.kr
blog-master.o-r.kr
bloger.niduser.info.check-user.o-r.kr
check-sign.o-r.kr
check-user.o-r.kr
check.niduser.info.check-sign.o-r.kr
checker.dns-blog.n-e.kr
checking.blog-master.o-r.kr
checking.cloud.niduser.auth-check.o-r.kr
cloud.check-info.o-r.kr
cloud.niduser.auth-check.o-r.kr
dns-blog.n-e.kr
dns.cloud.check-info.o-r.kr
dns.niduser.user-check.o-r.kr
info.check-sign.o-r.kr
info.check-user.o-r.kr
info.checker.dns-blog.n-e.kr
info.dns.cloud.check-info.o-r.kr
info.verify-user.r-e.kr
infochecker.dns.niduser.user-check.o-r.kr
niduser.auth-check.o-r.kr
niduser.checking.blog-master.o-r.kr
niduser.info.check-sign.o-r.kr
niduser.info.check-user.o-r.kr
niduser.info.checker.dns-blog.n-e.kr
niduser.info.dns.cloud.check-info.o-r.kr
niduser.info.verify-user.r-e.kr
niduser.user-check.o-r.kr
signinfo.bloger.niduser.info.check-user.o-r.kr
signinfo.niduser.info.check-user.o-r.kr
signinfo.niduser.info.verify-user.r-e.kr
user-check.o-r.kr
verify-user.r-e.kr

# Reference: https://x.com/0xmh1/status/1885541720907035080
# Reference: https://x.com/skocherhan/status/1885559794800423415
# Reference: https://www.virustotal.com/gui/ip-address/125.136.67.99/relations
# Reference: https://www.virustotal.com/gui/ip-address/183.105.107.132/relations
# Reference: https://www.virustotal.com/gui/file/a1bd69ddf6bc05df5e4513c2e580391995cc634eb288ebe4d0c157d75c81253e/detection
# Reference: https://www.virustotal.com/gui/file/d590572eea5208aa577d2cbe586b23ac2b818b8742b072f30c0b97a585be95c4/detection

http://158.247.238.12
http://183.105.107.132
125.136.67.99:9999
183.105.66.48:9999
andigh995.pro
ikikik11.org
moyaho995.pro
yootube.kr
abaa1.kro.kr
abaa2.kro.kr
abaastart1.kro.kr
delete1.kro.kr
installerfofo.kro.kr
nt89.kro.kr
nt89s.kro.kr
nt96.kro.kr
nt99.kro.kr
qudtls01.kro.kr
/installerabaa/

# Reference: https://x.com/JangPr0/status/1879054546661728605
# Reference: https://x.com/byrne_emmy12099/status/1886798799550726409
# Reference: https://www.virustotal.com/gui/file/f4c4f68f8b27279b00b718b02392d5dfe1766c342a189a51e0e2a6f6412e1ce0/detection
# Reference: https://www.virustotal.com/gui/file/084b0e774019ad450974dc48c5d25e23c8c0517e30013d55b9bba3787ce768f1/detection
# Reference: https://www.virustotal.com/gui/file/11afe5cc28666c39d3dc3e9d51f780e55ce57e29424861b94002fb3370474f7e/detection

74.50.94.175:7032
74.50.94.175:9992

# Reference: https://x.com/0xmh1/status/1887472860450459879
# Reference: https://www.virustotal.com/gui/file/b5d2815102ac04f15824c7e2faf29e57df0e8f5ad7d5dfa5eea390cd08729721/detection

bergaeroworks.co.za/wp-includes/js/inc/get.php

# Reference: https://asec.ahnlab.com/en/86098/

216.219.87.41:3389
74.50.94.175:3389

# Reference: https://x.com/MsftSecIntel/status/1889407814604296490
# Reference: https://x.com/unpacker/status/1890001871257096399
# Reference: https://threadreaderapp.com/thread/1889407814604296490.html
# Reference: https://app.validin.com/detail?find=210.179.30.213&type=ip4&ref_id=efecfad08cf#tab=resolutions (# 2025-02-12)

account-profile.servepics.com
accounts-porfile.serveirc.com
securedrive.fin-tech.com

# Reference: https://x.com/JangPr0/status/1891736047223963835
# Reference: https://www.virustotal.com/gui/file/4a6c23e76524364fe9b9f5ecd46dc73e7714cac93849a380f0d1b746fae3650d/detection

kerkenraad.com/src/list.php
kerkenraad.com/src/upload.php
vetilministry.com/bg/wp-includes/js/inc/get.php

# Reference: https://x.com/SecAI_AI/status/1891851916549742805
# Reference: https://i.secai.ai/research/1%EC%9B%94%EC%8B%A0%EA%B3%A0%EB%82%A9%EB%B6%80%EB%B3%80%EB%8F%99%EC%A0%84%EC%9E%90%EB%AC%B8%EC%84%9C.%EC%BB%A4%EB%AE%A4%EB%8B%88%ED%8B%B0.%ED%95%9C%EA%B5%AD

xn--1-wb6eh4hj4durmfjcnubk5pb9dezmj4b0xb.xn--9i1b01onwqqzd.xn--3e0b707e

# Reference: https://app.validin.com/detail?type=ip&find=158.247.250.251#tab=resolutions

ednatihome.store
ednativeservice.store
ednotiall.store
edouserv.store
koreakrx.online
kyeonblog.com
medocumnetshome.store
megovhepserv.store
mehintdoc.store
menavcorp.store

# Reference: https://x.com/SecAI_AI/status/1894388129500397860
# Reference: https://www.virustotal.com/gui/ip-address/118.193.69.87/relations

auth-info.p-e.kr
calling.p-e.kr
collect-info.p-e.kr
remember-info.p-e.kr
safety-call.p-e.kr
super-info.p-e.kr
blog-info.auth-info.p-e.kr
info.remember-info.p-e.kr
info.safety-call.p-e.kr
n-doc.super-info.p-e.kr
n-info.collect-info.p-e.kr
o8gwosoxiy.calling.p-e.kr

# Reference: https://app.validin.com/detail?type=ip&find=118.193.69.87#tab=host_pairs (# 2025-02-25)

chain-info.p-e.kr

# Reference: https://x.com/SecAI_AI/status/1897104553847226787

xn--2-wb6eh4h69noxcpshjpdk5kqvbe7a.xn--9i1b01onwqqzd.xn--3e0b707e

# Reference: https://x.com/SecAI_AI/status/1897302960260178369
# Reference: https://app.validin.com/detail?type=ip&find=118.193.68.90#tab=resolutions

admin-center.n-e.kr
auth-check.n-e.kr
auth-user.o-r.kr
check-user.n-e.kr
checkstep.n-e.kr
dns-blog.r-e.kr
n-sign.n-e.kr
nts-auth.n-e.kr
safeinfo.o-r.kr
sign-again.n-e.kr
sign-dns.r-e.kr
signcheck.o-r.kr
user-check.n-e.kr
user-sign.n-e.kr
info.www.sign-dns.r-e.kr
niduser.info.www.sign-dns.r-e.kr

# Reference: https://www.genians.co.kr/blog/threat_intelligence/apt-attacks-martial-law

100000recipe.com
auth-require.com
campaign2-nid.com
glaed-hotel.com
jongnno.com
kakao-check.com
kcar-service.com
knovvhow.com
kyf-dream.com
lotto-rich.com
merryear.com
naver-check.com
naverify.com
panmuntour.com
puac.net
samsunghospitol.com
sarkcc.com
seouul.com
unniedu.com
yecchong.com
yes24.vip
accounts.intorpark.com
accounts.kakao-check.com
accounts.kakao-login.com
accounts.kakao-verify.com
accounts.login-require.com
nid.auth-require.com
nid.naver-check.com
nid.naverify.com

# Reference: https://x.com/skocherhan/status/2036895606506176878
# Reference: https://x.com/skocherhan/status/2036904024088477785
# Reference: https://app.validin.com/detail?find=34be99c7e4dfe06ce03b91cddb103a2d&type=hash&ref_id=dcbb8e17b43#tab=host_pairs (# 2025-03-18)

2wq82.v6.navy
abcd.lisihong.top
account-login.o-r.kr
account-login.p-e.kr
accountcorpvstep.p-e.kr
accountsverify.kro.kr
acnms.dmdoc.dynv6.net
agfsddfdfdfndesfr.forum
alimi-nrnail.n-e.kr
an.navtorp.dns.navy
anav.nhiscopsed.dns.army
anav.ntexporte.dns.army
app.ntredirectinvoice.mydns.bz
armynavs.blog-nids.dns.army
armynid-service.myboxes.dns.army
armynidloes.anav.nhiscopsed.dns.army
attach.dynv6.net
au0fo.dns.army
auction.dynv6.net
auth.worksmobile.r-e.kr
authenticateprofile.giize.com
authoritycorp.kro.kr
binfo.bloghomes.mydns.vc
binfo.ublogblock.mydns.bz
binfo.userblogmail.mydns.vc
bisdocs.dns.army
blog-nids.dns.army
blog.linkrightcenter.mydns.bz
blog.lnkblockpreference.mydns.bz
blog.reviewusrblog.mydns.bz
bloghomes.mydns.vc
bloginfo.bloghomes.mydns.vc
blogmailauth.mydns.vc
bn.navtorp.dns.navy
cailtteve.live-on.net
check.authoritycorp.kro.kr
check.nid-auth.kro.kr
chk.nsetverification.mydns.bz
chkblog.bloghomes.mydns.vc
chkblog.blogmailauth.mydns.vc
chkblog.ublogblock.mydns.bz
cnav.nhishosts.dns.army
co.krnid-user.platformaz.co.kr
com-accountsverify.dynv6.net
com-check.dns.army
com-signin.dynv6.net
confirm.load-tax.kro.kr
confirm.nid-log.kro.kr
controlbloginfo.mydns.bz
cvcmains.dns.army
dedicate.p-e.kr
dev-forms.daliajobs.com
dkimbasedoc.mydns.bz
dmdoc.dynv6.net
dn.ntlink.server-on.net
doc-deliver.kinyz.v6.navy
doc-taxdeliver.dns.army
doc.controlbloginfo.mydns.bz
doc.dedicate.p-e.kr
docinf.feburarydocinfo.mydns.bz
docinfo.ntreferdoc.mydns.vc
docinfo.wetaxgousr.mydns.vc
docinvoiceinfo.mydns.vc
docmenus.server-on.net
docsverf.dns.army
dodicate.p-e.kr
dosped.dns.army
earth2.site
edoc-file.v6.army
edoc.dkimbasedoc.mydns.bz
edoc.docmenus.server-on.net
edoc.edocbindsvc.dynv6.net
edoc.mew-once.dns.army
edoc.receivehtdoc.server-on.net
edocbindsvc.dynv6.net
enhisn.dns.army
ercmtargetid.mydns.vc
erver.naverscorped.dns.army
ervers.strdocs.dns.army
eudtk-tax.dns.army
eug3j.dns.army
feburarydocinfo.mydns.bz
fetch83s.dynv6.net
google.account-login.o-r.kr
hpwonny.com
htxdoced.dns.army
i14o6.dns.army
ia3lp.v6.rocks
info.docinvoiceinfo.mydns.vc
info.ercmtargetid.mydns.vc
info.mydocverify.mydns.vc
info.usertargetdoc.mydns.vc
invoice.authenticateprofile.giize.com
invoice.dkimbasedoc.mydns.bz
invoice.edoc.mew-once.dns.army
invoice.netinvoicedeliver.mydns.bz
invoice.nts-change.dns.army
invoice.userhostverify.mydns.bz
ips-checkauth.mydns.vc
ips-edocdeliver.mydns.bz
ipsdesc.x10.network
ipsedocs.dns.navy
ipstecs.dns.navy
jc4si.txmfeidfzs.dns.navy
kakao.com-check.dns.army
kakao.com-signin.dynv6.net
kdda.serveirc.com
kinobaize.online
kinomovna.online
kinorempax.online
kinoriteka.online
kinotanaka.online
kinyz.v6.navy
knegx-umlink.dns.army
krnid-user.platformaz.co.kr
linkmybloger.mydns.bz
linkrightcenter.mydns.bz
lnkblockpreference.mydns.bz
load-tax.kro.kr
login-accounts.dynv6.net
login.accountcorpvstep.p-e.kr
login.strdocs.dns.army
logins.navoorps.dns.army
main-situation.myvnc.com
mew-once.dns.army
mexc.accountsverify.kro.kr
mexc.com-accountsverify.dynv6.net
midocs-main.v6.army
midsdoc.dns.army
mld.nts-multi.dynv6.net
mois-auth-nid.jc4si.txmfeidfzs.dns.navy
moiscorped.dns.army
moissaved.dns.navy
mood.edoc.mew-once.dns.army
mps-navors.dns.army
mscure.dns.army
mtops.dns.army
my.dodicate.p-e.kr
myboxes.dns.army
mydocument.run.place
mydocverify.mydns.vc
n-cloud.anav.ntexporte.dns.army
n-cloud.nidlgipes.dns.army
n-store.ips-checkauth.mydns.vc
n-store.nauth-ips.mydns.vc
n02zi.v6.rocks
nauth-ips.mydns.vc
nav-loeins.navoorps.dns.army
nav-logins.bamapos.com
nav-logins.ipstecs.dns.navy
nav-logins.navoorps.dns.army
nav-logins.nvc-cps.dns.army
nav-logins.nvctoped.dns.army
navdomain.n-e.kr
nave-scps.dns.navy
naverscorped.dns.army
navlogin.an.ipsdesc.x10.network
navlogin.an.navtorp.dns.navy
navlogin.an.ntces.x10.network
navlogin.apumies-jok.fi
navlogin.cederfeldt.se
navlogin.sev.cvcmains.dns.army
navlogin.streetathletics.ru
navlogin.wild1.net
navlogins.midsdoc.dns.army
navnts.midsdoc.dns.army
navoorps.dns.army
navorlogins.aerwear.ro
navorlogins.apumies-jok.fi
navorlogins.bn.ipsdesc.x10.network
navorlogins.bn.navtorp.dns.navy
navorlogins.bn.ntces.x10.network
navorlogins.bn.ntsmained.dns.navy
navorlogins.cederfeldt.se
navorlogins.certified.cl
navorlogins.deicer.dk
navorlogins.dicionar.io
navorlogins.ontariobsd.ca
navors.ipsedocs.dns.navy
navs.blog-nids.dns.army
navs.dn.nhisann.dns.navy
navs.moissaved.dns.navy
navtorp.dns.navy
navynidloes.moissaved.dns.navy
ndoc.realinfo.p-e.kr
ndocaycheck.dynv6.net
ndocs.naverscorped.dns.army
nedipegs.dns.army
netinvoicedeliver.mydns.bz
neverserver.o-r.kr
nhis-docd.dns.navy
nhisann.dns.navy
nhiscopsed.dns.army
nhishosts.dns.army
nhist.dns.navy
nhstp.dns.army
nid-app.security.pakasak.com
nid-auth.kro.kr
nid-iogin.strdocs.dns.army
nid-log.kro.kr
nid-login.ipstecs.dns.navy
nid-login.midocs-main.v6.army
nid-login.naverscorped.dns.army
nid-login.nvc-cps.dns.army
nid-login.strdocs.dns.army
nid-logins.degradingmcgill.ca
nid-main.decsei.ro
nid-naveradk.servemp3.com
nid-naverbzb.ddnsking.com
nid-navercsv.servehalflife.com
nid-navercvv.servequake.com
nid-naverczg.3utilities.com
nid-naverdlm.servegame.co
nid-naverfbr.servecounterstrike.com
nid-naverfoq.ddnsking.com
nid-naverfxc.servecounterstrike.com
nid-navergxn.servegame.com
nid-naverhem.3utilities.com
nid-naverhko.serveftp.com
nid-naverhpk.onthewifi.com
nid-naverizv.servecounterstrike.com
nid-naverjoj.3utilities.com
nid-naverjqs.serveftp.com
nid-naverjzc.servehalflife.com
nid-naverkrl.servequake.com
nid-navermdh.ddnsking.com
nid-navermhw.3utilities.com
nid-navermly.servegame.com
nid-navermrs.servecounterstrike.com
nid-navernet.onthewifi.com
nid-navernsw.ddnsking.com
nid-naverohn.3utilities.com
nid-naverolg.ddnsking.com
nid-naverprf.serveftp.com
nid-naverpub.onthewifi.com
nid-naverqos.onthewifi.com
nid-naverqpo.servegame.com
nid-naversea.servequake.com
nid-naverssp.servehalflife.com
nid-navertca.servehalflife.com
nid-naverumh.onthewifi.com
nid-naveruok.servequake.com
nid-naverupi.ddnsking.com
nid-naveruzz.servegame.com
nid-navervak.3utilities.com
nid-naverwml.servequake.com
nid-naverwql.servegame.com
nid-naverxqh.servecounterstrike.com
nid-naverxts.servehalflife.com
nid-naverzkc.servemp3.com
nid-server.decsei.ro
nid-server.jophey.net
nid-server.pjabbari.com
nid-servers.aerwear.ro
nid-servers.apumies-jok.fi
nid-servers.cederfeldt.se
nid-servers.cn.navtorp.dns.navy
nid-servers.cn.ntces.x10.network
nid-servers.cn.ntsmained.dns.navy
nid-servers.compy.ca
nid-servers.dicionar.io
nid-servers.ontariobsd.ca
nid-servers.wild1.net
nid-service.docsverf.dns.army
nid-service.lexvoip.net
nid-service.myboxes.dns.army
nid-service.pereras.eu
nid-service.sleepgate.im
nid-service.vulpes.pub
nid-sevices.docsverf.dns.army
nid-sevices.pereras.eu
nid-sevices.sleepgate.im
nid-user.nidlgipes.dns.army
nid-user.platformaz.co.kr
nid-voices.decsei.ro
nid-voices.jophey.net
nid.blog-nids.dns.army
nid.bloghomes.mydns.vc
nid.bn.nvepcos.dns.army
nid.cn.dosped.dns.army
nid.cn.htxdoced.dns.army
nid.cnav.nhiscopsed.dns.army
nid.dn.nedipegs.dns.army
nid.docsverf.dns.army
nid.moiscorped.dns.army
nid.moissaved.dns.navy
nid.npinformationid.mydns.vc
nid.ntpinvoice.kro.kr
nid.nts-change.dns.army
nid.pereras.eu
nid.sleepgate.im
nid.viewmybox.kro.kr
nid.vulpes.pub
nida.bamapos.com
nida.ipstecs.dns.navy
nida.midsdoc.dns.army
nida.mps-navors.dns.army
nida.nidlogipes.dns.army
nida.nvc-cps.dns.army
nida.strdocs.dns.army
nida.themgc.net
nidas.cederfeldt.se
niddocs.vulpes.pub
nide-login.secure.ipsedocs.dns.navy
nides.dicionar.io
nidloes.anav.nhiscopsed.dns.army
nidloes.blog-nids.dns.army
nidloes.bn.enhisn.dns.army
nidloes.dn.dosped.dns.army
nidloes.moiscorped.dns.army
nidloes.moissaved.dns.navy
nidlogin.degradingmcgill.ca
nidlogins.aerwear.ro
nidlogins.cederfeldt.se
nidlogins.cnav.nhiscopsed.dns.army
nidlogins.cnav.nhishosts.dns.army
nidlogins.deicer.dk
nidlogins.dicionar.io
nidlogins.dn.navtorp.dns.navy
nidlogins.dn.nhist.dns.navy
nidlogins.dn.nhstp.dns.army
nidlogins.dn.ntsmained.dns.navy
nidlogins.dn.secures.x10.network
nidlogins.en.navtorp.dns.navy
nidlogins.en.ntces.x10.network
nidlogins.en.ntsmained.dns.navy
nidlogins.moiscorped.dns.army
nidlogins.mts.nave-scps.dns.navy
nidlogins.nids-logins.dns.navy
nidlogins.servers.ipsedocs.dns.navy
nidlogins.streetathletics.ru
nidlogipes.dns.army
nidlogs.dn.ntces.x10.network
nidnavmail.myvnc.com
nids-logins.dns.navy
nids-main.degradingmcgill.ca
nids-server.elliott.ca
nids-server.lexvoip.net
nids-server.navors.ipsedocs.dns.navy
nids-server.pereras.eu
nids-server.sleepgate.im
nids-server.vulpes.pub
nids.an.nhist.dns.navy
nids.bamapos.com
nids.bisdocs.dns.army
nids.bn.nhis-docd.dns.navy
nids.decsei.ro
nids.elliott.ca
nids.en.nhist.dns.navy
nids.ipstecs.dns.navy
nids.jophey.net
nids.midocs-main.v6.army
nids.mps-navors.dns.army
nids.nvc-cps.dns.army
nids.themgc.net
nidsecure.o-r.kr
nidserver.naverscorped.dns.army
nidservers.bamapos.com
nidservers.degradingmcgill.ca
nidservers.ipstecs.dns.navy
nidservers.mps-navors.dns.army
nidservers.mscure.dns.army
nidservers.mtops.dns.army
nidservers.navoorps.dns.army
nidservers.nvc-cps.dns.army
nidservers.strdocs.dns.army
ninvoice.decsei.ro
ninvoice.jophey.net
nkdocument-hometax.mydns.bz
nood.edoc-file.v6.army
notice.account-login.p-e.kr
npcontactlink.mydns.vc
npinformationid.mydns.vc
ns2.platformaz.co.kr
nsetverification.mydns.bz
ntces.x10.network
ntdocrecord.mydns.vc
ntexporte.dns.army
ntlink.server-on.net
ntltax38in.dynv6.net
ntpinvoice.kro.kr
ntredirectinvoice.mydns.bz
ntreferdoc.mydns.vc
nts-change.dns.army
nts-govkr.mydns.vc
nts-multi.dynv6.net
ntsmained.dns.navy
nuser-login.ips-edocdeliver.mydns.bz
nvc-cps.dns.army
nvctoped.dns.army
nvepcos.dns.army
online-doc.linkpc.net
online-kt.dynv6.net
pida.midsdoc.dns.army
pida.strdocs.dns.army
platformaz.co.kr
platformaz.co.krnid-user.platformaz.co.kr
poled2s.dns.army
pwdcheck.rightsreserve.kro.kr
realinfo.p-e.kr
reconfirm.neverserver.o-r.kr
reviewusrblog.mydns.bz
rightsreserve.kro.kr
rx5o1.v6.navy
secure.navdomain.n-e.kr
security.pakasak.com
sev.cvcmains.dns.army
sip.authenticateprofile.giize.com
soft.doc-taxdeliver.dns.army
srv-notice.dedyn.io
store.auction.dynv6.net
store.online-kt.dynv6.net
strdocs.dns.army
tvu6a.dns.navy
txmfeidfzs.dns.navy
u3yte.v6.rocks
uahg0.v6.navy
ublog.bloghomes.mydns.vc
ublogblock.mydns.bz
update.nidsecure.o-r.kr
user-kakao.login-accounts.dynv6.net
userblogmail.mydns.vc
userhostverify.mydns.bz
usertargetdoc.mydns.vc
usr.docdevice.kro.kr
usr.ercmtargetid.mydns.vc
usr.npcontactlink.mydns.vc
usr.userhostverify.mydns.bz
viewmybox.kro.kr
wetaxgousr.mydns.vc
worksmobile.r-e.kr
workspaces.dynv6.net
xn--o80bu1t2kkuve89c.xyz
ylbvz.v6.rocks
yzj00ivzg6.dynv6.net

# Reference: https://app.validin.com/detail?find=210.114.11.156&type=ip4&ref_id=9a1e8c85fb6#tab=resolutions (# 2025-03-08)

google-com.kro.kr
drive.google-com.kro.kr

# Reference: https://x.com/SecAI_AI/status/1899463068108656667
# Reference: https://www.virustotal.com/gui/ip-address/123.58.200.71/relations

rightcorp.kro.kr
rightreserve.kro.kr
user.viewblog.kro.kr
viewblog.kro.kr
viewtaxdoc.kro.kr
info.rightcorp.kro.kr
manageblog.viewtaxdoc.kro.kr
post.viewtaxdoc.kro.kr
pwd.rightscorp.kro.kr
pwdcheck.rightreserve.kro.kr

# Reference: https://x.com/byrne_emmy12099/status/1900008095168028735
# Reference: https://www.virustotal.com/gui/file/6ffb5106d912e582bde2c095365fa37a441741e4b9ea7f856b2ecad9516b74c2/detection

http://101.36.114.190
/accounts.kakao.comwebloginfind_account/showHeader/nate.php

# Reference: https://www.lookout.com/threat-intelligence/article/lookout-discovers-new-spyware-by-north-korean-apt37
# Reference: https://app.validin.com/detail?find=27.255.81.116&type=ip4&ref_id=b701fbedc41#tab=resolutions

crowdon.info
mailcorp.cc

# Reference: https://x.com/byrne_emmy12099/status/1901250906802569421
# Reference: https://app.validin.com/detail?type=ip&find=45.14.246.94#tab=resolutions
# Reference: https://www.virustotal.com/gui/ip-address/192.109.119.104/relations
# Reference: https://www.virustotal.com/gui/ip-address/45.14.246.94/relations
# Reference: https://www.virustotal.com/gui/file/5f23b1ca43f6a18e3c9f21d390f5d1e187b1339b07a1dce70f8338f3be320878/detection

chol-kor.p-e.kr
comon-excepted.o-r.kr
condition-waite.p-e.kr
deromopa.r-e.kr
excepted-comon.r-e.kr
file-manager.o-r.kr
home-naite.o-r.kr
jeonpriter.n-e.kr
lib-section.kro.kr
login-live.o-r.kr
moparams.n-e.kr
morames.r-e.kr
mrasis.n-e.kr
mybox-file.o-r.kr
n-cloud.o-r.kr
nelocket.o-r.kr
neratras2.kro.kr
nihao-ninhao.p-e.kr
nocamoto.o-r.kr
nolomoro.p-e.kr
nooraeso.r-e.kr
noporado.p-e.kr
noramdis.o-r.kr
opedromos1.r-e.kr
prinitro.r-e.kr
pritersert.r-e.kr
proposalo.p-e.kr
qoporos.o-r.kr
qudoros1.o-r.kr
safety-files.o-r.kr
secfile-store.o-r.kr
secodners.kro.kr
section-libs.kro.kr
sectra-file.o-r.kr
type-verificasion.n-e.kr
vefication-type.o-r.kr
verginia2.r-e.kr
verify-files.o-r.kr
vionera1.o-r.kr
waite-conditions.r-e.kr
yesterdom1.r-e.kr
account.pritersert.r-e.kr
main.prinitro.r-e.kr
rogo.secodners.kro.kr
update.jeonpriter.n-e.kr

# Reference: https://www.virustotal.com/gui/ip-address/204.12.253.10/relations

pi-usdt.o-r.kr
change.pi-usdt.o-r.kr
hange.pi-usdt.o-r.kr

# Reference: https://x.com/freedomhack101/status/1900882765316595965
# Reference: https://www.virustotal.com/gui/ip-address/123.58.200.71/relations

blogdetect.kro.kr
rightscorp.kro.kr
profile.blogdetect.kro.kr

# Reference: https://x.com/byrne_emmy12099/status/1901910626345406487

visibird.com/wp-admin/js/widgets/hurryup/

# Reference: https://x.com/SecAI_AI/status/1902364687640953017
# Reference: https://virustotal.com/gui/ip-address/118.194.249.237/relations
# Reference: https://www.virustotal.com/gui/file/198391e9d41c08b1863bc8da3c4f51543757f2ee80933a01159261cc9c2a0cad/detection
# Reference: https://www.virustotal.com/gui/file/96b9a198b7de3f6c43f2d2e7c51d26a3b32eeb6a1c7ec85c216a62994b965211/detection

dns.ips-doc.r-e.kr
dns.user.ndoc-mail.n-e.kr
download.nts-app.n-e.kr
download.nts-app.o-r.kr
ips-doc.r-e.kr
n-check.dns.user.ndoc-mail.n-e.kr
n-info.user.dns.ips-doc.r-e.kr
ndoc-mail.n-e.kr
nidhelp.o-r.kr
nts-app.n-e.kr
nts-app.o-r.kr
user.dns.ips-doc.r-e.kr
user.ndoc-mail.n-e.kr

# Reference: https://x.com/freedomhack101/status/1903427050029146416
# Reference: https://app.validin.com/detail?find=101.36.114.58&type=ip4#tab=resolutions

ndser.servicemail.r-e.kr
onvasdx.cc
ruoknvcxsd.cc
servicemail.r-e.kr
uioafafliuao.top

# Reference: https://x.com/freedomhack101/status/1903427050029146416
# Reference: https://app.validin.com/detail?find=101.36.114.99&type=ip4#tab=resolutions

h3ytm.cloud
blog-report.p-e.kr
doc-service.o-r.kr
edoc-send.o-r.kr
email-check.o-r.kr
general-sign.o-r.kr
info-cert.o-r.kr
info.info-cert.o-r.kr
join-login.o-r.kr
mybox-check.o-r.kr
mybox-safe.o-r.kr
bloginfo.blog-report.p-e.kr
bloginfo.join-login.o-r.kr
callinfo.mybox-safe.o-r.kr
n-info.blog-report.p-e.kr
n-info.info-cert.o-r.kr
n-info.join-link.o-r.kr
nblog-info.join-link.o-r.kr
newinfo.email-check.o-r.kr
ninfo.blog-report.p-e.kr
tdoc.doc-service.o-r.kr
user-info.mybox-check.o-r.kr
userdoc.edoc-send.o-r.kr

# Reference: https://app.validin.com/detail?type=hash&find=6025ceaa4ac3a72c5946bd0c454245a9#tab=host_pairs (# 2025-03-23)

ghffde.site
gjdufde.icu
gjhuhr.store
gujfye.online
nbhgfr.icu
nhbgvf.site
njbghr.site
njgith.store
qmall.site
qwall.space

# Reference: https://app.validin.com/detail?find=27.255.79.240&type=ip4&ref_id=727d3cacdef#tab=resolutions

naverscan.info
naverteam.com.co
naverteam.in.net
nbjghy.xyz

# Reference: https://app.validin.com/detail?find=141.164.58.230&type=ip4&ref_id=952bd5ec0ab#tab=resolutions

ghjkle.online
ghytke.icu
krdocserv.store
krdoments.store
kredousrv.store
krservdoc.store
nasdfg.space
nbhgfv.site
nbhtre.space
nbmvr.shop
nbvcdfr.shop
nbvcxz.website
nbyhn.site
njbhgy.space
njfughr.space
njithm.website
nmjbg.website
npsds.space

# Reference: https://x.com/asdasd13asbz/status/1903809343554031853

ipinst.shop

# Reference: https://x.com/SecAI_AI/status/1904909455873237014
# Reference: https://www.virustotal.com/gui/ip-address/158.247.211.14/relations

blog-auth.kro.kr
userauthor.kro.kr
login.blog-auth.kro.kr
post.userauthor.kro.kr

# Reference: https://x.com/SecAI_AI/status/1905268320963621134
# Reference: https://www.virustotal.com/gui/ip-address/141.164.49.250/relations

nbox-sign.n-e.kr
nts-edoc.o-r.kr
tax-ndoc.o-r.kr
cloud.nbox-sign.n-e.kr
cloud.tax-ndoc.o-r.kr
userinfo.nts-edoc.o-r.kr
check.cloud.nbox-sign.n-e.kr
dns.userinfo.nts-edoc.o-r.kr
n-check.dns.userinfo.nts-edoc.o-r.kr
n-check.user.cloud.tax-ndoc.o-r.kr
n-info.check.cloud.nbox-sign.n-e.kr
user.cloud.tax-ndoc.o-r.kr

# Reference: https://x.com/SecAI_AI/status/1907090182362611810

blogalarm.kro.kr
checkmyblog.kro.kr
nid-info.checkmyblog.kro.kr
post.blogalarm.kro.kr

# Reference: https://x.com/JangPr0/status/1907297153120346219
# Reference: https://www.virustotal.com/gui/file/a87c663dea792121b6a17b8e605159116e30434f2c67b8be0b198ba8229d2a3d/detection
# Reference: https://www.virustotal.com/gui/file/0eda9fee2d452fe359fb66d5102d3b78398fd23e6f6068f36e1d29af994e30a8/detection

yellowstone-marketing.com/wp-includes/js/src/get.php
yellowstone-marketing.com/wp-includes/js/src/list.php
yellowstone-marketing.com/wp-includes/js/src/upload.php
yellowstone-marketing.com/wp-includes/js/inc/get.php
yellowstone-marketing.com/wp-includes/js/inc/list.php
yellowstone-marketing.com/wp-includes/js/inc/upload.php

# Reference: https://x.com/JangPr0/status/1909509108438282551

voicevosi.com/plugins/content/loadmodule/src/js/get.php
voicevosi.com/plugins/content/loadmodule/src/js/list.php
voicevosi.com/plugins/content/loadmodule/src/js/upload.php

# Reference: https://x.com/SecAI_AI/status/1907803274020876485
# Reference: https://wezard4u.tistory.com/429512
# Reference: https://www.virustotal.com/gui/ip-address/158.247.242.169/relations

foiunsonin.site
fosmansin.site
fuiusonans.store
iauonise.site
iesionis.site
nhonesmaon.homes
vidsuaiue.site
bloggroup.64bit.kr
docsdeliver.ggm.kr
groupsinvoice.64bit.kr
invoicegroup.64bit.kr
blog.docsdeliver.ggm.kr
helplink.bloggroup.64bit.kr
myblog.invoicegroup.64bit.kr
tax.groupsinvoice.64bit.kr

# Reference: https://app.validin.com/detail?find=34be99c7e4dfe06ce03b91cddb103a2d&type=hash&ref_id=d3368e33e7b#tab=host_pairs (# 2025-04-08)
# Reference: https://app.validin.com/detail?find=8d5de7ecb18c720b5723d23de8b56da4&type=hash&ref_id=76fa229b91f#tab=host_pairs (# 2025-04-08)
# Reference: https://app.validin.com/detail?find=d338d43b8946574e6733fef85376a428&type=hash&ref_id=841d30201cf#tab=host_pairs (# 2025-04-08)
# Reference: https://app.validin.com/detail?find=110.235.68.220&type=ip4&ref_id=d5c79dae5ba#tab=resolutions (# 2025-04-08)
# Reference: https://app.validin.com/detail?find=112.118.33.72&type=ip4&ref_id=dc10dd40318#tab=resolutions (# 2025-04-08)
# Reference: https://app.validin.com/detail?find=116.49.73.233&type=ip4&ref_id=d5c79dae5ba#tab=resolutions (# 2025-04-08)
# Reference: https://app.validin.com/detail?find=220.246.143.134&type=ip4&ref_id=d5c79dae5ba#tab=resolutions (# 2025-04-08)
# Reference: https://app.validin.com/detail?find=61.93.6.63&type=ip4&ref_id=d5c79dae5ba#tab=resolutions (# 2025-04-08)
# Reference: https://www.virustotal.com/gui/ip-address/158.247.247.157/relations

ablweope.site
alldoc.work.gd
billing-manga.line-rc.me
blog-info.yourinfo.kro.kr
bossyira.store
brownsix.com
demoserver001.no-ip.org
docedge.p-e.kr
docedger.p-e.kr
docservice.p-e.kr
document.onview.p-e.kr
garywong17.asuscomm.com
good-moment.dscloud.me
iamsam.asuscomm.com
kdda56.kro.kr
leeraymond.ddns.net
login.mexc-account.kro.kr
login.mexc-signin.kro.kr
m97.mailplug.mysaol.com
mai.docservice.p-e.kr
mailplug.mysaol.com
mc2010hk01.ddns.net
mexc-account.kro.kr
mexc-signin.kro.kr
my.docedge.p-e.kr
my.docedger.p-e.kr
naverdomain.r-e.kr
nid-naverhmt.servequake.com
nid-navermen.bounceme.net
onview.p-e.kr
onview.work.gd
ourdoc.linkpc.net
paegovhome.store
paloaltonetworks.r-e.kr
referluty.store
secure.naverdomain.r-e.kr
updates.paloaltonetworks.r-e.kr
wildcat-hongkong.asuscomm.com
yourinfo.kro.kr

# Reference: https://app.validin.com/detail?find=42.98.129.150&type=ip4&ref_id=dc10dd40318#tab=resolutions (# 2025-04-08)

celinechow.duckdns.org
cyli-rita.asuscomm.com
cylirita.ddns.net
harrierrouter.vpnplus.to
jimpang.asuscomm.com
kt307.asuscomm.com
petercck88u.asuscomm.com
shanking.ddns.net
station.ddns.net
tp1966.duckdns.org

# Reference: https://app.validin.com/detail?type=ip&find=218.102.137.85#tab=resolutions (# 2025-04-08)

kenysc.myds.me
kuankuan.asuscomm.com

# Reference: https://x.com/SecAI_AI/status/1909980369086292352
# Reference: https://www.virustotal.com/gui/ip-address/158.247.192.105/relations

ips-check.o-r.kr
dns.ips-check.o-r.kr
blog.dns.ips-check.o-r.kr

# Reference: https://x.com/byrne_emmy12099/status/1910164039633891407
# Reference: https://x.com/byrne_emmy12099/status/1910194391974916546

absongkhla.com/administrator/help/hurryup/
beldy.ma/wp-admin/js/widgets/hurryup/
go2kgstan.com/layouts/plugins/user/hurryup/
holosformations.fr/wp-admin/js/widgets/hurryup/
michaelagee.com/img/common/hurryup/

# Reference: https://mp.weixin.qq.com/s?__biz=MzI2MDc2MDA4OA==&mid=2247514665&idx=1&sn=37751d5f4cdb6b4d9786010ddd25e751&chksm=ea664d5edd11c4489b2f2744b6fae637ebf692c2cb95c73929fd9c0d80bfa62ae3913d795dd6&scene=178&cur_album_id=1539799351089283075

gtfydu.surfnet.ca
hiwork.o-r.kr
sudifo.ftp.sh
login.hiwork.o-r.kr

# Reference: https://www.virustotal.com/gui/ip-address/64.176.225.161/relations

ceilainghamilisim.store
cidsoeuas.site
ecoxisueyoie.icu
eicoseeoicue.icu
eiwzoius.site
hobbyramihuasamee.store
iucvusieooisu.icu
narayadebuanabirk.store
santokandaremadan.store
sieuizxue.site
sovxueiee.site
vfiseowiu.site
xcsiueiou.site
zhendywoxianziadn.store
account-login.kro.kr
account-sign.kro.kr
accounts.kakao-login.kro.kr
b-info.detailinfo.n-e.kr
b-info.sortinfo.n-e.kr
detailinfo.n-e.kr
einfo.openinfo.n-e.kr
google.account-login.kro.kr
google.account-sign.kro.kr
google.sign-account.o-r.kr
kakao-account.kro.kr
kakao-accounts.kro.kr
kakao-login.kro.kr
login.kakao-account.kro.kr
login.kakao-accounts.kro.kr
n-info.saveinfo.n-e.kr
ninfo.p-e.kr
openinfo.n-e.kr
saveinfo.n-e.kr
sign-account.o-r.kr
sortinfo.n-e.kr
yvgvwndoc.realinfo.p-e.kr

# Reference: https://app.validin.com/detail?find=e14fd596a9c4dbb1026bd2c4d1b73021&type=hash#tab=host_pairs (# 2025-04-12)

ntsactive.site
ntsagent.site
ntshome.cc
ntsmail.cc
ntsmsg.cc
ntspost.top
ntsservice.site
taxagent.site
taxhome.world
taxservice.site

# Reference: https://www.virustotal.com/gui/ip-address/156.244.19.218/relations

gcogle.store
mid-proxy.site
middleware.space
ncpt.ntsauth.us
ntsauth.online
ntsauth.us
ntshome.live
ntshome.top
ntshome.us
ntsmain.live
ntsmap.cloud
ntspost.live
ntstax.live
taxagent.site
taxhome.world
taxservice.site
a.taxagent.site
naver.ntsauth.online
naver.ntsauth.us
naver.ntshome.live
naver.ntshome.us
naver.ntsmain.live
naver.ntstax.live
naver.taxagent.site
naver.taxhome.world
ncpt.ntsauth.online

# Reference: https://x.com/byrne_emmy12099/status/1912268814873686354
# Reference: https://www.virustotal.com/gui/file/42f306b905ece8875bdf16d276b8e4c1f70265918625da475e0f0ff0aa90f31c/detection

http://103.149.98.247

# Reference: https://www.virustotal.com/gui/ip-address/141.164.61.89/relations

blogview.kro.kr
completeinfo.kro.kr
mexc-login.kro.kr
accounts.mexc-login.kro.kr
blog-info.blogview.kro.kr
e-info.completeinfo.kro.kr

# Reference: https://www.virustotal.com/gui/ip-address/141.164.36.253/relations
# Reference: https://www.virustotal.com/gui/ip-address/158.247.204.137/relations
# Reference: https://app.validin.com/detail?find=c002186216f972bb72f8193cdab9717452aad212&type=hash&ref_id=95be784a744#tab=host_pairs (# 2025-04-22)

alaram.shop
cloudarm.site
cloudservertotal.store
creps.vip
eorors.shop
financisae.site
fmansmcon.site
fnisdinxe.site
fnnews.site
fsmangemin.site
fwinasens.site
fwinesie.site
gdadex.top
jostinsounp.site
koreatotal.sbs
kparty.store
kpcon.site
kpsa.site
luckye.website
naverworks.site
navirostorelaw.site
nawstairrule.site
nids.pro
nidsm.pro
nipro.site
nirosoft.space
nives.space
noreplyer.ink
npwonsignskpic.site
oivso.shop
qazwsxt.xyz
relogines.online
sejongcloude.store
soicloudnin.site
stder.store
wnsistins.site
zawerty.ink
koein.r-e.kr
nassec.n-e.kr
srv93772862.ultasrv.net

# Reference: https://www.virustotal.com/gui/ip-address/141.164.53.3/relations

department-docuser.n-e.kr
getdocservice.r-e.kr
mexc-enkr.kro.kr
userdoc-sign.kro.kr
account.mexc-enkr.kro.kr
lnkdoc.department-docuser.n-e.kr
pwd.getdocservice.r-e.kr
user.userdoc-sign.kro.kr

# Reference: https://app.validin.com/detail?find=34be99c7e4dfe06ce03b91cddb103a2d&type=hash#tab=host_pairs (# 2025-04-25)

dshdia.top
gpadisd.top
inklwdc.top
jaistockp.top
jpstgm.top
jpstgmdw.top
jpstgmhse.top
mksybyd.top
pdsyhzx.top
qfrdvg.top
qrtsvgs.top
stockqq.top
tkksjsvc.top
toqpxyc.top

# Reference: https://x.com/JangPr0/status/1915547543804743808

deliberatecollaboration.com/wp-includes/js/inc/get.php
deliberatecollaboration.com/wp-includes/js/inc/list.php
deliberatecollaboration.com/wp-includes/js/inc/upload.php

# Reference: https://x.com/malwrhunterteam/status/1915653547657437381
# Reference: https://x.com/Thisism23567356/status/1916474398829068307
# Reference: https://www.virustotal.com/gui/file/8f6bd4aad71d11efa46687b9968dae8d735af6f966cdc3e955f859a3fd707fdd/detection

http://92.119.114.128
92.119.114.128:3389
92.119.114.128:7000
92.119.114.128:8080

# Reference: https://x.com/byrne_emmy12099/status/1915303778913513905
# Reference: https://www.virustotal.com/gui/file/7c1dee4e44685ecbd12723761b908708353193f2ff3b5b5b3133960c80827e2d/detection

gofinancially.com/images/upload/0422.png

# Reference: https://x.com/Cyberteam008/status/1916995226532462805

1e18ceed-893c-491b-a086-9e27907f02f6.nidcorp.store
6b74b212-3415-47ef-bc47-8f4ceaf5b4ef.nidcorp.store
6fc8755e-e3d7-46dc-9e2d-356b53b62e83.nidcorp.store
7acc2ab0-ec37-403c-bc2c-7aaba34ce0bf.nidcorp.store
8918e372-8548-4cba-8723-318bd9af6fac.check-user.o-r.kr
a.checkmail.n-e.kr
a.dns-down.o-r.kr
a.nidcorp.store
a.safeinfo.o-r.kr
accourt.p-e.kr
againcheck.site
b.calling.p-e.kr
b.checkmail.n-e.kr
b.nidcorp.store
b.safeinfo.o-r.kr
b7a06388-d667-4b7a-b73a-0420e1c60e61.nidcorp.store
blog-info.resign.n-e.kr
box.newdocs.p-e.kr
check.dns.nts-sign.o-r.kr
checkmail.n-e.kr
checkstep.o-r.kr
cloud.dns.checkstep.o-r.kr
d16edef3-4aee-400c-ace2-5d07ca6af96b.xn--on3bo3ef2fhpaw5a3et70ca466c7qp.p-e.kr
d76a2b35-4d67-41c4-bc6a-8cd06507f52d.nidcorp.store
dns-down.o-r.kr
dns.checkstep.o-r.kr
dns.nts-sign.o-r.kr
doc.preview.p-e.kr
info.cloud.dns.checkstep.o-r.kr
info.user.onlive-auth.r-e.kr
invoice.kaka2024.com-ever.eu
kaka2024.com-ever.eu
krlzgwy2021-kr.sugarfungame.com
krlzgwy2021-ws2bdg.sugarfungame.com
my.accourt.p-e.kr
newdocs.p-e.kr
news.theory.in.net
nid.excount.info
nidcorp.store
niduser.check.dns.nts-sign.o-r.kr
niduser.info.cloud.dns.checkstep.o-r.kr
nmail.info.user.onlive-auth.r-e.kr
nood.xn--on3bo3ef2fhpaw5a3et70ca466c7qp.p-e.kr
nts-sign.o-r.kr
onlive-auth.r-e.kr
ozszg.top
resign.n-e.kr
user.onlive-auth.r-e.kr
xn--on3bo3ef2fhpaw5a3et70ca466c7qp.p-e.kr
yvgvwndoc.realinfo.p-e.kr

# Reference: https://x.com/RedDrip7/status/1919683586057232648
# Reference: https://www.virustotal.com/gui/ip-address/162.220.11.186/relations
# Reference: https://www.virustotal.com/gui/file/7047efbd15b20086933a3e41f23252d3f8b049b913b2c05af520a3233368f700/detection
# Reference: https://www.virustotal.com/gui/file/123aefe0734da130b475bfdad6c3ebe49688569ab8310e71ec5252ec46cb67eb/detection

basiclogin.hardsoft.nu
dasfesfgsegsefsede.o-r.kr
linkedin.r-e.kr
naverdomain.r-e.kr
naverinc.r-e.kr
unisontg.n-e.kr
woribanker.r-e.kr
auth.linkedin.r-e.kr
auth.naverinc.r-e.kr
basiclogin.hardsoft.nu
gsegse.dasfesfgsegsefsede.o-r.kr
mail.unisontg.n-e.kr
secmail.woribanker.r-e.kr
secure.naverdomain.r-e.kr

# Reference: https://www.virustotal.com/gui/ip-address/141.164.48.222/relations

mail-alive.pro
accounts.mail-alive.pro
n-doc.mail-alive.pro
login-google.kro.kr
accounts.login-google.kro.kr

# Reference: https://app.validin.com/detail?type=hash&find=34be99c7e4dfe06ce03b91cddb103a2d#tab=host_pairs (# 2025-04-29)

afwdwjp.top
bgjpstock.com
bgjpstockai.com
binjpstock.com
binjpstockai.com
gxjdghs.top
instoaidm.top
jiasdhu.top
jiegpjp.com
jienbjp.top
jiestjp.com
jpgetsmnb.xyz
jpstmnb.xyz
leigpjp.com
leistjp.com
nabygts.top
nayswrs.top
qehuwh.top
qohfud.top
qpoqhcgs.top
qqstock.sbs
qqstock.top
rbhdys.top
shdfuahfu.top
soajhkl.top
stock66.sbs
stockqq.sbs
tasvgvc.top
ystfgasb.top

# Reference: https://x.com/byrne_emmy12099/status/1918199159817159092
# Reference: https://www.virustotal.com/gui/file/09b0aba40f1da5f3455a6f4097f5a9c88d80a51f2b5f9505370d323b6a78b6f0/detection

sitisrlweb.com/wp-includes/js/inc/get.php
sitisrlweb.com/wp-includes/js/src/list.php
sitisrlweb.com/wp-includes/js/src/upload.php

# Reference: https://x.com/byrne_emmy12099/status/1918643886869684526
# Reference: https://www.virustotal.com/gui/file/d5447bbdf4529a91373d4c6fb78640f9287b21b5bdd20f655d0a2deb262bec15/detection
# Reference: https://www.virustotal.com/gui/file/bf13fb57e2a0d8e59f9f10dbfc9edf651c70b31f4bea45abf1f085391b162e61/detection

http://109.107.157.107

# Reference: https://x.com/skocherhan/status/1919925736959344951
# Reference: https://www.virustotal.com/gui/ip-address/141.164.53.3/relations

againcheck.cloud.dns.niduser.www.dns.admin-center.n-e.kr
check-blog.r-e.kr
check.reportdocs.n-e.kr
checkme.user.safeblog.o-r.kr
checkublog.kro.kr
cloud-nts.o-r.kr
cloud.info.www.user-sign.n-e.kr
deleblog.64bit.kr
edoc.nts-service.o-r.kr
edoc.view.blog
edocs.portiondoc.o-r.kr
encodedoc.p-e.kr
files.cloud-nts.o-r.kr
grammity.com
log.deleblog.64bit.kr
mail.user-check.n-e.kr
nid.edoc.view.blog
nidinfo.checkublog.kro.kr
niduser.check.dns.www.nts-sign.o-r.kr
niduser.edoc.nts-service.o-r.kr
niduser.info.sign-dns.r-e.kr
niduser.infoes.www.cloude.check-blog.r-e.kr
nidverify.userdocget.p-e.kr
ninfo.sortinfo.r-e.kr
nts-service.o-r.kr
online.encodedoc.p-e.kr
portiondoc.o-r.kr
reportdocs.n-e.kr
safeblog.o-r.kr
signinfo.dns.niduser.info.www.verify-user.o-r.kr
signinfo.niduser.info.www.verify-user.r-e.kr
sortinfo.r-e.kr
user.safeblog.o-r.kr
userdocget.p-e.kr
verify-user.o-r.kr

# Reference: https://x.com/SecAI_AI/status/1920129746244981095
# Reference: https://www.virustotal.com/gui/ip-address/221.162.112.235/relations

090.gov5nikisa.kro.kr
alla.powresh.targetuplo.kro.kr
chr.mydataauthic.kro.kr
first.pokerstarus.kro.kr
gov5nikisa.kro.kr
in.mogovernts.kro.kr
loveme.chr.mydataauthic.kro.kr
mogovernts.kro.kr
motify.uspublicproum.kro.kr
mydataauthic.kro.kr
myus93nsesq.kro.kr
nid.account.myus93nsesq.kro.kr
pokerstarus.kro.kr
powresh.targetuplo.kro.kr
remote.set.setcokiep3.kro.kr
remote.set.superpages.kro.kr
set.setcokiep3.kro.kr
set.superpages.kro.kr
setcokiep3.kro.kr
sign.in.mogovernts.kro.kr
succ.alla.powresh.targetuplo.kro.kr
superpages.kro.kr
targetuplo.kro.kr
uspublicproum.kro.kr
web.remote.set.setcokiep3.kro.kr
web.remote.set.superpages.kro.kr

# Reference: https://x.com/malwrhunterteam/status/1920443077707088039
# Reference: https://x.com/JAMESWT_WT/status/1920472685806522846
# Reference: https://www.virustotal.com/gui/file/57bf816033afa8efad045a5dfc21129b3f83f14d35d9b7fccfce610f521a24c9/detection

mulsue23.com
us02web-zoom-us.mulsue23.com

# Reference: https://x.com/malwrhunterteam/status/1920780474743435356
# Reference: https://x.com/JAMESWT_WT/status/1920822561937490282
# Reference: https://app.any.run/tasks/166bb71d-0998-46cf-844b-3cd263bef4bd
# Reference: https://www.virustotal.com/gui/file/e9b9e6269037eeba8b99d416e952ffab3b0c514c0e5faf2043a8496f39ec3c86/detection

http://185.235.128.114
185.235.128.114:7000
alphasphere.digital
blazerise.digital
blinksurge.today
buzzangle.digital
buzzpeek.today
dailybitz.digital
dailyhush.today
echomedia.today
factbump.today
fastflow.digital
fastwire.today
flashdrop.digital
flashfeed.digital
flashvortex.today
freshscoop.digital
hotbriefs.digital
hotpulse.today
infoburst.today
infozap.digital
insightpress.today
keenpulse.today
neuracore.digital
neuratech.today
nowradar.digital
nowzoom.today
peakpulse.digital
pinnaclerore.today
pulsewhip.today
quicktap.today
rapidtone.digital
rushtidenow.today
snapbrief.today
sparkpulse.today
speedbriefs.digital
speedscope.digital
storydash.digital
stratoscore.digital
swiftinfolive.today
trendbeam.digital
twistblaze.today
ukquickpulse.today
updatix.digital
veritaslabs.digital
vertaflow.digital
zoomflare.digital

# Reference: https://x.com/JangPr0/status/1922144076402483610
# Reference: https://www.virustotal.com/gui/file/024f33b3051bc97c404020a61d22daf6567498b42cb4b7a5fc9d69466929be2b/detection

rayanlynch.com/wp-includes/js/common/src/list.php
rayanlynch.com/wp-includes/js/common/src/get.php
rayanlynch.com/wp-includes/js/common/src/upload.php

# Reference: https://www.virustotal.com/gui/ip-address/45.124.65.180/relations

abbess.leftfeedback.site
account.ckakao.kro.kr
account.k-center.kro.kr
account.protomail.tk
account.yafoo.ga
accounts.kakoa.ml
accounts.kakoa.o-r.kr
accouts.kakeo.ga
accuonts.kdesign.o-r.kr
acounts.angalentoni.cf
acounts.k-main.kro.kr
angalentoni.cf
angelantoni.tk
angelatoni.ml
angelntoni.ga
aol.socketplug.store
authen.ml
boards.n-e.kr
cdaun.r-e.kr
center.r-e.kr
checkup.ga
cholian.r-e.kr
ckakao.kro.kr
control.o-r.kr
csdaun.kro.kr
daun.authen.ml
daun.checkup.ga
daun.kro.kr
daun.supports.tk
daunhome.o-r.kr
daurn.privacies.r-e.kr
dcentre.kro.kr
detail.ga
dmain.kro.kr
edit.n-e.kr
favorites.gq
guider.r-e.kr
hamnail.o-r.kr
header.ncheck.kro.kr
helpdesk.xnate.kro.kr
helpnate.r-e.kr
home.dmain.kro.kr
home.nidmarket.p-e.kr
home.nservice.kro.kr
homemail.xonate.o-r.kr
insides.r-e.kr
k-center.kro.kr
k-main.kro.kr
kakeo.ga
kakoa.ml
kakoa.o-r.kr
kall.status.n-e.kr
kaoka.protect.n-e.kr
kaokaship.r-e.kr
kcorps.kro.kr
kdesign.o-r.kr
khome.security.p-e.kr
kmember.option.r-e.kr
ksites.o-r.kr
ksolution.n-e.kr
kteam.preview.o-r.kr
leftfeedback.site
live.angelantoni.tk
live.leftfeedback.site
login.hamnail.o-r.kr
login.mysnu.ga
login.mysnu.o-r.kr
logins.angelntoni.ga
logins.daun.kro.kr
look.npower.o-r.kr
main.kaokaship.r-e.kr
main.kcorps.kro.kr
mainboard.p-e.kr
member.protommail.ml
membership.nsetting.o-r.kr
menber.cdaun.r-e.kr
menber.dcentre.kro.kr
menber.navcen.kro.kr
mernber.daunhome.o-r.kr
modify.kro.kr
modify.nstore.r-e.kr
more.nworks.kro.kr
my.csdaun.kro.kr
my.snu.o-r.kr
myinfo.yarhoo.cf
mysnu.ga
mysnu.o-r.kr
n-main.r-e.kr
navcen.kro.kr
ncheck.kro.kr
ncorps.edit.n-e.kr
nedit.mainboard.p-e.kr
newsea.cholian.r-e.kr
nhn.center.r-e.kr
nhn.guider.r-e.kr
nhn.insides.r-e.kr
nhncorp.boards.n-e.kr
nhnview.kro.kr
nhorne.kro.kr
nid.control.o-r.kr
nid.detail.ga
nid.favorites.gq
nid.worksheets.tk
nidcontrol.o-r.kr
nidcorp.modify.kro.kr
nide.n-main.r-e.kr
nidmarket.p-e.kr
npower.o-r.kr
nservice.kro.kr
nsetting.o-r.kr
nsites.kro.kr
nstore.r-e.kr
nsuite.updates.o-r.kr
nuser.view.p-e.kr
nworks.kro.kr
option.nsites.kro.kr
option.r-e.kr
owa.angelantoni.tk
owa.leftfeedback.site
preview.o-r.kr
privacies.r-e.kr
protect.n-e.kr
protomail.tk
protommail.ml
sdaum.o-r.kr
secure.nhorne.kro.kr
security.p-e.kr
service.ksolution.n-e.kr
snu.o-r.kr
socketplug.store
status.n-e.kr
supports.tk
update.nhnview.kro.kr
updates.o-r.kr
user.ksites.o-r.kr
user.sdaum.o-r.kr
user2.nidcontrol.o-r.kr
userinfo.helpnate.r-e.kr
users.angelatoni.ml
view.p-e.kr
worksheets.tk
xnate.kro.kr
xonate.o-r.kr
yafoo.ga
yahoo.socketplug.store
yarhoo.cf

# Reference: https://www.virustotal.com/gui/ip-address/158.247.213.140/relations

atomic-mail.kro.kr
nts-ml.r-e.kr
loginsecurity.atomic-mail.kro.kr
n-info.nts-ml.r-e.kr

# Reference: https://www.virustotal.com/gui/ip-address/141.164.51.224/relations

brookingauth.store
doccontact.kro.kr
interbate.store
online-mexc.kro.kr
pagovservice.store
paservhill.store
reportdocs.n-e.kr
userauthdetect.n-e.kr
userdocget.p-e.kr
utilitauth.store
vaeouri.store
login.online-mexc.kro.kr

# Reference: https://x.com/malwrhunterteam/status/1922544903466217785
# Reference: https://www.virustotal.com/gui/file/6f5309b75420650aaa773ddab7e4652eae5850b741b42b425372994e427482cb/detection

inventscience.st

# Reference: https://x.com/byrne_emmy12099/status/1922689469972455808
# Reference: https://www.virustotal.com/gui/file/7210ba8af9d40f85dc611a2b31b81e1addc257dba51eaf56402e82f193887650/detection

/ttei35/test/main/trading.jpg

# Reference: https://x.com/SecAI_AI/status/1925193613899694141

# Reference: https://x.com/byrne_emmy12099/status/1925500080834191409
# Reference: https://www.virustotal.com/gui/ip-address/141.164.56.44/relations

http://141.164.56.44
invoiceercm.kro.kr
taxdeliveryservice.kro.kr
userauthority.p-e.kr
userauthoritydoc.p-e.kr
linkdoc.taxdeliveryservice.kro.kr
nid.invoiceercm.kro.kr
one.userauthoritydoc.p-e.kr
ssproxy.userauthority.p-e.kr
v2.taxdeliveryservice.kro.kr

# Reference: https://x.com/byrne_emmy12099/status/1925502961566065064

m2view.com.py/wp-admin/js/widgets/hurryup/

# Reference: https://x.com/byrne_emmy12099/status/1926578072054100177

krgroup.com/wp-admin/js/widgets/hurryup/

# Reference: https://x.com/byrne_emmy12099/status/1926976688551866756
# Reference: https://www.virustotal.com/gui/file/d5b59f06c2505cb28d1e7e52138b40ee5af7c1fc22a1b882e026fb187dd91be5/detection

24hrkpop.com/wp-includes/js/src/inc/get.php
24hrkpop.com/wp-includes/js/src/inc/list.php
24hrkpop.com/wp-includes/js/src/lib/upload.php

# Reference: https://x.com/byrne_emmy12099/status/1926984636346810768
# Reference: https://www.virustotal.com/gui/file/545a059e5bc1ac9cc679c90d92454b53f2f0468c2aa09ad01358230e6c80d883/detection

customelisa.com/js/hurryup/

# Reference: https://x.com/byrne_emmy12099/status/1927191183744254052
# Reference: https://www.virustotal.com/gui/ip-address/67.217.62.222/relations
# Reference: https://www.virustotal.com/gui/file/d75eae7a38df433a4ac5faca0c70a1634729d884e45d14d306b2078fe0a8e5af/detection

http://67.217.62.222
aconn.p-e.kr
appw.p-e.kr
appz.p-e.kr
chromup.p-e.kr
securelinks.o-r.kr
d.appz.p-e.kr
p.aconn.p-e.kr
quick.securelinks.o-r.kr
u.appw.p-e.kr
u.chromup.p-e.kr

# Reference: https://x.com/ThreatBookLabs/status/1927376622748832051
# Reference: https://x.com/ThreatBookLabs/status/1930271824975433966
# Reference: https://www.virustotal.com/gui/ip-address/158.247.199.0/relations

binduserdoc.p-e.kr
blog-authority.o-r.kr
canceldeleting.site
checkpwd.ntsdocsvc.r-e.kr
comfortableuse.site
connectservice.store
dfnogvnsirose.store
gkvnfsdognawiefoiawejofgiahng.xyz
dcloud.binduserdoc.p-e.kr
dinfo.invoicesendsvc.n-e.kr
edoc.groupinfodoc.n-e.kr
groupinfodoc.n-e.kr
hometax.ntsdocsvc.r-e.kr
hometxuser.n-e.kr
invoicesendsvc.n-e.kr
mountainhigher.site
binduserdoc.p-e.kry.o-r.kr
nhs.blog-authority.o-r.kr
nid.taxdepartments.kro.kr
ntsdocsvc.r-e.kr
rorichblog.co.kr
online.binduserdoc.p-e.kr
plesk.rorichblog.co.kr
police.binduserdoc.p-e.kr
profileid.binduserdoc.p-e.kr
requestrecover.store
rnailservice.store
rorichblog.co.kr
serveicecheck.store
supperrabit.site
taxdepartments.kro.kr
user-info.binduserdoc.p-e.kr
v2.hometxuser.n-e.kr
v2.zircon.one
zircon.one
zuioecis.site

# Reference: https://x.com/blackorbird/status/1927419846566019458
# Reference: https://www.virustotal.com/gui/ip-address/158.247.202.109/relations

ajerbairjan.store
handora.site
hasery.store
uropeanva.store
variylelocation.site
verifiruewtyu.store
yokirae.store
yunkuogn.store
deponline.p-e.kr
edoc.deponline.p-e.kr

# Reference: https://www.virustotal.com/gui/ip-address/27.102.113.107/relations
# Reference: https://app.validin.com/detail?find=158.247.207.197&type=ip4&ref_id=7a345f05936#tab=resolutions
# Reference: https://app.validin.com/detail?find=34be99c7e4dfe06ce03b91cddb103a2d&type=hash&ref_id=9779f544db0#tab=host_pairs (# 2025-05-26)

http://27.102.137.212
account-login.r-e.kr
accountgooglecroup.p-e.kr
aomitor.site
asset.kyc.mexc-service.store
baubal.store
cdseyzd.site
ciowisdzoi.site
ciueisoi.site
clouclservice.store
com-account.kro.kr
com-auth.server-on.net
com-blog.store
com-info.kro.kr
com-info.server-on.net
com-login.live-on.net
cswiusoni.site
daumepb.servehttp.com
daumflt.onthewifi.com
eiasioei.site
emiodseiou.site
encziuoi.site
ewsadina.site
fdeocsafe.site
findmeanywhere.store
fsecurity.ink
fwsnmasin.site
generateqiji.store
guiseofiose.xyz
hviewp.hs.vc
icxzuesu.site
kakao.com-info.kro.kr
kakao.com-info.server-on.net
kakao.com-login.live-on.net
kyc.mexc-service.store
liulie.home.kg
m-service.space
mail.com-blog.store
mail3.nate.serverpit.com
makrung.store
membership.ink
mexc-service.store
mexc.account-login.r-e.kr
mexc.com-account.kro.kr
mexc.m-service.space
mexc.navers.fun
motivisual.store
nate.serverpit.com
natexuf.myvnc.com
naver.spottt.com
navercorp.com-auth.server-on.net
navers.fun
ncodcepass.dynv6.net
neimongh.store
nid-naverawf.serveftp.com
nid-naverbby.servecounterstrike.com
nid-naverbqe.ddnsking.com
nid-naverctl.ddnsking.com
nid-naverdqw.servequake.com
nid-naverdsf.servecounterstrike.com
nid-naverefo.serveftp.com
nid-navereyc.onthewifi.com
nid-naverfaq.onthewifi.com
nid-naveriro.onthewifi.com
nid-naverirv.servehalflife.com
nid-naverixo.servemp3.com
nid-naverjlm.ddnsking.com
nid-naverkga.servemp3.com
nid-naverlnm.ddnsking.com
nid-naverlqd.servecounterstrike.com
nid-navermfn.servepics.com
nid-navermid.serveftp.com
nid-navernrr.servequake.com
nid-navernvj.servequake.com
nid-navernxe.servegame.com
nid-naveroar.servemp3.com
nid-naveroic.servequake.com
nid-naverosa.servecounterstrike.com
nid-naveroyq.servemp3.com
nid-naverpub.onthewifi.com
nid-naverqcr.servepics.com
nid-naversiq.servequake.com
nid-naverslf.servegame.com
nid-naversne.servecounterstrike.com
nid-naversno.servecounterstrike.com
nid-naverteta.serveftp.com
nid-navertgo.ddnsking.com
nid-navertht.ddnsking.com
nid-navertyh.servepics.com
nid-naveruhr.myvnc.com
nid-naveruyy.serveftp.com
nid-navervjb.myvnc.com
nid-navervtw.serveftp.com
nid-naverway.ddnsking.com
nid-naverwza.servecounterstrike.com
nid-naverxeu.serveftp.com
nid-naverzch.servegame.com
nid-naverzcr.myvnc.com
nid-naverzis.servequake.com
nid-naverztm.ddns.net
nid.naver.spottt.com
nwinsinas.site
nxaaines.site
one.usrinvoice.mydns.bz
onkeepsec.store
safeservcall.store
sfievdoseu.site
sign.accountgooglecroup.p-e.kr
usrinvoice.mydns.bz
vogue90blog.com
voiwucio.site
weovisie.site
whinsnaiun.store
wolsdsdre.site
woridocumun.site
wsginanse.site
wsinwnsi.site
wsoviua.site
xiao.bad.mn
xiexie.bot.nu
xiunianse.site
xnfueisew.site
xsuwinina.site
xziuwouiw.site
xzuiwnia.site
yagorf.myvnc.com

# Reference: https://x.com/byrne_emmy12099/status/1927367956901564832

retailparkderventa.com/assets/js/hurryup/

# Reference: https://x.com/byrne_emmy12099/status/1927388034896466290

spartel.com/wp-admin/js/widgets/hurryup/

# Reference: https://x.com/byrne_emmy12099/status/1927677082303144311

phasechangesolutions.com/wp-admin/css/colors/coffee/hurryup/

# Reference: https://x.com/byrne_emmy12099/status/1928097347155759464
# Reference: https://www.virustotal.com/gui/file/ec74362f90a482f03fc455358be86b80342487c868cb9e250634781186f0ec88/detection

ogw-srl.com/site/wp-includes/js/src/get.php
ogw-srl.com/site/wp-includes/js/src/list.php
ogw-srl.com/site/wp-includes/js/src/upload.php
slamarama.org/wp-includes/js/read/get.php
slamarama.org/wp-includes/js/read/list.php
slamarama.org/wp-includes/js/read/upload.php

# Reference: https://x.com/cyber_ra1/status/1928015732371247311
# Reference: https://x.com/byrne_emmy12099/status/1928044290229362857
# Reference: https://x.com/blackorbird/status/1930267218681680151
# Reference: https://www.virustotal.com/gui/ip-address/27.102.138.10/relations

http://27.102.138.10
http://27.102.138.216
http://27.102.138.226
http://141.164.51.224
http://158.247.199.0
http://158.247.242.166
http://158.247.247.157
http://158.247.252.100
account.mexc-en.kro.kr
account.usersupport-mexc.n-e.kr
accountsignv3.64bit.kr
accountverifcation.64bit.kr
accountverifcations.64bit.kr
allowservice.store
auth-supportgoogle.kro.kr
auth-usraccount.64bit.kr
block.setinfo.kro.kr
bn.seververif.server-on.net
bn.tiang.server-on.net
callnotice.server-on.net
check-gooqle.site
check-info.store
checkpwd.networkoutpost.com
checkyouinfo.kro.kr
checkyouinfo.live-on.net
cn.seververif.server-on.net
cn.unlink.server-on.net
corn-info.space
dn.twoon.co.kr
ejioasd.top
google.accountsignv3.64bit.kr
google.accountverifcation.64bit.kr
google.accountverifcations.64bit.kr
google.auth-usraccount.64bit.kr
google.login-oauthuser.kro.kr
google.login-verifyaccount.o-r.kr
google.oauth-verification.p-e.kr
google.securevalidation.live-on.net
google.sign-useraccount.p-e.kr
google.sign-usraccount.64bit.kr
google.sign-verifyuser.64bit.kr
google.signin-authv3.n-e.kr
google.useraccountsverify.mydns.jp
google.userauthenticate-v3.kro.kr
google.usernotifications.server-on.net
google.userverification.o-r.kr
google.usrverification.64bit.kr
google.v3-accountsign.kro.kr
log.checkyouinfo.kro.kr
login-oauthuser.kro.kr
login-verifyaccount.o-r.kr
login.mexc-ko.kro.kr
lognotice.server-on.net
mail.check-info.store
mexc-en.kro.kr
mexc-ko.kro.kr
mexc.corn-info.space
mexc.sign-useraccount.kro.kr
myaccount.check-gooqle.site
na.lognotice.server-on.net
nc.callnotice.server-on.net
ne.checkyouinfo.live-on.net
nhsdoc.networkoutpost.com
nid.nidauthsvc.p-e.kr
nidauthsvc.p-e.kr
nidlnk.networkoutpost.com
ns2.check-info.store
oauth-verification.p-e.kr
pasevperson.store
peopellifesuccess.site
securevalidation.live-on.net
setinfo.kro.kr
seververif.server-on.net
sign-useraccount.kro.kr
sign-useraccount.p-e.kr
sign-usraccount.64bit.kr
sign-verifyuser.64bit.kr
sign.auth-supportgoogle.kro.kr
signin-authv3.n-e.kr
tiang.server-on.net
unlink.server-on.net
useraccountsverify.mydns.jp
userauthenticate-v3.kro.kr
usernotifications.server-on.net
usersupport-mexc.n-e.kr
userverification.o-r.kr
usrverification.64bit.kr
v3-accountsign.kro.kr
veri.yoursinfo.kro.kr
yoursinfo.kro.kr

# Reference: https://wezard4u.tistory.com/429498

seacura.com/wp-includes/js/get.php
seacura.com/wp-includes/js/list.php
seacura.com/wp-includes/js/upload.php

# Reference: https://app.validin.com/detail?find=c002186216f972bb72f8193cdab9717452aad212&type=hash#tab=host_pairs (# 2025-06-01)

asaninst.site
bizkoffice.com
downloads.autos
large.makeup
sejongcloud.site
totalsever.site

# Reference: https://x.com/byrne_emmy12099/status/1930104823577465006
# Reference: https://www.virustotal.com/gui/file/2d516c97e510bbdfb89eae329b88e0bf5557105b8e1f1de91f88f0e944835f15/detection

thegreatratings.com/wp-admin/js/widgets/hurryup/

# Reference: https://x.com/byrne_emmy12099/status/1931887447878885474

accwebcloud.com

# Reference: https://x.com/cyberwar_15/status/1931871427587916076
# Reference: https://www.genians.co.kr/en/blog/threat_intelligence/triple-combo

dirwear.000webhostapp.com
jieun.dothome.co.kr
nauji.n-e.kr
nomera.n-e.kr
onsungtong.n-e.kr
update.screawear.ga
vamboo.n-e.kr

# Reference: https://x.com/byrne_emmy12099/status/1933299821303251386

supportive.website

# Reference: https://app.validin.com/detail?find=27.102.138.9&type=ip4&ref_id=c51603cdcf7#tab=resolutions

checkinfo.pro
info-check.store
nid-account.store
cjlogistics.kro.kr
app.cjlogistics.kro.kr
dns.cjlogistics.kro.kr
google-account.checkinfo.pro

# Reference: https://x.com/JangPr0/status/1934848610312802607
# Reference: https://www.virustotal.com/gui/file/f0dae5dc37da56496166971da30d615c0fdfd54790e3fd0d58d3511627e2251b/detection

stock-investing-basics.com/jessica/wp-includes/js/common/inc/get.php
stock-investing-basics.com/jessica/wp-includes/js/common/src/list.php
stock-investing-basics.com/jessica/wp-includes/js/common/src/upload.php

# Reference: https://x.com/lazarusholic/status/1934966841321066866
# Reference: https://asec.ahnlab.com/en/88465/
# Reference: https://app.validin.com/detail?find=f1ee451b98a1cf62ab615e44d0468b7b&type=hash&ref_id=40a44b381e4#tab=host_pairs (# 2025-06-17)
# Reference: https://app.validin.com/detail?find=211.170.73.245&type=ip4&ref_id=3354f9de4a4#tab=resolutions (# 2025-06-17)
# Reference: https://app.validin.com/detail?find=211.32.57.117&type=ip4&ref_id=3354f9de4a4#tab=resolutions (# 2025-06-17)

http://103.130.212.116
http://103.149.98.230
assembly.mtomtech.co.kr
assembly.twoon.co.kr
bgsys.co.kr
e-securedrive.assembly.mtomtech.co.kr
e-securedrive.assembly.twoon.co.kr
invoice.bgsys.co.kr
m.qwe33.org
nava.unids.com
naver.bnene.com
naver.npmpt.com
naver.okzk.com
naver.paumard.com
naver.rkfd.com
naver.unibutton.com
neve.coreytech.com
nid.naver.rkfd.com
nid.naver.unibutton.com
niva.serverpit.com
nld.naver.bnene.com
nld.naver.npmpt.com
nld.naver.okzk.com
nld.naver.paumard.com
qwe33.org
securedrivecert.crabdance.com
securedrivelog.register.im
superziba.com
/0220_pprb_man_1/
/pprb/0220_pprb_man_1/
/pprb/0220_pprb_man_1/an/d.php
/anlab/d.php?newpa=

# Reference: https://unit42.paloaltonetworks.com/kimjongrat-stealer-variant-powershell/

cdn.glitch.global/17443dac-272c-421c-80ac-53a3695ede0e/
cdn.glitch.global/2eefa6a0-44ff-4979-9a9c-689be652996d/
cdn.glitch.global/4ab4f138-6f66-4b39-a7dc-9d4843dcf34f/
cdn.glitch.global/59e3786e-8284-4f16-8844-134b12e58b6f/
cdn.glitch.global/c97fe797-45c1-473b-a2f8-3c0c8bb431af/

# Reference: https://x.com/RexorVc0/status/1935208698391265600
# Reference: https://mp.weixin.qq.com/s?__biz=MzI2MDc2MDA4OA==&mid=2247515137&idx=1&sn=98a66e3565c09db9b5a0d0fc4674177b&chksm=ea664b76dd11c2609464609b7f47077c0e50324fba496447f7d262a25fc0e94f1973c3030ee6&scene=178&cur_album_id=1539799351089283075&search_click_id
# Reference: https://www.virustotal.com/gui/file/252ce6c7e91f14f9046a5f79d43cada21734e7123f6e29676daa6d5138873383/detection
# Reference: https://www.virustotal.com/gui/file/011c56403fd2171b667f4b200c2d26ebec69f19a9b8e9ecf115e718bc0318d2a/detection

162.216.114.133:53
cooldate.p-e.kr
drydate.p-e.kr
oxford.p-e.kr
june.drydate.p-e.kr
summer.cooldate.p-e.kr
uni.oxford.p-e.kr

# Reference: https://x.com/byrne_emmy12099/status/1935053386422034929
# Reference: https://www.virustotal.com/gui/file/0e75a7d2077c13eb5c8b1329ea3b254d56b1b9210bacf5998ead7c17e62d1247/detection

nidnaver.cloud
knees.nidnaver.cloud
toes.nidnaver.cloud

# Reference: https://x.com/byrne_emmy12099/status/1935055166665015743
# Reference: https://www.virustotal.com/gui/file/892297367c318b2e66cf0ee2fc592f86cc07dbdd424898030d695f246dd696a1/detection

w7fsbv.onlinewebshop.net

# Reference: https://www.enki.co.kr/en/media-center/tech-blog/dissecting-kimsuky-s-attacks-on-south-korea-in-depth-analysis-of-github-based-malicious-infrastructure

141.164.41.17:443
bosinnaun.site
dfagovph.store
egoruopove.store
fowsaionis.site
ko.myfiend.shop
ouioasan.site
voisomig.site
wasionuin.site
wisminsim.site
wmanisdin.site
wscnains.site
zoicopinum.store

# Reference: https://app.validin.com/detail?find=158.247.202.109&type=ip4#tab=resolutions

fniuomens.site
runauiso.site
wruniesio.site

# Reference: https://app.validin.com/detail?find=158.247.230.196&type=ip4#tab=resolutions

kfqload.site
mfaceneriury.store
mfatehranservewemtonyweroperioneiranemb.store
totalcloud.site

# Reference: https://app.validin.com/detail?find=158.247.253.215&type=ip4#tab=resolutions

gplayall.store
homecloudservice.store
requestmail.online
totalcloudservice.store

# Reference: https://app.validin.com/detail?find=121.173.12.113&type=ip4&ref_id=16324e9a9fd#tab=resolutions

confirm.nidslogin.n-e.kr
etax.redirectme.net
homtax-edoc.redirectme.net
homtax.serveirc.com
homtaxadmin.redirectme.net
nidlogin.redirectme.net
notice.servebeer.com
reconfirm.redirectme.net
security.servepics.com

# Reference: https://app.validin.com/detail?find=141.164.55.2&type=ip4&ref_id=18237052911#tab=resolutions

log.strangled.net

# Reference: https://app.validin.com/detail?find=8493f7f619daa37a8bd3d4b0fe2452de2f977657dc72fa132e7940d1a3370533&type=hash&ref_id=36302954df8#tab=host_pairs (# 2025-06-21)

fewopwehu.store
hunegary.store
tjtlnwm.xyz

# Reference: https://x.com/byrne_emmy12099/status/1937330494624137690
# Reference: https://www.virustotal.com/gui/file/1f22feddc82ea3638c4d9d7ea646b0d3212626cec3adb7eca08fe6c273dc9083/detection

aseauav.co.kr/pcount/count/index.php

# Reference: https://www.virustotal.com/gui/ip-address/158.247.236.169/relations
# Reference: https://app.validin.com/detail?find=158.247.236.169&type=ip4&ref_id=ec9a3bedcdd#tab=resolutions

cfgosterp.store
fccrestoretp.site
namvipsigndkasm.store
navarioscope.site
navarmsgnoreply.site
navirstackscorp.store
nawspeacemans.shop
nmails.site
npcwscmainconfig.store
npmsvcmailchk.site
npsuaksdoway.site
nsecallow.site
nwpdrsotip.store
tensouderp.store
tomprestp.store
docsdeliver.mydns.jp
hometxdoc.mydns.bz
userinfoblg.o-r.kr
userlogin-verify.n-e.kr
binfo.userinfoblg.o-r.kr
docinfo.docsdeliver.mydns.jp
mexc.userlogin-verify.n-e.kr
usr.hometxdoc.mydns.bz
zlkjvniueqkhfugjkert.kro.kr
a-info.userinfoblg.o-r.kr
b-info.userinfoblg.o-r.kr
c-info.userinfoblg.o-r.kr
d-info.userinfoblg.o-r.kr
e-info.userinfoblg.o-r.kr
f-info.userinfoblg.o-r.kr
g-info.userinfoblg.o-r.kr
h-info.userinfoblg.o-r.kr
i-info.userinfoblg.o-r.kr
j-info.userinfoblg.o-r.kr
k-info.userinfoblg.o-r.kr
l-info.userinfoblg.o-r.kr
m-info.userinfoblg.o-r.kr
n-info.userinfoblg.o-r.kr
o-info.userinfoblg.o-r.kr
p-info.userinfoblg.o-r.kr
q-info.userinfoblg.o-r.kr
r-info.userinfoblg.o-r.kr
s-info.userinfoblg.o-r.kr
t-info.userinfoblg.o-r.kr
u-info.userinfoblg.o-r.kr
v-info.userinfoblg.o-r.kr
w-info.userinfoblg.o-r.kr
x-info.userinfoblg.o-r.kr
y-info.userinfoblg.o-r.kr
z-info.userinfoblg.o-r.kr

# Reference: https://medium.com/@LCSC-IE/identifying-north-korean-kimsuky-apt43-infrastructure-b6817a58a65b
# Reference: https://app.validin.com/detail?type=ip&find=158.247.215.121#tab=resolutions
# Reference: https://www.virustotal.com/gui/ip-address/141.164.51.224/relations

amaisens.site
babaleside.cyou
foisains.site
fsxcmin.site
masoidide.cyou
narmadide.icu
nxczins.site
saoiuaou.site
smanains.site
umasomon.site
voosinm.site
wnsoidos.site
clouddocservice.o-r.kr
dcloud.docderive.n-e.kr
departmentedoc.r-e.kr
docavailable.kro.kr
docderive.n-e.kr
drivedoc.o-r.kr
endoc.kaznets.com
nhsdoc.crabdance.com
ntspaysvc.o-r.kr
policegoalsvc.p-e.kr
checkpwd.clouddocservice.o-r.kr
doc-user.docderive.n-e.kr
eldoc.docderive.n-e.kr
hometx.taxdepartmentsvc.kro.kr
idverify.docavailable.kro.kr
nid.policegoalsvc.p-e.kr
niduser.drivedoc.o-r.kr
nts.departmentedoc.r-e.kr
nts.user-hometx.r-e.kr
online.receivdocs.n-e.kr
providedoc.docavailable.kro.kr
pwdcheck.receivdocs.n-e.kr
user.ntspaysvc.o-r.kr
userauthority.receivdocs.n-e.kr
userlog.docderive.n-e.kr
receivdocs.n-e.kr
taxdepartmentsvc.kro.kr
user-hometx.r-e.kr

# Reference: https://www.virustotal.com/gui/ip-address/27.102.138.214/relations
# Reference: https://app.validin.com/detail?find=27.102.138.214&type=ip4&ref_id=2fd6d8a92a1#tab=resolutions

docnscorp.space
account-mexc.kro.kr
nv-dns.o-r.kr
e-doc.nv-dns.o-r.kr
sign.account-mexc.kro.kr

# Reference: https://www.virustotal.com/gui/ip-address/27.102.138.241/relations
# Reference: https://app.validin.com/detail?find=27.102.138.241&type=ip4&ref_id=0ea7e6d1e74#tab=resolutions

app.tworld-store.kro.kr
appstore.skt-mobile.kro.kr
appstore.skt-service.kro.kr
appstore.sktelecom-security.kro.kr
checkinfo.nbox-nd.r-e.kr
download.sktelecom.o-r.kr
info-check.space
ninfo.duckdns.org
skt-mobile.kro.kr
skt-service.kro.kr
sktelecom-security.kro.kr
tworld-store.kro.kr

# Reference: https://www.virustotal.com/gui/ip-address/27.102.138.155/relations

mexc.site
com-mg.mydns.tw
com-view.mydns.tw
kyc-verify.o-r.kr
mexc-view.n-e.kr
mexc.mexc.site
cto.com-mg.mydns.tw
confirm.kyc-verify.o-r.kr
file.cto.com-mg.mydns.tw
login.mexc-view.n-e.kr

# Reference: https://app.validin.com/detail?find=3a8da3b6980574b5b43377ab3dde3ca1&type=hash&ref_id=0d4bc70bd9c#tab=host_pairs (# 2025-06-24)

account-contact.kro.kr
accountcorp.online
corpverifcation.store
login-secure.kro.kr
notice-security.kro.kr
notice-user.kro.kr
security-sign.kro.kr
sign-account.kro.kr
sign-user.kro.kr
sign-v3.kro.kr
signin-account.kro.kr
v3-sign-account.kro.kr
v3-sign.kro.kr
account-google.notice-security.kro.kr
account-google.security-sign.kro.kr
dns-google.notice-user.kro.kr
dns-google.signin-account.kro.kr
google.account-contact.kro.kr
google.corpverifcation.store
google.login-secure.kro.kr
google.sign-user.kro.kr
google.sign-v3.kro.kr
google.signin-account.kro.kr
google.v3-sign-account.kro.kr
google.v3-sign.kro.kr
login.accountcorp.online
router-google.sign-account.kro.kr

# Reference: https://app.validin.com/detail?find=27.102.138.171&type=ip4&ref_id=ec97853d078#tab=resolutions

g-service.online
view.g-service.online

# Reference: https://www.virustotal.com/gui/ip-address/141.164.48.222/relations
# Reference: https://app.validin.com/detail?find=141.164.48.222&type=ip4&ref_id=523254a332b#tab=resolutions

email-service.pro
account-service.kro.kr
account-verify.kro.kr
check-account.kro.kr
email-link.kro.kr
verification-account.kro.kr
google-submit.kro.kr
google.account-service.kro.kr
google.account-verify.kro.kr
google.check-account.kro.kr
google.email-link.kro.kr
google.email-service.pro
google.verification-account.kro.kr
login.google-submit.kro.kr

# Reference: https://www.virustotal.com/gui/ip-address/27.102.138.172/relations
# Reference: https://app.validin.com/detail?find=27.102.138.172&type=ip4&ref_id=523254a332b#tab=resolutions

accountcorp.site
g-service.shop
login.accountcorp.site
mail.g-service.shop
view.g-service.shop

# Reference: https://www.virustotal.com/gui/ip-address/185.18.222.117/relations
# Reference: https://app.validin.com/detail?find=185.18.222.117&type=ip4&ref_id=523254a332b#tab=resolutions

http://185.18.222.117
account-signin.kro.kr
accounts-sign.kro.kr
login-accounts.kro.kr
notice-account.kro.kr
notice-service.kro.kr
security-notice.kro.kr
security-user.kro.kr
sign-accounts.kro.kr
sign-security.kro.kr
account-google.notice-service.kro.kr
account-google.security-notice.kro.kr
account-google.security-user.kro.kr
account-google.sign-security.kro.kr
dns-google.account-signin.kro.kr
dns-google.login-accounts.kro.kr
dns-google.sign-accounts.kro.kr
google.accounts-sign.kro.kr
google.sign-security.kro.kr
support-google.notice-account.kro.kr

# Reference: https://app.validin.com/detail?find=185.18.222.54&type=ip4&ref_id=b6d4775534f#tab=resolutions

home.p-e.kr
login.home.p-e.kr

# Reference: https://app.validin.com/detail?find=27.102.113.20&type=ip4&ref_id=e6997b847f3#tab=resolutions

daumcxl.ddnsking.com
daumcyd.ddns.net
daumfrb.ddns.net
daumoiw.chickenkiller.com
daumrmu.bounceme.net
kakao.chickenkiller.com
kakao.gurdit.com
kakao.ignorelist.com
kakao.jumpingcrab.com
kakao.twilightparadox.com
nate.chickenkiller.com
nate.crabdance.com
nate.ignorelist.com
nate.opior.com
natezlx.myvnc.com
naver.hackquest.com
naver.midjava.com
naver.norushcharge.com
naver.pakasak.com
naver.photo-frame.com
naver.raspberryip.com
naver.serverpit.com
naver.twilightparadox.com
nid-naverbpk.onthewifi.com
nid-naverduq.servegame.com
nid-naverkhc.serveftp.com
nid-naverkhd.onthewifi.com
nid-navernlj.servegame.com
nid-naverpns.onthewifi.com
nid-naverwhf.3utilities.com
nid-naverxft.onthewifi.com
nid-naveryhy.ddnsking.com
nid-naverzsq.ddnsking.com
nid-naverzwr.serveftp.com
accounts.kakao.chickenkiller.com
accounts.kakao.gurdit.com
accounts.kakao.ignorelist.com
accounts.kakao.jumpingcrab.com
accounts.kakao.twilightparadox.com
mail3.nate.chickenkiller.com
mail3.nate.crabdance.com
mail3.nate.ignorelist.com
mail3.nate.opior.com
nid-naverahs.servequake.com
nid-naverkae.servecounterstrike.com
nid-naverpvp.servequake.com
nid-navertdm.servequake.com
nid.naver.hackquest.com
nid.naver.midjava.com
nid.naver.norushcharge.com
nid.naver.pakasak.com
nid.naver.photo-frame.com
nid.naver.raspberryip.com
nid.naver.serverpit.com
nid.naver.twilightparadox.com

# Reference: https://app.validin.com/detail?find=158.247.242.126&type=ip4&ref_id=62f820067fe#tab=resolutions

ramasin.store
smartwallpaper.store
webhistoryanalyze.store

# Reference: https://x.com/ThreatBookLabs/status/1939504169435767127

check-info.site
com-claim.mydns.bz
geneinfo.n-e.kr
manageinfo.n-e.kr

# Reference: https://x.com/blackorbird/status/1939957956621066721
# Reference: https://www.genians.co.kr/en/blog/threat_intelligence/suky-castle

androcl.csproject.org
androclesproject.o-r.kr
bikaro.store
check-computer.kro.kr
cukumam.shop
drive.polices.site
kida.plusdocs.kro.kr
konamo.xyz
lecture-site.kro.kr
login.androclesproject.o-r.kr
menews.o-r.kr
mspro.kro.kr
msprovider.menews.o-r.kr
naunsae.store
online.check-computer.kro.kr
online.lecture-site.kro.kr
plusdocs.kro.kr
polices.site
raedom.store
secure.drive.polices.site
securedrive.privatedns.org
securedrive.servehttp.com
tenelbox.store

# Reference: https://x.com/suyog41/status/1940398834187898973
# Reference: https://www.virustotal.com/gui/file/81a284353e770872988e483b351223b722004893adc257d671c084b474371ca9/detection

mobballetc2ec.com/wp-admin/js/widgets/hurryup/

# Reference: https://app.validin.com/detail?find=34be99c7e4dfe06ce03b91cddb103a2d&type=hash#tab=host_pairs (# 2025-07-02)

access.userrecoveropt.kro.kr
ahope.site
ail-naver.servegame.com
airdrop.p2pb2b.kro.kr
alpha-bill.fin-ncloud.com
alpha-bill.gov-ncloud.com
alpha-bill.ncloud.com
beta-bill.fin-ncloud.com
beta-bill.gov-ncloud.com
beta-bill.nbp-corp.com
beta-bill.ncloud.com
beta-billx.naver.com
bill.fin-ncloud.com
bill.gov-ncloud.com
bill.ncloud.com
bn.imortinfo.live-on.net
chataquaesg.com
com-ace.live-on.net
com-ces.keyword-on.net
com-ox.mydns.jp
daebakit.site
decegonert.store
dn.imortinfo.live-on.net
edoc.ntdocument.r-e.kr
edoc.ntpservice.kro.kr
edoc.view.com-ace.live-on.net
edoc.view.com-ces.keyword-on.net
edoc.view.file.com-ox.mydns.jp
enclisept.space
encredor.space
epido.site
etismacoup.site
fecarounetp.store
file.com-ox.mydns.jp
gcctomp.site
gofecav.site
imortinfo.live-on.net
in-voice.dynv6.net
invoice.myonlinedoc.kro.kr
jpbill.ncloud.com
keomskd.site
kfowkd.site
kiroffo.site
linkdeposits.o-r.kr
login.siteuserverification.kro.kr
login.usrdeleteservice.kro.kr
marketpricef.buzz
marry.verymad.net
mid.edoc.view.file.com-ox.mydns.jp
mov-naver.servehalflife.com
myonlinedoc.kro.kr
naver.chickenkiller.com
naver.crabdance.com
naver.ignorelist.com
naver.jumpingcrab.com
naver.minecraftnoob.com
navergkk.servecounterstrike.com
navergle.serveftp.com
naverlsi.ddnsking.com
naversta.3utilities.com
nid-login.ekivotos.gr
nid-naverbmn.servecounterstrike.com
nid-naverdff.3utilities.com
nid-naverdgl.onthewifi.com
nid-naveredh.servecounterstrike.com
nid-naverewb.servequake.com
nid-naverguv.servequake.com
nid-navergyk.serveftp.com
nid-naverkkr.onthewifi.com
nid-navernuw.ddnsking.com
nid-naveroty.serveftp.com
nid-naverpghg.3utilities.com
nid-naverqei.servecounterstrike.com
nid-naverrfi.onthewifi.com
nid-naversqt.ddnsking.com
nid-naversrk.serveftp.com
nid-naverttk.servehalflife.com
nid-naveruah.serveftp.com
nid-naveruva.3utilities.com
nid-navervwa.servehalflife.com
nid-naverxrm.servegame.com
nid-naverydpp.servecounterstrike.com
nid-naveryty.servegame.com
nid-naverzmyc.ddnsking.com
nid.edoc.view.com-ace.live-on.net
nid.linkdeposits.o-r.kr
nid.naver.chickenkiller.com
nid.naver.crabdance.com
nid.naver.ignorelist.com
nid.naver.jumpingcrab.com
nid.naver.minecraftnoob.com
nid.ntdocument.r-e.kr
nld.edoc.view.com-ces.keyword-on.net
nidservers.themgc.net
nood.edoc.view.file.com-ox.mydns.jp
ntdocument.r-e.kr
ntpservice.kro.kr
one.userclaimload.kro.kr
oscretar.site
p2pb2b.kro.kr
plefkre.site
precust.space
quiomansi.sbs
segerut.space
sentragopt.store
seporet.space
siteuserverification.kro.kr
thikkre.site
userclaimload.kro.kr
userrecoveropt.kro.kr
usrdeleteservice.kro.kr
vascroutep.store
view.com-ace.live-on.net
view.com-ces.keyword-on.net
view.file.com-ox.mydns.jp
vpn280621771.softether.net
w3fx0gxf.today
xiao.zanity.net

# Reference: https://app.validin.com/detail?find=118.194.228.184&type=ip4&ref_id=efd5a5f2a6b#tab=resolutions

one-service.life
accounts-profile.servepics.com
accounts.one-service.life
drive-confirm.servehttp.com
kdda56.serveftp.com
kdda56.servehttp.com
myaccounts-setting.servehttp.com

# Reference: https://app.validin.com/detail?find=172.86.111.75&type=ip4&ref_id=efd5a5f2a6b#tab=resolutions

accounts-myservice.servepics.com
freedrive.servehttp.com
login-accounts.servehttp.com
myaccounts-profile.servehttp.com
mydocs.onthewifi.com
securedrive-mofa.servehttp.com
translate.onthewifi.com
undocs.ddns.net
undocs.myvnc.com
undocs.servehttp.com

# Reference: https://x.com/ThreatBookLabs/status/1942780953849651418
# Reference: https://www.virustotal.com/gui/ip-address/27.102.137.242/relations
# Reference: https://app.validin.com/detail?find=27.102.137.242&type=ip4&ref_id=66af4d6ff8a#tab=resolutions (# 2025-07-06)

http://27.102.137.242
an.ntlink.live-on.net
an.verifyserve.live-on.net
com-login.kro.kr
dn.infclog.live-on.net
dn.nodeyou.live-on.net
infclog.live-on.net
kakao.com-login.kro.kr
nodeyou.live-on.net
ntlink.live-on.net
verifyserve.live-on.net

# Reference: https://app.validin.com/detail?find=158.247.249.46&type=ip4&ref_id=ad26f63a45f#tab=resolutions
# Reference: https://app.validin.com/detail?find=c002186216f972bb72f8193cdab9717452aad212&type=hash#tab=host_pairs (# 2025-07-09)

cdieused.site
edusecudie.site
eiisaoin.site
eioduisoue.site
irucuseiw.site
oicuszcis.site
oxseieo.site
sioenise.site
uoeicxo.site
chosunlibs.r-e.kr
chosunweb.n-e.kr
kimchee.p-e.kr
nidnosr.n-e.kr

# Reference: https://www.virustotal.com/gui/ip-address/27.102.138.91/relations

http://27.102.138.91
cyber.server-on.net
nts-edoc.live-on.net
p2b-team.kro.kr
signin.server-on.net
checksign.nts-edoc.live-on.net
n-info.signin.server-on.net
sales.p2b-team.kro.kr

# Reference: https://app.validin.com/detail?find=27.102.138.154&type=ip4&ref_id=3ece2c29b85#tab=resolutions

mexcs.shop
com-cool.mydns.bz
com-life.keyword-on.net
view.mexcs.shop
mybox.com-cool.mydns.bz
file.com-life.keyword-on.net

# Reference: https://www.virustotal.com/gui/ip-address/216.219.95.242/relations
# Reference: https://www.virustotal.com/gui/file/9f73e39ca5afd64bb1bd3ed2da84c1fec67143af23ab59fe9d66387fc61b1395/detection

aomeioras2.r-e.kr
broowo.n-e.kr
chonkris.n-e.kr
churchlovenet.n-e.kr
daniele.n-e.kr
donghowon.n-e.kr
hongra.n-e.kr
joyseo.n-e.kr
kocill.n-e.kr
kopycill.n-e.kr
metong.n-e.kr
nelro.n-e.kr
seoim.n-e.kr
skytpoo.n-e.kr
spaoverce.p-e.kr
titicaca.n-e.kr
tongsoju.n-e.kr

# Reference: https://www.virustotal.com/gui/ip-address/213.142.157.4/relations

drover.crabdance.com
goole.n-e.kr
gooqle.n-e.kr
kns.p-e.kr
kwac.p-e.kr
nover.n-e.kr
store.farted.net
accounts.gooqle.n-e.kr
aconts.goole.n-e.kr
land.gooqle.n-e.kr
mail.kns.p-e.kr
nid.kwac.p-e.kr
nid.nover.n-e.kr
privateaccounts.gooqle.n-e.kr
storeer.chickenkiller.com

# Reference: https://x.com/byrne_emmy12099/status/1946721611878711302

temp.demetradesign.it/eternalwealth/wp-content/plugins/health-check/pages/interview/d.php

# Reference: https://app.validin.com/detail?find=158.247.197.181&type=ip4&ref_id=841428900b1#tab=resolutions

dongavpn.sbs
eosicxodienie.icu
fewaine.site
fowiosi.site
iasoiexci.site
ieucobnduie.icu
vouge90blog.com
wiusoins.site
zixcueovieon.icu
wave12.co.kr

# Reference: https://x.com/byrne_emmy12099/status/1948029281181016485
# Reference: https://www.virustotal.com/gui/file/372c8dc7df9e584f117c9543f1fbe1cc3674e8e47a848feaefa049e8e71870dc/detection

/God0808RAMA/group_0721/
/God0808RAMA/

# Reference: https://www.virustotal.com/gui/ip-address/27.102.137.214/relations

account-v3sign.server-on.net
accountssignin.kro.kr
accountuserconfirm.kro.kr
oauthusrlogin.kro.kr
onlinegdrive.kro.kr
secureverification.kro.kr
google.account-v3sign.server-on.net
google.accountssignin.kro.kr
google.accountuserconfirm.kro.kr
google.oauthusrlogin.kro.kr
google.onlinegdrive.kro.kr
google.secureverification.kro.kr

# Reference: https://www.virustotal.com/gui/ip-address/158.247.192.187/relations

accountsitelogin.kro.kr
doc-portal.o-r.kr
hcaredocs.o-r.kr
secureactivity.kro.kr
userauthority.server-on.net
docinfo.doc-portal.o-r.kr
google.accountsitelogin.kro.kr
google.secureactivity.kro.kr
google.userauthority.server-on.net
httpnewdoc.hcaredocs.o-r.kr
hxxpnewdoc.hcaredocs.o-r.kr
invoice.npsuserdoc.cloudns.pro
linkdoc.hcaredocs.o-r.kr
newdoc.hcaredocs.o-r.kr
npsuserdoc.cloudns.pro
verify.hcaredocs.o-r.kr
xn--hpnewdoc-lf5aa.hcaredocs.o-r.kr

# Reference: https://app.validin.com/detail?find=141.164.42.147&type=ip4&ref_id=7cf677b56b4#tab=resolutions

assernbly-portai.online
assebly.o-r.kr
assernbly.n-e.kr
namail.n-e.kr
narnail.o-r.kr
potarl.p-e.kr
nawstairlaw.site
npwthfighsklay.store
npwtwkicklain.store
nwp25lawpointin.store
riavelerscorp.store
totopiicckk7.shop
totopppplayy3.shop
totopppplayy5.shop
totopppppick3.shop

# Reference: https://x.com/ThreatBookLabs/status/1952157612658807143
# Reference: https://www.virustotal.com/gui/ip-address/203.245.0.121/community

http://203.245.0.121
203.245.0.121:443

# Reference: https://x.com/byrne_emmy12099/status/1953234862099579213
# Reference: https://x.com/ThreatBookLabs/status/1958002067186065811
# Reference: https://www.virustotal.com/gui/file/0375a1e1f558d436de7e93570aa15f9554210d52f724d1189d65c809d31c04cf/detection

lizventure.com/wp-includes/js/common/src/get.php
lizventure.com/wp-includes/js/common/src/list.php
lizventure.com/wp-includes/js/common/src/upload.php
offworldempires.com/wp-includes/js/common/src/get.php
offworldempires.com/wp-includes/js/common/src/list.php
offworldempires.com/wp-includes/js/common/src/upload.php

# Reference: https://wezard4u.tistory.com/429571
# Reference: https://app.validin.com/detail?find=80.240.25.169&type=ip4&ref_id=63dda09d394#tab=resolutions

nextforum-online.com
officecheckingpo.com
officemailcenter.com
officemainrest.com
telidhe.com
websecuritynotice.com
websiteservice-noreply.com
onnara9.saas.gcloud.go.kr

# Reference: https://x.com/asdasd13asbz/status/1957488385611952557
# Reference: https://www.virustotal.com/gui/ip-address/103.80.49.97/relations
# Reference: https://app.validin.com/detail?find=a93338c41c541aecef9257584993765e&type=hash&ref_id=8a75dacb841#tab=host_pairs (# 2025-08-18)

accountgoog.space
accounts.sundby.com
appsettings.space
bit.wiki.gd
help.sundby.com
myaccount.apps.dj
mydoc.wiki.gd
mydrive.minecraft.pe
mydrive.raspberryip.com
myview.pakasak.com
register.info.gf
services.inet2.org
services.soon.it
setting.serverpit.com
setting.youpc.ro
yahoolor.ddnsking.com
ysetting.info.gf

# Reference: https://app.validin.com/detail?find=158.247.215.61&type=ip4&ref_id=e5e71b1e2fc#tab=resolutions (# 2025-08-19)

cuiseoviu.site
eioxcudiyine.icu
ixcudieowie.icu
owiucxdiwo.site
page-engine.site
rexcisuiewinuo.icu
saunuionm.site
ssercsesite.store
sxainoius.site
vodiuwsofew.xyz
weoivinse.site
wmiuoins.site
wzioeniun.site

# Reference: https://app.validin.com/detail?find=34be99c7e4dfe06ce03b91cddb103a2d&type=hash&ref_id=2bf554ef1ec#tab=host_pairs (# 2025-08-21)

alcidrm.site
altowod.site
an.infiyou.mydns.bz
an.infiyou.server-on.net
apolok.site
auth.blogauthor.r-e.kr
auth.checkserviceblog.kro.kr
auth.eboardsvc.r-e.kr
auth.myonlineblog.r-e.kr
auth.netblogs.kro.kr
authenticate.ntaxhomedoc.live-on.net
authenticatetarget.mydns.bz
binfo.blogercommunity.o-r.kr
binfo.blogscorp.kro.kr
binfo.eblogapp.kro.kr
binfo.muserblog.server-on.net
blogauthor.r-e.kr
blogclaimcenter.kro.kr
blogerapp.o-r.kr
blogercommunity.o-r.kr
bloginfo.blogclaimcenter.kro.kr
bloginfo.blogerapp.o-r.kr
bloginfo.blogercommunity.o-r.kr
blogscorp.kro.kr
bn.infiyou.server-on.net
bn.noticingyou.server-on.net
checkserviceblog.kro.kr
chkblog.blogauthor.r-e.kr
chkblog.checkserviceblog.kro.kr
chkblog.eboardserver.n-e.kr
chkblog.eboardsvc.r-e.kr
chkblog.myonlineblog.r-e.kr
chkblog.netblogs.kro.kr
cloudonline.server-on.net
cn.infiyou.mydns.bz
cn.noticingyou.mydns.bz
com-auth.live-on.net
com-login.server-on.net
com-swod.mydns.tw
cot.man.com-swod.mydns.tw
dn.noticingyou.server-on.net
doc-info.ultimamilla.cl
docinfo.myschdoc.o-r.kr
eblogapp.kro.kr
eboardserver.n-e.kr
eboardsvc.r-e.kr
edoc.authenticatetarget.mydns.bz
edoc.view.file.cot.man.com-swod.mydns.tw
edocusers.n-e.kr
file.cot.man.com-swod.mydns.tw
govdoc.p-e.kr
htax-kr.server-on.net
htax-mail.server-on.net
infiyou.mydns.bz
infiyou.server-on.net
info.udocreferal.kozow.com
invoice.dapit.net
invoice.udocreferal.kozow.com
ksufer.info
man.com-swod.mydns.tw
muserblog.server-on.net
myonlineblog.r-e.kr
myschdoc.o-r.kr
navercorp.com-auth.live-on.net
navercorp.com-login.server-on.net
netblogs.kro.kr
nid.edoc.view.file.cot.man.com-swod.mydns.tw
nmail.server-on.net
nnks.duckdns.org
noticingyou.mydns.bz
noticingyou.server-on.net
ntaxhomedoc.live-on.net
nts-go.server-on.net
nts-kr.server-on.net
online.govdoc.p-e.kr
pdoc.edocusers.n-e.kr
surfboard-kr.aisu.cyou
ublog.blogauthor.r-e.kr
ublog.checkserviceblog.kro.kr
ublog.eboardserver.n-e.kr
ublog.myonlineblog.r-e.kr
ublog.netblogs.kro.kr
udocreferal.kozow.com
usr.authenticatetarget.mydns.bz
vfirst.store
view.file.cot.man.com-swod.mydns.tw
vpn730486675.softether.net

# Reference: https://www.virustotal.com/gui/ip-address/216.244.74.97/relations

drive.gurdit.com
drive.isageek.net
forms.evils.in
forms.govt.hu
mydrive.joe.dj
setting.showmyhomes.com
view.allisons.org

# Reference: https://www.virustotal.com/gui/ip-address/121.183.134.113/relations

http://121.183.134.113
121.183.134.113:443
121.183.134.113:7000
121.183.134.113:8080

# Reference: https://www.virustotal.com/gui/ip-address/158.247.240.40/relations

auth.blogsnet.r-e.kr
auth.eboard-blog.kro.kr
auth.eboardserver.n-e.kr
binfo.blogauthservice.o-r.kr
binfo.blogerapp.o-r.kr
binfo.bloghomecenter.r-e.kr
binfo.communityweb.n-e.kr
blogauthservice.o-r.kr
blogerapp.o-r.kr
bloghomecenter.r-e.kr
bloginfo.bloghomecenter.r-e.kr
bloginfo.blogscorp.kro.kr
bloginfo.communityweb.n-e.kr
bloginfo.eblogapp.kro.kr
bloginfo.homeblogs.kro.kr
bloginfo.onlineblogid.o-r.kr
blogscorp.kro.kr
blogsnet.r-e.kr
chk.hometxusers.kro.kr
chkblog.normalblog.o-r.kr
communityweb.n-e.kr
confirmusrdoc.mydns.bz
eblogapp.kro.kr
eboard-blog.kro.kr
eboardserver.n-e.kr
eboardsvc.r-e.kr
hmm.rwbcode.com
homeblogs.kro.kr
hometxusers.kro.kr
neorg.privatedns.org
nid.eboard-blog.kro.kr
normalblog.o-r.kr
onlineblogid.o-r.kr
taxdoc.dapit.net
ublog.eboardsvc.r-e.kr

# Reference: https://www.virustotal.com/gui/ip-address/27.102.137.179/relations
# Reference: https://www.virustotal.com/gui/ip-address/27.102.137.181/relations
# Reference: https://www.virustotal.com/gui/ip-address/27.102.138.94/relations

blog-sec.keyword-on.net
blog-sec.server-on.net
check-info.nmail.server-on.net
check-info.nts-go.server-on.net
check.htax-mail.server-on.net
cyber.keyword-on.net
delivery.cjlogistics.kro.kr
dns-check.blog-sec.server-on.net
dns-check.nps.server-on.net
dns-check.npskr.server-on.net
dns-check.ntax.keyword-on.net
dns-info.nps-kr.server-on.net
dns-info.ntax.keyword-on.net
dns-info.ntsbiling.server-on.net
dns.doc-nps.server-on.net
dns.hometax.server-on.net
dns.htax.server-on.net
dns.nps-go.server-on.net
dns.nps-kr.server-on.net
dns.npskr.server-on.net
doc-nps.server-on.net
go-tax.live-on.net
hometax.server-on.net
htax-go.server-on.net
htax.live-on.net
htax.server-on.net
n-dns.signin.keyword-on.net
n-info.blog-sec.keyword-on.net
n-info.doc-nps.server-on.net
n-info.go-tax.live-on.net
n-info.htax.live-on.net
n-info.htax.server-on.net
n-info.npskr.server-on.net
n-info.nts-go.server-on.net
n-tax.server-on.net
nid-check.doc-nps.server-on.net
nid-check.htax-go.server-on.net
nid-check.nps-kr.server-on.net
nid-check.npskr.server-on.net
nid-check.ntax-doc.server-on.net
nid-check.ntcn-kr.server-on.net
nid-check.nts-kr.live-on.net
nid-check.ntskr.server-on.net
nps-go.server-on.net
nps-kr.server-on.net
nps.server-on.net
npskr.server-on.net
ntax-doc.server-on.net
ntax.keyword-on.net
ntcn-kr.server-on.net
nts-kr.live-on.net
ntsbiling.server-on.net
ntskr.server-on.net
signin.keyword-on.net

# Reference: https://x.com/byrne_emmy12099/status/1960515703141970332
# Reference: https://www.virustotal.com/gui/file/89a6d3392668ba1b765a5ebcc8ac5045fffe8b6ef431004cba352868424a5cc3/detection

koreadiplomacyplaza.kro.kr
/pprb/pm/d.php

# Reference: https://www.virustotal.com/gui/ip-address/158.247.223.235/relations

cxiesoine.site
eaciunis.site
ecisouasi.site
eruionis.site
esiuxouin.site
isueszis.site
nzoinao.site
uoinesx.site
wiocduie.site
woivuaiwn.site
xioesiaud.site
xionisnai.site

# Reference: https://app.validin.com/detail?find=34be99c7e4dfe06ce03b91cddb103a2d&type=hash#tab=host_pairs (# 2025-08-29)

15dhyfituhivoivjjgijrtjtgg.cfd
15fuerouhrgiurtituigjtug.cfd
15hjdgvfdjbvunghghod.cfd
15jhguerhguyogjopgoff.cfd
15ygfyerfgyufhsdgfyegf.cfd
15yufibeuiohuireiogjrgji.cfd
20iuhfuighufiheufg.cfd
20keydhtdygeydsds.cfd
20ssdjtcurgyivtoheiwff.cfd
20syudfgweyuyrfuvv.cfd
21jkhvgyurgegiuhdfdfe.cfd
21khferuhuihlruygreuygfushdyfug.cfd
21ljijirvhrugjfiojiofef.cfd
21qwporfeoighyrtyuiijfzp.cfd
21uiygifuhuerotnbperopuhrgu.cfd
21vicbguyfgufgihjda.cfd
21wdsufhuifoeriogheuirhuieh.cfd
21yeyyuegygfuwehijkksas.cfd
22adfvnujghpjfkosd.cfd
22bakgjiotjohdjkjhklf.cfd
22cakegdghiuhgiuhiujsdf.cfd
22effortmgklfjgihtg.cfd
22framerytgdjfhifgg.cfd
22gapsdihgjimighfe.cfd
27anihvihitjiourigjriogjoe.cfd
27budhfirehigptroogore.cfd
27ciuyvihrtoijhfiphjgipjs.cfd
27cuihrihguhgijsiojhko.cfd
27djuciyheojfigfuygji.cfd
27efguhgihrtgorjeopiewofjre.cfd
27fjdhvunhuigjoko.cfd
29foxcherrywoo.cfd
29groovetaxas.cfd
29homedockshark.cfd
29icebergframepool.cfd
29joysticktunepipe.cfd
29keypointcircle.cfd
acigwubpbyjebdin.cfd
adfwe3rvwerga.cfd
adxudvfcvyvlctkh.cfd
aedxeexprcmjdhde.cfd
afvwegthgbwegwda.cfd
aieidkjehuvniewe.cfd
aqozaasdfjvazcv.site
b4356hjrtrtybner.cfd
bnpo239ufqoweioq.cfd
bnwoierhgo3bngoe.cfd
bsdhrherherherte.cfd
btrdpsiwoqivskvp.cfd
bvjhsdfhiows23fs.cfd
bvo234hbfoqweihr.cfd
bvsowe43no54sdif.cfd
csdangernotel.cfd
csdlofihwseforwp.cfd
cwlafjvrcbwyurdk.cfd
delojmmfirkcnnsi.cfd
dfrmhtyjbigmtbls.cfd
dfwserwr234fwere.cfd
dgljkedrstretret.cfd
diuvwquxiefimckg.cfd
dkbmvpweiouhbrn3.cfd
dl2sdffjtptdwjsa.cfd
dsf1000qwfkehaks.cfd
dsfgvno238ygvbiv.cfd
dsfkiuweh4r234fe.cfd
dsfno234vnopwe4i.cfd
dudaoddsdwlslsrk.cfd
ebyaznzrhfeuobgq.cfd
efwrewrewrewrewr.cfd
ekfmfldnds3raeoi.cfd
ekrlrakbmivpzuod.cfd
elkvwiefpawhfvsd.cfd
embtqmkquztvwklj.cfd
enqrylxlbxyzhhbi.cfd
ertr45dftyrtjrds.cfd
etraedtrr434grfd.cfd
eyeziguxgcufdnok.cfd
fdghrtymxzaree4g.cfd
fdsvwerw98uh32bf.cfd
fghr5tfhdhtryrty.cfd
fienalsecsecurity.store
fnw2i4o3ffuboowe.cfd
forwardcorpsecurity.store
friu23vfi823gvwi.cfd
fsczxcweoi.site
fstsxtoqhtmlrxdu.cfd
fthsrfdtyhryrtyr.cfd
ftyvtgyyuioyui.cfd
gbsoqrybemudlxxn.cfd
gjalvznzdexzefp.site
gjdfhowerhuohdsf.cfd
gyutfretytugyi.cfd
gzdkwqouefnwhwoi.cfd
halkdjhfeoihvwgw.cfd
haniedaleseebalda.store
hdkrkswndmlswee1.cfd
helsingkeysecuritycom.store
herisnenalseocstore.store
hnhyutytoqsdprtg.cfd
hvpqweirhnwpetof.cfd
hvq2l3i87vyqadfe.cfd
ibjblaxfnwpkkhrb.cfd
idonskenecoolsurry.store
iu09werbnoiuszhs.cfd
iwerjhfuedfoxsdf.cfd
jcucvipqvaewpfzd.cfd
jefewrewrewhrbdr.cfd
jfjdetwzwdespfoy.cfd
jhguygyghjkujj.cfd
jhwvfhdrpdpgkrxb.cfd
ket8er5kiupsherf.cfd
ksvh2398ycvweafw.cfd
larmalmelsmeralda.store
lgqzxdqqpimulunt.cfd
lihgpiojdfbenjmf.cfd
lrgewrt7643wsqj9.cfd
lsfo34bno34bio43.cfd
ludoji.pro
lvwiouwheivq09fa.cfd
mangoiewrhbepq23.cfd
mcjxxkymgczdbhhj.cfd
mhoupoktwhtzztch.cfd
midlesecurity.cfd
mlxqummnvnvykynf.cfd
mokyezlbzbqzvbwd.cfd
mqzbrihvxqdvivpu.cfd
mspdoirehwpg03pe.cfd
mvexmamsdjuboghz.cfd
ncjdij23ndsa3.cfd
nhwcwrtucfiisoyj.cfd
nidowermgrdce.cfd
noiu98h923b9bfwe.cfd
noteci.pro
nsdzwhmudotwlvsb.cfd
nvbdsoftiirenwe2.cfd
ohbtwjxavetrzuub.cfd
oierblkjsxofdgbo.cfd
oijoijewjrhiijgs.cfd
oipcanftkkdaktrf.cfd
oipewo834nlksiu3.cfd
operhkimpalyd.cfd
ortwhyzeecwgfxiu.cfd
ortyiihixetuatha.cfd
ovunyghvwxpombvo.cfd
oxjmvxpossvbxybh.cfd
p3w09jnlwi3j4h2o.cfd
pgoynjpxmmuncdwo.cfd
pmkom09fdusdsfsn.cfd
pnggvzktmjopzlph.cfd
psakqwejbfoih234.cfd
psdfn4oiqweersfe.cfd
psofhwernlvwiehd.cfd
pwsbisvwmruzhxhc.cfd
qfiuhslkeewjpdfg.cfd
qftwhtyuyterttrr.cfd
qhqofhdnfenthsmf.cfd
qikfuqgw3eooq2nb.cfd
qlkvqwneproj23vs.cfd
rsdkywqczoapeynt.cfd
rtyrfvyjrtitg6tu.cfd
rycqvkbwcrtzaesg.cfd
sdf083hnouf0fewr.cfd
sdfiuoher9snlkdf.cfd
se23rftresesrrer.cfd
sedku2398fqwebor.cfd
serminalskehvnio.cfd
shgurufhirjhkedegf.cfd
sodftqxschgzccmb.cfd
sodifhj0we9nowse.cfd
soeihfrwo0303now.cfd
sospfkdmq35rfdgf.cfd
sredgtrsg4et3bhf.cfd
ssedrfe45ytyyert.cfd
sytenskenecoolsurry.store
tbvwenher03nvvwe.cfd
tdfu4fjgsdfgsere.cfd
thchfchuvvjiobjiji.cfd
thinkallmessagee.buzz
thsdhearder.store
tkfadmfhrrnsms0w.cfd
tkfkdawehpigreww.cfd
tnuhrfhruhjkklkldd.cfd
trialskneujiqw3f.cfd
tyrfyuyyihiuiiyi.cfd
tzybwufdwzdkbxkb.cfd
udhfgebfhoklerjdll.cfd
ufuitgpwjitjiykiko.cfd
uskycuidbuitoigs.cfd
uweoihbgqpinsdve.cfd
uyxkqkpxijbvwjpx.cfd
vbnxcosernhoihoe.cfd
vksfewkiurybsdkf.cfd
vl9238fyqwoejrbn.cfd
vnowejb532obwfer.cfd
vnuhtijgiptjoykpl.cfd
wajdzszlrdyeoacv.cfd
wbmpsa2309ugw12f.cfd
wclsvcuiusgkdlao.cfd
wdoutgkdnmeurwvj.cfd
wesiouec.site
weyiewuryieuyrie.cfd
wiujbiujbipjbklfs.cfd
wmxzsfgjhkjfhqsr.cfd
woifruahfe.site
wrf23oiuhbfqjb2g.cfd
wuibwwbyomeltoba.cfd
xbewrh453jedjrte.cfd
xvbrcoaujkxgbrnr.cfd
ygfcuwfzjkldqfxn.cfd
yinianshenmiszelda.store
ypoqxmzltqmolhsv.cfd
ytrytyierdtrtyi.cfd
zcafqawgdsrhfdrh.cfd
zqkwsqzteimmwwzm.cfd
zsewbuknrorrghhj.cfd
zxchgbiureruhvid.cfd
zzfg2poh8fwbnlej.cfd

# Reference: https://x.com/ElementalX2/status/1963305327442739474
# Reference: https://www.virustotal.com/gui/file/028289fac74184ab05c8e57e61e60f97e1345f20a5d523b995b29eb7bfc23c92/detection

iuh234.medianewsonline.com

# Reference: https://x.com/ThreatBookLabs/status/1963439273610547336

callteve.live-on.net
noteyou.live-on.net

# Reference: https://dti.domaintools.com/inside-the-kimsuky-leak-how-the-kim-dump-exposed-north-koreas-credential-theft-playbook/

webcloud-notice.com

# Reference: https://www.virustotal.com/gui/ip-address/142.11.248.98/relations

kakaocorp.nmailhub.com
nate.nmailhub.com
navercorpae.nmailhub.com
navercorpej.nmailhub.com
navercorphb.nmailhub.com
navercorpnq.nmailhub.com

# Reference: https://www.genians.co.kr/en/blog/threat_intelligence/deepfake

astaibs.co.kr
contamine-sarzin.fr
dangol.pro
guideline.or.kr
healthindustry.sookmyung.ac.kr
hyounwoolab.com
jiwooeng.co.kr
liveml.cafe24.com
seytroux.fr
snuopel.cafe24.com
versonnex74.fr
zabel-partners.com

# Reference: https://www.virustotal.com/gui/ip-address/158.247.254.170/relations

akvozngpvjiaitnm.site
dciaopztuqfkoadfh.site
ficpafopanvzmcxads.site
giaethzvmaetistr.site
kvzperhapthzjbwi.site
mlkboapiejqlznxvs.site
opojgaoirnajdz.site
pzjaohvzllajitaf.site
vzoaewnoaidnbtz.site

# Reference: https://www.virustotal.com/gui/ip-address/158.247.207.7/relations
# Reference: https://www.virustotal.com/gui/ip-address/158.247.224.102/relations

bristope.space
donfrastic.space
emeranetop.store
focrust.space
gestimo.space
necrougovtp.site
nustranetp.store
seprone.site
tgcendept.store
tomcendetp.store
cebm.seprone.site
nid-login.live-on.net
nts-nl.mydns.vc
navercorp.nid-login.live-on.net
vest.donfrastic.space

# Reference: https://x.com/byrne_emmy12099/status/1969187321175011415
# Reference: https://www.virustotal.com/gui/file/80b3cce8300cf54cb5622e47d524d7ba82be0b4379a7251becfc1557b2524471/detection

parkland.incrediblevisibility.com/js/src/get.php
parkland.incrediblevisibility.com/js/src/list.php
parkland.incrediblevisibility.com/js/src/upload.php

# Reference: https://www.virustotal.com/gui/ip-address/158.247.219.27/relations

aspiresnedmebednet.store
callbition.kro.kr
cancel.repairservice.store
cancel.rnailservice.store
cancel.serveicecheck.store
candle.connectservice.store
candle.peopellifesuccess.site
candle.repairservice.store
cclip.sebaliarcomsecurity.store
com-signin.live-on.net
confirm.canceldeleting.site
declareskcakesitem.store
ektogthermoddoosec.store
lcslip.sebaliarcomsecurity.store
lcsmet.aspiresnedmebednet.store
lcsmet.serminialsystemsec.store
log.callbition.kro.kr
navercorp.com-signin.live-on.net
nidlip.sebaliarcomsecurity.store
nidmet.nsecuritygroupservice.store
nidmet.serminialsystemsec.store
oieiwksg.gkvnfsdognawiefoiawejofgiahng.xyz
phikaism.gkvnfsdognawiefoiawejofgiahng.xyz
posts.ewsadina.site
rvrhvray.nsecuritygroupservice.store
sebaliarcomsecurity.store
selirisnelsecurity.store
seriomsnejkeysenet.store
serminialsystemsec.store
skelidi.aspiresnedmebednet.store
sndkwejnetmansecurity.store
ssllip.sebaliarcomsecurity.store
sslmet.aspiresnedmebednet.store
sslmet.serminialsystemsec.store
staticnidlip.sebaliarcomsecurity.store
staticskelidi.aspiresnedmebednet.store
thisacountryemsec.store
ytqvinlt.nsecuritygroupservice.store

# Reference: https://www.virustotal.com/gui/ip-address/158.247.196.118/relations

apptxdoc.kro.kr
authblogcenter.dynv6.net
bloginfo.ublogcenter.kro.kr
nid.authblogcenter.dynv6.net
nid.usernblogs.mydns.vc
ublog.ublogcenter.kro.kr
ublogcenter.kro.kr
usernblogs.mydns.vc
usr.apptxdoc.kro.kr

# Reference: https://www.virustotal.com/gui/ip-address/27.102.137.93/relations

binfo.fennis.tk
bloginfo.fennis.tk
in-voices.abrdns.com
invoice.mydns.jp
naveredocs.abrdns.com
nid.ignorelist.com
niper.mooo.com
nvc.invoice.mydns.jp
in-voice.naveredocs.abrdns.com
navercorp.in-voices.abrdns.com

# Reference: https://x.com/ThreatBookLabs/status/1970986744112894273
# Reference: https://www.virustotal.com/gui/ip-address/27.102.138.163/relations
# Reference: https://www.virustotal.com/gui/ip-address/27.102.138.181/relations

ailone.mydns.bz
alone.server-on.net
cailiteve.mydns.bz
cailiuicnck.mydns.bz
calinck.mydns.bz
calinck.server-on.net
caliuicnck.mydns.bz
calltteve.mydns.bz
calltteve.server-on.net
ciliuicnck.mydns.bz
document-hometax.mydns.bz
eidocument-hometax.mydns.bz
ekdocument-hometax.mydns.bz
endocument-home.mydns.bz
eodocument-hometax.mydns.bz
ifcolnvfim.mydns.bz
ifillog.mydns.bz
iiailog.mydns.bz
infalog.mydns.bz
infclog.mydns.bz
infelog.mydns.bz
infelog.server-on.net
infiailog.mydns.bz
infoconfim.mydns.bz
infwlog.mydns.bz
infwlog.server-on.net
intyounfo.server-on.net
inyoiurnfo.mydns.bz
inyounfo.mydns.bz
ips-store.mydns.vc
isyouirinfo.mydns.bz
isyounfo.mydns.bz
isyounfo.server-on.net
loglli1syou.mydns.bz
lognisyou.mydns.bz
nlink.mydns.bz
nlink.server-on.net
nodeyou.mydns.bz
nodeyou.server-on.net
noteyou.mydns.bz
ntdlink.mydns.bz
ntdlink.mydns.vc
nto11link.mydns.bz
oedocument-home.mydns.bz
seveverif.mydns.bz
sevilivierif.mydns.bz
sevirverif.keyword-on.net
sevrverif.mydns.bz
sevrverif.server-on.net
verality.mydns.bz
veraty.keyword-on.net
vericy.mydns.bz
vericy.server-on.net
verity.mydns.bz
verity.server-on.net
verninity.mydns.bz
an.ailone.mydns.bz
an.calinck.mydns.bz
an.calinck.server-on.net
an.caliuicnck.mydns.bz
an.calltteve.server-on.net
an.eidocument-hometax.mydns.bz
an.endocument-home.mydns.bz
an.ifcolnvfim.mydns.bz
an.infclog.mydns.bz
an.infelog.mydns.bz
an.infoconfim.mydns.bz
an.intyounfo.server-on.net
an.inyounfo.mydns.bz
an.isyouirinfo.mydns.bz
an.isyounfo.mydns.bz
an.isyounfo.server-on.net
an.nodeyou.server-on.net
an.noticingyou.server-on.net
an.ntdlink.mydns.bz
an.ntlink.server-on.net
an.sevilivierif.mydns.bz
an.sevrverif.server-on.net
an.vericy.server-on.net
an.verity.mydns.bz
an.verninity.mydns.bz
bn.ailone.mydns.bz
bn.alone.server-on.net
bn.cailiuicnck.mydns.bz
bn.calinck.server-on.net
bn.calltteve.server-on.net
bn.document-hometax.mydns.bz
bn.endocument-home.mydns.bz
bn.eodocument-hometax.mydns.bz
bn.infelog.server-on.net
bn.infiailog.mydns.bz
bn.isyouirinfo.mydns.bz
bn.loglli1syou.mydns.bz
bn.nlink.server-on.net
bn.nodeyou.server-on.net
bn.noteyou.mydns.bz
bn.ntdlink.mydns.bz
bn.ntdlink.mydns.vc
bn.sevrverif.mydns.bz
bn.sevrverif.server-on.net
bn.vericy.mydns.bz
bn.verity.server-on.net
bn.verninity.mydns.bz
bzncd.nto11link.mydns.bz
check.ailone.mydns.bz
cn.ailone.mydns.bz
cn.calinck.mydns.bz
cn.calltteve.mydns.bz
cn.eodocument-hometax.mydns.bz
cn.infclog.mydns.bz
cn.infwlog.mydns.bz
cn.intyounfo.server-on.net
cn.inyounfo.mydns.bz
cn.isyounfo.mydns.bz
cn.isyounfo.server-on.net
cn.loglli1syou.mydns.bz
cn.nlink.mydns.bz
cn.nlink.server-on.net
cn.nodeyou.mydns.bz
cn.nodeyou.server-on.net
cn.ntdlink.mydns.bz
cn.oedocument-home.mydns.bz
cn.sevrverif.server-on.net
cn.vericy.mydns.bz
dn.ailone.mydns.bz
dn.cailiteve.mydns.bz
dn.cailiuicnck.mydns.bz
dn.calinck.server-on.net
dn.calltteve.server-on.net
dn.ciliuicnck.mydns.bz
dn.ekdocument-hometax.mydns.bz
dn.infalog.mydns.bz
dn.infwlog.mydns.bz
dn.infwlog.server-on.net
dn.isyounfo.mydns.bz
dn.isyounfo.server-on.net
dn.loglli1syou.mydns.bz
dn.nodeyou.mydns.bz
dn.nodeyou.server-on.net
dn.ntdlink.mydns.bz
dn.ntdlink.mydns.vc
dn.sevrverif.mydns.bz
dn.sevrverif.server-on.net
dn.verality.mydns.bz
kakako.com-login.live-on.net
nad.lognisyou.mydns.bz
nad.sevirverif.keyword-on.net
nad.veraty.keyword-on.net
nbd.lognisyou.mydns.bz
nbd.sevirverif.keyword-on.net
nbd.veraty.keyword-on.net
ncd.lognisyou.mydns.bz
ncd.nto11link.mydns.bz
ncd.sevirverif.keyword-on.net
ncd.veraty.keyword-on.net
ndd.nto11link.mydns.bz
ndd.veraty.keyword-on.net
publiccn.nlink.mydns.bz

# Reference: https://x.com/seunghoonhan/status/1972904905993306517
# Reference: https://www.virustotal.com/gui/ip-address/208.73.204.132/relations
# Reference: https://www.virustotal.com/gui/ip-address/216.219.95.242/relations

aomeioras2.r-e.kr
artisgo.n-e.kr
bermates.n-e.kr
brimo.n-e.kr
broowo.n-e.kr
chonkris.n-e.kr
churchlovenet.n-e.kr
daniele.n-e.kr
deta2.n-e.kr
donghowon.n-e.kr
goji2.n-e.kr
hayoungju.n-e.kr
hongra.n-e.kr
jeilmid.n-e.kr
joyseo.n-e.kr
jujeong.n-e.kr
jungop.n-e.kr
kapayok.p-e.kr
kisis2.n-e.kr
kocill.n-e.kr
konacord.n-e.kr
kopycill.n-e.kr
mboooun.n-e.kr
metong.n-e.kr
morotomot.r-e.kr
musicsta.n-e.kr
nauji.n-e.kr
nelro.n-e.kr
nosxxx.r-e.kr
onsungtong.n-e.kr
queosera2.n-e.kr
seoim.n-e.kr
skytpoo.n-e.kr
spaoverce.p-e.kr
strela.n-e.kr
titicaca.n-e.kr
tongsoju.n-e.kr
tradoam.n-e.kr
xn----302f2n80xlsd.xn--oi2b61z32a.xn--3e0b707e
xn----qb2fk2dxzf58k.xn--9i1b01onwqqzd.xn--3e0b707e
xn----qb2fk2dxzf58k.xn--hu5b25b77nvwc.xn--3e0b707e
xn----zo1f59igrdbqcpug.xn--h32bi4v.xn--3e0b707e
xn--4y2b50aj3ks0e.xn--oi2b61z32a.xn--3e0b707e
xn--v69a29tqre.xn--oi2b61z32a.xn--3e0b707e

# Reference: https://www.virustotal.com/gui/ip-address/209.159.155.109/relations
# Reference: https://www.virustotal.com/gui/ip-address/69.10.50.85/relations

aomeio.r-e.kr
beratosv.n-e.kr
box-fields.o-r.kr
bseng.myds.me
certloma.n-e.kr
cloudprofile.n-e.kr
data-cloud.n-e.kr
dellotic.r-e.kr
drm-manager.p-e.kr
dropbox-file.o-r.kr
fasoo-manage.n-e.kr
limpero2.r-e.kr
meritos1.r-e.kr
mesovera.n-e.kr
nocheck2.n-e.kr
pqros2.r-e.kr
secbox.o-r.kr
service-cloud.o-r.kr
usvera.r-e.kr
xomotoe.n-e.kr
zetm.kozow.com
zoporote.n-e.kr
web.zetm.kozow.com
xn--299a1vv85bdrg.xn--oi2b61z32a.xn--3e0b707e
xn--910b562a8pe.xn--oi2b61z32a.xn--3e0b707e
xn--950bl1sumh.xn--9i1b01onwqqzd.xn--3e0b707e
xn--950bt9sumh.xn--hk3b17f.xn--3e0b707e
xn--950bt9sumh.xn--oi2b61z32a.xn--3e0b707e
xn--h49al33az1h7ra.xn--yq5b.xn--3e0b707e
xn--hy1bv3cmxf83l.xn--9i1b01onwqqzd.xn--3e0b707e
xn--o80b37ia946w.xn--hk3b17f.xn--3e0b707e
xn--oi2b94x3uih9a.xn--h32bi4v.xn--3e0b707e
xn--on3b21fd6d9xs.xn--9i1b01onwqqzd.xn--3e0b707e
xn--zb0b93vywk06b.xn--h32bi4v.xn--3e0b707e

# Reference: https://www.virustotal.com/gui/ip-address/162.220.11.227/relations

metratics.o-r.kr
metrotas1.o-r.kr
xn--ij2bj3bu52b75a.xn--oi2b61z32a.xn--3e0b707e
xn--o80bp9muva858d.xn--9i1b01onwqqzd.xn--3e0b707e
xn--vf0bp3hv1sl8m.xn--hk3b17f.xn--3e0b707e

# Reference: https://www.virustotal.com/gui/ip-address/50.98.242.161/relations
# BANNER_0_HASH-HOST=8c5c13160070661cd5ab6a1a016b1f25

arm.publicvm.com
cpi.publicvm.com
dpi.publicvm.com
gpt.publicvm.com

# Reference: https://www.virustotal.com/gui/ip-address/195.85.250.22/relations

acount.centralpto.com
auth.n-works.o-r.kr
cerabox.o-r.kr
docotot.o-r.kr
drineover.o-r.kr
eoralic.r-e.kr
file-storidge.o-r.kr
fileworks.o-r.kr
kako-alert.p-e.kr
lenocovo.p-e.kr
meratics1.r-e.kr
moemeoras2.p-e.kr
morasis2.o-r.kr
n-filedrive.o-r.kr
nate-login.o-r.kr
nhn-file.r-e.kr
nhn-filecenter.o-r.kr
qoraer1.o-r.kr
security-centers.o-r.kr
septwelve.r-e.kr
seramixv.r-e.kr
teracodev.p-e.kr
uoseung.o-r.kr
worriesv.r-e.kr
xn----985ehgq49b6qr.xn--9i1b01onwqqzd.xn--3e0b707e
xn--220b630b8rb38z.xn--9i1b01onwqqzd.xn--3e0b707e
xn--2i0b050bujcb6q.xn--oi2b61z32a.xn--3e0b707e
xn--2i0b10r1wd66ao9t.xn--hk3b17f.xn--3e0b707e
xn--2i0bm4p0kj9le.xn--9i1b01onwqqzd.xn--3e0b707e
xn--910bj06aw1bm2f.xn--h32bi4v.xn--3e0b707e
xn--9i1b52g1q7a.xn--2i0b10rqve.xn--3e0b707e
xn--le5b23cqb60y.xn--9i1b01onwqqzd.xn--3e0b707e
xn--on3b52i03bca.xn--hk3b17f.xn--3e0b707e
xn--oy2b13dv1g3wcqxuiwd.xn--h32bi4v.xn--3e0b707e
xn--oy2b17nw6bstt.xn--hu5b25b77nvwc.xn--3e0b707e
xn--sp5b2lg28aiga.xn--oi2b61z32a.xn--3e0b707e
xn--v52b2zfto2xwyc.xn--h32bi4v.xn--3e0b707e
xn--z92bt5aizg97e.xn--hk3b17f.xn--3e0b707e
xn--zb0b93v7zf0yr.xn--yq5b.xn--3e0b707e
xn--zb0b93vkiklkp.xn--2i0b10rqve.xn--3e0b707e
xn--zb0b93vtnf44e91dp0q.xn--h32bi4v.xn--3e0b707e
xn--zb0b93vtnfsqae03deya.xn--2i0b10rqve.xn--3e0b707e
xn--zb0bt79a34ew5j.xn--h32bi4v.xn--3e0b707e

# Reference: https://www.virustotal.com/gui/ip-address/125.135.176.13/relations

aenco.kro.kr
1.aenco.kro.kr
draw.aenco.kro.kr
file.aenco.kro.kr
note.aenco.kro.kr
submit.aenco.kro.kr
xn--o39aq1b2fz70e41bw5kczc.xn--hk3b17f.xn--3e0b707e

# Reference: https://www.virustotal.com/gui/ip-address/154.90.62.240/relations

com-privacy.kro.kr
docprivacy.mydns.vc
msvc.linkpc.net
nblog.gleeze.com
invoice.docprivacy.mydns.vc
mexc.com-privacy.kro.kr

# Reference: https://www.virustotal.com/gui/ip-address/210.219.229.61/relations

cmails.ddns.net

# Reference: https://www.virustotal.com/gui/ip-address/27.102.138.181/relations

an.veraity.mydns.bz
bn.incoincfim.mydns.bz
bn.nideeyou.mydns.bz
bn.sevilrverif.mydns.bz
cailteve.mydns.bz
calicnck.mydns.bz
caliucnck.mydns.bz
cn.caliucnck.mydns.bz
cn.incoincfim.mydns.bz
cn.infillog.mydns.bz
cn.isyoiurnfo.mydns.bz
cn.nideeyou.mydns.bz
cn.ntilink.mydns.bz
cn.sevilrverif.mydns.bz
cn.veraity.mydns.bz
dn.cailteve.mydns.bz
dn.incoincfim.mydns.bz
dn.infillog.mydns.bz
dn.veraity.mydns.bz
incoincfim.mydns.bz
inconfim.mydns.bz
infillog.mydns.bz
isyoiurnfo.mydns.bz
isyournfo.mydns.bz
nad.calicnck.mydns.bz
nad.sevirverif.mydns.bz
nbd.isyournfo.mydns.bz
nbd.veraty.mydns.bz
ncd.calicnck.mydns.bz
ndd.calicnck.mydns.bz
ndd.sevirverif.mydns.bz
nideeyou.mydns.bz
ntilink.mydns.bz
sevilrverif.mydns.bz
sevirverif.mydns.bz
veraity.mydns.bz
veraty.mydns.bz

# Reference: https://x.com/malwrhunterteam/status/1982080767699361948
# Reference: https://x.com/smica83/status/1982117034549756309
# Reference: https://www.virustotal.com/gui/ip-address/157.250.201.136/relations
# Reference: https://www.virustotal.com/gui/file/6bc272a88d1eec9d561c09920e42793bb4c3d29b4da0fa57c553c4f9be28bafd/detection

alzip.r-e.kr
attachcloud.o-r.kr
attachload.o-r.kr
docucloud.o-r.kr
mailplatform.o-r.kr
naverwork.r-e.kr
onecloud.o-r.kr
threecloud.o-r.kr
twocloud.o-r.kr
attach.docucloud.o-r.kr
attach.mailplatform.o-r.kr
down.attachcloud.o-r.kr
down.attachload.o-r.kr
load.onecloud.o-r.kr
load.threecloud.o-r.kr
load.twocloud.o-r.kr
mail.naverwork.r-e.kr
update.alzip.r-e.kr

# Reference: https://x.com/ThreatBookLabs/status/1984062925523615924
# Reference: https://www.virustotal.com/gui/ip-address/141.164.63.16/relations

accountrecheck.server-on.net
an.cailtteve.mydns.bz
auth.blogrighthome.server-on.net
binfo.embloger.server-on.net
blogrighthome.server-on.net
cailtteve.mydns.bz
calianck.keyword-on.net
chkblog.accountrecheck.server-on.net
cn.cailtteve.mydns.bz
cn.incoinecfim.mydns.bz
com-mtc.server-on.net
com-tree.mydns.tw
contactdocid.server-on.net
dn.cailtteve.mydns.bz
dn.incoinecfim.mydns.bz
docinfo.myblogauth.mydns.vc
docinfo.usermemberblog.mydns.vc
docs.usrdocslink.server-on.net
edoc.contactdocid.server-on.net
edoc.usermemberblog.mydns.vc
edoc.view.com-mtc.server-on.net
edoc.webdoclnk.server-on.net
embloger.server-on.net
incoinecfim.mydns.bz
infellog.mydns.bz
info.myblogauth.mydns.vc
info.usermemberblog.mydns.vc
invoice.myblogauth.mydns.vc
invoice.onlinedeposits.mydns.bz
invoice.usermemberblog.mydns.vc
ips-nid.mydns.vc
iswa2.mydns.jp
lognisyou.live-on.net
myblogauth.mydns.vc
nad.calianck.keyword-on.net
nad.lognisyou.live-on.net
nad.sevirvrerif.keyword-on.net
nad.veraty.live-on.net
nai.navoerlogin.keyword-on.net
navrlogen.live-on.net
nbd.calianck.keyword-on.net
nbd.infellog.mydns.bz
nbd.lognisyou.live-on.net
nbd.nidayou.keyword-on.net
nbd.veraty.live-on.net
ncd.lognisyou.live-on.net
ncd.nidayou.keyword-on.net
ncd.veraty.live-on.net
ndd.calianck.keyword-on.net
ndd.lognisyou.live-on.net
ndd.sevirvrerif.keyword-on.net
nid-check.nps-htax.live-on.net
nid-invoice.ips-nid.mydns.vc
nid-user.ips-nid.mydns.vc
nid.edoc.view.com-mtc.server-on.net
nid.police.com-tree.mydns.tw
nid.usrdocslink.server-on.net
nidayou.keyword-on.net
nps-htax.live-on.net
ntdocid.server-on.net
officialnblog.server-on.net
onlinedeposits.mydns.bz
police.com-tree.mydns.tw
pretalx.iswa2.mydns.jp
pretix.iswa2.mydns.jp
proeblog.server-on.net
sevirvrerif.keyword-on.net
user.officialnblog.server-on.net
userdoc.webdoclnk.server-on.net
usermemberblog.mydns.vc
usr.usermemberblog.mydns.vc
usrdocslink.server-on.net
veraty.live-on.net
verify.usrdocslink.server-on.net
view.com-mtc.server-on.net
webdoclnk.server-on.net
xiaoyux.mydns.jp

# Reference: https://x.com/MalGamy12/status/1984570746941706348
# Reference: https://www.virustotal.com/gui/ip-address/157.250.201.136/relations
# Reference: https://www.virustotal.com/gui/file/0be26482a47e696774686dd19be90ee8220e17c739a85e6b114d4a81d32b3cfc/detection

jhtjtfjhtfght.r-e.kr
naverwoks.o-r.kr
othertime.o-r.kr
personcheck.o-r.kr
supershop.o-r.kr
hrhrdh.jhtjtfjhtfght.r-e.kr
load.othertime.o-r.kr
load.supershop.o-r.kr
mail.naverwoks.o-r.kr
secure.personcheck.o-r.kr

# Reference: https://www.virustotal.com/gui/ip-address/157.250.202.223/relations

erwrqdsf.ignorelist.com
gresdryre.o-r.kr
qqwefafaw.p-e.kr

# Reference: https://www.virustotal.com/gui/ip-address/216.158.235.72/relations

doc.p-e.kr
donguk.r-e.kr
ewersdasda.p-e.kr
ewfwefwerterwerw.p-e.kr
navermyboxx.p-e.kr
pointpark.p-e.kr
worksmobile.o-r.kr
worksmobile.p-e.kr
mail.pointpark.p-e.kr
mail.worksmobile.o-r.kr
mail.worksmobile.p-e.kr
nid.navermyboxx.p-e.kr
rwerwer.ewfwefwerterwerw.p-e.kr
vs.donguk.r-e.kr

# Reference: https://www.virustotal.com/gui/ip-address/69.10.53.144/relations

aeaeae.p-e.kr
amlsystem.p-e.kr
asldfkjlji.linkpc.net
aaa.pfpfpfpf.p-e.kr
cloudevergreen.work.gd
dkfkslkdk.run.place
dkfljliwefk.run.place
doccument.p-e.kr
kangbong.p-e.kr
kfkfkfkf.p-e.kr
lkdjfiwehifhoi.work.gd
meganz.p-e.kr
navermyboxx.p-e.kr
noteverify.n-e.kr
onlinedoc.p-e.kr
pfpfpfpf.p-e.kr
poolhub.p-e.kr
suportro.p-e.kr
tololo.p-e.kr
cloud.noteverify.n-e.kr
cloud.poolhub.p-e.kr
doc.kfkfkfkf.p-e.kr
main.suportro.p-e.kr
mybox.onlinedoc.p-e.kr
nei.tololo.p-e.kr
nid.doccument.p-e.kr
nid.navermyboxx.p-e.kr
one.amlsystem.p-e.kr
onview.publicvm.com
pcloud.meganz.p-e.kr
snim.kangbong.p-e.kr
tolo.aeaeae.p-e.kr

# Reference: https://www.virustotal.com/gui/ip-address/86.104.74.173/relations

doyoda.r-e.kr
nbnbnb.p-e.kr
mvmvmv.doyoda.r-e.kr
pig.nbnbnb.p-e.kr

# Reference: https://x.com/malwrhunterteam/status/1986492204240564680
# Reference: https://www.gendigital.com/blog/insights/research/dprk-kimsuky-lazarus-analysis
# Reference: https://www.virustotal.com/gui/ip-address/69.10.50.36/relations
# Reference: https://www.virustotal.com/gui/file/368769df7d319371073f33c29ad0097fbe48e805630cf961b6f00ab2ccddbb4c/detection
# Reference: https://www.virustotal.com/gui/file/b52f1b281615bd57126f392c40a371703021285f950fe33d6f0e782a7732e838/detection
# Reference: https://www.virustotal.com/gui/file/c9938936a80b588ba3ac9403854bdae8bf4f39fb2274662749af7a37bd4f43c8/detection
# Reference: https://www.virustotal.com/gui/file/e19ce3bd1cbd980082d3c55a4ac1eb3af4d9e7adf108afb1861372f9c7fe0b76/detection
# Reference: https://www.virustotal.com/gui/file/a3876a2492f3c069c0c2b2f155b4c420d8722aa7781040b17ca27fdd4f2ce6a9/detection
# HEADER_HASH-HOST=b400b25b9380193af3d7

http://166.88.11.10
http://23.27.140.49
2prosrv.com
alamosoftware.com
alamosoftware.net
birancearea.com
csplserver.in
externalmagentaspa.com
mechanicalintegrity-beta.com
medivet-agrimaster.com
quickchargeapp.com
redeamigos.com
sableforesight.com
simplrcloud.net
svichado.fund
tazkaraonline.com
test-sonarh.com
tronracing.com
tronscanner.io
unbrandedretailers.com
load.auraria.org
load.fpr.net
mailchamper.o-r.kr
git.mailchamper.o-r.kr

# Reference: https://x.com/lazarusholic/status/1986425869540442333
# Reference: https://www.virustotal.com/gui/file/bcdd8a213cf6986bad4bb487fe1bf798e159d32fd3a88b4e8d2945403d1c428d/detection

116.202.99.218:443

# Reference: https://x.com/seunghoonhan/status/1986595419590435112
# Reference: https://www.virustotal.com/gui/ip-address/162.220.11.202/relations
# Reference: https://www.logpresso.com/ko/blog/2025-11-06-healthcheckup-malware

load.rwbcode.com
naverwork.o-r.kr
samework.o-r.kr
secuwizvpn.r-e.kr
skycloud.o-r.kr
skyline.r-e.kr
wooritg.o-r.kr
attach.skycloud.o-r.kr
attach.skyline.r-e.kr
gwa.wooritg.o-r.kr
image.secuwizvpn.r-e.kr
load.samework.o-r.kr
mail.naverwork.o-r.kr

# Reference: https://www.virustotal.com/gui/ip-address/162.245.188.225/relations
# Reference: https://www.virustotal.com/gui/file/a45b6dcc453a25fee4db82db719f6269d7a2006939a326476bdcd0207f6c637c/detection

162.245.188.225:53
compressedzip.n-e.kr
ksnpolaris.o-r.kr
download.ksnpolaris.o-r.kr

# Reference: https://app.validin.com/detail?find=162.220.13.18&type=ip4&ref_id=bd7303c45d9#tab=resolutions

jeongbu-24.n-e.kr
alirn.jeongbu-24.n-e.kr

# Reference: https://app.validin.com/detail?find=34be99c7e4dfe06ce03b91cddb103a2d&type=hash#tab=host_pairs (# 2025-11-07)

account-google.com-user.kro.kr
an.sevilrivierif.mydns.bz
ashiikovwootay.site
bn.cail1teve.mydns.bz
cail1teve.mydns.bz
cailiucnck.mydns.bz
chk.docreferal.kozow.com
chk.npmaininvoice.mydns.bz
chk.npsempower.mysynology.net
com-user.kro.kr
dn.logllilssyou.mydns.bz
doc.docreferal.kozow.com
doc.ipgojirecord.mydns.bz
doc.npmaininvoice.mydns.bz
doc.npsempower.mysynology.net
docreferal.kozow.com
factorysmsecuritycorp.store
followgpraphicserver.store
fosmerianalcorpcom.store
fptresourcesecserver.store
fstavicenter.store
fstnxtroom.store
google-account.com-user.kro.kr
icoincfim.mydns.bz
ifcoinvfim.mydns.bz
info.ipgojirecord.mydns.bz
info.membergojinp.mydns.bz
info.qgreference.dynuddns.net
invoice.ipgojirecord.mydns.bz
invoice.qgreference.dynuddns.net
ipgojirecord.mydns.bz
ips-as.mydns.bz
jerminalibahubalarikal.store
linkinvoicesample.mydns.bz
logllilssyou.mydns.bz
m.nid.navor.r-e.kr
membergojinp.mydns.bz
n-corp.nts-kit.mydns.bz
n-invoice.ips-as.mydns.bz
nad.ifcoinvfim.mydns.bz
naver.seclogistic.com
navor.r-e.kr
ndocbpass.dns.army
necjournalsecurity.store
nhbaselink.mydns.bz
nhomeslan.site
nid-navercwu.servecounterstrike.com
nid-naverekt.servecounterstrike.com
nid-navereqp.servegame.com
nid-navergip.onthewifi.com
nid-naverjxt.3utilities.com
nid-navermpg.3utilities.com
nid-naversry.serveftp.com
nid-naversym.ddnsking.com
nid-navertir.onthewifi.com
nid-navertnx.ddnsking.com
nid-navertuv.servegame.com
nid-naverubp.serveftp.com
nid-naverwrg.ddnsking.com
nid.naver.seclogistic.com
nid.navor.r-e.kr
nids.cn.ntsspic.dynv6.net
npmaininvoice.mydns.bz
npsempower.mysynology.net
nts-kit.mydns.bz
ntsspic.dynv6.net
one.usermyblog.dynuddns.com
origininvoice.mydns.bz
qgreference.dynuddns.net
sevilrivierif.mydns.bz
sxcm.root.sx
usermyblog.dynuddns.com
verify.docreferal.kozow.com
verify.ipgojirecord.mydns.bz
verify.npmaininvoice.mydns.bz
viewer.soon.it

# Reference: https://www.virustotal.com/gui/ip-address/158.247.248.45/relations

accsupporthome.store
bzwais.site
daumuek.bounceme.net
daumwxj.ddns.net
daumzeb.sytes.net
emv1.nps-top.site
emyo01pyd7n9s5xf.cfd
emyo02mgp0pka0p8.cfd
emyo03b9h3m9sjgk.cfd
emyo0469yi18iq5z.cfd
emyo058cr3jqz4i6.cfd
emyo06wxseln1viu.cfd
emyo07x2lt37r3ha.cfd
emyo08vfzk7yi649.cfd
emyo09czbhtim46b.cfd
emyo10xv70j9g3ic.cfd
emyo119qpz3taq0n.cfd
emyo12v2jg6vbtri.cfd
emyo13nm8xcutmlv.cfd
emyo14e4nb7raqki.cfd
emyo159i0tdtmqbg.cfd
emyo166cqm24343c.cfd
emyo174uj5zyji72.cfd
emyo186qs4xvg6dv.cfd
emyo195t7ft9q1ob.cfd
emyo20b6zqf6td8l.cfd
gmsrvstate.store
homesafeacc.store
hostlightserver.store
http-emv1.nps-top.site
http-naver.nps-com.space
http-out.nps-from.site
http-relay.nps-top.site
https-emv1.nps-top.site
https-naver.nps-com.space
https-out.nps-from.site
https-relay.nps-top.site
liw0284p3uv0unu.cfd
liw03zzqk3rnk5t.cfd
liw04ph07le2xxc.cfd
liw054tzgo6cb14.cfd
liw06q2o463vraw.cfd
liw07cc6350xnol.cfd
maservinfo.store
mois-news.site
mta-sts.nps-com.space
mx.nps-com.space
natemjp.onthewifi.com
naver.nps-com.site
naver.nps-com.space
naver.nps-com.store
ndocajavsvr.store
nid-naverdsm.servecounterstrike.com
nid-navereut.servecounterstrike.com
nid-naverfez.ddnsking.com
nid-naverhpv.servehalflife.com
nid-naverjdq.3utilities.com
nid-naverlpd.onthewifi.com
nid-navernrn.3utilities.com
nid-naverowu.servequake.com
nid-naverpxi.servegame.com
nid-naverqdp.onthewifi.com
nid-naversyy.ddnsking.com
nid-navervei.serveftp.com
nid-naverxrl.3utilities.com
nps-com.site
nps-com.space
nps-com.store
nps-from.site
nps-host.space
nps-top.site
out.nps-from.site
prodollar.co.kr
relay.nps-top.site
smpmail.nps-com.space
smtp.mois-news.site
smtp.nps-com.space
smtpauth.nps-com.space
smtpmail.nps-com.space
smtpmail.nps-from.site
staging.nps-top.site
statelozdaagsrv.store
store.nps-from.site
store.nps-top.site
useforwebdoc.store
wbdoc01k36lxr5qil.cfd
wbdoc02e7kn05alk5.cfd
wbdoc03ymndh08q9q.cfd
wbdoc048q5eoc0p1e.cfd
wbdoc05wa7rkcp2qr.cfd
wbdoc06hzznwz5s08.cfd
wbdoc07g8zuicplw8.cfd
wbdoc08m5v3i38be0.cfd
wbdoc09tcemdbxmus.cfd
wbdoc10hgj71q0x27.cfd
wbdoc11q70qfv3ij0.cfd
wbdoc12ky2qfmlji7.cfd
wbdoc13an08oafk19.cfd
wbdoc14dh1hcaw2u8.cfd
wbdoc159lnk4c0siw.cfd
wbdoc16hpzcdkpoyi.cfd
wbdoc17uu2vj59l0l.cfd
wbdoc18vnlpzmpnkq.cfd
wbdoc19y9ammtlqh3.cfd
wbdoc209g88t4xehm.cfd
wbdoc214x17eaduwa.cfd
wbdoc22pqwag11gdq.cfd
wbdoc23wb0h9q73mv.cfd
wbdoc245wiv1gnlim.cfd
wbdoc25q51tg6te6j.cfd
wbdoc26c12v7sz2od.cfd
wbdoc27df2hztv2uv.cfd
wbdoc28d6yxnvf6cv.cfd
wbdoc29vy6jsyc1p3.cfd
wbdoc30fobtt3uz1j.cfd
webmail.nps-com.space

# Reference: https://www.virustotal.com/gui/ip-address/38.54.40.183/relations

accountsecuritycert.kro.kr
accountsecuritycorp.kro.kr
accountuserv3.kro.kr
accountuserverify.kro.kr
google.accountsecuritycert.kro.kr
google.accountsecuritycorp.kro.kr
google.accountuserv3.kro.kr
google.accountuserverify.kro.kr

# Reference: https://www.virustotal.com/gui/ip-address/141.164.38.27/relations

natecok.myvnc.com
nid-naversgg.ddnsking.com
nid-naverwrn.serveftp.com

# Reference: https://www.virustotal.com/gui/ip-address/27.102.137.106/relations

auction.server-on.net
delivery.auction.server-on.net
edoc-nts.mydns.bz
google.sign-account.r-e.kr
ips-calleve.mydns.vc
ips-gov.mydns.vc
ips-nidservice.mydns.vc
mail-ips.mydns.bz
mobile.auction.server-on.net
n-cloud.edoc-nts.mydns.bz
n-cloud.nts-doc.mydns.vc
n-cloud.nts-mls.mydns.bz
n-corp.nts-mls.mydns.bz
n-invoice.ips-gov.mydns.vc
n-store.edoc-nts.mydns.bz
n-store.nts-ncorp.mydns.vc
nid-user.edoc-nts.mydns.bz
nid-user.ips-calleve.mydns.vc
nts-as.mydns.bz
nts-doc.mydns.vc
nts-ecall.mydns.vc
nts-eml.mydns.vc
nts-mls.mydns.bz
nts-ncorp.mydns.vc
nuser-info.mail-ips.mydns.bz
nuser-info.nts-doc.mydns.vc
nuser-login.ips-calleve.mydns.vc
nuser-login.ips-nidservice.mydns.vc
nuser-login.mail-ips.mydns.bz
online-kt.server-on.net
sign-account.r-e.kr
user-nid.nts-ecall.mydns.vc

# Reference: https://www.virustotal.com/gui/ip-address/158.247.205.34/relations

apolosizybashcome.store
asysincrashsitely.store
belinghamnidosame.store
biologigraphylabroom.store
cruelaisancemilia.store
fsdoctarpi.store
fsvictoory.store
gilisemilianetism.store
himalaisbeardient.store
homecorpdep.mydns.vc
rizbanyiliyassecy.store
sanctobeseljanety.store
somaliasmandasyle.store
themodern.bar
blogauthmanage.mydns.vc
info.blogauthmanage.mydns.vc

# Reference: https://www.virustotal.com/gui/ip-address/158.247.211.212/relations

accountvoice.r-e.kr
allvoice.r-e.kr
derivelink.kro.kr
directdeliver.r-e.kr
docinfo.accountvoice.r-e.kr
docinfo.invoiceacc.mydns.bz
docinfo.invoicemg.kro.kr
docinfo.npdocinfo.kro.kr
docinfo.ntinvoices.kro.kr
docinfo.re-authenticate.r-e.kr
docinfo.webpdoc.n-e.kr
doclistdetail.n-e.kr
docmethod.r-e.kr
docmgmt.o-r.kr
docs-info.n-e.kr
edoc.derivelink.kro.kr
edoc.docmethod.r-e.kr
edoc.docmgmt.o-r.kr
edoc.invoicesystem.n-e.kr
edocinvoices.o-r.kr
indoc.navors-corp.v6.navy
indoc.nvc-corp.dynv6.net
invoice.accountvoice.r-e.kr
invoice.derivelink.kro.kr
invoice.docmgmt.o-r.kr
invoice.docs-info.n-e.kr
invoice.invoicemg.kro.kr
invoice.npdocinfo.kro.kr
invoice.perioddocs.p-e.kr
invoiceacc.mydns.bz
invoicemg.kro.kr
invoices.nvc-corp.dynv6.net
invoicesystem.n-e.kr
mydocslnk.r-e.kr
navors-corp.v6.navy
nid.directdeliver.r-e.kr
nid.ntdepinfo.r-e.kr
nid.policydocs.p-e.kr
npdocinfo.kro.kr
ntdepinfo.r-e.kr
ntinvoices.kro.kr
nvc-corp.dynv6.net
oauth.allvoice.r-e.kr
oauth.invoicesystem.n-e.kr
perioddocs.p-e.kr
policydocs.p-e.kr
re-authenticate.r-e.kr
recheck.edocinvoices.o-r.kr
usr.doclistdetail.n-e.kr
usr.mydocslnk.r-e.kr
usr.ntinvoices.kro.kr
webpdoc.n-e.kr

# Reference: https://www.virustotal.com/gui/ip-address/27.102.138.181/relations

an.ntilink.mydns.bz
an.sevilverif.mydns.bz
an.vernity.mydns.bz
bn.sevilverif.mydns.bz
cn.cailteve.mydns.bz
cn.sevilverif.mydns.bz
dn.logllisyou.mydns.bz
ifillog.mydns.bz
iyoiurnfo.mydns.bz
logllisyou.mydns.bz
nbd.icoincfim.mydns.bz
ncd.ifillog.mydns.bz
ncd.iyoiurnfo.mydns.bz
ndd.lognisyou.mydns.bz
sevilverif.mydns.bz
vernity.mydns.bz

# Reference: https://www.virustotal.com/gui/ip-address/158.247.210.58/relations

cloud-check.ncorp-edoc.mydns.vc
cloud-check.nps-niduser.live-on.net
cloudflare.nid-recaptcha.kro.kr
cloudflare.nid-recheck.kro.kr
dns-check.nps-info.live-on.net
dns-info.nps-info.live-on.net
dns.nts-eml.mydns.vc
eml-nts.live-on.net
ips-cloud.nid-recheck.kro.kr
ips-doc.mydns.vc
ips-ecall.mydns.bz
ips-edoc.mydns.bz
ips-htax.mydns.bz
ips-info.mydns.vc
ips-ntax.mydns.bz
ips-org.mydns.vc
ips-store.mydns.vc
ips-tax.mydns.vc
n-cloud.nts-gov.mydns.bz
n-cloud.nts-mls.mydns.vc
n-cloud.nts-nidauth.mydns.bz
n-corp.ips-doc.mydns.vc
n-corp.ips-htax.mydns.bz
n-corp.ips-info.mydns.vc
n-corp.nts-info.mydns.bz
n-corp.nts-nidauth.mydns.bz
n-info.ncorp-edoc.mydns.vc
n-info.nps-niduser.live-on.net
n-invoice.ips-ntax.mydns.bz
n-invoice.ips-org.mydns.vc
n-invoice.ips-tax.mydns.vc
n-invoice.nts-gov.mydns.bz
n-invoice.nts-mls.mydns.vc
n-store.ips-edoc.mydns.bz
n-store.ips-org.mydns.vc
n-store.nts-gov.mydns.bz
n-store.nts-kit.mydns.bz
navercorp-2nd.eml-nts.live-on.net
navercorp-info.eml-nts.live-on.net
ncorp-cloud.ips-doc.mydns.vc
ncorp-edoc.mydns.vc
ncorp-info.ips-info.mydns.vc
ncorp-info.ips-store.mydns.vc
ncorp-invoice.ips-doc.mydns.vc
ncorp-invoice.ips-tax.mydns.vc
nid-check.nps-niduser.live-on.net
nid-check.nts-eml.mydns.vc
nid-invoice.ips-tax.mydns.vc
nid-recaptcha.kro.kr
nid-recheck.kro.kr
nid-user.ips-tax.mydns.vc
nps-info.live-on.net
nps-niduser.live-on.net
nts-edoc.mydns.vc
nts-eml.mydns.vc
nts-gov.mydns.bz
nts-gov.mydns.vc
nts-info.mydns.bz
nts-kit.mydns.vc
nts-mls.mydns.vc
nts-nidauth.mydns.bz
nuser-info.ips-ecall.mydns.bz
nuser-info.ips-org.mydns.vc
nuser-info.ips-tax.mydns.vc
nuser-info.nts-edoc.mydns.vc
nuser-info.nts-eml.mydns.vc
nuser-info.nts-mls.mydns.vc
nuser-login.ips-tax.mydns.vc
user-nid.nts-gov.mydns.vc

# Reference: https://www.virustotal.com/gui/ip-address/158.247.216.96/relations

accountndoc.server-on.net
asdsa.o-r.kr
auth.blogmanage.server-on.net
bcvdw.o-r.kr
blogmanage.server-on.net
blogzoneid.dynv6.net
customply.o-r.kr
dfwefrbwerewreds.cfd
docinfo.blogzoneid.dynv6.net
docinfo.linktxdoc.server-on.net
docinfo.maildocusers.mydns.vc
docinfo.nportalonline.mydns.vc
dotypelist.kro.kr
ebdesfgvf65dgfdg.cfd
edoc.maildocusers.mydns.vc
edoc.onlinedoczone.dynv6.net
hktaxdoc.mydns.vc
info.dotypelist.kro.kr
info.hktaxdoc.mydns.vc
info.maildocusers.mydns.vc
info.nportalonline.mydns.vc
info.personaldoc.mydns.vc
info.taxdocdevice.mydns.vc
invoice.blogzoneid.dynv6.net
invoice.dotypelist.kro.kr
invoice.linktxdoc.server-on.net
invoice.nportalonline.mydns.vc
invoice.personaldoc.mydns.vc
jidfea.r-e.kr
linktxdoc.server-on.net
maildocusers.mydns.vc
ndfge325rtertret.cfd
nid.npusecretary.server-on.net
nidsim.onlinencorpmailsecurity.store
nofov.p-e.kr
nportalonline.mydns.vc
npusecretary.server-on.net
oauth.contactdocid.server-on.net
onlinedoczone.dynv6.net
personaldoc.mydns.vc
qaunte.n-e.kr
random.nmailinconline.store
random.onlinenmailserver.store
sasda.r-e.kr
sdfdsbwe4tsfdsrr.cfd
sdfvwsefresdfdsw.cfd
seoulgov.online
snsunnyne.store
thdbodyloose.store
trialcorpsecurity.store
tyhfa.p-e.kr
user.blogmanage.server-on.net
usr.hktaxdoc.mydns.vc
usr.maildocusers.mydns.vc
usr.nportalonline.mydns.vc
werhbertreg423re.cfd
yuirj.n-e.kr

# Reference: https://www.virustotal.com/gui/ip-address/216.189.157.89/relations

access.cdaumauth.cf
access.daurninfo.ml
accont.estcoft.kro.kr
accont.noute.kro.kr
account.qrnail.kro.kr
accounts.goggle.n-e.kr
accounts.p-e.kr
acess.lives.kro.kr
alowusr.dmstat.r-e.kr
aoi-mail.ml
autoupdate.kro.kr
avastupdate.kro.kr
backspaice.fun
bunmsde.xcdmklo.p-e.kr
byunad.r-e.kr
cdaumauth.cf
changepwd.nete.p-e.kr
check.dmnew.cf
check.ntenew.kro.kr
chollian.manager-alert.tk
claum.kro.kr
curt.guntuer.kro.kr
danm.kro.kr
dauncheck.ml
daurn.kro.kr
daurninfo.ml
dmail.r-e.kr
dmnew.cf
dmstat.r-e.kr
download.manager-alert.tk
estcoft.kro.kr
estsft.autoupdate.kro.kr
goggle.n-e.kr
goggle.p-e.kr
google.accounts.p-e.kr
gooqle.kro.kr
guntuer.kro.kr
hamnail.kro.kr
help.yahoc.kro.kr
home.nates.kro.kr
home.nete.p-e.kr
hotrnail.ml
kakaocheck.ml
lives.kro.kr
login.claum.kro.kr
login.dauncheck.ml
login.daurn.kro.kr
login.hamnail.kro.kr
login.hotrnail.ml
login.lives.kro.kr
login.nate-home.kro.kr
login.outlook-live.ml
logins.hamnail.kro.kr
mail.claum.kro.kr
mail.danm.kro.kr
mail3.nate-or.kro.kr
majortom.ml
manager-alert.tk
member.hamnail.kro.kr
members.cdaumauth.cf
members.hamnail.kro.kr
my.telegram-support.ml
myaccount.aoi-mail.ml
nait.r-e.kr
nate-home.kro.kr
nate-or.kro.kr
nates.kro.kr
nete.p-e.kr
noute.kro.kr
outlook-live.ml
paege.dmail.r-e.kr
profi1e.nait.r-e.kr
qrnail.kro.kr
qurhut.xurunos.n-e.kr
rigth.backspaice.fun
rnyaccounts.gooqle.kro.kr
router.avastupdate.kro.kr
signin.goggle.p-e.kr
signin.hotrnail.ml
signin.nates.kro.kr
stat.dauncheck.ml
telegram-support.ml
user.dauncheck.ml
userprofile.dauncheck.ml
verify.goggle.n-e.kr
xcdmklo.p-e.kr
xurunos.n-e.kr
yahoc.kro.kr
zyunk.byunad.r-e.kr

# Reference: https://www.virustotal.com/gui/ip-address/121.159.44.6/relations

imvoice.o-r.kr
nids.o-r.kr
xn--4y2bl5s.imvoice.o-r.kr
xn--4y2bl5s.nids.o-r.kr
xn--lu5btd128b.xn--4y2bl5s.imvoice.o-r.kr
xn--lu5btd128b.xn--4y2bl5s.nids.o-r.kr
xn--sn3b25q.xn--lu5btd128b.xn--4y2bl5s.imvoice.o-r.kr

# Reference: https://www.virustotal.com/gui/ip-address/206.71.149.159/relations

lkcakjnztiaht.site
ojvapajr3fiaeftl.site
pcljantpzvnat.site

# Reference: https://www.virustotal.com/gui/ip-address/149.248.79.197/relations

hauvhzbewiqoas.site
igpahtavoaiwllafei.site

# Reference: https://www.virustotal.com/gui/ip-address/64.176.224.71/relations

account-login.security-service.kro.kr
blog-niduser.mydns.bz
cloud-check.ncorp-doc.mydns.vc
cloud-check.nps-msg.live-on.net
cloud-check.nps-nidservice.live-on.net
cloud-check.nps-site.live-on.net
cloud-info.nps-nidservice.live-on.net
cloud-info.nps-site.live-on.net
cloud.ncorp-doc.mydns.vc
cloud.nl-nps.live-on.net
cloud.nps-msg.live-on.net
cloud.nps-nidservice.live-on.net
cyber.mydns.vc
dns.nidnotice-blog.mydns.bz
dns.nts-nid.mydns.vc
htax-noticedoc.mydns.bz
ips-auth.mydns.vc
ips-calldoc.mydns.vc
ips-cdn.mydns.bz
ips-gov.mydns.bz
n-cloud.htax-noticedoc.mydns.bz
n-cloud.ips-gov.mydns.bz
n-cloud.nts-auth.mydns.bz
n-corp.htax-noticedoc.mydns.bz
n-corp.ips-auth.mydns.vc
n-corp.ips-calldoc.mydns.vc
n-corp.ips-cdn.mydns.bz
n-corp.nidnotice-ips.mydns.bz
n-corp.nts-eml.mydns.bz
n-info.ncorp-doc.mydns.vc
n-info.nps-nidservice.live-on.net
n-info.nts-nid.mydns.vc
n-invoice.ips-auth.mydns.vc
n-store.nts-auth.mydns.bz
navercorp-info.nts-ncorp.live-on.net
ncorp-cloud.ips-auth.mydns.vc
ncorp-doc.mydns.vc
ncorp-info.ips-auth.mydns.vc
nid-check.cyber.mydns.vc
nid-check.ncorp-doc.mydns.vc
nid-check.nps-msg.live-on.net
nid-check.nts-nid.mydns.vc
nid-invoice.ips-auth.mydns.vc
nid-user.ips-auth.mydns.vc
nidnotice-blog.mydns.bz
nidnotice-ips.mydns.bz
nl-nps.live-on.net
nps-msg.live-on.net
nps-nidservice.live-on.net
nps-site.live-on.net
nts-auth.mydns.bz
nts-eml.mydns.bz
nts-ncorp.live-on.net
nts-nid.mydns.vc
nuser-login.ips-calldoc.mydns.vc
security-service.kro.kr

# Reference: https://medium.com/@meeswicky1100/dprk-unc3782-d66329e5c071
# Reference: https://github.com/Meesvanwickeren/Threat_Intel/blob/main/DPRK_UNC3782_Indicators

0x0.care
1inchdao.com
1inchdao.top
3dnavernidc.online
a4de2ac4b938.navmailer.xyz
acc-portal.nl
acks.tech
admin.arbinu.club
admin.arbinu.fun
admin.arbinu.pro
admin.daisen.fi
admin.etherscard.com
admin.lidonft.fi
admin.lidonft.io
admin.lidonft.pro
admin.navernida.online
admin.noox.capital
admin.noox.cash
admin.noox.club
admin.noox.digital
admin.noox.fi
admin.noox.financial
admin.noox.fund
admin.noox.global
admin.noox.in
admin.noox.live
admin.noox.pro
admin.noox.space
admin.noox.vip
admin.noox.zone
admin.nooxbadge.pro
admin.nooxnft.com
admin.pepemon.fi
admin.psyop.fi
admin.reth.fi
admin.unisocks.co
admin.unisocks.help
admin.unisocks.org
admin.unisocks.pro
aerodromehub.top
aerodromes.xyz
aevodao.top
aevolabs.top
aevopass.xyz
aevostake.top
aevostakes.xyz
agni.farm
aiozdao.xyz
aiozlabs.top
aiozlabs.xyz
aioztoken.top
airdropdao.top
airdrophubs.xyz
airdroplab.top
airdropnew.xyz
airdropnft.icu
airdropnfts.xyz
airdropsdao.top
airdroptokens.top
alienbase.icu
alienbase.info
alienbase.org
alienbase.top
allianceblock.co
alliancelabs.top
alliancelabs.xyz
altrewards.top
altrewards.xyz
ambients.top
ambients.xyz
ankrdao.org
arb2.xyz
arbinu.club
arbinu.fun
arbinu.net
arbinu.org
arbinu.pro
arbinu.xyz
arbinus.xyz
arbinutoken.top
arbinutoken.xyz
arbius.app
arkhamvip.com
arkhamvip.xyz
asteth.org
autoconfig.navernida.online
autodiscover.navernida.online
avalaunchdao.xyz
axelarchain.com
barnbridge.xyz
barnsbridge.xyz
beamdao.top
beamhubs.top
beamhubs.xyz
beamlab.top
beamlab.xyz
beamlabs.top
beamsdao.xyz
beamshub.top
beamslab.xyz
bitflow.fund
blasthub.top
blasthubs.top
blastnative.xyz
blastnativelab.top
blastnativelab.xyz
blastnatives.top
blastnatives.xyz
blendrdao.top
blendrhub.xyz
blendrlabs.top
blendrprotocol.com
blendrprotocols.top
blendrprotocols.xyz
blendrshub.xyz
blog.nidanaver.tech
bonusdao.top
bonusdao.xyz
bonushub.xyz
bonuslab.top
bonuslabs.xyz
bvmdao.com
bvmdao.xyz
centersecurity.link
claimdao.top
claimeeth.xyz
claimhub.top
claimhubs.top
claimshub.xyz
clearview-cpa.ca
clearview-cpa.net
cloudalarm.online
cloudalarm.site
cloudfls.xyz
cloudjs.xyz
corpnavcenter.tech
corpnavsec.site
corpsecservice.site
corresfe.com
cosmicnetwork.org
cotiv2.com
cpanel.custom-center.nl
cpanel.havercorps.site
cpanel.havercorpteam.site
cpanel.mailhelp.online
cpanel.nauercorp.site
cpanel.nauercorpteam.website
cpanel.navcorp.website
cpanel.navcorpmanager.site
cpanel.navcorpmanager.website
cpanel.navcorpteam.site
cpanel.navecorp.site
cpanel.navecorp.website
cpanel.navercorpd.online
cpanel.naveservice.site
cpanel.navmanager.site
cpanel.navrcorp.site
cpanel.novercorp.site
cpcalendars.havercorp.site
cpcalendars.havercorps.site
cpcalendars.havercorpteam.site
cpcalendars.nauercorp.site
cpcalendars.nauercorp.website
cpcalendars.nauercorpteam.website
cpcalendars.navcorpmanager.site
cpcalendars.navecorp.website
cpcalendars.navercorpd.online
cpcalendars.naveservice.site
cpcalendars.navportalservice.site
cpcalendars.navrcorp.site
cpcalendars.novercorp.site
cpcalendars.portal-sec.nl
cpcontacts.custom-center.nl
cpcontacts.havercorp.site
cpcontacts.havercorps.site
cpcontacts.havercorpteam.site
cpcontacts.nauercorp.site
cpcontacts.nav-service.nl
cpcontacts.navcorpmanager.site
cpcontacts.navcorpmanager.website
cpcontacts.navcorpteam.site
cpcontacts.navecorp.site
cpcontacts.navecorp.website
cpcontacts.navercorpd.online
cpcontacts.naveservice.site
cpcontacts.navportalservice.site
cpcontacts.navrcorp.site
cpcontacts.novercorp.site
cpcontacts.portal-sec.nl
cus-corp.nl
custom-center.nl
cyberblast.net
cyberblast.top
cyberzk.co
daisen.fi
daoairdrop.xyz
dhedge.net
dhedgedao.xyz
dhedgehub.top
dhedgehub.xyz
dhedges.xyz
docnaverteam.site
docnavervteam.site
docsecteam.site
dogetoken20.com
dogetoken20.xyz
dropcoins.top
dropdao.top
droplabs.xyz
dropnft.xyz
dropnfts.xyz
dropsdao.xyz
dropslab.xyz
dropsnft.xyz
droptokens.top
earnairdrop.xyz
earnclaim.xyz
earndao.top
earnedlab.top
earnedlab.xyz
earnedlabs.xyz
earngift.xyz
earnhubs.top
earnhubs.xyz
earni.top
earni.xyz
earnihub.top
earnihub.xyz
earnlabs.xyz
earnnft.top
earnnfts.xyz
earnrewards.xyz
earnsbonus.top
earnsbonus.xyz
earnsdao.xyz
earnsdrop.icu
earnsdrop.top
earnshub.top
earnshub.xyz
earnslab.top
earnslab.xyz
earnsnft.top
earnsnft.xyz
echelonlab.xyz
echelonprime.org
echelonprime.xyz
eeth.top
eethdao.top
eethdao.xyz
eether.xyz
eethers.xyz
eethfi.top
eethlab.top
eethlab.xyz
eethlabs.top
eethpool.com
eigentoken.org
eigentoken.top
enjintoken.top
enjintoken.xyz
ensdao.top
enshub.xyz
enslab.xyz
enstokens.xyz
ependle.com
ependle.top
ependledao.top
ependledao.xyz
ependlefi.xyz
ependlehub.top
ependlehub.xyz
ependlelab.top
ependles.xyz
ependleshub.top
ependleshub.xyz
ericoneth.org
ericoneth.xyz
ethcardnft.space
ethena.fund
ethenahub.top
ethenahub.xyz
ethenalabs.top
etherscard.com
ethersfi.com
ethlabs.top
everstake.app
fetdao.top
fetdao.xyz
fethub.top
fethub.xyz
flokidao.org
flokitoken.top
fluidnft.xyz
gagapepe.org
galanode.org
galanode.xyz
galanodes.com
galanodes.top
galanodes.xyz
galasnode.xyz
gavax.net
gavax.top
giftnft.top
giftnfts.top
giftsnft.top
glqdao.xyz
glqnet.xyz
glqtoken.top
gmtstepn.tech
gmtstepn.xyz
gmxdao.com
gmxtoken.com
gpepedao.top
gpepedao.xyz
gpepehub.xyz
gpepelab.top
gpepelabs.xyz
gpepes.xyz
gpepesdao.top
gpepetoken.xyz
graphnetwork.xyz
graphpool.xyz
grokmeme.org
grokmeme.tech
grokmemes.tech
groksmeme.xyz
groktoken.top
gtrade.top
havercorp.site
havercorps.site
havorcorpsv.online
hytopia.app
hytopia.top
illuviumtoken.top
illuviumtoken.xyz
imxnft.org
imxnft.top
imxnft.xyz
imxnfts.top
imxnfts.xyz
jitodao.top
jquerylabs.zone
jquerystack.zone
jquerystacks.info
jquerystacks.xyz
jquerytz.zone
karratcoin.top
karratcoin.xyz
kdao.app
kendulab.top
kendulabs.com
kendulabs.xyz
keptoken.com
lfgho.com
lidodao.net
lidodao.top
lidonft.fi
lidonft.io
lidonft.pro
listadao.org
listadao.top
login.navnaver.com
loopring.digital
loopringcoin.com
loopringcoin.top
loopringcoin.xyz
loopringhubs.xyz
loopringtoken.xyz
loopringtokens.xyz
m.navervcorp.com
mail.acc-portal.nl
mail.arbinu.club
mail.arbinu.fun
mail.cus-corp.nl
mail.custom-center.nl
mail.daisen.fi
mail.etherscard.com
mail.ethersfi.com
mail.havercorps.site
mail.havercorpteam.site
mail.lidonft.fi
mail.lidonft.io
mail.lidonft.pro
mail.mailhelp.online
mail.mailteam.site
mail.nauercorp.site
mail.nauercorp.website
mail.nauercorpteam.website
mail.nav-service.nl
mail.navcorp.website
mail.navcorpmanager.site
mail.navcorpteam.site
mail.navecorp.website
mail.navercorpa.website
mail.navercorpd.online
mail.navercorpg.online
mail.navernida.online
mail.naveservice.site
mail.navmanager.site
mail.navportalservice.site
mail.navrcorp.site
mail.noox.capital
mail.noox.cash
mail.noox.club
mail.noox.digital
mail.noox.fi
mail.noox.financial
mail.noox.fund
mail.noox.in
mail.noox.live
mail.noox.pro
mail.noox.space
mail.noox.vip
mail.noox.zone
mail.nooxbadge.pro
mail.nooxnft.com
mail.novercorp.site
mail.npromo.xyz
mail.pepemon.fi
mail.portal-sec.nl
mail.psyop.fi
mail.reth.fi
mail.sec-corp.nl
mail.sec-portal.nl
mail.sup-corp.nl
mail.unisocks.co
mail.unisocks.help
mail.unisocks.org
mail.unisocks.pro
mailer.npromo.xyz
mailserviceteam.online
maincontrol.in
mantrachain.org
mantradao.top
mantratoken.xyz
mavercoip.online
mavercorp.com
meekickdao.top
meekickdao.xyz
meekicksdao.top
meekicksdao.xyz
meekickshub.xyz
meekickslab.xyz
methdao.xyz
mether.top
methers.top
methers.xyz
meths.xyz
modetoken.top
modetoken.xyz
mogmeme.com
mogmeme.xyz
moonwelldao.xyz
mortoken.org
mortoken.top
mseth.xyz
msteth.com
mstether.top
mx-pool1.shtlink.online
mx-pool4.shtlink.online
mx-pool5.shtlink.online
mx-pool8.shtlink.online
mx.navercorpc.website
na.custom-center.nl
na.portal-sec.nl
naccscorp.site
nacmns.online
nacmnvcorp.site
nacmscorp.online
nacmsnvcorp.site
nacmsvn.site
nacmsvna.online
nacnavcorp.site
nacnavteam.site
nacncmteam.site
nacncorp.online
nacncscorp.tech
nacndoc.site
nacnmcorp.site
nacnscorp.site
nacnscteam.online
nacnsncorp.site
nacnsvcorp.tech
nacnsvteam.online
nacnvcn.tech
nacnvcorp.online
nacnvcorp.tech
nacnverteam.online
nacnvns.site
nacnvsanas.tech
nacnvscorp.tech
nacnvsncorp.site
nacorpna.site
nacorpvteam.tech
nacscorp.online
nacscorp.tech
nacsdoc.tech
nacsnacorp.online
nacsnar.xyz
nacsnavcorp.online
nacsnavscorp.online
nacsncorp.tech
nacsnsvcorp.site
nacsvcorp.site
nacsvncorp.site
nacvcorp.site
nacvcorp.tech
nacvncscorp.online
nacvncscorp.tech
nacvncxcorp.site
nacvnmsacorp.site
nacvnscorp.online
nacvnscorp.tech
nacvnsr.xyz
nacvnxcorp.tech
nacvscorp.tech
nacvsnas.site
nacvsncscorp.online
nacvteam.online
nacxnacs.online
nacxns.online
naerteam.xyz
namnscorp.online
namnscorp.site
namnscorp.tech
namnscteam.site
namnsv.online
namnsv.site
namnsvcorp.online
namnsvcorp.tech
namnsvteam.tech
namnvcorp.online
namnvcorp.site
namnvcorp.tech
namnvscorp.online
namnwcorp.online
namscorp.site
namsnsvcorp.online
namsnv.site
namwscop.site
nanavcorp.tech
nancncorp.online
nancorpnet.online
nancorpns.tech
nancsnacorp.site
nancsncorp.site
nancvcorp.tech
nancvncscorp.site
nanmsccorp.online
nanmscorp.tech
nanmwcorp.online
nanmwns.online
nannscorp.online
nanscorpns.tech
nansdocm.site
nansncorp.site
nansvmcorp.online
nanvcascorp.tech
nanvco.online
nanvcscorp.site
nanvncnteam.tech
nanvncorp.online
nanvncorp.tech
nanvscorp.tech
naomnr.tech
naomsncorp.online
naoncorp.online
naosncorp.site
naoswm.tech
naredia.xyz
naredib.xyz
naredic.xyz
naredid.xyz
naredie.xyz
naredirecta.tech
naredirecta.xyz
naredirectb.tech
naredirectb.xyz
naredirectc.tech
naredirectc.xyz
naredirectd.tech
naredirectd.xyz
naredirecte.tech
naredirecte.xyz
narncorp.tech
narnscorp.online
narvxna.site
nascmnv.site
nascncorp.online
nascvncscorp.online
nasmna.site
nasncorp.site
nasncorpcs.tech
nasncsvcorp.online
nasomr.online
naswsteam.site
nasxcenter.tech
nasxcorp.tech
nasxmnar.online
nasxncorp.online
nasxnv.site
nauercorp.site
nauercorpa.online
nauercorpb.online
nauercorpc.online
nauercorpd.online
nav-service.nl
nav.custom-center.nl
nav.portal-sec.nl
navascorp.online
navcanco.site
navcecorp.online
navcencorp.tech
navcenters.tech
navcescorp.site
navcncorp.online
navcncorp.site
navcncorp.tech
navcncorpnv.online
navcnsarcorp.online
navcnscorp.site
navcnsnacorp.tech
navcnvcorp.online
navcnwsa.online
navcocs.online
navcocs.site
navcom.site
navcorp.tech
navcorp.xyz
navcorpacenter.site
navcorpca.online
navcorpcenter.tech
navcorpcs.site
navcorpcteam.online
navcorpn.site
navcorpnc.site
navcorpns.site
navcorps.website
navcorpsa.site
navcorpteam.online
navcorpteam.site
navcorpvteam.site
navcsacorp.online
navcsacorp.site
navcsateam.site
navcsncorp.site
navcsncorp.tech
navcsnvacorp.site
navcsorp.tech
navcsvcorp.site
navdocorp.online
navdocs.online
navdocteams.site
navecorp.site
navecvop.tech
naveewteam.site
navencer.online
navencorp.online
navenidc.click
navenidd.click
navenide.click
navenscorp.online
naveocorp.website
naveorcorp.host
naveracom.click
naveranid.xyz
naverbcom.click
naverbnid.xyz
naverccom.click
navercnid.xyz
navercom.site
navercoma.click
navercoma.tech
navercomb.click
navercomc.click
navercomd.click
navercomd.tech
navercome.click
navercomf.click
navercorpa.online
navercorpa.tech
navercorpa.website
navercorpb.online
navercorpb.tech
navercorpb.website
navercorpc.online
navercorpc.tech
navercorpc.website
navercorpd.online
navercorpd.tech
navercorpd.website
navercorpe.online
navercorpe.tech
navercorpe.website
navercorpf.online
navercorpf.tech
navercorpf.website
navercorpg.online
navercorpg.tech
navercorpg.website
navercorph.online
navercorph.tech
navercorph.website
navercorpi.online
navercorpi.tech
navercorpj.online
navercorpj.tech
navercorpk.online
navercorpk.tech
navercorpl.online
navercorpm.online
navercorpn.online
navercorpo.online
navercorpp.online
navercorpq.online
navercorps.online
navercorpt.online
navercorpteam.online
navercorpu.online
navercorpv.online
navercorpw.online
navercorpx.online
navercorpy.online
navercorpz.online
navercp.com
naverdcom.click
naverdnid.live
naverdnid.xyz
naverecom.click
naverenid.live
naverenid.xyz
naverfcom.click
navergcom.click
naverhcom.click
naverkr.com
naverkr.online
navermanager.online
navermanager.site
navernidcorp.online
navernscorp.com
naverocorpteam.site
naverologin.com
naverom.com
naveronavteam.site
naveroo.com
naveror.com
naverorgs.com
naveroteam.site
naverotn.online
naverotna.online
naverotnad.online
naverotnco.online
naverotncokr.online
naverotncom.online
naverotncomp.online
naverotncompany.online
naverotnkr.online
naverotnred.online
naverotnredi.online
naverotnredirect.online
naverovvcorp.tech
naverramblecompany.online
naverramblered.online
naverrambleredi.online
naverrambleredir.online
naverrcorp.site
naverredb.xyz
naverrteam.site
naversec.site
navertcorp.com
navervcorp.com
navervteam.site
naveservice.site
navevrcorp.online
navmacorp.tech
navmailcorp.site
navmailer.xyz
navmanager.site
navmanager.website
navmcns.site
navmcorp.tech
navmncteam.site
navmnsc.site
navmnscorp.online
navmnscorp.site
navmnscorp.tech
navmnsdoc.online
navmnswcorp.online
navmnteam.online
navmnwscorp.site
navmnwscorp.tech
navmowcorp.online
navmscnteam.tech
navmscorp.tech
navmscteam.site
navmsncorp.online
navmwcn.tech
navmwncorp.tech
navmwnscorp.site
navnaccorp.tech
navnacncorp.tech
navnacnsv.site
navnacscorp.site
navnancorp.site
navncm.site
navncnacorp.online
navncncorp.site
navncncorp.tech
navnco.online
navncorps.site
navncsacorp.site
navncscorp.online
navncscorp.site
navncsnacns.site
navncsnacorp.site
navncsnco.tech
navncsncorp.online
navncsncorp.site
navncsnvcorp.site
navncteam.site
navndocs.com
navngteam.site
navnmcorp.site
navnmcorp.tech
navnmscorp.site
navnmscorp.tech
navnmst.site
navnocorp.online
navnocorp.tech
navnrcorp.site
navnsacorp.site
navnsancorp.site
navnscn.site
navnscncorp.site
navnscorp.online
navnscorp.site
navnscsncorp.tech
navnscteam.online
navnscvteam.site
navnsecteam.online
navnsncorp.online
navnsncorp.site
navnswcorp.online
navnvcorp.site
navnvcscorp.site
navnvcso.online
navnvncorp.site
navnvscorp.online
navnwcorp.online
navnzcorp.site
navoncs.tech
navoocorp.xyz
navorcorp.tech
navosma.tech
navowscop.tech
navportal.tech
navportalcenter.tech
navportalcorp.tech
navportalcorp.xyz
navportalcorpcenter.site
navportalsec.tech
navportalsecs.site
navportalssec.tech
navrcorp.site
navreplyc.live
navrrcorp.site
navrscorp.site
navsancorp.tech
navscxna.site
navseccenter.tech
navsecteam.website
navsecurity.tech
navsecurityteam.tech
navsecvcorp.tech
navsite.online
navsnavcorp.tech
navsncnacorp.site
navsncorp.online
navsncorp.tech
navsxmar.tech
navsxnar.tech
navsxteam.online
navwcsvorp.online
navwnscorp.site
navxnas.online
nawcorp.tech
nawencop.site
nawonscorp.site
naxasvm.site
naxcorp.tech
naxcvn.online
naxncncorp.online
naxns.xyz
naxver.site
naxvnas.site
ncnavcorp.site
ncnavcorp.tech
ncnaver.com
neasnwer.xyz
necnsvcorp.site
necnvcscorp.online
necosna.tech
necscorp.site
nemsbox.online
nemsow.xyz
nenvna.online
neomns.online
neomnscorp.online
neomnscorp.tech
neonmnr.site
neonsam.site
neonsava.site
neonsmat.tech
neonsna.site
neonsno.online
neonsor.tech
neonsvna.tech
neonsvnas.online
neonsvnas.tech
neonvas.tech
neonvasr.xyz
neorasnv.site
neorsna.tech
neorsnav.xyz
neorsvna.online
neorsvnas.online
neosar.xyz
neosmnr.online
neosmr.site
neosnar.online
neosnas.tech
neosvas.tech
neosvnas.site
neosvnas.tech
neosxvnar.site
neovanar.online
neowan.online
neoxnar.site
neoxvnas.online
neramsva.site
nerasmar.online
nerasvn.tech
nerasxn.tech
nerasxnv.xyz
nerasxvna.online
nerdasna.tech
nernvna.site
neroans.site
neromns.online
nerosna.xyz
nerosop.site
nerosvna.online
nerosvna.site
nerovnsa.xyz
nersmnar.site
nersxvna.site
nersxvna.tech
nersxvrna.tech
nesacorp.tech
nesacs.tech
nesaxna.xyz
nesmcorp.site
nesncorp.site
nesnmr.online
nesnvas.xyz
nesnvc.tech
nesrmer.xyz
nesrnar.tech
nesrnva.xyz
nesrosvna.online
nestnc.site
nesvansxr.xyz
nesvba.online
nesvnar.online
nesvnas.tech
nesvnax.xyz
nesvncorp.site
nesvsnar.online
nesvwna.online
nesxnage.tech
nesxnas.site
nesxnas.tech
nesxnasa.site
nesxnasr.site
nesxnsa.site
nesxnva.online
nesxnva.site
nesxva.online
nesxvma.site
nesxvna.xyz
nesxvnas.site
nevcosr.xyz
nevncorp.online
nevns.site
nevxna.site
nevxna.xyz
nexocorp.site
nexomo.xyz
nexvnacs.site
nexvosmas.site
ngnsxna.tech
ngrner.site
nid.navercom.site
nid.navervcorp.com
nid.nidanaver.tech
nidanaver.tech
nidnavcenter.link
nidnavcorp.com
nidnavscenter.xyz
nidnavsecurity.tech
nidnsnaver.com
nidrnaver.com
niftytailor.top
niftytailorlabs.xyz
niftytailorpass.xyz
niftytailors.net
niftytailors.org
niftytailors.top
nmnavcorp.tech
nmnscorp.online
noacos.tech
nocorps.online
nodesdao.top
nodesgpu.com
nodesgpu.top
nodesgpu.xyz
nomnwscorp.online
nomosor.xyz
nonavcorp.online
noox.capital
noox.cash
noox.club
noox.digital
noox.farm
noox.fi
noox.finance
noox.financial
noox.fund
noox.global
noox.in
noox.live
noox.pro
noox.space
noox.tech
noox.top
noox.vip
noox.zone
nooxbadge.pro
nooxbadge.top
nooxdao.fun
nooxdao.net
nooxdao.online
nooxdao.pro
nooxdao.top
nooxdao.world
nooxdao.xyz
nooxhub.pro
nooxhub.top
nooxlab.top
nooxlab.xyz
nooxlabs.net
nooxlabs.top
nooxlabs.xyz
nooxnft.app
nooxnft.com
nooxnft.fi
nooxnft.finance
nooxnft.link
nooxnft.loan
nooxnft.net
nooxnft.online
nooxnft.org
nooxnft.space
nooxpro.com
nosnavcorp.online
nosvnomer.tech
novercorp.site
nownar.tech
nowsncorp.online
nowsncorp.tech
noxmos.site
noxosner.site
nr.custom-center.nl
nr.portal-sec.nl
nrexnas.site
nrosmar.tech
nrosvr.online
nrsnmar.site
nsairdrop.top
nsairdrop.xyz
nsawsv.online
nseccenter.space
nsecsecurity.tech
nsmavcorp.online
nsmnavcorp.site
nsnawo.xyz
nsvancs.site
nsxnan.tech
nsxwnas.online
nvcteam.site
nvwxa.site
nvxama.site
nvxmw.xyz
nvxnsa.online
nvxwa.site
nvxwxa.site
nwascorp.site
nwnoser.tech
nwomner.tech
nwons.tech
nwscorp.online
nwsvq.site
nwsxxnas.online
oceandao.top
oceanhub.xyz
oceansdao.icu
oceansdao.xyz
oceantoken.top
oethtoken.top
oethtoken.xyz
omni-labs.org
omni-labs.top
omni-labs.xyz
omnistake.org
ondopoint.com
ondopoint.org
ondopoint.top
ondopoint.xyz
ondopoints.top
ondorewards.xyz
ousdhub.icu
ousdhub.xyz
ousdhubs.top
ousdlab.top
ousdlabs.xyz
ousdprotocol.xyz
ousdtoken.top
ousdtoken.xyz
paxgolds.com
paxos.gifts
paxos.pro
paxosgift.com
paxosgold.gift
paxosgold.info
paxosvip.com
paxosvip.gold
paxosvip.pro
paxosvip.top
peipeidao.top
peipeidao.xyz
pencils.farm
pendlehub.top
pendlehub.xyz
pendlehubs.xyz
pendlelabs.xyz
pendlesdao.xyz
pendleslab.xyz
pepemon.fi
peth.live
peth.network
peth.top
peth.world
pmpstatic.navervcorp.com
pooleth.top
port.navernidc.link
portal-sec.nl
portalcorpsec.site
portalseccorps.site
psyop.fi
pyrtoken.org
pyrtoken.tech
rbntoken.xyz
rdroplab.xyz
realiotoken.xyz
renderdao.top
renderlabs.top
rendersdao.top
rendershub.xyz
renzotoken.xyz
reth.fi
rewadshub.xyz
rewardhubs.xyz
rewardlab.xyz
rewardlabs.top
rewardlabs.xyz
rewardpendle.top
rewardpro.xyz
rewardsdao.xyz
rewardshub.top
rewardsnft.xyz
rewardtokens.xyz
reztoken.com
reztoken.top
reztoken.xyz
riaveicoip.online
riaveicorp.online
riaveiracom.online
riaveirambcom.online
riaveirambred.online
riaveiramcom.online
riaveiramred.online
riaveirared.online
riavercorp.online
riaverredirect.online
ribbon.fund
ringdao.top
ringprotocol.app
ringprotocol.net
ringprotocol.top
ringprotocol.xyz
rpldao.xyz
rplhub.xyz
rplnft.com
rplnft.xyz
rplsdao.xyz
rplshub.xyz
rseth.org
rston.org
rsweth.com
rsweth.top
rsweth.xyz
rswether.top
rswether.xyz
rswethers.top
rswethers.xyz
rswethlab.top
rsweths.xyz
rwafinance.org
rwafinance.top
sbfcs.xyz
sdai.app
sdaitokens.top
sec-center.nl
sec-corp.nl
sec-portal.nl
seccenter.link
secnavcenter.tech
secncenter.website
secportalnav.site
secportals.digital
secure.navervcorp.com
securitynavcenter.tech
server.cus-corp.nl
server.custom-center.nl
server.nauercorpd.online
server.nav-service.nl
server.navcorp.website
server.navcorpmanager.website
server.navercorpa.website
server.naverteam.co
server.naveservice.site
server.novercorp.site
server.portal-sec.nl
server.sec-corp.nl
shadownodes.top
shadowsnode.xyz
shibabone.org
shibabone.tech
shibabone.xyz
shtlink.online
sofaprotocol.xyz
sofaprotocols.xyz
sparkdao.xyz
spkdao.com
spkdao.icu
spkdao.xyz
spkhub.xyz
spklab.xyz
spkprotocol.xyz
spktoken.com
spktoken.org
sports.news.navervcorp.com
staderdao.top
staderdao.xyz
staderhub.top
staderhub.xyz
staders.com
staders.org
stadersdao.top
stadershub.top
staderslab.xyz
staderx.top
stage.navervcorp.com
stage.navnaver.com
stakedao.top
stakedfish.top
stakedfish.xyz
stakefish.org
stakelink.top
stakelinks.top
stakesdao.top
stakesdao.xyz
stakesfish.xyz
stakeshub.xyz
stakeslink.top
stakesstone.xyz
stakestone.bond
stakestone.farm
stakestonelabs.top
stakestonelabs.xyz
stakestones.top
staksfish.xyz
staltlayer.com
staltlayer.top
staltlayer.xyz
stketh.com
stketh.net
stketh.org
stketh.xyz
stkether.tech
stkether.top
stkhub.top
stklab.xyz
stklabs.top
stlabs.xyz
stlink.app
stlink.farm
stlink.org
stlink.pro
stlink.world
stlinkdao.xyz
stlinkhub.xyz
stlinklabs.xyz
stlinks.org
stlinks.top
stlinksdao.top
stlinkslab.top
ststx.org
sukuwallet.com
sukuwallet.tech
sukuwallets.top
sup-corp.nl
syncustoken.top
taikodao.org
taikodao.top
taikohub.top
taikolabs.top
test.navervcorp.com
test.navnaver.com
thenextgem.org
tokemak.org
tokemak.top
tokemaks.top
tokemaks.xyz
trachub.xyz
trachubs.xyz
traclab.top
traclabs.top
traclabs.xyz
tracprotocol.org
tracprotocols.top
tracprotocols.xyz
trumpmemecoin.app
trumpmemecoin.net
trumpmemecoin.org
trumpmemecoin.top
trumpmemecoins.xyz
trumpmemetoken.top
trumpmemetoken.xyz
turbomeme.org
turbomeme.top
turbomeme.xyz
turbomemecoin.xyz
turbomemes.xyz
uni-socks.xyz
unisock.org
unisockdao.top
unisockdao.xyz
unisocklabs.top
unisocklabs.xyz
unisocks.app
unisocks.club
unisocks.co
unisocks.farm
unisocks.fi
unisocks.finance
unisocks.help
unisocks.net
unisocks.online
unisocks.org
unisocks.pro
unisocks.top
unisocks.xyz
unisocksbox.top
unisocksbox.xyz
unisocksdao.pro
unisocksdao.top
unisockshub.com
unisockshub.top
unisockshub.xyz
unisockslab.top
unisockslab.xyz
unisockslabs.xyz
uniswaplp.com
uniswaplp.top
univ4.org
univ4hub.top
univ4hub.xyz
univ4labs.top
univ4labs.xyz
univ4lp.top
univs4.top
usdedao.top
usdedao.xyz
usdehub.top
usdehubs.xyz
usdelab.top
usdena.com
usdena.digital
usdena.pro
usdepool.icu
usdepro.xyz
usdeprotocol.xyz
usdrops.xyz
ushub.xyz
ushubs.xyz
vectorfinance.tech
vectorfinance.top
vejoe.top
vejoe.xyz
vezawahoy.com
vnaxva.site
vnxwna.site
vtxtoken.xyz
wasabiprotocol.com
wasabiprotocol.top
wbtc.support
wbtc.tech
wbtcdao.com
wbtcfi.com
wbtcprotocol.com
webdisk.acc-portal.nl
webdisk.custom-center.nl
webdisk.havercorp.site
webdisk.havercorps.site
webdisk.havercorpteam.site
webdisk.mailhelp.online
webdisk.nauercorp.site
webdisk.navcorp.website
webdisk.navcorpmanager.site
webdisk.navcorpmanager.website
webdisk.navcorpteam.site
webdisk.navecorp.site
webdisk.navecorp.website
webdisk.navercorpd.online
webdisk.navmanager.site
webdisk.novercorp.site
webdisk.portal-sec.nl
webmail.arb2.xyz
webmail.arbinu.club
webmail.arbinu.fun
webmail.custom-center.nl
webmail.daisen.fi
webmail.ethersfi.com
webmail.havercorp.site
webmail.havercorpteam.site
webmail.lidonft.fi
webmail.lidonft.io
webmail.lidonft.pro
webmail.mailhelp.online
webmail.nauercorp.website
webmail.nav-service.nl
webmail.navcorp.website
webmail.navcorpmanager.site
webmail.navcorpmanager.website
webmail.navcorpteam.site
webmail.navecorp.site
webmail.navercorpa.website
webmail.navercorpd.online
webmail.navercorpg.online
webmail.navernida.online
webmail.naveservice.site
webmail.navmanager.site
webmail.navportalservice.site
webmail.navrcorp.site
webmail.noox.capital
webmail.noox.cash
webmail.noox.club
webmail.noox.digital
webmail.noox.fi
webmail.noox.financial
webmail.noox.fund
webmail.noox.global
webmail.noox.in
webmail.noox.live
webmail.noox.pro
webmail.noox.space
webmail.noox.vip
webmail.noox.zone
webmail.nooxbadge.pro
webmail.nooxnft.com
webmail.novercorp.site
webmail.pepemon.fi
webmail.portal-sec.nl
webmail.psyop.fi
webmail.reth.fi
webmail.unisock.org
webmail.unisocks.co
webmail.unisocks.help
webmail.unisocks.org
webmail.unisocks.pro
zeland.xyz
zelend.top
zlend.xyz
zststx.com

# Reference: https://x.com/smica83/status/1988579542227952086
# Reference: https://www.virustotal.com/gui/file/812f63098324f9555a7cc08f5e3868d47ef3e14a7b981dd7f86900bb85f49d31/detection

mainbundle.dns.army
office.mainbundle.dns.army

# Reference: https://www.virustotal.com/gui/ip-address/158.247.244.237/relations

account-manage.pro
google.account-manage.pro
google.manage-account.kro.kr
google.manage-accounts.kro.kr
indoc.bucehome.net
indoc.lukefleed.xyz
indocs.lukefleed.xyz
manage-account.kro.kr
manage-accounts.kro.kr
nave-logins.dns.navy
naver-edocs.v6.navy
navor-logins.dns.navy
navorlogins.malmo.cl
ne-service.v6.navy
nid-server.qlabs.pro
nid-servers.malmo.cl
nid-servers.vonar.ch
nid-service.naver-edocs.v6.navy
nid-service.ne-service.v6.navy
nid-sevices.nave-logins.dns.navy
nid.navor-logins.dns.navy
nid.nidslogins.v6.navy
nidlogins.contem.bz
nidlogins.muguro.com
nidlogins.vonar.ch
nids.contem.bz
nidslogins.v6.navy

# Reference: https://www.virustotal.com/gui/ip-address/133.186.229.122/relations
# BANNER_0_HASH-HOST=22d9c90105123686ce899fe3980a9a88

ajdtemp.p-e.kr
doanthi.myvnc.com
dorushop.p-e.kr
l2piazoninterlude.servegame.com
lebane.duckdns.org
myoldtibia772.servegame.com
projectpgc.ddns.net
shoptemp.p-e.kr
tableview.p-e.kr
tourview.p-e.kr
vpn-remote.ddns.net
vpn-remote.duckdns.org
yahooamn.ddnsking.com
zdspgc.ddns.net

# Reference: https://x.com/byrne_emmy12099/status/1989273058931351899
# Reference: https://www.virustotal.com/gui/ip-address/174.138.184.236/relations
# Reference: https://www.virustotal.com/gui/file/d96a88f0378d8234490f56057441ac98287d3da398bec01feb7a7809ff43ed46/detection

http://174.138.184.236
dropfiles2img.com

# Reference: https://www.virustotal.com/gui/ip-address/158.247.195.173/relations

blog.checkmyposting.webredirect.org
blog.postinguhost.mydns.vc
bloginfo.ublogprotector.mydns.vc
checkmyposting.webredirect.org
checkuposting.mydns.vc
checkusrblogs.mydns.vc
conterfgcp.store
docinfo.checkusrblogs.mydns.vc
edoc.checkusrblogs.mydns.vc
edoc.nhsdonate.mydns.vc
fcgresp.space
fecnam.space
fentavoust.store
fgcenugetp.store
info.checkuposting.mydns.vc
invoice.postinguhost.mydns.vc
invoice.targetblogrecord.dns.army
mosensopt.online
nhsdonate.mydns.vc
postinguhost.mydns.vc
secaprout.store
targetblogrecord.dns.army
tascrounep.store
tonreap.space
ublogprotector.mydns.vc
usermanagetokendown.ggm.kr

# Reference: https://www.enki.co.kr/en/media-center/blog/kimsuky-s-ongoing-evolution-of-kimjongrat-and-expanding-threats
# Reference: https://www.virustotal.com/gui/file/315e433cf27e7eb08d3d6c204477a8563d51e9f659ed179594f013ba9fdd244f/detection
# Reference: https://www.virustotal.com/gui/file/9b7afcd4d0f2dc91a8909d913543d822abf2a6ccdf7e301e2823811f6b8e27e2/detection

mailhubsec.com
averpns.onthewifi.com
averqcr.servepics.com
avervtw.serveftp.com
quemr.mailhubsec.com
rsbto.mailhubsec.com
yfews.mailhubsec.com

# Reference: https://www.virustotal.com/gui/ip-address/64.176.224.132/relations

blogcorplink.mydns.vc
docicloud.dynv6.net
moisdocdeposit.dynv6.net
onlinechkcenter.mydns.vc
regenterprisedoc.dynv6.net
reverifyinvoice.v6.navy
docinfo.docicloud.dynv6.net
edoc.onlinechkcenter.mydns.vc
edoc.regenterprisedoc.dynv6.net
edoc.reverifyinvoice.v6.navy
info.regenterprisedoc.dynv6.net
invoice.regenterprisedoc.dynv6.net
usr.blogcorplink.mydns.vc
usr.moisdocdeposit.dynv6.net

# Reference: https://app.validin.com/detail?find=34be99c7e4dfe06ce03b91cddb103a2d&type=hash#tab=host_pairs (# 2025-12-10)
# CLASS_0_HASH-HOST=80deacb6297c36fad2ed450b6ebe60ca

aaadaleaflafgu.forum
aaargiladfgftion.forum
aaaviiamfviafgtzis.forum
aabluuebfdfug.forum
aabusbgffgfily.forum
aachoicfdfdg.forum
aacpyrthdffdonat.forum
aacquiatmdfid.forum
aacvngxfdfdjsgfm.forum
aarfdghtfdtatach.forum
aasteaffstefdfroofdfuis.forum
aatoofctofdtoco.forum
aatoosfbtofosabtu.forum
aatrakmtrfrnsilpa.forum
acdfddftesrfs.forum
acdfenfgsfdffges.forum
adddfedsddfdfngdat.forum
adfalsfdffddfrra.forum
adfeffdfsfpeg.forum
adfessdfgsrs.forum
adfeusffndfg.forum
adfkbfasrdfs.forum
adfrmgfgfi.forum
adfsfafdfnfdgut.forum
adfttsffndrde.forum
afddfefdffdfsrvfegs.forum
afdefddhnsudft.forum
afdefdfssfadfgh.forum
afdfdfssfdls.forum
afdfscdsidffsla.forum
afdicfsfsfdfdff.forum
afewlfdgfebfase.forum
affsdfsicglfdf.forum
afgfydfdndssar.forum
ahealthhfdfvei.forum
ajodfodfdfsn.forum
asydfpsasfdaay.forum
atarrfatacfdtriaa.forum
avdfuadfgdfge.forum
avfodffesfgr.forum
bcoaectdfiaidadiateligeate.forum
cabsabdfaglt.forum
caelneglndfddfloso.forum
carncvagltfnts.forum
cbfdfgicbdf.forum
cbilfdfljobs.forum
ccfgnbufdfess.forum
cchichifdfdihuahua.forum
cchtnnvajfgcfgstone.forum
ccnccdffgers.forum
cdxcxcavdfkz.forum
cdzcavhtdafny.forum
ceegacdfdjyr.forum
celfdnedfdfso.forum
cfxvacvvdggmedia.forum
cifghvnfdgkillz.forum
cjaxcvafffdefs.forum
cmagmafdfgnezeta.forum
cnodfgnodfdftures.forum
coyrdgevcaopeinvesebe.forum
cpdfahtfgang.forum
cqzcxfdsaqjgfdy.forum
cscvvncgfjfggfcape.forum
cvxfgscheer.forum
cyacvdsgayfg.forum
czacvfhgfggsys.forum
czzgfsdfafa.forum
daacdfbsl.forum
daaxcvgrfdfodtabil.forum
dacregdanfdare.forum
daecxvbdsazic.forum
daedfpfhsgh.forum
dairtrfgdfgsirq.forum
dapfghcbvfravel.forum
dardsvdfgencyfront.forum
dayfvcsgdyoupc.forum
ddfesvdgfdty.forum
demudmkgfr.forum
desmedfftfia.forum
dfblohdfarhcia.forum
dfddourbddsgms.forum
dfdfhrihfting.forum
dfdfthhbeachh.forum
dmfdmstradfgdomes.forum
dmrdfsfurh.forum
dousffdfrds.forum
dsdfssfadgdr.forum
dsemardfrihttve.forum
dseshfhrket.forum
dsfdfnfdhatsn.forum
dsigsidhdfread.forum
dsofsdfsbhdfx.forum
eedaecbjfukhtyekocleaner.forum
eedamghcbsdfrmsj.forum
hssedbsghtative.forum
hssedfgrftwork.forum
hssedfoution.forum
hssedftterftion.forum
hssedsdroject.forum
hssedslofalfwork.forum
hssedundiange.forum
vnvmacefsggaelsfmeos.forum
vnvmausiefcaiaeie.forum
vnvmaxcvfefesrgftaliceont.forum
vnvmbgsubcfeetatecity.forum
vnvmcijnefecircsuseflavses.forum
vnvmeefegcvrfsgefsemefi.forum
vnvmefgfsvxceforesflist.forum
vnvmefjgfhsetfaefggas.forum
vnvmefmfcxgrfegmultikult.forum
vnvmefnoesefffnefor.forum
vnvmeftcbvcsgesefhe.forum
vnvmefzbgsfsaiefwcsua.forum
vnvmexcsbheerfeutzzu.forum
vnvmfefansgsefefilefre.forum
vnvmfeyceghemosfilic.forum
vnvmffeasiaergias.forum
vnvmfgegraaiaurbaaa.forum
vnvmfsevxcgrefmiefftfob.forum
vnvmgfgeyjghseiemaerket.forum
vnvmhvgfeceaowercomaut.forum
vnvmiaaoefaacioaeeucatiaa.forum
vnvmjbfcleleeifnei.forum
vnvmkefgeefreskeecha.forum
vnvmkhefnsbaorkhaefgeby.forum
vnvmlfevcfgfehfgtlemit.forum
vnvmlgefwhssclfntefgfw.forum
vnvmlitffeeuraaeeraa.forum
vnvmmerrfehfmirasur.forum
vnvmmrsghefefsmusteata.forum
vnvmsalueaafeftural.forum
vnvmsefeeaeiasfaoraatica.forum
vnvmsegufeciberasfetica.forum
vnvmtuefrisarurasl.forum
wevdsfiofize.forum
wsseaiseactca.forum
wssebaigatoabit.forum
wsseclecanest.forum
wssecloudvistc.forum
wssecoaevistc.forum
wssedaeceseaout.forum
wsseeaisefoage.forum
wsseecaoactca.forum
wsseecaovistc.forum
wsseeinteulse.forum
wsseeixelseaout.forum
wsseeuaeactca.forum
wssefaesataek.forum
wsseglowacven.forum
wsseluncecta.forum
wssenovcactca.forum
wssenovcacven.forum
wssesdwiftnest.forum
wsseskyacaboa.forum
wsseskyaieele.forum
wssesncegaove.forum
wssesolcablooe.forum
wssestcaeulse.forum
wssestcalooe.forum
wssetaueoabit.forum
wsseuabcnaieele.forum
wssevibecncaoa.forum
wssezeneulse.forum
wssezenitanest.forum
zttfafeafrasafans.forum
account-google.sign-protect.kro.kr
account-kakao.dynv6.net
accounts.google.seclogistic.com
airdrop.asterdex.kro.kr
asterdex.kro.kr
chromeupdate.mydns.vc
com-login.dns.army
doc-hometax.mydns.bz
edoc.npinvoicesecurity.mydns.vc
google.seclogistic.com
google.securityaccountverif.kro.kr
ips-callev.mydns.vc
ips-go.mydns.bz
ips-logmail.mydns.bz
ips-nidhelp.mydns.bz
join86s.dynv6.net
kakao.com-login.dns.army
login.account-kakao.dynv6.net
n-corp.ips-logmail.mydns.bz
n-corp.notice-blog.mydns.bz
n-store.ips-nidhelp.mydns.bz
nid-naverazd.servehalflife.com
nid-naverbxw.servegame.com
nid-navercwv.servegame.com
nid-naverdqy.3utilities.com
nid-naverggi.3utilities.com
nid-navergup.servecounterstrike.com
nid-naverifk.ddnsking.com
nid-naverjpd.servequake.com
nid-naverkze.onthewifi.com
nid-naverpkr.serveftp.com
nid-naverpog.ddnsking.com
nid-navervxu.servecounterstrike.com
nid-naverxil.onthewifi.com
nid-user.ips-callev.mydns.vc
nid-user.notice-blog.mydns.bz
nidloes.an.ntesledg.dns.army
nids13.dynv6.net
notice-blog.mydns.bz
npinvoicesecurity.mydns.vc
ntesledg.dns.army
securityaccountverif.kro.kr
sign-protect.kro.kr

# Reference: https://www.virustotal.com/gui/ip-address/27.102.138.45/relations

abrs.heninvoice.dynv6.net
access.usercorpsetting.kro.kr
access.userreverify.kro.kr
accessmemberuid.mydns.bz
accountuserservice.kro.kr
accountverifications.kro.kr
authenticateudoc.1cooldns.com
billmatedoc.kro.kr
billmatedoc.mydns.bz
chk.accessmemberuid.mydns.bz
chk.supportipsinvoice.mydns.bz
chk.uncork.biz
currentdoclist.mydns.bz
doc.authenticateudoc.1cooldns.com
doc.ndocasset.mydns.bz
doc.targetinvaddress.mydns.bz
doc.usrauthsystem.mydns.bz
doc.verify.nappdeliver.dynv6.net
docempower.giize.com
docinfo.nhistargetlink.cloud-ip.cc
edoc.ipsinvoicegoji.mydns.bz
edoc.usrauthsystem.mydns.bz
heninvoice.dynv6.net
info.abrs.heninvoice.dynv6.net
info.accessmemberuid.mydns.bz
info.nipsreceivedoc.mydns.bz
info.supportipsinvoice.mydns.bz
info.uncork.biz
info.usrauthsystem.mydns.bz
info.usrselectlist.mydns.bz
invoice.abrs.heninvoice.dynv6.net
invoice.accessmemberuid.mydns.bz
invoice.currentdoclist.mydns.bz
invoice.nipsreceivedoc.mydns.bz
invoice.okxdeliverasset.kro.kr
invoice.supportipsinvoice.mydns.bz
invoice.usrauthsystem.mydns.bz
invoice.verify.nappdeliver.dynv6.net
ipsinvoicegoji.mydns.bz
login.accountuserservice.kro.kr
login.accountverifications.kro.kr
nappdeliver.dynv6.net
ndocasset.mydns.bz
nhistargetlink.cloud-ip.cc
nipsreceivedoc.mydns.bz
npuhostvoice.mydns.bz
okxdeliverasset.kro.kr
one.billmatedoc.kro.kr
policy.usermemberauth.kro.kr
qeing.qooglegle.kro.kr
qooglegle.kro.kr
randstring.npuhostvoice.mydns.bz
repterminvoice.mydns.bz
service.useraccountpolicy.kro.kr
supportipsinvoice.mydns.bz
targetinvaddress.mydns.bz
user.billmatedoc.mydns.bz
useraccountpolicy.kro.kr
usercorpsetting.kro.kr
userinfo.abrs.heninvoice.dynv6.net
usermemberauth.kro.kr
userreverify.kro.kr
usr.usrauthsystem.mydns.bz
usrauthsystem.mydns.bz
usrselectlist.mydns.bz
usrsessioncheck.mydns.bz
verify.accessmemberuid.mydns.bz
verify.authenticateudoc.1cooldns.com
verify.docempower.giize.com
verify.nappdeliver.dynv6.net
verify.supportipsinvoice.mydns.bz
verify.uncork.biz
xn--jj0bm3ks5m0ud95l6mlbqa.kr

# Reference: https://x.com/Dixit_404/status/1998976475849175247
# Reference: https://tria.ge/251211-fx9xbaxjan/behavioral1

/pandora0009/wiwin12/

# Reference: https://www.virustotal.com/gui/ip-address/158.247.224.152/relations

158-247-224-102.nip.io
edoc-main.dns.navy
edoc.abrdns.com
in-voice.navarajbudha.com.np
indoc.naver-corps.dns.navy
indocs.naver-corps.dns.navy
indocs.navor.r-e.kr
inner-voice.mydns.jp
inner.navarajbudha.com.np
invoice.dynv6.net
invoice.naves.dynv6.net
invoices.nvrcops.v6.rocks
ips-edocs.x10.network
nave.edoc.abrdns.com
naver-corps.dns.navy
navercorp.v6.rocks
navercorps.edoc-main.dns.navy
navercorps.edoc.abrdns.com
navercorps.inner-voice.mydns.jp
navercorps.v6.rocks
navers-login.dynv6.net
navers.edoc.abrdns.com
navers.inner-voice.mydns.jp
naves.dynv6.net
naves.edoc.abrdns.com
naves.edocs.dynv6.net
naves.inner-voice.mydns.jp
navor.edoc.abrdns.com
navor.r-e.kr
navors-logins.v6.rocks
navors.edoc.abrdns.com
navors.inner-voice.mydns.jp
nid-logins.dynv6.net
nid-server.smartjz.cn
nid-service.ips-edocs.x10.network
nid-service.navers-login.dynv6.net
nid-sevices.navercorps.v6.rocks
nid.navers-login.dynv6.net
nid.navors-logins.v6.rocks
nid.nid-logins.dynv6.net
ninvoice.contem.bz
nvrcops.v6.rocks

# Reference: https://www.enki.co.kr/en/media-center/blog/kimsuky-distributing-malicious-mobile-app-via-qr-code

http://27.102.137.106
http://27.102.137.180
http://27.102.137.181
http://27.102.137.214
http://27.102.137.93
http://27.102.138.163
http://27.102.138.181
27.102.137.106:443
27.102.137.180:443
27.102.137.181:443
27.102.137.214:443
27.102.137.93:443
27.102.138.163:443
27.102.138.181:443

# Reference: https://x.com/sakaijjang/status/2009200983956705620
# Reference: https://wezard4u.tistory.com/429687

kiev.bigsize.com

# Reference: https://x.com/ThreatBookLabs/status/2014307245170028890
# Reference: https://www.virustotal.com/gui/ip-address/141.164.61.168/relations

auth.oblogcenter.r-e.kr
binfo.commonoblog.kro.kr
bloginfo.commonoblog.kro.kr
cailtteve.mydns.vc
checkoutblog.server-on.net
cn.cailtteve.mydns.vc
commonoblog.kro.kr
dcloud.logindevice.o-r.kr
dn.cailtteve.mydns.vc
doc.userauth.kro.kr
edoc.logindevice.o-r.kr
edubaksa-n.ahcorp.co.kr
friday-n.ahcorp.co.kr
hrdked-n.ahcorp.co.kr
ips-calledoc.mydns.bz
ips-dns.mydns.bz
ips-dns.mydns.vc
ips-ndoc.mydns.bz
ips-taxmail.mydns.bz
logindevice.o-r.kr
mydoc.receivenat.r-e.kr
n-blog.nblog-auth.mydns.bz
n-cloud.ips-dns.mydns.vc
n-cloud.ips-taxmail.mydns.bz
n-cloud.nblog.mydns.bz
n-corp.ips-taxmail.mydns.bz
navedoc.profilecheck.p-e.kr
navoerlogin.keyword-on.net
nblog-auth.mydns.bz
nblog.mydns.bz
nid-user.ips-ndoc.mydns.bz
nid-user.nblog.mydns.bz
nid.oblogcenter.r-e.kr
nuser-login.ips-calledoc.mydns.bz
oblogcenter.r-e.kr
onetop-n.ahcorp.co.kr
profilecheck.p-e.kr
receivenat.r-e.kr
taxdoc.nhomex.kro.kr
user-doc.logindevice.o-r.kr
userauth.kro.kr

# Reference: https://x.com/byrne_emmy12099/status/2015702444198756357
# Reference: https://www.virustotal.com/gui/file/e43beb8b3584d1d6b78c4ece0d88037d6183914f4b0ca615839a6dc7b8a41fea/detection

anotepad.com/notes/btwhw34i
hypernotepad.com/n/32db501442b7e604

# Reference: https://www.virustotal.com/gui/ip-address/27.102.137.118/relations

accessdoctype.mydns.bz
authenticate.useraccountcheck.kro.kr
authtermdoc.mydns.bz
contactprofile.mydns.bz
doc.accessdoctype.mydns.bz
doc.contactprofile.mydns.bz
doc.nps-usrcontent.mydns.bz
dynamictargetid.mydns.bz
edoc.accessdoctype.mydns.bz
edoc.ipvinvoicelist.mydns.bz
edoc.nps-usrcontent.mydns.bz
info.dynamictargetid.mydns.bz
info.ips-usrcontent.mydns.bz
info.nps-usrcontent.mydns.bz
invoice.ipvinvoicelist.mydns.bz
ips-usrcontent.mydns.bz
ipsdepinvoice.mydns.bz
ipsinformdoc.mydns.bz
ipvinvoicelist.mydns.bz
np-onlineusrdoc.ggm.kr
nps-usrcontent.mydns.bz
security.useraccountveriafy.kro.kr
uprofilecenter.mydns.bz
useraccountcheck.kro.kr
useraccountveriafy.kro.kr
usr.accessdoctype.mydns.bz

# Reference: https://x.com/byrne_emmy12099/status/2021419179392512000
# Reference: https://www.virustotal.com/gui/file/117d7bed68749479cc96f44d69426a6fa98c2d1d25946235659a800628a20db4/detection

ycpatent.co.kr/GnAjax/check_valid/cache/member.php
/GnAjax/check_valid/cache/member.php

# Reference: https://x.com/skocherhan/status/2022304341961355592
# Reference: https://www.virustotal.com/gui/ip-address/27.102.138.49/relations

account.userverifytmp.kro.kr
app.niappinvoice.mydns.bz
chk.niappinvoice.mydns.bz
chk.userdirectaddr.mydns.bz
console.userpaymethod.kro.kr
derivedevicepack.mydns.bz
doc.niappinvoice.mydns.bz
doc.userdirectaddr.mydns.bz
docauthzone.mydns.bz
docinfo.docauthzone.mydns.bz
docinfo.ipsusergoji.mydns.bz
drive.userpayments.kro.kr
edoc.docauthzone.mydns.bz
edoc.epsdocgoji.mydns.bz
edoc.linknprecord.mydns.bz
edoc.usraccesstype.mydns.bz
epsdocgoji.mydns.bz
info.link-usrinvoice.mydns.bz
info.linknprecord.mydns.bz
info.ninvoice-usrinfo.mydns.bz
info.ntaxuserlog.mydns.bz
info.ntercmdoc.mydns.bz
info.userdirectaddr.mydns.bz
invoice.docauthzone.mydns.bz
invoice.link-usrinvoice.mydns.bz
invoice.linknprecord.mydns.bz
invoice.niappinvoice.mydns.bz
invoice.userdirectaddr.mydns.bz
invoice.usraccesstype.mydns.bz
ipsusergoji.mydns.bz
link-usrinvoice.mydns.bz
linknprecord.mydns.bz
login.useraccountpolicies.kro.kr
login.userdrivepayment.kro.kr
niappinvoice.mydns.bz
ninvoice-portal.mydns.bz
ninvoice-usrinfo.mydns.bz
ntaxuserlog.mydns.bz
ntercmdoc.mydns.bz
ntinvestment.mydns.bz
ntpinvoicehwp.mydns.bz
ntsmasterid.mydns.bz
ntusertypes.mydns.bz
nvauthterm.mydns.bz
useraccountpolicies.kro.kr
userdirectaddr.mydns.bz
userdrivepayment.kro.kr
userinfo.ninvoice-portal.mydns.bz
userpayments.kro.kr
userpaymethod.kro.kr
userverifytmp.kro.kr
usr.docauthzone.mydns.bz
usr.linknprecord.mydns.bz
usr.usraccesstype.mydns.bz
usraccesstype.mydns.bz
verify.niappinvoice.mydns.bz
verify.userdirectaddr.mydns.bz

# Reference: # Reference: https://x.com/skocherhan/status/2022304341961355592
# Reference: https://www.virustotal.com/gui/ip-address/27.102.137.32/relations

nid.naver.courter.com
taxhelp6.dynv6.net

# Reference: https://x.com/Ghostyak/status/2022116338874167552
# Reference: https://www.virustotal.com/gui/ip-address/118.193.68.242/relations

ercmload23nd.dynv6.net
ipsmas.dns.army
nav-logins.ipsmas.dns.army
nav-logins.nts-edoced.dns.army
nctips.dynu.org
nid-login.nts-edoced.dns.army
nida.ipsmas.dns.army
nida.nts-edoced.dns.army
nidservers.nts-edoced.dns.army
nts-edoced.dns.army

# Reference: https://x.com/WabiSabi777_/status/2022255046268952842
# Reference: https://www.virustotal.com/gui/file/a40a61e54be9cc1671ea6832fef8139ce811a7d759058bb8b4ca86863f4cc1bd/detecion

/ieesh65e/tongil/main/
/ieesh65e/

# Reference: https://www.virustotal.com/gui/ip-address/27.102.138.8/relations

access.mois-gokr.dns.navy
access.view.mois-kr-log.dynv6.net
cain.mew-coin13.dns.army
com-mew.dynv6.net
edoc-file.dynv6.net
edoc-otp.dynv6.net
edoc-view.dynv6.net
edoc.file.nts-kkk.dynv6.net
edoc.mois-gokr.dns.navy
file.nts-kkk.dynv6.net
ko.view.mois-kr-log.dynv6.net
mew-coin13.dns.army
mew-edoc.dynv6.net
mew.nts-edoc-view.dns.navy
mid.edoc.file.nts-kkk.dynv6.net
mid.mmm.mmm.mmm.mew-edoc.dynv6.net
mid.mmm.mmm.mmm.mmm.edoc-otp.dynv6.net
mid.nts-list.dns.navy
mld.com-mew.dynv6.net
mld.edoc.file.nts-kkk.dynv6.net
mld.mmm.mmm.mmm.mew-edoc.dynv6.net
mld.mmm.mmm.mmm.mmm.edoc-otp.dynv6.net
mois-gokr.dns.navy
mois-kr-log.dynv6.net
mood.edoc.file.nts-kkk.dynv6.net
mood.edoc.nts-one.dynv6.net
mood.mmm.mmm.mmm.mmm.edoc-otp.dynv6.net
mood.nts-list.dns.navy
nid.edoc.file.nts-kkk.dynv6.net
nid.mmm.mmm.mmm.mew-edoc.dynv6.net
nid.mmm.mmm.mmm.mmm.edoc-otp.dynv6.net
nid.nts-list.dns.navy
nid.view.mois-kr-log.dynv6.net
nld.edoc.file.nts-kkk.dynv6.net
nld.mmm.mmm.mmm.mew-edoc.dynv6.net
nld.mmm.mmm.mmm.mmm.edoc-otp.dynv6.net
nld.nts-edoc-view.dns.navy
nld.nts-list.dns.navy
nood.edoc.file.nts-kkk.dynv6.net
nood.mmm.mmm.mmm.mew-edoc.dynv6.net
nood.mmm.mmm.mmm.mmm.edoc-otp.dynv6.net
nood.nts-edoc-view.dns.navy
nood.nts-list.dns.navy
nood.shinhan-cards.dns.army
nts-all.dynv6.net
nts-edoc-view.dns.navy
nts-kkk.dynv6.net
nts-list.dns.navy
shinhan-cards.dns.army
view.mois-gokr.dns.navy
view.mois-kr-log.dynv6.net

# Reference: https://x.com/Ghostyak/status/2023245449306726801
# Reference: https://www.shodan.io/host/27.102.138.152

http://27.102.138.152
27.102.138.152:3389

# Reference: https://x.com/Ghostyak/status/2022822846058369525

asdfs432.dns.navy
fd6we5.dns.army
gen-ker.dynv6.net

# Reference: https://x.com/Ghostyak/status/2023969122300948647
# Reference: https://www.virustotal.com/gui/ip-address/38.60.220.30/relations
# BANNER_0_HASH-HOST=10958277d0d4da21a83114feb4ac1703
# BANNER_0_HASH-HOST=0ebb1c2a717f4619b5135f47a9590c4f

accounts-google.site
admin.ikuu.xule.cc
admin.mithuri.xule.cc
adult.news-portal.site
all-over.news-portal.site
android-auth.site
asaas.top
asxrockgelll.shop
au.news-web.site
bdasyfdya.shop
beauty.news-portal.site
beta.news-portal.site
bot.news-portal.site
brain.news-portal.site
btsdtyjugtrtyuio.shop
couparng.site
cpcalendars.news-portal.site
cute4u.nl
daily-new.site
daily-news.blog
daily-news.cv
denanwaveb.cloud
development.news-portal.site
documentwallet.store
eatmorers.cloud
eblokrcoll.shop
elhandasya.org
elinkddc.mail.ntsfirm.site
fixit.national-news.site
fm250227.website
fm250228.site
fuifruohoihyp.top
fyudiomhnv.shop
gatesway.cloud
gccglc.cloud
gcogle.store
gcoogle.site
gcoogle.store
gddtftdxdxd.shop
global-news.icu
global-news.site
golangwork.top
hsaihfkahfband.top
htmaavip-svip.icu
htmaavip-svip.lol
htmaavip-svip.sbs
htmaavip-svip.top
htmaavip-svip.xyz
htmbbvip-svip.icu
htmbbvip-svip.lol
htmbbvip-svip.sbs
htmbbvip-svip.top
htmbbvip-svip.xyz
htmccvip-svip.icu
htmccvip-svip.lol
htmccvip-svip.sbs
htmccvip-svip.top
htmccvip-svip.xyz
htmddvip-svip.icu
htmddvip-svip.lol
htmddvip-svip.sbs
htmddvip-svip.top
htmddvip-svip.xyz
htmeevip-svip.icu
htmeevip-svip.lol
htmeevip-svip.sbs
htmeevip-svip.top
htmeevip-svip.xyz
htmffvip-svip.icu
htmffvip-svip.lol
htmffvip-svip.sbs
htmffvip-svip.top
htmffvip-svip.xyz
htmggvip-svip.icu
htmggvip-svip.lol
htmggvip-svip.sbs
htmggvip-svip.top
htmggvip-svip.xyz
htmhhvip-svip.icu
htmhhvip-svip.lol
htmhhvip-svip.sbs
htmhhvip-svip.top
htmhhvip-svip.xyz
htmiivip-svip.icu
htmiivip-svip.lol
htmiivip-svip.sbs
htmiivip-svip.top
htmiivip-svip.xyz
htmjjvip-svip.icu
htmjjvip-svip.sbs
htmjjvip-svip.top
htmkkvip-svip.icu
htmkkvip-svip.sbs
htmkkvip-svip.top
htmllvip-svip.icu
htmllvip-svip.sbs
htmllvip-svip.top
htmmmvip-svip.icu
htmmmvip-svip.sbs
htmmmvip-svip.top
htmnnvip-svip.icu
htmnnvip-svip.sbs
htmnnvip-svip.top
htmoovip-svip.icu
htmoovip-svip.sbs
htmoovip-svip.top
htmppvip-svip.icu
htmppvip-svip.lol
htmppvip-svip.sbs
htmppvip-svip.top
htmqqvip-svip.icu
htmqqvip-svip.lol
htmqqvip-svip.sbs
htmqqvip-svip.top
htmrrvip-svip.icu
htmrrvip-svip.lol
htmrrvip-svip.sbs
htmrrvip-svip.top
htmssvip-svip.icu
htmssvip-svip.lol
htmssvip-svip.sbs
htmssvip-svip.top
htmttvip-svip.icu
htmttvip-svip.lol
htmttvip-svip.sbs
htmttvip-svip.top
htmuuvip-svip.icu
htmuuvip-svip.lol
htmuuvip-svip.sbs
htmuuvip-svip.top
htmvvvip-svip.icu
htmvvvip-svip.lol
htmvvvip-svip.sbs
htmvvvip-svip.top
htmwwvip-svip.icu
htmwwvip-svip.lol
htmwwvip-svip.sbs
htmwwvip-svip.top
htmwwvip-svip.xyz
htmxxvip-svip.icu
htmxxvip-svip.lol
htmxxvip-svip.sbs
htmxxvip-svip.top
htmxxvip-svip.xyz
htmyyvip-svip.icu
htmyyvip-svip.lol
htmyyvip-svip.sbs
htmyyvip-svip.top
htmyyvip-svip.xyz
htmzzvip-svip.icu
htmzzvip-svip.lol
htmzzvip-svip.sbs
htmzzvip-svip.top
htmzzvip-svip.xyz
hu.news-web.site
hyundaigroup.org
idmgmt.store
indeeds-msg.shop
india-times.national-news.site
irsz.us
jfhhgjgfhdh.shop
jwcoservice.nl
kokko.top
kuronekoreamerytes.shop
kuronekoreamrytes.shop
kuronekorearemrytes.shop
kuronekorearmryets.shop
kuronekorenamryts.online
kuronekorenarytes.info
larsvanreijen.nl
layanan.littlequery.id
li.news-web.site
link.kuronekorearmryets.shop
link.paypay-cert.shop
link.paypay-home.shop
linkeln-home.xyz
lndeeds-home.xyz
lndeedxhome.cloud
login.news-web.site
ltas-home.online
mailer001.cloud
mailer001.site
mailer003.cloud
managenaccount.website
mpmmp.top
national-news.site
news-global.site
news-portal.site
news-web.site
nhis-home.site
nhis-kr.xyz
nhis-news.cv
nhis-news.icu
nhis-news.online
nhis-notice.cv
nhis-notice.site
nhis-post.cv
nhis-posting.icu
nhis-posting.store
nhis-web.cv
nhiskorea.site
nhiskorea.space
nhisnews.online
nhisnews.site
nhisnews.xyz
nhispost.xyz
nhisposting.click
nhisposting.xyz
nhisworking.site
nps-kr.site
nta-views.online
ntaxhome.online
ntaxhome.site
ntaxkorea.site
ntaxlaw.site
ntaxline.site
ntaxnews.online
ntaxnews.site
ntaxnews.xyz
ntaxpage.online
ntaxpost.site
ntaxpost.xyz
ntaxpro.site
nts-home.top
ntscard.icu
ntsdocs.xyz
ntsfirm.site
ntshost.site
ntshosting.site
ntshosting.xyz
ntshotnews.link
ntslaw.site
ntslawfirm.xyz
ntsletter.cloud
ntsletter.world
ntsoffice.xyz
ntspost.world
ntsteam.world
ntstech.site
ntstoday.link
ntstopnews.link
ntsworking.site
paypay-bnk.info
paypay-cert.online
paypay-cert.shop
paypay-home.shop
paypay-homes.online
paypay-main.info
paypay-main.shop
rdasdjsfagy.shop
real-dating.news-portal.site
realfox.website
riskcheck.texasrobot.top
scancredit.shop
spicyhub.cloud
surferzone.cloud
talayotegrpserver.dyndns.info
tasteiter.cloud
tblokrcoll.shop
tepco-home.online
tfdcczdasv.shop
track.ntsfirm.site
uifgiasgfih.shop
usercentes.info
userveirfy.site
vpn858684190.softether.net
wetax-go.site
wetax-kr.site
wetaxkorea.online
womens-adult.news-portal.site
woocoo.top
wyudyagsdy.shop
yoroi.site

# Reference: https://www.virustotal.com/gui/ip-address/47.91.170.222/relations

eposzent.icu

# Reference: https://x.com/skocherhan/status/2024754886177333482
# TITLE-HOST=네이버 : 로그인

acutyq9ppsz5m5edmjb0q9pxvbeb49paq6dushvtst8ze.vercel.app
animated-fishstick-six.vercel.app
bafkreia2gk2e6rlmrhq5llxv27sdhqxgdqxrj4acvirlyy7yo327bvq6py.ipfs.dweb.link
bafkreia6thcc4mhmlo4m763gpbdljqlg34ktudbnm4by5cf223wrsuz76m.ipfs.dweb.link
bafkreiahl3xad7qkvydrrupbbncaoqni2yv26voe6kspeeg3ijkbf5ca54.ipfs.dweb.link
bafkreibfg2rryjr7rp4wmywlaiutj4yiiamdjfs6sch4a3nhrohogascte.ipfs.dweb.link
bafkreibnmvqwgtwq47mff4sr4grua5kj7qirxtas3nnleif6mz3n6wzy3a.ipfs.dweb.link
bafkreibtkif5xtkl5gayzdymypy5nf7srmy34dbyyrrvhistj37opr4wxq.ipfs.dweb.link
bafkreicm6tdgpxmqonpynwxxrdfcjon6upiay5u7vw7cwt7brlclpayvqu.ipfs.dweb.link
bafkreiewlcprq4lxz6rcjbltiakzueaoe4lhkxxkgoupktaubg7a4zwzmm.ipfs.dweb.link
bafkreihasgfpuhz5wrvhxxqrh7tdvlu7uujislz3cye26kh6c6d6symsye.ipfs.dweb.link
bafybeiamo2yli2vn6dvjshqwwvj3armjgxlo7ftkclqthmz5bvcdvitmui.ipfs.dweb.link
bafybeian4zt4p7vnsmhrdxd255ieqqdhfdnlchf2l46lwhfuz57bvwyoiy.ipfs.dweb.link
bafybeicawmisjxovyyl25je3ws65ksqlcd7xnqfnusnhe6ohk2mhjfybou.ipfs.dweb.link
bafybeie5f5zmnofaardfauktuutu6zxh6pju6itev6tgck7kdwezlbmvga.ipfs.dweb.link
bafybeif7odk4pgkjew4srkod7g7yimfnsa6vf7mrldf5fin7okpltgpfgm.ipfs.dweb.link
bba-fr8v.vercel.app
bba-nine.vercel.app
ben-7m06wn4vu-mastachu3000-gmailcom.vercel.app
blowballonrespiratory.vercel.app
bytrderetrytuyiuoli-lukgjfhdhfjgkh.vercel.app
car-grik8z9ay-tessenwout-gmailcom.vercel.app
car-taupe.vercel.app
cityboysandgirltogether.vercel.app
clinquant-buttercream-d4fa95.netlify.app
cold-7wdiwiawp-mastachu3000-gmailcom.vercel.app
cold-self.vercel.app
cubeserverreconnecting.medimapgroup.com
cvnmswzmnnav.vercel.app
decghnnavcdef.vercel.app
dingrahype.vercel.app
docreg.pages.dev
durr.vercel.app
elle1.vercel.app
elle2.vercel.app
elle3.vercel.app
elle4.vercel.app
elle6.vercel.app
elle7.vercel.app
eve1-sooty.vercel.app
fam1-eight.vercel.app
fam2-eight.vercel.app
fam3.vercel.app
fam4.vercel.app
funds-beige.vercel.app
funds-k7d9.vercel.app
goldminecompany.vercel.app
goodluck-a9k.pages.dev
gsmart88.github.io
guileless-fairy-f832ec.netlify.app
hieltech-purchase-order.vercel.app
histarnaverlogin.vercel.app
host-brown-delta.vercel.app
hpppppp.vercel.app
humm-jw6u.vercel.app
humm-r23m.vercel.app
hypnotic-capricious-jaw.glitch.me
ifffff.vercel.app
improved-journey.vercel.app
jack-adwxxrg1e-mastachu3000-gmailcom.vercel.app
jgfryyhugytcrhuyvtreteyrtufyiguhilh.vercel.app
jioer.vercel.app
joe333-jl6i.vercel.app
jollof-and-rice.vercel.app
juji91.github.io
kangoolhfgiyufxcyuhv.vercel.app
literate-sniffle-rho.vercel.app
loquacious-gaufre-7e3f0e.netlify.app
lordgimmeasign.vercel.app
luck-billowy-halibut.glitch.me
lum22-8cfp.vercel.app
lum22.vercel.app
m.neofeel.work
medical-devices-purchase-quotation.vercel.app
medical-equipments.vercel.app
miniature-octo-succotash-eight.vercel.app
morningstar-wheat.vercel.app
mrb.kum.mybluehost.me
nack.vercel.app
navcedsnmjld.vercel.app
naver-inv-037.vercel.app
naver-purchase-order.vercel.app
naver-quotation-submission.vercel.app
naver.club
naver1.vercel.app
naver2.vercel.app
naverbill.pages.dev
navermail-login.vercel.app
navernid.pythonanywhere.com
naverwebmailsiginpageiyutyrterytuyu.vercel.app
navor.p-e.kr
navsoldvbmcsw.vercel.app
ncafe-articleview.com
ncafe-readarticles.com
ncafe-viewarticle.com
ncafearticle-read.com
ncafearticles-viewer.com
new-purchase-order.vercel.app
nhn-articleread.cafe
nhn-cafearticle.com
nhncafe-article.com
nid-navar.protanec.com
nid-navar.rixardos.com
nid-navar.ryship.com
nidcafe-readpost.com
nidlogin.azurewebsites.net
nnvawdbnmjkkx.vercel.app
npayorder.com
orca-app-b79lw.ondigitalocean.app
order-and-invoices.vercel.app
order-submission-yutyrdytfugiohj-hg.vercel.app
orders.pay.naver.com.npayorder.com
parapara.vercel.app
project-e2u.pages.dev
purchase-order-workers-playground-weathered-moon-6962.mslee.workers.dev
purchase-order2025.vercel.app
purchase-proforma-invoice.vercel.app
redesigned-octo-goggles-theta.vercel.app
ret-o5bllzmoy-tessenwout-gmailcom.vercel.app
reversefundingresources.vercel.app
safe-paynaver.com
segyeong-hi-tech-co-ltd-purchase-or.vercel.app
semeinoepravoinfo8jp17girak12psvdchw1oqkctiesemwvnc1.vercel.app
signinnaverkhgfrdjhugyfd5ghgyt.vercel.app
stars.vercel.app
steve-mj48u7ra1-mastachu3000-gmailcom.vercel.app
sugarcoatedbinacle.vercel.app
syncronizationprojectswork.vercel.app
tdcnmnjk.vercel.app
this-is-a-new-order.vercel.app
trfhnmcvds.vercel.app
tvcmnbanavc.vercel.app
ubancsnmc.vercel.app
usd-purchase-order-workers-playground-square-cell-37b8.mslee.workers.dev
valvequotationandrequest.vercel.app
vhswncnav.vercel.app
virtual-l4qsh1z1j-marhokate-gmailcom.vercel.app
webmailnaverlogin.vercel.app
work-serve.onrender.com
workers-playground-cold-violet-5b28.jusang425.workers.dev
workers-playground-dawn-field-1022.mslee.workers.dev
workers-playground-empty-base-3eb8.jusang425.workers.dev
workers-playground-purple-surf-d54d.mslee.workers.dev
workers-playground-rapid-cloud-140b.jusang425.workers.dev
workers-playground-sweet-violet-3303.jusang425.workers.dev
workers-playground-wandering-dew-9153.jusang425.workers.dev
workers-playground-yellow-cloud-e417.mslee.workers.dev
xexykiosk.cc
xxa-8lq4.vercel.app
xxa-phi.vercel.app
xxaa-eta.vercel.app
ybtpo-202508041.vercel.app
yuanbvgtseyrutiyuo-ulgfdvhjhkjljhgf.vercel.app

# Reference: https://x.com/byrne_emmy12099/status/2024982156582453425
# Reference: https://www.virustotal.com/gui/file/7fd74931c6b88ac25dbc72c19d17a866dc13c0b33e3f6a0a18147ca7a5ffc389/detection

45.150.192.250:8080
withoutwithin.onthewifi.com

# Reference: https://x.com/skocherhan/status/2025245190211129580

edocsnavp.dynv6.net
ipsdecmain.dns.army
ipsnoticed.dns.army
isget.dns.army
nav-logins.edocsnavp.dynv6.net
nav-logins.ipsdecmain.dns.army
nav-logins.navorscorps.x10.network
nav-logins.nts-alert.dns.navy
navorloeins.bn.ntces.x10.network
navorscorpes.dns.navy
navorscorps.x10.network
navs.ipsnoticed.dns.army
navs.vipsdocs.dns.army
nid-login.navorscorpes.dns.navy
nid-login.nts-alert.dns.navy
nid-login.unts-corp.dynv6.net
nid.ipsnoticed.dns.army
nida.ipsdecmain.dns.army
nida.navorscorps.x10.network
nida.ntdecs.dns.army
nida.nts-alert.dns.navy
nida.unts-corp.dynv6.net
nidloes.ipsnoticed.dns.army
nidloes.isget.dns.army
nidlogins.ipsnoticed.dns.army
nidlogins.isget.dns.army
nids.edocsnavp.dynv6.net
nids.ipsdecmain.dns.army
nids.ipsnoticed.dns.army
nids.isget.dns.army
nids.navorscorps.x10.network
nids.ntdecs.dns.army
nids.vipsdocs.dns.army
nidservers.edocsnavp.dynv6.net
nidservers.navorscorps.x10.network
nidservers.ntdecs.dns.army
nidservers.nts-alert.dns.navy
nidservers.unts-corp.dynv6.net
ntces.x10.network
ntdecs.dns.army
nts-alert.dns.navy
rlogins.bn.ntces.x10.network
unts-corp.dynv6.net
vipsdocs.dns.army

# Reference: https://x.com/skocherhan/status/2025264875816001899
# Reference: https://www.virustotal.com/gui/ip-address/172.245.64.240/relations

numerlcacu.online
workforcrecruit.info
online-access.dynv6.net
viewdocument2785.dns.army
workforcerecruit.authorizeddns.net
account.viewdocument2785.dns.army
api-events.viewdocument2785.dns.army
browser-datasets-event.viewdocument2785.dns.army
citi.online-access.dynv6.net
df-cfp.viewdocument2785.dns.army
ecs.viewdocument2785.dns.army
graph.viewdocument2785.dns.army
login.viewdocument2785.dns.army
login1.viewdocument2785.dns.army
login2.viewdocument2785.dns.army
logincdn1.viewdocument2785.dns.army
nn365.viewdocument2785.dns.army
nndcdn.viewdocument2785.dns.army
sso.viewdocument2785.dns.army
tpf.viewdocument2785.dns.army

# Reference: https://x.com/skocherhan/status/2025274934553980963

blogstore.mydns.vc
deliverdoc-ips.mydns.bz
ips-calledoc.mydns.vc
ips-ecorp.mydns.bz
ips-edocdeliver.mydns.vc
ips-mailer.mydns.vc
ips-nidkr.mydns.bz
ips-nidlog.mydns.vc
ipsdoc-auth.mydns.vc
ipsml-auth.mydns.vc
nid-blog.mydns.vc
nts-authdoc.mydns.vc
nts-dns.mydns.vc
ntstore.mydns.vc
n-cloud.ips-ecall.mydns.bz
n-cloud.ips-ecorp.mydns.bz
n-cloud.ips-edocdeliver.mydns.vc
n-cloud.ips-mailer.mydns.vc
n-cloud.ips-nidlog.mydns.vc
n-cloud.nts-authdoc.mydns.vc
n-cloud.nts-dns.mydns.vc
n-corp.ips-dns.mydns.vc
n-corp.ips-ecall.mydns.bz
n-corp.ips-ecorp.mydns.bz
n-corp.ips-edocdeliver.mydns.vc
n-corp.ips-nidlog.mydns.vc
n-corp.ipsdoc-auth.mydns.vc
n-corp.ipsml-auth.mydns.vc
n-corp.nid-blog.mydns.vc
n-corp.nts-dns.mydns.vc
n-corp.ntstore.mydns.vc
n-store.blogstore.mydns.vc
n-store.ips-calledoc.mydns.vc
n-store.ips-dns.mydns.vc
n-store.ips-ecall.mydns.bz
n-store.ips-ecorp.mydns.bz
n-store.ips-mailer.mydns.vc
n-store.ips-nidlog.mydns.vc
n-store.ipsdoc-auth.mydns.vc
n-store.ipsml-auth.mydns.vc
n-store.nblog.mydns.bz
n-store.nid-blog.mydns.vc
n-store.ntstore.mydns.vc
n-user.ips-ecorp.mydns.bz
nid-naverdqp.servequake.com
nid-user.ips-ecall.mydns.bz
nid-user.ips-ecorp.mydns.bz
nid-user.ips-edocdeliver.mydns.vc
nid-user.ips-mailer.mydns.vc
nid-user.ips-nidlog.mydns.vc
nid-user.ipsdoc-auth.mydns.vc
nid-user.ipsml-auth.mydns.vc
nid-user.nid-blog.mydns.vc
nid-user.nts-authdoc.mydns.vc
nuser-login.blogstore.mydns.vc
nuser-login.ips-dns.mydns.vc
nuser-login.ips-ecall.mydns.bz
nuser-login.ips-ecorp.mydns.bz
nuser-login.ips-mailer.mydns.vc
nuser-login.nblog.mydns.bz
nuser-login.nid-blog.mydns.vc
nuser-login.nts-dns.mydns.vc

# Reference: https://app.validin.com/detail?find=c2bd47d03b48320b1c23f8f92e1f89f6&type=hash&ref_id=4d053dd12f1#tab=host_pairs

20.na-home.online
2o.naver-club.top
dev.science.aidu.kr
dnnever.weebly.com
fleamarkel.naver-payment.com
fleamarkel.naver-store.com
fleamarkel.naverpayment.com
fleamarket.naver-active.com
fleamarket.naver-flea.com
fleamarket.naver-fleamart.com
fleamarket.naver-flear.com
fleamarket.naver-fleas.com
fleamarket.naver-fleat.com
fleamarket.naver-free.com
fleamarket.naver-markets.com
fleamarket.naver-nflea.com
fleamarket.naver-paymarket.com
fleamarket.naver-paymart.com
fleamarket.naver-paymenl.com
fleamarket.naver-paymenls.com
fleamarket.naver-paymentsys.com
fleamarket.naver-pays.com
fleamarket.naver-sto.com
fleamarket.naver-stor.com
fleamarket.naver-stors.com
fleamarket.naver-stove.com
fleamarket.naver-strom.com
fleamarket.navercshop.com
fleamarket.navercshopa.com
fleamarket.navercshops.com
fleamarket.naverflear.com
fleamarket.naverflearmart.com
fleamarket.naverflearmarts.com
fleamarket.navermarke1.com
fleamarket.navermarkel.com
fleamarket.navernarket.com
fleamarket.naverpaymente.com
fleamarket.naverpayments.com
fleamarket.naverpaymentz.com
fleamarket.naverside.com
fleamarket.naverstor.com
fleamarket.nfleamarke-naver.com
fleamarket.nfleamarkel-naver.com
fleamarket.nfleamarket-naver.com
frtgrrrrrrrrrr.weebly.com
gs-pt1.com
jkdgkkdjkrlk.weebly.com
na-home.online
na-shop.site
naver-active.com
naver-club.top
naver-club.xyz
naver-flea.com
naver-fleamart.com
naver-flear.com
naver-fleas.com
naver-fleat.com
naver-free.com
naver-home.top
naver-markets.com
naver-nflea.com
naver-paymarket.com
naver-paymart.com
naver-paymenl.com
naver-paymenls.com
naver-payment.com
naver-paymentsys.com
naver-pays.com
naver-sto.com
naver-stor.com
naver-store.com
naver-stors.com
naver-stove.com
naver-strom.com
naver.net.br
navercshop.com
navercshopa.com
navercshops.com
naverflear.com
naverflearmart.com
naverflearmarts.com
navermarke1.com
navermarkel.com
navernarket.com
naverpayment.com
naverpaymente.com
naverpayments.com
naverpaymentz.com
naversh.top
navershefffffff.weebly.com
naverside.com
naverstor.com
nfleamarke-naver.com
nfleamarkel-naver.com
nfleamarket-naver.com
nnsav.weebly.com
science.aidu.kr

# Reference: https://x.com/Ghostyak/status/2028365739762323777
# Reference: https://www.virustotal.com/gui/ip-address/101.36.114.231/relations
# Reference: https://www.virustotal.com/gui/file/1eff237dee95172363bfc0342d0389f809f753a6ec5e6848e57b3fd5482e9793/detection
# Reference: https://www.virustotal.com/gui/file/af50f35701916d3909f2727cdcbde1a7af47f46eb8db3996905b1c0725aa133f/detection
# Reference: https://www.virustotal.com/gui/file/d7c09e7bf79aa9b786dcd9f870427f4a1110f702646fba9d3835215ad3649d0b/detection
# BODY_SHA1-HOST=32a4fd9837338a46a5cdc1bfe3149fbec30fed69

http://130.94.29.111
aointerviews.com
authterms.mydns.bz
bn.ndocaapass.dynv6.net
check.nid-log.com
daumbdu.viewdns.net
docnodeaccess.mydns.bz
dt.ndocbpass.dns.army
edoc.authterms.mydns.bz
elecviews66.dynv6.net
elecviews85.dynv6.net
info.docnodeaccess.mydns.bz
invoice.npdocrequires.mydns.bz
mhjjh.dynv6.net
naverlvp.servegame.com
naverpaa.servehalflife.com
navoripes.dns.army
navs.bn.ndocaapass.dynv6.net
ncodbvpass.dynv6.net
ncodbzpass.dynv6.net
ncodcapass.dynv6.net
ncodcbpass.dynv6.net
ncodccpass.dynv6.net
ncodcepass.dynv6.net
ndoc-pass.dns.army
ndocaapass.dynv6.net
ndocabpass.dynv6.net
ndocadpass.dynv6.net
ndocatpass.dynv6.net
ndocaupass.dynv6.net
ndocazpass.dynv6.net
ndocbapass.dynv6.net
ndocbcpass.dynv6.net
ndocbdpass.dynv6.net
ndocbepass.dynv6.net
ndocbfpass.v6.army
ndocbgpass.v6.army
ndocbpass.dns.army
ndocepass.dns.army
ndocfpass.dns.army
ndochpass.dns.army
ndockverify.dns.army
ndocnpass.dns.army
ndocopass.dns.army
ndocpass.dns.army
ndocppass.dns.army
ndocs2mai1.dns.army
ndocs5mai1.dns.army
nid-log.com
nid-login.navoripes.dns.army
nid-naverchr.serveftp.com
nid-naverdlm.servegame.com
nid-naverdmv.servehalflife.com
nid-naverecj.ddnsking.com
nid-navermdh.servegame.com
nid-naveroon.serveftp.com
nid-naverstk.onthewifi.com
nid-naveryuw.ddnsking.com
nid.bn.nnvesips.dns.army
nidloes.bn.nnvesips.dns.army
nidlogins.cn.nnvesips.dns.army
nnvesips.dns.army
npdocrequires.mydns.bz
read73s.dynv6.net
rule52s.dynv6.net
rule62s.dynv6.net
t3.nid-log.com
yzjkdaspo.top
yzjladsiouewk.top
yzkjdasiouej.top
yzopjasdiw.top
yzopjklfs.top

# Reference: https://x.com/skocherhan/status/2028588428787433658

view-mdoc.p-e.kr
service.view-mdoc.p-e.kr
police.service.view-mdoc.p-e.kr
nid.police.service.view-mdoc.p-e.kr
edoc.file.view.xn--1-wb6eh4hj4durmfjcnubk5pb9dezmj4b0xb.xn--2i0b10rqve.xn--3e0b707e
edoc.view.xn--1-wb6eh4hj4dt5o56a42nfzdh3l5rhgtx.xn--hu5b25b77nvwc.xn--3e0b707e
file.view.xn--1-wb6eh4hj4durmfjcnubk5pb9dezmj4b0xb.xn--2i0b10rqve.xn--3e0b707e
mid.edoc.view.xn--1-wb6eh4hj4dt5o56a42nfzdh3l5rhgtx.xn--hu5b25b77nvwc.xn--3e0b707e
nld.edoc.file.view.xn--1-wb6eh4hj4durmfjcnubk5pb9dezmj4b0xb.xn--2i0b10rqve.xn--3e0b707e
nood.xn--1-bz5exjyrvsf7xv7oxnb39cd6q4ypdq6b.xn--h32bi4v.xn--3e0b707e
view.xn--1-wb6eh4hj4dt5o56a42nfzdh3l5rhgtx.xn--hu5b25b77nvwc.xn--3e0b707e
view.xn--1-wb6eh4hj4durmfjcnubk5pb9dezmj4b0xb.xn--2i0b10rqve.xn--3e0b707e

# Referene: https://x.com/skocherhan/status/2028925760291979679

kim-reed.springperfume.org.uk

# Reference: https://x.com/skocherhan/status/2028589092506595810

chatai.trcipg.top

# Reference: https://x.com/skocherhan/status/2029308664788484421

nhpgojimem.dynuddns.com
info.nhpgojimem.dynuddns.com
invoice.nhpgojimem.dynuddns.com
userinfo.nhpgojimem.dynuddns.com

# Reference: https://x.com/JangPr0/status/2029937088670683305
# Reference: https://www.virustotal.com/gui/ip-address/27.102.113.106/relations
# Reference: https://www.virustotal.com/gui/file/c089457d5f4b22313b927bb36a320f8d7a1ddb6d5b82293dc2374dcfd4b1b8b2/detection
# Reference: https://www.virustotal.com/gui/file/ca42cba2782a0b6952dd0425fa08cbd4de65f77fcc00e965ee97c39bea42eb18/detection

erasecloud.n-e.kr
load.serverpit.com
msvscode.o-r.kr
naverrcorp.n-e.kr
navrcloud.n-e.kr
ottcloud.n-e.kr
auth.ottcloud.n-e.kr
load.erasecloud.n-e.kr
load.navrcloud.n-e.kr
nid.naverrcorp.n-e.kr
update.msvscode.o-r.kr

# Reference: https://app.validin.com/detail?find=27.102.113.0%2F24&type=ip&ref_id=0527ad889b6#tab=resolutions (# 2026-03-06)

acccounts-googlce.ddnsking.com
acccounts-gooogle.ddnsking.com
accoounts-qooqle.3utilities.com
accoounts-qooqle.serveftp.com
accounnt-kakao.myvnc.com
accounnts-google.servebeer.com
accounnts-goooqle.3utilities.com
accounnts-gooqle.ddnsking.com
accounnts-qoooqle.3utilities.com
account-kakao.ddnsking.com
account-kakao.servehttp.com
accountkakao.myvnc.com
accounts-kakaogmg.servehttp.com
accounts.google.hackquest.com
accounts.google.ignorelist.com
accounts.google.jumpingcrab.com
accounts.google.minecraftnoob.com
accounts.google.raspberryip.com
accounts2-qooqle.ddnsking.com
accouunts-gooogle.ddnsking.com
accouunts-gooqle.3utilities.com
accouut-kakao.servehttp.com
accouuts-gooogle.3utilities.com
accouuts-gooogle.ddnsking.com
accouuts-gooogle.serveftp.com
accouuts-qooqle.ddnsking.com
accouuts-qooqle.servecounterstrike.com
communicationkaitlin.dynserv.org
damubou.myvnc.com
darn-kacko.kro.kr
daumabt.onthewifi.com
daumcfi.onthewifi.com
daumlpb.myvnc.com
daummjw.servehttp.com
daumpga.myvnc.com
dmaii.o-r.kr
dropbox.onthewifi.com
google.hackquest.com
google.ignorelist.com
google.jumpingcrab.com
google.minecraftnoob.com
google.okzk.com
google.raspberryip.com
googlearm.ddnsking.com
googledgz.serveftp.com
googledwh.ddnsking.com
googleeuu.servecounterstrike.com
googleezu.ddnsking.com
googlegyi.myvnc.com
googlehwi.myvnc.com
googlehys.myvnc.com
googleiyq.myvnc.com
googlelsd.myvnc.com
googlelsz.servecounterstrike.com
googlemad.servequake.com
googlemnj.serveftp.com
googlepdy.serveftp.com
googleped.servecounterstrike.com
googletoq.serveftp.com
googlewxv.servequake.com
googlewzg.serveftp.com
gooqlesecs.ddnsking.com
gsec.ddnsking.com
kacka.kro.kr
kedit.n-e.kr
ksevice.p-e.kr
lethalinjectionthechair.dynserv.org
link-nid-log.oc9bk.dynv6.net
login-yahoozfb.myvnc.com
mail-nate.servemp3.com
menber.kedit.n-e.kr
menber.nhnsevice.n-e.kr
mess.dyndns.org
myaccount.google.okzk.com
natefew.myvnc.com
natejtv.myvnc.com
navemailservice.serveftp.com
ncheck.r-e.kr
nedit.kro.kr
nhnsevice.n-e.kr
nid-mailnav.ddnsking.com
nid-naever2.serveftp.com
nid-nasver.servecounterstrike.com
nid-nav3.servemp3.com
nid-nav3.servepics.com
nid-navbn.servegame.com
nid-navcersecs.servequake.com
nid-navcjw.myvnc.com
nid-navcorp.ddnsking.com
nid-navcorp2.onthewifi.com
nid-navcorpsec.onthewifi.com
nid-nave3.myvnc.com
nid-naveersec.ddnsking.com
nid-naver.servecounterstrike.com
nid-naveraccount.myvnc.com
nid-naveradk.servemp3.com
nid-naveraeup.ddnsking.com
nid-naverans.servegame.com
nid-naverbth.onthewifi.com
nid-navercau.myvnc.com
nid-navercbys.servegame.com
nid-navercdt.serveftp.com
nid-navercorp.myvnc.com
nid-naverdct.myvnc.com
nid-naverezx.servecounterstrike.com
nid-naverfaf.myvnc.com
nid-naverfnx.ddnsking.com
nid-navergkn.serveftp.com
nid-naverhcf.servemp3.com
nid-naveridh.onthewifi.com
nid-naveripw.ddnsking.com
nid-naverjkf.onthewifi.com
nid-naverjoj.3utilities.com
nid-naverkmv.onthewifi.com
nid-naverkne.serveftp.com
nid-navermail.servepics.com
nid-navermails.servegame.com
nid-navermbi.servemp3.com
nid-navernja.myvnc.com
nid-navernmk.servemp3.com
nid-navernrh.servemp3.com
nid-navernvi.myvnc.com
nid-navernym.servequake.com
nid-naveroup.servepics.com
nid-naverowr.serveftp.com
nid-naverpub.onthewifi.com
nid-naverqxz.serveftp.com
nid-naverrez.serveftp.com
nid-naverrtc.myvnc.com
nid-naversecmail.onthewifi.com
nid-naversll.myvnc.com
nid-naversti.servepics.com
nid-naversups.servemp3.com
nid-naversvq.onthewifi.com
nid-naverulg.myvnc.com
nid-naverupt.servequake.com
nid-naverurd.servemp3.com
nid-naveruta.servequake.com
nid-naveruvp.servegame.com
nid-navervan.onthewifi.com
nid-navervfr.ddnsking.com
nid-naverwoe.myvnc.com
nid-naverxkr.servecounterstrike.com
nid-naveryty.servegame.co
nid-naverzae.ddnsking.com
nid-navesec.serveftp.com
nid-naveserve.serveftp.com
nid-navesrvsec.servepics.com
nid-navesupport.3utilities.com
nid-navghs.servepics.com
nid-navmail.3utilities.com
nid-navorr.servequake.com
nid-navorsec.servecounterstrike.com
nid-navoue.onthewifi.com
nid-navsec.servebeer.com
nid-navsecsm.ddnsking.com
nid-navsecsrv.servequake.com
nid-navsepro.myvnc.com
nid-navserve.servemp3.com
nid-navsupport.ddnsking.com
nid-navsupport.servegame.com
nid-navxcs.servecounterstrike.com
nid-nsecurity.onthewifi.com
nidnav-mail.servegame.com
nidnavaccount.onthewifi.com
nidnavarsvc.onthewifi.com
nidnavcer.ddnsking.com
nidnaver.myvnc.com
nidnaver.servepics.com
nidnaversec.myvnc.com
nidnavmail.serveftp.com
nidnavsecer.myvnc.com
nidnavsecs.onthewifi.com
nidnavsecs.servequake.com
nidnvm.servecounterstrike.com
nidnvmail.servehttp.com
nidnvsecum.servemp3.com
nids-navar.servepics.com
nids-navcer.onthewifi.com
nids-navcer.servegame.com
nidsecnav.servegame.com
nidsnavar.servemp3.com
nidsnaver.onthewifi.com
oc9bk.dynv6.net
paege.dmaii.o-r.kr
paege.nedit.kro.kr
partner.kacka.kro.kr
profi1e.ncheck.r-e.kr
profi1es.darn-kacko.kro.kr
secacc-google.ddnsking.com
srv.ksevice.p-e.kr
updatedns.itemdb.com
vpn817528364.softether.net
xo-nate3.myvnc.com
yahooarq.myvnc.com

# Reference: https://www.virustotal.com/gui/ip-address/27.102.137.140/relations
# CERT_CN-IP=WIN-Q63127AQDIT

http://27.102.137.172
http://27.102.137.183
http://27.102.138.136
http://27.102.138.144
http://27.102.138.150
http://27.102.138.157
13udm.v6.navy
2ebq4.dns.army
3tg8i.dns.army
4ckuc.dns.army
6exkk.v6.navy
747yz.v6.navy
7ieub.dns.army
9jgeb.v6.navy
a7f3q.v6.navy
bng0e.dns.army
cd1h3.dns.army
dbi0b.v6.navy
fsmhn.v6.navy
gk5c4.v6.navy
ifrdr.dns.army
jupbc.dns.army
l6hlm.v6.navy
red9c.dns.army
rpf9z.v6.navy
s7ycn.dns.army
umc5a.dns.army
yv3ie.dns.army
43t34t.yv3ie.dns.army
g24.bng0e.dns.army
linker.l6hlm.v6.navy
t34r.7ieub.dns.army
xvzdn.2ebq4.dns.army

# Reference: https://www.virustotal.com/gui/ip-address/141.164.38.81/relations

bybits-security.barney.ro
docsstores.v6.rocks
hid.neddocs.x10.network
htdcos.dns.army
indoc.dfmab.eu
indoc.mashen.biz
indocs.dfmab.eu
indocs.dynv6.net
innerdoc.v6.rocks
invoice.dfmab.eu
invoice.mashen.biz
ips-edocs.elementfx.com
login.htdcos.dns.army
logins.en.ntedoc.dedyn.io
logins.ntsdocs.dns.army
mts-main.dns.army
nav-19gins.htsdocs.dns.army
nav-logins.htsdocs.dns.army
nav-logins.midsdoc.dns.army
nav-nida.htsdocs.dns.army
nav-nts.midsdoc.dns.army
navlogin.docsstores.v6.rocks
navlogin.indocs.dynv6.net
navlogin.sevice.ntedoc.dedyn.io
navorlogins.bn.ntedoc.dedyn.io
navorlogins.indocs.dynv6.net
navorlogins.rootcop.info
navr-corps.dns.navy
ndocs.midsdoc.dns.army
ndocs.navr-corps.dns.navy
ndocs.nemdocs.x10.network
neddocs.x10.network
nemdocs.x10.network
nid-login.htdcos.dns.army
nid-login.midsdoc.dns.army
nid-server.gaston.in
nid-server.mpau.eu
nid-server.navs.innerdoc.v6.rocks
nid-server.triatlonpacense.es
nid-servers.cn.ntedoc.dedyn.io
nid-servers.docsstores.v6.rocks
nid-servers.indocs.dynv6.net
nid-servers.rootcop.info
nid-service.neddocs.x10.network
nid-sevices.ips-edocs.elementfx.com
nid.neddocs.x10.network
nida.htdcos.dns.army
nida.htsdocs.dns.army
nida.mts-main.dns.army
nida.ntsdocs.dns.army
nide-login.gaston.in
nide-login.triatlonpacense.es
nide-login.vip.innerdoc.v6.rocks
nidlogins.docsstores.v6.rocks
nidlogins.en.ntedoc.dedyn.io
nidlogins.gaston.in
nidlogins.indocs.dynv6.net
nidlogins.ntsdocs.dns.army
nidlogins.rootcop.info
nidlogins.triatlonpacense.es
nidlrgins.ntsdocs.dns.army
nids-server.gaston.in
nids-server.navors.innerdoc.v6.rocks
nids-server.triatlonpacense.es
nids.htdcos.dns.army
nidservers.htsdocs.dns.army
nidservers.midsdoc.dns.army
nilogin.triatlonpacense.es
ninvoce.nemdocs.x10.network
ns.bn.ntedoc.dedyn.io
ntedoc.dedyn.io
nts.midsdoc.dns.army
nts.nemdocs.x10.network
ntsdocs.dns.army
o6vrrmqkea.nemdocs.x10.network
pida.htsdocs.dns.army
pids.htdcos.dns.army

# Reference: https://www.virustotal.com/gui/ip-address/118.193.68.242/relations

dipsd.dns.navy
gtopsed.dns.army
ipscorped.dns.navy
ipsedx.dns.army
ipsgtt.dns.army
moisesd.dns.army
nav-logins.ipscorped.dns.navy
nav-logins.navdocs-main.dns.navy
nav-logins.navorntes.dns.army
navdocs-main.dns.navy
navesps.dns.navy
navorntes.dns.army
navorscorpes.dynv6.net
navs.dn.nioipsde.dns.army
navs.ipsgtt.dns.army
navs.moisesd.dns.army
navs.navorntes.dns.army
navs.ntotps.dns.army
navs.ntsedco.dns.army
navscorpes.dynv6.net
ndociverify.dns.army
ndocs-verify.dns.army
ndocs.an.nvpesd.dns.army
ndocs.dn.nvpesd.dns.army
ndocs.navorntes.dns.army
nedvtex.dns.army
nesever.navesps.dns.navy
nesever.navorntes.dns.army
nid-login.ipscorped.dns.navy
nid-login.navdocs-main.dns.navy
nid-login.navorscorpes.dynv6.net
nid-naveruml.servecounterstrike.com
nid.bn.nedvtex.dns.army
nid.en.nioipsde.dns.army
nid.ipsgtt.dns.army
nid.navorntes.dns.army
nid.npsesdocs.dns.army
nida.ipscorped.dns.navy
nida.navdocs-main.dns.navy
nida.navorntes.dns.army
nida.navorscorpes.dynv6.net
nidloes.bn.gtopsed.dns.army
nidloes.bn.nioipsde.dns.army
nidloes.cn.nioipsde.dns.army
nidloes.cn.ntaxcopsed.dns.army
nidloes.dn.nioipsde.dns.army
nidloes.en.dipsd.dns.navy
nidloes.ipsgtt.dns.army
nidloes.moisesd.dns.army
nidloes.navorntes.dns.army
nidloes.npsesdocs.dns.army
nidloes.ntsedco.dns.army
nidlogins.bn.nioipsde.dns.army
nidlogins.bn.ntaxcopsed.dns.army
nidlogins.cn.gtopsed.dns.army
nidlogins.cnav.polidcs.dns.navy
nidlogins.dn.nioipsde.dns.army
nidlogins.ipsgtt.dns.army
nidlogins.npsesdocs.dns.army
nidlogins.ntsedco.dns.army
nids.anav.poldocs.dns.navy
nids.cn.nioipsde.dns.army
nids.cnav.poldocs.dns.navy
nids.dn.dipsd.dns.navy
nids.enav.poldocs.dns.navy
nids.ipscorped.dns.navy
nids.ipsgtt.dns.army
nids.moisesd.dns.army
nids.navorntes.dns.army
nids.navorscorpes.dynv6.net
nids.ntotps.dns.army
nids.ntsedco.dns.army
nidserver.an.nvpesd.dns.army
nidserver.bn.nvpesd.dns.army
nidserver.dn.nvpesd.dns.army
nidserver.en.nvpesd.dns.army
nidserver.navorntes.dns.army
nidservers.ipscorped.dns.navy
nidservers.ipsedx.dns.army
nidservers.navdocs-main.dns.navy
ninvoce.dn.nvpesd.dns.army
ninvoce.navesps.dns.navy
nioipsde.dns.army
npsesdocs.dns.army
ntaxcopsed.dns.army
ntotps.dns.army
nts.cn.nvpesd.dns.army
nts.en.nvpesd.dns.army
ntsedco.dns.army
nvpesd.dns.army
polidcs.dns.navy

# Reference: https://www.virustotal.com/gui/ip-address/152.32.139.149/relations

139.149amdoc-hometax.mydns.bz
139.149aodoc-hometax.mydns.bz
149amdoc-hometax.mydns.bz
149aodoc-hometax.mydns.bz
152.32.139.149amdoc-hometax.mydns.bz
152.32.139.149aodoc-hometax.mydns.bz
32.139.149amdoc-hometax.mydns.bz
32.139.149aodoc-hometax.mydns.bz
akdoc-hometax.mydns.bz
aldoc-hometax.mydns.jp
amdoc-hometax.mydns.bz
aodoc-hometax.mydns.bz
appleviewer.sbs
at.aldoc-hometax.mydns.jp
at.ndoc-verify.dns.army
at.ndocaverify.dns.army
at.ndoccverify.dns.army
at.ndocfverify.dns.army
atdoc-hometax.mydns.jp
bt.ndoceverify.dns.army
bt.ndockverify.dns.army
ct.ndoc-verify.dns.army
ct.ndoccverify.dns.army
dt.ndoc-verify.dns.army
dt.ndocaverify.dns.army
ncloud.julgiya.com
ndoc-verify.dns.army
ndocaverify.dns.army
ndocbverify.dns.army
ndoccverify.dns.army
ndoceverify.dns.army
ndocfverify.dns.army
ndocgverify.dns.army
ndocpverify.dns.army
ndocs-nsend.dynv6.net
ndocs0link.dns.army
ndocs0mai1.dns.army
ndocs3link.dns.army
ndocs3send.dynv6.net
ndocsverify.dns.army
ndocverify.dns.army

# Reference: https://www.virustotal.com/gui/ip-address/152.32.138.225/relations

appdocdynamic.mydns.bz
blogreference.dynuddns.net
bloguresource.mydns.bz
chk.controlbloginfo.mydns.bz
chk.ercmbasedoc.mydns.bz
chk.supportnpdisp.mydns.bz
doc.docrequireaccess.mydns.bz
doc.lnkuserauth.giize.com
doc.supportnpdisp.mydns.bz
docinfo.appdocdynamic.mydns.bz
docinfo.blogreference.dynuddns.net
docinfo.bloguresource.mydns.bz
docinfo.dkimbasedoc.mydns.bz
docinfo.ntaddressdoc.mydns.bz
docinfo.ntsgojilists.mydns.bz
docrequireaccess.mydns.bz
edoc.appdocdynamic.mydns.bz
edoc.blogreference.dynuddns.net
edoc.bloguresource.mydns.bz
edoc.infoblogrequire.mydns.bz
edoc.ntaddressdoc.mydns.bz
edoc.ntprefdoc.mydns.bz
ercmbasedoc.mydns.bz
info.controlbloginfo.mydns.bz
infoblogrequire.mydns.bz
infoinvoicebook.dynuddns.com
invoice.appdocdynamic.mydns.bz
invoice.blogreference.dynuddns.net
invoice.bloguresource.mydns.bz
invoice.docrequireaccess.mydns.bz
invoice.epsdocgoji.mydns.bz
invoice.ercmbasedoc.mydns.bz
invoice.infoinvoicebook.dynuddns.com
invoice.ntaddressdoc.mydns.bz
invoice.supportnpdisp.mydns.bz
lnkuserauth.giize.com
nid.ublogblock.mydns.bz
ntaddressdoc.mydns.bz
ntdispsize.ddnsguru.com
ntlinedoc.mydns.bz
ntprefdoc.mydns.bz
ntsgojilists.ddnsguru.com
ntsgojilists.mydns.bz
origindocgoji.mydns.bz
supportnpdisp.mydns.bz
taxdoc.bloguresource.mydns.bz
taxdoc.dkimbasedoc.mydns.bz
taxdoc.infoblogrequire.mydns.bz
usr.appdocdynamic.mydns.bz
usr.blogreference.dynuddns.net
usr.dkimbasedoc.mydns.bz
usr.epsdocgoji.mydns.bz
usr.ntprefdoc.mydns.bz
verify.controlbloginfo.mydns.bz
verify.supportnpdisp.mydns.bz

# Reference: https://x.com/skocherhan/status/2032213375057301676

158.247.210.58n-cloud.nauth-ips.mydns.vc
158.247.210.58n-store.ips-nidlg.mydns.bz
210.58n-cloud.nauth-ips.mydns.vc
210.58n-store.ips-nidlg.mydns.bz
247.210.58n-cloud.nauth-ips.mydns.vc
247.210.58n-store.ips-nidlg.mydns.bz
58n-cloud.nauth-ips.mydns.vc
58n-store.ips-nidlg.mydns.bz
dosirake.kro.kr
edoc-ips.mydns.bz
edoc-ips.mydns.vc
ips-calldoc.mydns.bz
ips-cokr.mydns.bz
ips-ecall.mydns.vc
ips-elogmail.mydns.bz
ips-govkr.mydns.bz
ips-invoicestore.mydns.vc
ips-kit.mydns.bz
ips-nidecall.mydns.vc
ips-nidlg.mydns.bz
ips-nidstore.mydns.bz
ips-notice.mydns.bz
ipstore.mydns.bz
link-nid-log.oq7n2.dynv6.net
mall.dosirake.kro.kr
n-cloud.ips-kit.mydns.bz
n-cloud.ipstore.mydns.bz
n-cloud.nauth-ips.mydns.vc
n-cloud.nauth-nts.mydns.vc
n-cloud.nts-taxkr.mydns.vc
n-cloud.ntsml-auth.mydns.vc
n-corp.ips-cokr.mydns.bz
n-corp.ips-elogmail.mydns.bz
n-corp.ips-nidlg.mydns.bz
n-corp.ips-notice.mydns.bz
n-corp.ipstore.mydns.bz
n-corp.nauth-ips.mydns.vc
n-corp.nts-auth.dns.army
n-corp.nts-calledoc.dynv6.net
n-corp.nts-ecorp.mydns.bz
n-corp.nts-govkr.mydns.vc
n-corp.nts-masterdoc.mydns.bz
n-store.ips-ecall.mydns.vc
n-store.ips-govkr.mydns.bz
n-store.ips-invoicestore.mydns.vc
n-store.ips-nidecall.mydns.vc
n-store.ips-nidlg.mydns.bz
n-store.ips-notice.mydns.bz
n-store.ipstore.mydns.bz
n-store.nauth-nts.mydns.vc
n-store.nidinvoice-ips.mydns.bz
n-store.nts-calledoc.dynv6.net
n-store.nts-nidlogin.dynv6.net
n-store.nts-taxkr.mydns.vc
n-store.ntsml-auth.mydns.vc
n-store.tax-auth.dynv6.net
nauth-nts.mydns.vc
naver.liferod.com
nid-naverirl.servegame.com
nid-naverpqw.onthewifi.com
nid-user.ips-ecall.mydns.vc
nid-user.ips-govkr.mydns.bz
nid-user.ips-nidecall.mydns.vc
nid-user.ips-notice.mydns.bz
nid-user.nauth-ips.mydns.vc
nid-user.nts-govkr.mydns.vc
nid-user.nts-masterdoc.mydns.bz
nid-user.nts-nidlog.mydns.jp
nid-user.nts-nidlogin.dynv6.net
nid-user.ntsml-auth.mydns.vc
nid.naver.liferod.com
nidinvoice-ips.mydns.bz
nts-auth.dns.army
nts-calledoc.dynv6.net
nts-ecorp.mydns.bz
nts-helper.mydns.bz
nts-helper.mydns.jp
nts-masterdoc.mydns.bz
nts-nidlog.mydns.jp
nts-nidlogin.dynv6.net
nts-nidstore.mydns.jp
nts-nidstore.mydns.vc
nts-taxkr.mydns.vc
ntsml-auth.mydns.vc
ntstax-go.mydns.jp
nuser-login.ips-ecall.mydns.vc
nuser-login.ips-nidecall.mydns.vc
nuser-login.ips-nidlg.mydns.bz
nuser-login.nauth-ips.mydns.vc
nuser-login.nauth-nts.mydns.vc
nuser-login.nts-calledoc.dynv6.net
nuser-login.nts-govkr.mydns.vc
nuser-login.nts-helper.mydns.bz
nuser-login.nts-nidstore.mydns.vc
nuser-login.ntsml-auth.mydns.vc
nuserauth.mydns.jp
oq7n2.dynv6.net
tax-auth.dynv6.net
tax-gokr.mydns.jp
user-nid.nts-masterdoc.mydns.bz

# Reference: https://x.com/skocherhan/status/2032672115405554035

an.ndoc-hometax.mydns.bz
an.nkdoc-hometax.mydns.bz
andoc-home.mydns.jp
bn.nkdoc-hometax.mydns.bz
bn.nwdoc-hometax.mydns.bz
cn.eldoc-hometax.mydns.bz
cn.eodoc-hometax.mydns.bz
cn.indoc-hometax.mydns.bz
cn.inyoiurnfo.mydns.bz
cn.nldoc-hometax.mydns.jp
dn.ewdoc-hometax.mydns.bz
dn.icolncfim.mydns.bz
dn.mmdoc-hometax.mydns.bz
dn.mtdoc-hometax.mydns.bz
eldoc-hometax.mydns.bz
eodoc-hometax.mydns.bz
ewdoc-hometax.mydns.bz
icolncfim.mydns.bz
indoc-hometax.mydns.bz
ledoc-hometax.wjg.jp
lidocs-hometax.wjg.jp
lkdoc-hometax.mydns.bz
lldoc-hometax.mydns.jp
lmdoc-hometax.mydns.bz
lndoc-home.mydns.jp
lpdoc-home.mydns.bz
lpdocument-home.mydns.bz
lwdoc-hometax.wjg.jp
medoc-hometax.mydns.bz
mmdoc-hometax.mydns.bz
mtdoc-hometax.mydns.bz
navemainse.mydns.jp
ndoc-hometax.mydns.bz
nedoc-hometax.mydns.jp
nkdoc-hometax.mydns.bz
nldoc-home.mydns.jp
nldoc-hometax.mydns.jp
nmdoc-hometax.mydns.bz
nndoc-home.mydns.jp
nodoc-hometax.mydns.bz
npdoc-home.mydns.bz
nwdoc-hometax.mydns.bz

# Reference: https://x.com/smica83/status/2032707038770315606
# Reference: https://tria.ge/260314-jtdlgsaz8v/behavioral1

/brandonleeodd93-blip/doc7/
/brandonleeodd93-blip/

# Reference: https://x.com/skocherhan/status/2032602147548696890

article-com.eu

# Reference: https://x.com/skocherhan/status/2032603246888427844

check-self.o-r.kr
binfo.cert-dns.o-r.kr
information.www.check-self.o-r.kr
sec.information.www.check-self.o-r.kr
mt.sec.information.www.check-self.o-r.kr
niduser.mt.sec.information.www.check-self.o-r.kr

# Reference: https://x.com/skocherhan/status/2033300800399888682

4lykpex1me.dynv6.net
97q67g0jlo.dynv6.net
9vbbpmpkkl.dynv6.net
adj.elecdocs.dynv6.net
agdsgw.jdtlwcuprq.dynv6.net
akdocs-hometax.mydns.bz
an.ciliucnck.mydns.bz
an.ekdocs-hometax.mydns.bz
an.esdoc-hometax.mydns.bz
an.esdocument-hometax.mydns.bz
an.icoinecfim.mydns.bz
an.nkdocs-hometax.mydns.bz
an.verninty.mydns.bz
az62lmb01g.dynv6.net
bn.cailiuecnck.mydns.bz
bn.caliuecnck.mydns.bz
bn.ciliucnck.mydns.bz
bn.ciliuecnck.mydns.bz
bn.docs-hometax.mydns.bz
bn.ekdocs-hometax.mydns.bz
bn.idocument-hometax.mydns.bz
bn.n1ilink.mydns.bz
bn.siviliverif.mydns.bz
bn.veraiity.mydns.bz
cailiuecnck.mydns.bz
caliuecnck.mydns.bz
calliteve.mydns.bz
callteve.mydns.bz
ciliteve.mydns.bz
ciliucnck.mydns.bz
ciliuecnck.mydns.bz
cn.cailiuecnck.mydns.bz
cn.caliuecnck.mydns.bz
cn.lwdocs-hometax.wjg.jp
cn.nkdocs-hometax.mydns.bz
cn.nndeeiyou.mydns.bz
cn.siviliverif.mydns.bz
cn.sivilverif.mydns.bz
cn.verninty.mydns.bz
direct.n-cafe.cloud-ip.cc
dn.akdocs-hometax.mydns.bz
dn.eodocs-hometax.mydns.bz
dn.esdocument-hometax.mydns.bz
dn.iiablog.mydns.bz
dn.modocument-hometax.mydns.bz
dn.n1i1link.mydns.bz
dn.nndeeyou.mydns.bz
dn.veraiity.mydns.bz
docs-hometax.mydns.bz
docviews21.dynv6.net
docviews36.dynv6.net
dsfw4e.4lykpex1me.dynv6.net
ebookings.dynv6.net
ebooks.mtomtech.co
edocs.desaindigital.com
edocs.fuzzylookups.com
edocs.zigboxs.com
edocuments.dynv6.net
edocview46.dynv6.net
edocview49.dynv6.net
edocview53.dynv6.net
efine-police-go.p-e.kr
ekdocs-hometax.mydns.bz
elecdocs.dynv6.net
elecviews26.dynv6.net
elecviews43.dynv6.net
elecviews47.dynv6.net
elecviews57.dynv6.net
elecviews62.dynv6.net
elecviews67.dynv6.net
elecviews68.dynv6.net
elecviews69.dynv6.net
elecviews73.dynv6.net
elecviews90.dynv6.net
eledoc.decharacter.com
eodocs-hometax.mydns.bz
esdoc-hometax.mydns.bz
esdocument-hometax.mydns.bz
f23few.az62lmb01g.dynv6.net
g4w5wgea.97q67g0jlo.dynv6.net
hkc.elecdocs.dynv6.net
hsl.elecdocs.dynv6.net
icoinecfim.mydns.bz
idocument-hometax.mydns.bz
ifiailog.mydns.bz
iiablog.mydns.bz
invoice.efine-police-go.p-e.kr
invoices.dynv6.net
ip89.ip-139-99-86.net
isyourinfo.mydns.bz
ityoiurnfo.mydns.bz
j764rff.9vbbpmpkkl.dynv6.net
jdtlwcuprq.dynv6.net
k-invoice.v6.navy
ligllilssyou.mydns.bz
ligllisyou.mydns.bz
load.k-invoice.v6.navy
lwdocs-hometax.wjg.jp
modocument-hometax.mydns.bz
mtdocument-hometax.mydns.bz
mydocs.corporateadworld.com
n-cafe.cloud-ip.cc
n1i1link.mydns.bz
n1ilink.mydns.bz
nad.adworldlog.com
nad.ciliteve.mydns.bz
nad.ifiailog.mydns.bz
nad.invoices.dynv6.net
nad.nldeeyou.mydns.bz
nad.ntolink.mydns.bz
nai.virnity.mydns.bz
naver.adworldlog.com
naver.desaindigital.com
naver.technoreform.com
naverdocs.dynv6.net
nbd.adworldlog.com
nbd.calliteve.mydns.bz
nbd.ityoiurnfo.mydns.bz
nbd.ligllilssyou.mydns.bz
nbd.ligllisyou.mydns.bz
nbd.ntolink.mydns.bz
ncd.callteve.mydns.bz
ncd.ligllilssyou.mydns.bz
ncd.ni11link.mydns.bz
ncd.nldeeyou.mydns.bz
ncrecky.dynv6.net
ndd.adworldlog.com
ndd.ifiailog.mydns.bz
ndd.isyourinfo.mydns.bz
ndd.ityoiurnfo.mydns.bz
ndd.ligllisyou.mydns.bz
ndd.ntolink.mydns.bz
ni11link.mydns.bz
nid-login.police-notice.dns.army
nid.casepractice.com
nid.ebookings.dynv6.net
nid.ebooks.mtomtech.co.kr
nid.edocs.desaindigital.com
nid.edocs.fuzzylookups.com
nid.edocs.zigboxs.com
nid.eledoc.decharacter.com
nid.liferod.com
nid.mydocs.corporateadworld.com
nid.naver.adworldlog.com
nid.naver.desaindigital.com
nid.naver.technoreform.com
nid.naverdocs.dynv6.net
nid.user-line.dynv6.net
nidd.ncrecky.dynv6.net
nids27.dynv6.net
nids29.dynv6.net
nids30.dynv6.net
nids33.dynv6.net
nids53.dynv6.net
nids67.dynv6.net
nkdocs-hometax.mydns.bz
nldeeyou.mydns.bz
nndeeiyou.mydns.bz
nndeeyou.mydns.bz
ntolink.mydns.bz
nts.taxmenu.dynv6.net
police-notice.dns.army
rewy45yw.dynv6.net
rty4he.rewy45yw.dynv6.net
siviliverif.mydns.bz
sivilverif.mydns.bz
support.swatsupported.dns.army
swatsupported.dns.army
taxmenu.dynv6.net
unw.elecdocs.dynv6.net
user-line.dynv6.net
veraiity.mydns.bz
verninty.mydns.bz
virnity.mydns.bz
xno.elecdocs.dynv6.net
xsc.elecdocs.dynv6.net
ycx.elecdocs.dynv6.net
ziz.edocuments.dynv6.net

# Reference: https://x.com/skocherhan/status/2033295431657025869

naver.casepractice.com
naver.corporateadworld.com
naver.techartsserver.com
nid.naver.casepractice.com
nid.naver.corporateadworld.com
nid.naver.techartsserver.com

# Reference: https://x.com/skocherhan/status/2033638998049202393

docviews1.dynv6.net
docviews11.dynv6.net
docviews12.dynv6.net
docviews13.dynv6.net
docviews14.dynv6.net
docviews15.dynv6.net
docviews16.dynv6.net
docviews17.dynv6.net
docviews18.dynv6.net
docviews19.dynv6.net
docviews2.dynv6.net
docviews20.dynv6.net
docviews22.dynv6.net
docviews23.dynv6.net
docviews24.dynv6.net
docviews25.dynv6.net
docviews26.dynv6.net
docviews27.dynv6.net
docviews28.dynv6.net
docviews3.dynv6.net
docviews30.dynv6.net
docviews31.dynv6.net
docviews32.dynv6.net
docviews33.dynv6.net
docviews34.dynv6.net
docviews35.dynv6.net
docviews37.dynv6.net
docviews38.dynv6.net
docviews39.dynv6.net
docviews4.dynv6.net
docviews40.dynv6.net
docviews41.dynv6.net
docviews42.dynv6.net
docviews43.dynv6.net
docviews44.dynv6.net
docviews45.dynv6.net
docviews46.dynv6.net
docviews47.dynv6.net
docviews48.dynv6.net
docviews49.dynv6.net
docviews5.dynv6.net
docviews50.dynv6.net
docviews51.dynv6.net
docviews52.dynv6.net
docviews53.dynv6.net
docviews54.dynv6.net
docviews55.dynv6.net
docviews56.dynv6.net
docviews57.dynv6.net
docviews58.dynv6.net
docviews59.dynv6.net
docviews6.dynv6.net
docviews60.dynv6.net
docviews61.dynv6.net
docviews62.dynv6.net
docviews63.dynv6.net
docviews64.dynv6.net
docviews65.dynv6.net
docviews66.dynv6.net
docviews67.dynv6.net
docviews68.dynv6.net
docviews69.dynv6.net
docviews7.dynv6.net
docviews70.dynv6.net
docviews71.dynv6.net
docviews73.dynv6.net
docviews74.dynv6.net
docviews8.dynv6.net
docviews9.dynv6.net
docviews91.dynv6.net
edocview1.dynv6.net
edocview10.dynv6.net
edocview11.dynv6.net
edocview12.dynv6.net
edocview13.dynv6.net
edocview14.dynv6.net
edocview15.dynv6.net
edocview16.dynv6.net
edocview17.dynv6.net
edocview18.dynv6.net
edocview19.dynv6.net
edocview2.dynv6.net
edocview20.dynv6.net
edocview21.dynv6.net
edocview22.dynv6.net
edocview23.dynv6.net
edocview24.dynv6.net
edocview25.dynv6.net
edocview26.dynv6.net
edocview27.dynv6.net
edocview28.dynv6.net
edocview29.dynv6.net
edocview3.dynv6.net
edocview30.dynv6.net
edocview31.dynv6.net
edocview32.dynv6.net
edocview33.dynv6.net
edocview34.dynv6.net
edocview35.dynv6.net
edocview36.dynv6.net
edocview37.dynv6.net
edocview39.dynv6.net
edocview4.dynv6.net
edocview40.dynv6.net
edocview41.dynv6.net
edocview42.dynv6.net
edocview45.dynv6.net
edocview47.dynv6.net
edocview5.dynv6.net
edocview51.dynv6.net
edocview52.dynv6.net
edocview54.dynv6.net
edocview55.dynv6.net
edocview6.dynv6.net
edocview7.dynv6.net
edocview8.dynv6.net
edocview9.dynv6.net
elecviews17.dynv6.net
elecviews18.dynv6.net
elecviews20.dynv6.net
elecviews21.dynv6.net
elecviews22.dynv6.net
elecviews23.dynv6.net
elecviews24.dynv6.net
elecviews25.dynv6.net
elecviews27.dynv6.net
elecviews28.dynv6.net
elecviews29.dynv6.net
elecviews30.dynv6.net
elecviews31.dynv6.net
elecviews32.dynv6.net
elecviews33.dynv6.net
elecviews34.dynv6.net
elecviews35.dynv6.net
elecviews36.dynv6.net
elecviews37.dynv6.net
elecviews38.dynv6.net
elecviews39.dynv6.net
elecviews40.dynv6.net
elecviews41.dynv6.net
elecviews42.dynv6.net
elecviews44.dynv6.net
elecviews45.dynv6.net
elecviews46.dynv6.net
elecviews48.dynv6.net
elecviews49.dynv6.net
elecviews50.dynv6.net
elecviews51.dynv6.net
elecviews52.dynv6.net
elecviews53.dynv6.net
elecviews54.dynv6.net
elecviews55.dynv6.net
elecviews56.dynv6.net
elecviews59.dynv6.net
elecviews61.dynv6.net
elecviews63.dynv6.net
elecviews64.dynv6.net
elecviews65.dynv6.net
elecviews70.dynv6.net
elecviews74.dynv6.net
elecviews76.dynv6.net
elecviews77.dynv6.net
elecviews78.dynv6.net
elecviews79.dynv6.net
elecviews8.dynv6.net
elecviews80.dynv6.net
elecviews81.dynv6.net
elecviews82.dynv6.net
elecviews83.dynv6.net
elecviews84.dynv6.net
elecviews86.dynv6.net
elecviews87.dynv6.net
elecviews89.dynv6.net
elecviews91.dynv6.net
elecviews92.dynv6.net
elecviews93.dynv6.net
elecviews94.dynv6.net
elecviews95.dynv6.net
elecviews96.dynv6.net
elecviews97.dynv6.net
elecviews98.dynv6.net
elecviews99.dynv6.net
join17s.dynv6.net
join19s.dynv6.net
join39s.dynv6.net
join41s.dynv6.net
join44s.dynv6.net
join49s.dynv6.net
join78s.dynv6.net
join93s.dynv6.net
myblog14s.dynv6.net
myblog16s.dynv6.net
myblog24s.dynv6.net
myblog40s.dynv6.net
myblog49s.dynv6.net
myblog57s.dynv6.net
myblog7s.dynv6.net
myblog87s.dynv6.net
myblog91s.dynv6.net
myblog95s.dynv6.net
nids0.dynv6.net
nids10.dynv6.net
nids11.dynv6.net
nids12.dynv6.net
nids14.dynv6.net
nids17.dynv6.net
nids19.dynv6.net
nids21.dynv6.net
nids25.dynv6.net
nids38.dynv6.net
nids41.dynv6.net
nids48.dynv6.net
nids49.dynv6.net
nids5.dynv6.net
nids55.dynv6.net
nids58.dynv6.net
nids59.dynv6.net
nids61.dynv6.net
nids62.dynv6.net
nids7.dynv6.net
nids73.dynv6.net
nids77.dynv6.net
nids80.dynv6.net
nids95.dynv6.net
note4.dns.army
police16s.dynv6.net
police17s.dynv6.net
police21s.dynv6.net
police39s.dynv6.net
police41s.dynv6.net
police58s.dynv6.net
police63s.dynv6.net
police79s.dynv6.net
police7s.dynv6.net
police84s.dynv6.net
police88s.dynv6.net
police93s.dynv6.net
police94s.dynv6.net
police98s.dynv6.net
taxes4.dynv6.net
taxes5.dynv6.net
taxes6.dynv6.net
taxes9.dynv6.net

# Reference: https://x.com/skocherhan/status/2034121930001826258

an.dpsipes.dns.army
an.ipsnvep.dns.army
an.ntsotp.dns.army
anav.ntxhosts.dns.army
bn.ntsotp.dns.army
bnav.ntxhosts.dns.army
ccnpart.kro.kr
cn.cofipdo.dns.army
cn.ipsnvlep.dns.army
cnav.htxcpy.dns.army
cnav.ntxhosts.dns.army
cofipdo.dns.army
com-account.dns.army
dn.ipsnvep.dns.army
dn.ipsnvlep.dns.army
dn.ntxals.dns.army
dnav.htxcpy.dns.army
dnav.ntxhosts.dns.army
doc-ips.dns.navy
dpsipes.dns.army
drive.ccnpart.kro.kr
edocesnavs.dynv6.net
en.ntopeds.dns.army
en.ntsotp.dns.army
enav.ntxthom.dns.army
htxcpy.dns.army
ipscorped.dynv6.net
ipsnvep.dns.army
ipsnvlep.dns.army
kakao.com-account.dns.army
moisalap.dns.navy
moisnoticed.dns.army
napses.dns.army
nav-logins.ipscorped.dynv6.net
nav-logins.ntdinvocie.dns.army
navedtops.dns.army
navlogs.moisalap.dns.navy
navorlogins.doc-ips.dns.navy
navps.dns.army
navripses.dns.army
navrrps.dns.army
navs.an.dpsipes.dns.army
navs.cn.cofipdo.dns.army
navs.dn.ntxals.dns.army
navs.en.ntopeds.dns.army
navs.moisnoticed.dns.army
navs.navedtops.dns.army
navs.navps.dns.army
navs.navripses.dns.army
navs.nedotps.dns.navy
ndocs.an.ntsotp.dns.army
ndocs.navrrps.dns.army
nedotps.dns.navy
nesever.an.ntsotp.dns.army
nesever.bn.ntsotp.dns.army
nesever.navrrps.dns.army
nid-login.ipscorped.dynv6.net
nid-login.ntdinvocie.dns.army
nid-naverhoc.onthewifi.com
nid-naverpep.servequake.com
nid-naveruiw.servegame.com
nid-servers.doc-ips.dns.navy
nid-service.nvctop.dynv6.net
nid.cn.ipsnvlep.dns.army
nid.dn.ipsnvep.dns.army
nid.dnav.htxcpy.dns.army
nid.dnav.ntxhosts.dns.army
nid.enav.ntxthom.dns.army
nid.navps.dns.army
nid.navripses.dns.army
nida.edocesnavs.dynv6.net
nida.ipscorped.dynv6.net
nida.ntdinvocie.dns.army
nides.moisalap.dns.navy
nidloes.an.ipsnvep.dns.army
nidloes.cnav.htxcpy.dns.army
nidloes.cnav.ntxhosts.dns.army
nidloes.dn.ipsnvlep.dns.army
nidloes.napses.dns.army
nidloes.navedtops.dns.army
nidloes.navps.dns.army
nidloes.navripses.dns.army
nidlogins.bnav.ntxhosts.dns.army
nidlogins.dn.ntxals.dns.army
nidlogins.dnav.ntxhosts.dns.army
nidlogins.moisnoticed.dns.army
nidlogins.navedtops.dns.army
nidlogins.navps.dns.army
nids.anav.ntxhosts.dns.army
nids.bnav.ntxhosts.dns.army
nids.dnav.ntxhosts.dns.army
nids.ipscorped.dynv6.net
nids.moisalap.dns.navy
nids.moisnoticed.dns.army
nids.navedtops.dns.army
nids.navps.dns.army
nids.navripses.dns.army
nids.nedotps.dns.navy
nids.ntdinvocie.dns.army
nidserver.navrrps.dns.army
nidservers.ipscorped.dynv6.net
nidservers.ntdinvocie.dns.army
ninvoce.bn.ntsotp.dns.army
ninvoce.navrrps.dns.army
ntdinvocie.dns.army
ntopeds.dns.army
nts.bn.ntsotp.dns.army
nts.en.ntsotp.dns.army
nts.navrrps.dns.army
ntsotp.dns.army
ntxals.dns.army
ntxhosts.dns.army
ntxthom.dns.army
nvctop.dynv6.net
random_switch.navripses.dns.army

# Reference: https://x.com/skocherhan/status/2033994044393627913

accountuquery.kro.kr
accountverification.kro.kr
changepaymentoption.kro.kr
checkoptionview.kro.kr
combookmark.kro.kr
deliverymailsvc.kro.kr
global.homeandroid.kro.kr
globalpayment.kro.kr
homeandroid.kro.kr
info.severalrule.kro.kr
invoice.uncork.biz
jser.billmatedoc.mydns.bz
linkyoursecurity.kro.kr
loein.usrdeleteservice.kro.kr
login.usernormalsvc.kro.kr
mail.nhistargetlink.cloud-ip.cc
node.combookmark.kro.kr
node.onelinesvcads.kro.kr
node.paymentglobalserver.kro.kr
node.usermadver.kro.kr
onelinesvcads.kro.kr
paymentglobalserver.kro.kr
retry.globalpayment.kro.kr
security.accountuquery.kro.kr
service.deliverymailsvc.kro.kr
service.linkyoursecurity.kro.kr
severalrule.kro.kr
size.accountverification.kro.kr
usermadver.kro.kr
usernormalsvc.kro.kr
usrcorps.kro.kr
verify.changepaymentoption.kro.kr
view.checkoptionview.kro.kr

# Reference: https://x.com/skocherhan/status/2034368941468889253

nid-mail.o-r.kr
dns-sign.www.nid-mail.o-r.kr

# Reference: https://x.com/skocherhan/status/2034374861640884723

naverr.email
npost-dns.com

# Reference: https://x.com/skocherhan/status/2034366890043126077

join54s.dynv6.net
myblog2s.dynv6.net
myblog78s.dynv6.net
online98s.dynv6.net
search38s.dynv6.net

# Reference: https://x.com/skocherhan/status/2034373020215607498

nid-naver-login.com

# Reference: https://x.com/skocherhan/status/2034355534518694287

akdocument-hometax.mydns.bz
aldocument-home.mydns.jp
amdocument-hometax.mydns.bz
an.nwdocument-hometax.mydns.bz
aodocument-hometax.mydns.bz
atdocument-hometax.mydns.jp
ledocument-hometax.wjg.jp
lidocument-hometax.wjg.jp
lkdocument-hometax.mydns.bz
lldocument-home.mydns.jp
lmdocument-hometax.mydns.bz
lndocument-home.mydns.jp
medocument-hometax.mydns.bz
midocument-hometax.mydns.bz
mkdocument-hometax.mydns.bz
mpdocument-home.mydns.bz
nidocument-hometax.mydns.bz
nldocument-home.mydns.jp
nmdocument-hometax.mydns.bz
nndocument-home.mydns.jp
nodocument-hometax.mydns.bz
ntdocument-hometax.mydns.jp
nwdocument-hometax.mydns.bz

# Reference: https://x.com/skocherhan/status/2034778424170946657

admin.check-user.kro.kr
cert.abrdns.com
changephone.v6.navy
check-invoice.dns.navy
check-spo.kro.kr
check-user.kro.kr
check.cert.abrdns.com
check.traffice-safe.dns.navy
confirm.tax-deliver.v6.navy
contactinfo.v6.navy
corona.koreahealth.dns.navy
daehanpolice.dns.army
directpolice.healthorg.abrdns.com
docs-traff.v6.navy
dynamicdepinvoice.abrdns.com
e-document.dns.navy
efine-gov.dns.army
efine-kor.dns.army
goegle-auth.kro.kr
gov-docs.dns.navy
green-traffic.dynv6.net
healthorg.abrdns.com
hello0dns.kro.kr
help.nv-help.dynv6.net
help.policeinvoice.dns.army
help.swatpolicy.dns.army
helppolice.dynv6.net
hometax.dns.navy
htax-store.dns.navy
invoice-doc.v6.rocks
invoice.accesscam.org
invoice.check-spo.kro.kr
invoice.p0licehelp.v6.navy
invoice.policeinvoice.dns.army
invoice.rep32-tax.dns.army
justicefirm.dynv6.net
korea-traffic.dns.army
koreahealth.dns.navy
koreapay.v6.rocks
kro-cert.kro.kr
lawfirm.v6.rocks
laworgan.v6.navy
login.nid-verify.v6.rocks
mail-deliver.v6.rocks
mail.green-traffic.dynv6.net
missed-tax.v6.rocks
mtnvs.dynv6.net
n-cloud.htax-store.dns.navy
naverpayhistory.koreapay.v6.rocks
ndoc-deliver.dynv6.net
nid-auth.v6.navy
nid-traffic.v6.rocks
nid-user.tax-loadoc.dns.army
nid-verify.v6.rocks
nid.police-notice-go.kro.kr
ninfo.dynamicdepinvoice.abrdns.com
nis-24.v6.rocks
note-tx.dns.army
npaylog.healthorg.abrdns.com
ntsncorp.dynv6.net
nv-help.dynv6.net
p0licehelp.v6.navy
p0liceinvoice.dns.army
poc-doc24.dns.army
poli-doc24.v6.navy
police-notice-go.kro.kr
police-notify.dns.navy
police-of-traffic.dynv6.net
police.webredirect.org
policedoc.kozow.com
policehelp.dns.army
policeinvoice.dns.army
policesupport.dynv6.net
pueg.hello0dns.kro.kr
red-traffic.dns.navy
rep32-tax.dns.army
safe-driving.v6.rocks
safe-travel.v6.rocks
safe24.dns.navy
seoulpolice.dynv6.net
service.goegle-auth.kro.kr
support.policeinvoice.dns.army
support.traffic-police24.v6.rocks
swatpolicy.dns.army
t-get.dns.army
targetpolice.dns.army
tax-check.dns.army
tax-deliver.v6.navy
tax-guide.dns.army
tax-loadoc.dns.army
tax.ooguy.com
traffic-mail.dynv6.net
traffic-police.dns.army
traffic-police24.v6.rocks
traffic.safe-travel.v6.rocks
traffice-safe.dns.navy
ugent-doc.dynv6.net
urgent.swatpolicy.dns.army
verify.kro-cert.kro.kr

# Reference: https://x.com/skocherhan/status/2035212493694406693

aumyjk9jxc.dns.army
block.usermemberblg.freeddns.org
cheerupkorea.com
datasetdoc.mydns.bz
hgfhfj.ddnsfree.com
info.user.ipsdelivercheck.dynv6.net
investinfdoc.mydns.bz
invoice.datasetdoc.mydns.bz
invoice.memberlogcheck.mydns.bz
invoicedoc-nts.dynv6.net
ips-invoicestore.dynv6.net
ipsdelivercheck.dynv6.net
ipsncorp.dns.navy
memberlogcheck.mydns.bz
n-cloud.invoicedoc-nts.dynv6.net
n-store.invoicedoc-nts.dynv6.net
n-store.noticekr-ips.dynv6.net
n-store.nts-nidinvoce.dynv6.net
n-store.ntx-nav.dynv6.net
ncodbspass.dynv6.net
ndocacverify.dynv6.net
ndocadcheck.dynv6.net
ndocaeverify.dynv6.net
ndocafverify.dynv6.net
ndocagpass.dynv6.net
ndocagverify.dynv6.net
ndocahverify.dynv6.net
ndocaipass.dynv6.net
ndocajpass.dynv6.net
ndocakpass.dynv6.net
ndocakverify.dynv6.net
ndocalpass.dynv6.net
ndocalverify.dynv6.net
ndocampass.dynv6.net
ndocamverify.dynv6.net
ndocaopass.dynv6.net
ndocaoverify.dynv6.net
ndocappass.dynv6.net
ndocapverify.dynv6.net
ndocaqpass.dynv6.net
ndocaqverify.dynv6.net
ndocarverify.dynv6.net
ndocasverify.dynv6.net
nid-ntsdoc.dynv6.net
nid-user.ipsncorp.dns.navy
nid.ndocaqverify.dynv6.net
nida.service-relay.dedyn.io
noticekr-ips.dynv6.net
nts-nidinvoce.dynv6.net
ntx-nav.dynv6.net
nuser-login.invoicedoc-nts.dynv6.net
nuser-login.ips-invoicestore.dynv6.net
nuser-login.nid-ntsdoc.dynv6.net
service-relay.dedyn.io
usermemberblg.freeddns.org
usr.investinfdoc.mydns.bz

# Reference: https://x.com/skocherhan/status/2035113201680122080

netelecviews33.dynv6.net
pull16s.dynv6.net
search1s.dynv6.net
search20s.dynv6.net
search39s.dynv6.net
search62s.dynv6.net
search64s.dynv6.net
search75s.dynv6.net
search88s.dynv6.net

# Reference: https://www.virustotal.com/gui/ip-address/123.58.200.69/relations

checkidentity.dynv6.net
chkidentity.mydns.bz
naildoc.abrdns.com
nhdisplaygoji.mydns.bz
nhp-usrcorp.dynv6.net
nloadpaydoc.mydns.bz
ntaddrlist.mydns.bz
ntl-memberlist.mydns.bz
uidentitycorp.dynv6.net
userdirectlog.mydns.bz
docid.naildoc.abrdns.com
edoc.chkidentity.mydns.bz
edoc.naildoc.abrdns.com
edoc.nloadpaydoc.mydns.bz
edoc.uidentitycorp.dynv6.net
nid.chkidentity.mydns.bz
nid.naildoc.abrdns.com
ninvoice.naildoc.abrdns.com
randstring.uidentitycorp.dynv6.net

# Reference: https://x.com/skocherhan/status/2035848460016971802

059879e5-b2e8-4f58-aa46-95f69d92aa34.random.voranstaks.shop
185-93-6-134.netherlands-2.vps.ac
952cd7f5-55c2-472f-bc9d-08487ef75661.random.voranstaks.shop
accessory.r-e.kr
acdfoei.xn--9i1b01onwqqzd.xn--3e0b707e
adtzfyogarp.xn--hu5b25b77nvwc.xn--3e0b707e
airspacehome.shop
airtunnelhouse.shop
anonmixer.io
apoitdtdgbxb.xn--h32bi4v.xn--3e0b707e
autographfree.shop
autopilots.shop
azwcyrsdqyhwn.xn--h32bi4v.xn--3e0b707e
babyhouse.xn--2i0b10rqve.xn--3e0b707e
backanalysis.cyou
backwardcompatibility.sbs
balabala.xn--h32bi4v.xn--3e0b707e
bdjksoe.xn--yq5b.xn--3e0b707e
behavioralanalysis.cyou
beneficialpartnership.space
benevolentleadership.sbs
bhzxmnlqtgkefi.xn--yq5b.xn--3e0b707e
biodegradableplastic.space
birdhomeapp.shop
bismarkets.xn--hu5b25b77nvwc.xn--3e0b707e
bkggadmvavvcg.xn--hk3b17f.xn--3e0b707e
blockbusterrelease.cfd
bqvtzljmefukwo.xn--hu5b25b77nvwc.xn--3e0b707e
broadmindedthinker.website
brzviuqqrohsl.xn--h32bi4v.xn--3e0b707e
bzkweizbjlqchmy.xn--9i1b01onwqqzd.xn--3e0b707e
bzuntral.xn--9i1b01onwqqzd.xn--3e0b707e
clagwtnymiidgt.r-e.kr
cloudealsim.shop
comeonever.site
compartmentalized.sbs
cqipiadigoyzo.xn--h32bi4v.xn--3e0b707e
customizability.sbs
cvxrboujlsnpki.xn--2i0b10rqve.xn--3e0b707e
cxqdzkfgkmk.r-e.kr
cxvemippatvetn.kro.kr
czqwhmdx.xn--hk3b17f.xn--3e0b707e
dechlorinationists.cyou
decontaminationship.cfd
decriminalizations.store
despendclaim.com
discombobulationsly.sbs
disenfranchisements.space
disillusionmenting.boats
dkvyrmbzbnyl.xn--h32bi4v.xn--3e0b707e
dockplaygate.beauty
dpfsuxuaxdkacwqq.xn--oi2b61z32a.xn--3e0b707e
dvlqwzfmps.xn--9i1b01onwqqzd.xn--3e0b707e
dyqfsjmvpbkh.xn--hu5b25b77nvwc.xn--3e0b707e
eagleskyking.cfd
ebwlhfeesfr.xn--2i0b10rqve.xn--3e0b707e
ecwzhtxcgmwhgboc.xn--yq5b.xn--3e0b707e
edgwjzahpprymw.xn--h32bi4v.xn--3e0b707e
eggalone.boats
ehpagovzxyd.xn--hu5b25b77nvwc.xn--3e0b707e
ejpfypgxpsuxwen.o-r.kr
electroencephalogram.sbs
emv1.intelhouse.shop
emv1.saintmario.shop
environmentalistically.cyou
epidemiologically.cfd
epvrdiblztywyxql.xn--9i1b01onwqqzd.xn--3e0b707e
establishclassroom.cyou
establishmentarianism.boats
euvskybzntml.p-e.kr
exceptionalistically.space
experimentationalism.website
expressgolfstar.sbs
extemporaneousnesses.beauty
exzbpurjophbwft.p-e.kr
eyhaboktjrer.n-e.kr
gquxdljhmrsa.xn--oi2b61z32a.xn--3e0b707e
gtsdtwzdwfo.xn--oi2b61z32a.xn--3e0b707e
hlvoaswlajfeq.r-e.kr
hvrmaqopnpvqcnzi.o-r.kr
intelhouse.shop
irykiixdfztqy.r-e.kr
izmlmkqbxqcqdjq.xn--2i0b10rqve.xn--3e0b707e
jbulshyofqhhqdk.n-e.kr
jlirftlfeerq.r-e.kr
jmrdxqzhytwplko.o-r.kr
jmspujpagmazvm.xn--9i1b01onwqqzd.xn--3e0b707e
jmtiqeaxodho.xn--h32bi4v.xn--3e0b707e
jsrkhvjmbxlhy.xn--hk3b17f.xn--3e0b707e
jzmhlklzrpidvejr.xn--yq5b.xn--3e0b707e
jzwillyjdpxfircb.xn--h32bi4v.xn--3e0b707e
kingwisecell.store
kolxyxeuvzkch.xn--2i0b10rqve.xn--3e0b707e
kopwjxlnkfrzq.xn--hu5b25b77nvwc.xn--3e0b707e
krlpziqtwkej.kro.kr
kwenxkmlhjf.n-e.kr
lopdejklaige.r-e.kr
luhxjjczurutd.r-e.kr
lzvogdghompwsx.kro.kr
m.establishclassroom.cyou
m.extemporaneousnesses.beauty
mail.naversec.online
mail.naverus.online
mdsqymsvvgaiq.xn--9i1b01onwqqzd.xn--3e0b707e
mfgymunpujyfsq.xn--hu5b25b77nvwc.xn--3e0b707e
mlhmoyidmbhggxgb.xn--yq5b.xn--3e0b707e
mlmzhmtukadctfcq.r-e.kr
mnaever.com
mngjaunnsuo.o-r.kr
mpinrzunoqxcixq.r-e.kr
mqvnrjhcekx.kro.kr
muikjzvpoudze.p-e.kr
mvrhjqplkxdsmow.r-e.kr
myawifmndhhfff.p-e.kr
naverapp.site
naverme.online
naversec.online
naverus.online
nbeynuvaaqit.n-e.kr
nbqksjzrhmptlxa.n-e.kr
ndvcikpjnnc.o-r.kr
ngvqtuukrumgx.p-e.kr
ngybdgavuaqu.r-e.kr
nid.naverus.online
nkcbtrpzwyawk.kro.kr
nkdmlzhrjqwtvsa.p-e.kr
ns2.intelhouse.shop
nsxginpbeieswv.p-e.kr
online-edu-course.online
online.paperview.kro.kr
ovdlktdrysrwvxjq.xn--oi2b61z32a.xn--3e0b707e
pktpyetxyir.xn--oi2b61z32a.xn--3e0b707e
pwzqcrjtkhlpymao.xn--hu5b25b77nvwc.xn--3e0b707e
qxroevhjlwqtsfda.r-e.kr
random.voranstaks.shop
rexhuteqjtqxalhj.r-e.kr
saintmario.shop
serviceassistcenter.com
sibnwuglggqfqk.xn--hk3b17f.xn--3e0b707e
sjvtzdfflwrvq.xn--hu5b25b77nvwc.xn--3e0b707e
spaceoutskate.store
sqxgdkijmcjg.xn--hu5b25b77nvwc.xn--3e0b707e
static.anonmixer.io
sunriseall.shop
syiwrsgnwpp.xn--yq5b.xn--3e0b707e
uguwilbybxchilx.xn--yq5b.xn--3e0b707e
uhhpumqhcucrfeuu.xn--h32bi4v.xn--3e0b707e
ulvfeqestfuimbq.p-e.kr
usgmqtekypr.o-r.kr
uvcnxtzakim.r-e.kr
uxqpyxnvxvf.r-e.kr
vnsfqtluvpkgd.r-e.kr
voranstaks.shop
weww.naversec.online
wigkbxriiwfjsu.o-r.kr
wiwqyveoxwyq.r-e.kr
xzukfliumlgjv.r-e.kr
ynwttphhhpy.xn--hu5b25b77nvwc.xn--3e0b707e
yvjgadvskyutad.o-r.kr
yxakmjrpznyscsas.xn--h32bi4v.xn--3e0b707e

# Reference: https://x.com/malwrhunterteam/status/2036158996554637591
# HEADER_HASH-HOST=f301eb4abaf0d5278126

1drivenet.site
aihurger.lol
arraybooster.space
at1anticcouncil.org
atlanticcouncil.us02web.online
authlobby.site
bestporn.buzz
btmnl.ink
burisa.space
caginoff.online
debegegusivu.online
docsnews.pro
drawsub.center
eastasiagroup.online
eninpasula.shop
euratu.space
expireddomain.store
faturu.store
federen.site
gamblecoin.store
gordoner.store
guysings.site
hatana.site
hemini.site
hironu.site
koreatimes.pro
kucoman.online
kyodonews.us
minbuza.site
mschkc.space
mt4tools.com
nagawa.space
ndu.wiki
nzzone.org
osmenevac.store
princetom.store
princeton.us02web.online
pubano.pro
qugesr.online
quickcon.store
quncyinst.site
racswera.online
raesing.online
rasumi.site
rukomu.space
seribumasuk.com
sharefiles365.online
siignet.store
smartwolf.site
sneke.site
soft-til.space
spulunk.it.com
stimson.shop
thedispatch.online
thehomes.online
tumoko.store
ultromero.online
us02web.online
vertics.org
voidsmilensk.shop
whaincloud.store
whineglobals.store
yourunclaimedmoney.us
yurigo.xyz
zoommet.site

# Reference: https://x.com/skocherhan/status/2036427645370441731

fetch10s.dynv6.net
fetch11s.dynv6.net
fetch12s.dynv6.net
fetch13s.dynv6.net
fetch14s.dynv6.net
fetch15s.dynv6.net
fetch16s.dynv6.net
fetch17s.dynv6.net
fetch18s.dynv6.net
fetch19s.dynv6.net
fetch1s.dynv6.net
fetch20s.dynv6.net
fetch21s.dynv6.net
fetch22s.dynv6.net
fetch23s.dynv6.net
fetch25s.dynv6.net
fetch29s.dynv6.net
fetch2s.dynv6.net
fetch30s.dynv6.net
fetch31s.dynv6.net
fetch33s.dynv6.net
fetch34s.dynv6.net
fetch39s.dynv6.net
fetch3s.dynv6.net
fetch40s.dynv6.net
fetch41s.dynv6.net
fetch42s.dynv6.net
fetch43s.dynv6.net
fetch44s.dynv6.net
fetch45s.dynv6.net
fetch46s.dynv6.net
fetch47s.dynv6.net
fetch48s.dynv6.net
fetch49s.dynv6.net
fetch4s.dynv6.net
fetch50s.dynv6.net
fetch51s.dynv6.net
fetch52s.dynv6.net
fetch53s.dynv6.net
fetch54s.dynv6.net
fetch55s.dynv6.net
fetch56s.dynv6.net
fetch57s.dynv6.net
fetch58s.dynv6.net
fetch59s.dynv6.net
fetch5s.dynv6.net
fetch60s.dynv6.net
fetch61s.dynv6.net
fetch62s.dynv6.net
fetch63s.dynv6.net
fetch64s.dynv6.net
fetch65s.dynv6.net
fetch66s.dynv6.net
fetch67s.dynv6.net
fetch68s.dynv6.net
fetch69s.dynv6.net
fetch6s.dynv6.net
fetch70s.dynv6.net
fetch71s.dynv6.net
fetch72s.dynv6.net
fetch73s.dynv6.net
fetch74s.dynv6.net
fetch75s.dynv6.net
fetch76s.dynv6.net
fetch77s.dynv6.net
fetch78s.dynv6.net
fetch79s.dynv6.net
fetch80s.dynv6.net
fetch81s.dynv6.net
fetch82s.dynv6.net
fetch87s.dynv6.net
fetch89s.dynv6.net
fetch8s.dynv6.net
fetch90s.dynv6.net
fetch92s.dynv6.net
fetch93s.dynv6.net
fetch94s.dynv6.net
fetch95s.dynv6.net
fetch97s.dynv6.net
fetch9s.dynv6.net
try45s.dynv6.net

# Reference: https://x.com/skocherhan/status/2036478912583053652

nldlg.dynv6.net
ntx-store.dynv6.net
n-cloud.ntx-store.dynv6.net

# Reference: https://x.com/skocherhan/status/2036444684436865138

12-ko-official.com
login-co-kr.com
navercorp.store
com.12-ko-official.com
naaverrr.com.12-ko-official.com
naverr.com.12-ko-official.com
naverrr.com.12-ko-official.com

# Reference: https://www.virustotal.com/gui/ip-address/158.247.219.150/relations

150edoc.npsdkimrecord.mydns.bz
150nhsmobiles.mydns.bz
150userinfo.nhsmobiles.mydns.bz
158.247.219.150edoc.npsdkimrecord.mydns.bz
158.247.219.150nhsmobiles.mydns.bz
158.247.219.150userinfo.nhsmobiles.mydns.bz
219.150edoc.npsdkimrecord.mydns.bz
219.150nhsmobiles.mydns.bz
219.150userinfo.nhsmobiles.mydns.bz
247.219.150edoc.npsdkimrecord.mydns.bz
247.219.150nhsmobiles.mydns.bz
247.219.150userinfo.nhsmobiles.mydns.bz
addridentity.dynv6.net
allmedicalterm.com
app.docreflink.mydns.bz
appdeliverlist.dynuddns.com
auth-umblog34s.dynv6.net
auth-umblog44s.dynv6.net
auth-umblog45s.dynv6.net
auth-umblog46s.dynv6.net
auth-umblog47s.dynv6.net
auth-umblog48s.dynv6.net
auth-umblog49s.dynv6.net
auth-umblog50s.dynv6.net
auth-umblog51s.dynv6.net
auth-umblog52s.dynv6.net
auth-umblog53s.dynv6.net
auth-umblog54s.dynv6.net
auth-umblog55s.dynv6.net
auth-umblog56s.dynv6.net
auth-umblog57s.dynv6.net
auth-umblog58s.dynv6.net
auth-umblog61s.dynv6.net
auth-umblog62s.dynv6.net
auth-umblog64s.dynv6.net
auth-umblog65s.dynv6.net
auth-umblog68s.dynv6.net
auth-umblog69s.dynv6.net
auth-umblog70s.dynv6.net
auth-umblog72s.dynv6.net
auth-umblog73s.dynv6.net
auth-umblog74s.dynv6.net
auth-umblog75s.dynv6.net
auth-umblog76s.dynv6.net
auth-umblog84s.dynv6.net
auth-umblog85s.dynv6.net
authenticateterm.gleeze.com
baroitda.co.kr
baseblogdoc.mydns.bz
block.nblogoflink.mydns.bz
blogactionsv.dns.army
blogrighof2id.dynv6.net
blogrighof5id.dynv6.net
blogrighof6id.dynv6.net
blogrighof7id.dynv6.net
chk.nbaseinvoice.mydns.bz
datansetdoc.dynv6.net
dhjgugufurioejnfoeri.kro.kr
doc.docreflink.mydns.bz
doc.nbaseinvoice.mydns.bz
docinf.appdeliverlist.dynuddns.com
docinf.authenticateterm.gleeze.com
docinf.docusraccess.mydns.bz
docinf.ipsessioncheck.giize.com
docinf.memberblogvisit.mydns.bz
docinf.ninlineid5s.dynv6.net
docinf.npsdkimrecord.mydns.bz
docinf.ntsaccessmember.mydns.bz
docinf.ntverifyrecord.mydns.bz
docinfo.garmanage.com
docinfo.ntxnodeinvoice.mydns.bz
docreflink.mydns.bz
docusraccess.mydns.bz
edoc.addridentity.dynv6.net
edoc.appdeliverlist.dynuddns.com
edoc.authenticateterm.gleeze.com
edoc.baroitda.co.kr
edoc.blogrighof5id.dynv6.net
edoc.docusraccess.mydns.bz
edoc.handleublog.dynv6.net
edoc.htdocmodify.mydns.bz
edoc.ipsessioncheck.giize.com
edoc.nhbasetarget.mydns.bz
edoc.nhitargetdoc.mydns.bz
edoc.nhsdomainspf.mydns.bz
edoc.ninlineid3s.dynv6.net
edoc.npaprildoc.dynv6.net
edoc.nphostinvoice.mydns.bz
edoc.npsdkimrecord.mydns.bz
edoc.ntsaccessmember.mydns.bz
edoc.ntverifyrecord.mydns.bz
edoc.reverifyusrprofile.mydns.bz
edoc.usercontactblog.mydns.bz
ezwebsites.com
feburarydocmydns.bz
feburarymydns.bz
galfioneycia.com.ar
glu.n-e.kr
glu.xn--h32bi4v.xn--3e0b707e
handleublog.dynv6.net
hiyumyum.com
htdocmodify.mydns.bz
htresourcedoc.mydns.bz
ice.ntsaccessmember.mydns.bz
ice.ntverifyrecord.mydns.bz
ihcorppost.dynv6.net
ihndeliver.dynv6.net
infnusrcorp.dynv6.net
info.addridentity.dynv6.net
info.appdeliverlist.dynuddns.com
info.auth-umblog34s.dynv6.net
info.authenticateterm.gleeze.com
info.baroitda.co.kr
info.blogactionsv.dns.army
info.ezwebsites.com
info.galfioneycia.com.ar
info.garmanage.com
info.handleublog.dynv6.net
info.htdocmodify.mydns.bz
info.ipsessioncheck.giize.com
info.mem-authcenter38s.dynv6.net
info.memberblogvisit.mydns.bz
info.nbaseinvoice.mydns.bz
info.nhireferal.mydns.bz
info.nhiscoaccess.mydns.bz
info.ninlineid13s.dynv6.net
info.ninlineid39s.dynv6.net
info.ninlineid42s.dynv6.net
info.ninlineid45s.dynv6.net
info.npaprildoc.dynv6.net
info.npsdkimrecord.mydns.bz
info.ntdoc-usrsvc.mydns.bz
info.ntsaccessmember.mydns.bz
info.ntverifyrecord.mydns.bz
info.requestmbl27s.dynv6.net
info.reverifyusrprofile.mydns.bz
info.ubposting25s.dynv6.net
infverifyuser.dynv6.net
innaver.com
invoice.addridentity.dynv6.net
invoice.appdeliverlist.dynuddns.com
invoice.baroitda.co.kr
invoice.garmanage.com
invoice.handleublog.dynv6.net
invoice.ipsessioncheck.giize.com
invoice.mem-authcenter3s.dynv6.net
invoice.mem-authcenter73s.dynv6.net
invoice.nhireferal.mydns.bz
invoice.nhsdomainspf.mydns.bz
invoice.nhsmobiles.mydns.bz
invoice.ninlineid28s.dynv6.net
invoice.npaprildoc.dynv6.net
invoice.nphostinvoice.mydns.bz
invoice.ntdoc-usrsvc.mydns.bz
invoice.ntsaccessmember.mydns.bz
invoice.ntverifyrecord.mydns.bz
invoice.ntxnodeinvoice.mydns.bz
invoicesetupsvc.mydns.bz
ipsessioncheck.giize.com
kxiotxrk.auth-umblog85s.dynv6.net
linkdnsrequire.mydns.bz
linkeveryblog.mydns.bz
mem-authcenter31s.dynv6.net
mem-authcenter38s.dynv6.net
mem-authcenter3s.dynv6.net
mem-authcenter45s.dynv6.net
mem-authcenter46s.dynv6.net
mem-authcenter4s.dynv6.net
mem-authcenter73s.dynv6.net
mem-authcenter7s.dynv6.net
memberblogvisit.mydns.bz
nadatabase.mydns.bz
nav-info.ntverifyrecord.mydns.bz
nay-info.ntverifyrecord.mydns.bz
nbaseinvoice.mydns.bz
nblogoflink.mydns.bz
nboxservice.mydns.bz
ncorprecord.dynv6.net
ndyndoc.dynv6.net
newapriltarget.dynv6.net
nhbasetarget.mydns.bz
nhgojilist.dynuddns.net
nhireferal.mydns.bz
nhiscoaccess.mydns.bz
nhitargetdoc.mydns.bz
nhsdomainspf.mydns.bz
nhsmobiles.mydns.bz
nid.ntplnk8s.dynv6.net
ninlineid13s.dynv6.net
ninlineid24s.dynv6.net
ninlineid28s.dynv6.net
ninlineid29s.dynv6.net
ninlineid31s.dynv6.net
ninlineid36s.dynv6.net
ninlineid39s.dynv6.net
ninlineid3s.dynv6.net
ninlineid42s.dynv6.net
ninlineid45s.dynv6.net
ninlineid46s.dynv6.net
ninlineid5s.dynv6.net
ninlineid9s.dynv6.net
nkv-usrprofile.mydns.bz
npaddingdoc.mydns.bz
npaprildoc.dynv6.net
nphostinvoice.mydns.bz
nphostmydns.bz
npsdkimrecord.mydns.bz
ntdoc-usrsvc.mydns.bz
ntgokorea.mydns.bz
ntlinkprofile.mydns.bz
ntmobileuser.mydns.bz
ntplnk0s.dynv6.net
ntplnk1s.dynv6.net
ntplnk2s.dynv6.net
ntplnk5s.dynv6.net
ntplnk6s.dynv6.net
ntplnk7s.dynv6.net
ntplnk8s.dynv6.net
ntsaccessmember.mydns.bz
ntsvestigate.dynv6.net
ntverifyrecord.mydns.bz
ntxnodeinvoice.mydns.bz
ntxnodemydns.bz
nvuvestigate.dynv6.net
ogrigg.authenticateterm.gleeze.com
pybbtrez.auth-umblog53s.dynv6.net
raofaum.auth-umblog57s.dynv6.net
reportml44id.dynv6.net
requestmbl27s.dynv6.net
requestmbl43s.dynv6.net
reverifyusrprofile.mydns.bz
taxdoc.baseblogdoc.mydns.bz
taxdoc.usercontactblog.mydns.bz
ubposting25s.dynv6.net
useraccount.nboxservice.mydns.bz
usercontactblog.mydns.bz
userinfo.addridentity.dynv6.net
userinfo.appdeliverlist.dynuddns.com
userinfo.authenticateterm.gleeze.com
userinfo.baroitda.co.kr
userinfo.garmanage.com
userinfo.handleublog.dynv6.net
userinfo.htdocmodify.mydns.bz
userinfo.invoicesetupsvc.mydns.bz
userinfo.ipsessioncheck.giize.com
userinfo.memberblogvisit.mydns.bz
userinfo.nhsmobiles.mydns.bz
userinfo.ninlineid24s.dynv6.net
userinfo.ninlineid29s.dynv6.net
userinfo.ninlineid31s.dynv6.net
userinfo.ninlineid46s.dynv6.net
userinfo.nphostinvoice.mydns.bz
userinfo.npsdkimrecord.mydns.bz
userinfo.ntlinkprofile.mydns.bz
userinfo.ntsaccessmember.mydns.bz
userinfo.ntverifyrecord.mydns.bz
userinfo.reportml44id.dynv6.net
userinfo.requestmbl43s.dynv6.net
userinfo.reverifyusrprofile.mydns.bz
usr.baseblogdoc.mydns.bz
usrinvoicelog.mydns.bz
verify.docreflink.mydns.bz
verify.nbaseinvoice.mydns.bz
yccbkk.auth-umblog74s.dynv6.net
ycuanbg.auth-umblog84s.dynv6.net
yduyfieruioprejfggfy.r-e.kr

# Reference: https://x.com/G60930953/status/2040605804949053513
# Reference: https://www.virustotal.com/gui/file/169586b6eb36b17520ef5afd206da86c4de89eb01d6294ba9631414271ba752f/detection

http://103.67.196.25
auth.servepics.com

# Reference: https://www.virustotal.com/gui/ip-address/27.102.137.150/relations

txau1.top
ge-kr.txau1.top
naterqn.onthewifi.com
naverose.onthewifi.com
nid-navercto.ddnsking.com
nid-navergbd.serveftp.com
nid-navernyp.onthewifi.com

# Reference: https://www.virustotal.com/gui/ip-address/27.102.137.38/relations

d21.eu89q.dns.army
deliver-doc.v6.navy
deliver.miss-tax.dns.navy
efine-log.kro.kr
electric-support.v6.rocks
eu89q.dns.army
gent-pgr.dynv6.net
gger.lnnot.dynv6.net
lnnot.dynv6.net
login.pay-tax.dns.navy
miss-tax.dns.navy
ndoc-tax.dynv6.net
nid-htl.duckdns.org
nid-log.electric-support.v6.rocks
nid-tax.dns.army
ntax-doc.v6.rocks
pay-tax.dns.navy
prof-vi.duckdns.org
read.tax-doc.v6.rocks
tax-doc.v6.rocks
tax-invoice.dns.army
tdoc-in.v6.navy
ueeg.gent-pgr.dynv6.net
uj3892hr.dynv6.net
verify.efine-log.kro.kr

# Reference: https://www.virustotal.com/gui/ip-address/165.154.52.8/relations

com-nts.dns.army
kakao.com-nts.dns.army
log.kakao.com-nts.dns.army

# Reference: https://x.com/skocherhan/status/2045202017875120258

abusecenter.nblogclaim44bid.dynv6.net
abusecenter.ntha-3s.dynv6.net
aqazyjxhkiw.ntsvestigate.dynv6.net
blogrighof22id.dynv6.net
blogrighof64id.dynv6.net
chposting7s.dynv6.net
edoc.nvtcorp-37bid.dynv6.net
eiigewdlgtj.auth-umblog70s.dynv6.net
info.nvtcorp-35bid.dynv6.net
invoice.nblog-rcenter41id.dynv6.net
manage-mublog73id.dynv6.net
nabuse-28bid.dynv6.net
nabuse-46bid.dynv6.net
nblog-rcenter19id.dynv6.net
nblog-rcenter25id.dynv6.net
nblog-rcenter26id.dynv6.net
nblog-rcenter2id.dynv6.net
nblog-rcenter31id.dynv6.net
nblog-rcenter41id.dynv6.net
nblog-rcenter97id.dynv6.net
nblog-rcenter98id.dynv6.net
nblogclaim18bid.dynv6.net
nblogclaim20bid.dynv6.net
nblogclaim31bid.dynv6.net
nblogclaim3bid.dynv6.net
nblogclaim44bid.dynv6.net
nblogclaim46bid.dynv6.net
nbreceip2id.dynv6.net
nbreceip34id.dynv6.net
nbreceip48id.dynv6.net
nbreceip8id.dynv6.net
nbreceip97id.dynv6.net
netedoc.npaprildoc.dynv6.net
netinvoice.chposting7s.dynv6.net
netwww.auth-umblog70s.dynv6.net
netwww.requestmbl27s.dynv6.net
nid-blog.nblogclaim46bid.dynv6.net
nid.nblog-rcenter2id.dynv6.net
nid.ntha-11s.dynv6.net
nid.ntha-15s.dynv6.net
ntha-11s.dynv6.net
ntha-15s.dynv6.net
ntha-22s.dynv6.net
ntha-2s.dynv6.net
ntha-33s.dynv6.net
ntha-3s.dynv6.net
ntha-7s.dynv6.net
ntha-8s.dynv6.net
nvtcorp-25bid.dynv6.net
nvtcorp-35bid.dynv6.net
nvtcorp-37bid.dynv6.net
reportml65id.dynv6.net
reverify.nblog-rcenter26id.dynv6.net
reverify.ntha-33s.dynv6.net
userinfo.nbreceip8id.dynv6.net
xn--userinfo-mr3d.ninlineid46s.dynv6.net

# Reference: https://x.com/skocherhan/status/2045963626901897341

alstnskkal.duckdns.org
com-verified.dynv6.net
iec11px.dynv6.net
iec12px.dynv6.net
iec26px.dynv6.net
iec28px.dynv6.net
isc24px.dns.army
isc8px.dns.army
msi5ex.dynv6.net
mts18op.dynv6.net
mts2op.dynv6.net
nos34ips.dynv6.net
nos35ips.dynv6.net
nos36ips.dynv6.net
nos37ips.dynv6.net
ns17ios.dynv6.net
ntdepo.dns.army
ntspiu.dynv6.net
ntxcopesd.dns.army
pinc.toh.info
account.com-verified.dynv6.net
login.account.com-verified.dynv6.net
n-cloud.nos37ips.dynv6.net
n-store.iec28px.dynv6.net
n-store.ns17ios.dynv6.net
navs.en.ntspiu.dynv6.net
nid-user.iec12px.dynv6.net
nid-user.mts18op.dynv6.net
nid-user.nos37ips.dynv6.net
nid.en.ntxcopesd.dns.army
nidlogins.cn.ntdepo.dns.army
nuser-login.isc8px.dns.army
outlook.pinc.toh.info

# Reference: https://x.com/skocherhan/status/2046292771594555463

als22nty.dns.army
anav.iposepo.dns.army
bnav.iterpost.dns.army
enav.ipspcoep.dns.army
iposepo.dns.army
ipseno10s.dns.army
ipseno15s.dns.army
ipseno31s.dns.army
ipseno5s.dns.army
ipspcoep.dns.army
iterpost.dns.army
mois0ex.dynv6.net
mois22ex.dynv6.net
mois26ex.dynv6.net
mois36ex.dynv6.net
mois39ex.dynv6.net
n-crop.anav.iposepo.dns.army
n-store.enav.ipspcoep.dns.army
navipdes.dns.army
nid-login.mois26ex.dynv6.net
nid-login.ntx25sp.dns.army
nid.navipdes.dns.army
nida.mois22ex.dynv6.net
nida.ntx24sp.dns.army
nidloes.navipdes.dns.army
nids.bnav.iterpost.dns.army
nids.navipdes.dns.army
nids.nts9pops.dns.army
nids.tois5ex.dynv6.net
nidservers.als22nty.dns.army
nsc2tx.dynv6.net
ntrsdos28s.dns.army
ntrsdos33s.dns.army
ntrsdos38s.dns.army
ntrsdos3s.dns.army
nts8pops.dns.army
nts9pops.dns.army
ntx10sp.dns.army
ntx24sp.dns.army
ntx25sp.dns.army
ntxdoe0s.dns.army
ntxdoe2s.dns.army
ntxsp11s.dns.army
ntxsp17s.dns.army
ntxsp21s.dns.army
ntxsp23s.dns.army
ntxsp27s.dns.army
ntxsp28s.dns.army
ntxsp2s.dns.army
ntxsp31s.dns.army
ntxsp32s.dns.army
ntxsp33s.dns.army
ntxsp35s.dns.army
ntxsp37s.dns.army
ntxsp39s.dns.army
ntxsp4s.dns.army
ntxsp5s.dns.army
ntxsp6s.dns.army
ntxsp8s.dns.army
ntxsp9s.dns.army
op10ntyx.dns.navy
op11ntyx.dns.navy
op12ntyx.dns.navy
op15ntyx.dns.navy
op17ntyx.dns.navy
op19ntyx.dns.navy
op22ntyx.dns.navy
op24ntyx.dns.navy
op25ntyx.dns.navy
op27ntyx.dns.navy
op28ntyx.dns.navy
op29ntyx.dns.navy
op30ntyx.dns.navy
op34ntyx.dns.navy
op35ntyx.dns.navy
op36ntyx.dns.navy
pntsr27s.dns.army
pntxes18s.dynv6.net
pntxes20s.dynv6.net
tois15ex.dynv6.net
tois5ex.dynv6.net
tpe5ie.dynv6.net
xn--n-cop-iyu.anav.iposepo.dns.army
xto14ic.dynv6.net

# Reference: https://x.com/phatomcandle/status/2046650190183256469

http://118.194.248.246
118.194.248.246:443

# Reference: https://x.com/skocherhan/status/2047021479523496153

accstore.dynv6.net
alertkr.dynv6.net
almsalert.dynv6.net
asntml.dynv6.net
bigdeal.dynv6.net
govalert.dynv6.net
hldsl.dynv6.net
htax-alert.dynv6.net
invoicedoc-ips.mydns.vc
ips-authcheck.mydns.bz
ips-checkauth.mydns.vc
ips-ecorp.mydns.jp
ips-edocdeliver.mydns.bz
ips-helper.mydns.bz
ips-helper.mydns.vc
ips-helpinvoice.mydns.bz
ips-invoicestore.dynv6.net
ips-krgo.mydns.bz
ips-nidauth.mydns.vc
ips-nidlg.mydns.bz
ips-notice.mydns.bz
ips-notice.mydns.vc
ips-taxkr.mydns.bz
ipsdeliver.mydns.bz
ipsdeliver.mydns.vc
ipsdoc-auth.mydns.vc
ipsntcorp.dynv6.net
lgtax.dynv6.net
mlsqs.dynv6.net
msapw.dynv6.net
n-cloud.asntml.dynv6.net
n-cloud.invoicedoc-ips.mydns.vc
n-cloud.ips-edocdeliver.mydns.bz
n-cloud.ips-helper.mydns.vc
n-cloud.ips-krgo.mydns.bz
n-cloud.ips-nidlg.mydns.bz
n-cloud.ips-taxkr.mydns.bz
n-cloud.ipsdoc-auth.mydns.vc
n-cloud.nidinvoice-ips.mydns.vc
n-cloud.noticeips-nid.mydns.bz
n-cloud.noticekr-ips.mydns.bz
n-cloud.nts-authdoc.mydns.vc
n-cloud.reloguser2.dynv6.net
n-cloud.tax-nav.dns.army
n-corp.accstore.dynv6.net
n-corp.alertkr.dynv6.net
n-corp.invoicedoc-ips.mydns.vc
n-corp.ips-authcheck.mydns.bz
n-corp.ips-checkauth.mydns.vc
n-corp.ips-edocdeliver.mydns.bz
n-corp.ips-helper.mydns.vc
n-corp.ips-helpinvoice.mydns.bz
n-corp.ips-nidauth.mydns.vc
n-corp.ips-nidlg.mydns.bz
n-corp.ips-notice.mydns.bz
n-corp.ips-notice.mydns.vc
n-corp.ips-taxkr.mydns.bz
n-corp.ipsdoc-auth.mydns.vc
n-corp.ipsmkt.dynv6.net
n-corp.mvtsl.dynv6.net
n-corp.nidinvoice-ips.mydns.vc
n-corp.noticeips-nid.mydns.bz
n-corp.noticekr-ips.mydns.bz
n-corp.nts-checkauth.mydns.vc
n-corp.reloguser2.dynv6.net
n-corp.tax-sdoc.dynv6.net
n-store.invoicedoc-ips.mydns.vc
n-store.ips-authcheck.mydns.bz
n-store.ips-checkauth.mydns.vc
n-store.ips-edocdeliver.mydns.bz
n-store.ips-helper.mydns.vc
n-store.ips-invoicestore.dynv6.net
n-store.ips-nidauth.mydns.vc
n-store.ips-taxkr.mydns.bz
n-store.ipsdoc-auth.mydns.vc
n-store.ipslogin.dns.navy
n-store.lgtax.dynv6.net
n-store.nidinvoice-ips.mydns.vc
n-store.noticekr-ips.dynv6.net
n-store.nts-checkauth.mydns.vc
n-store.reloguser2.dynv6.net
n-store.store-ipscorp.dynv6.net
nid-user.asntml.dynv6.net
nid-user.govalert.dynv6.net
nid-user.invoicedoc-ips.mydns.vc
nid-user.ips-authcheck.mydns.bz
nid-user.ips-checkauth.mydns.vc
nid-user.ips-edocdeliver.mydns.bz
nid-user.ips-helper.mydns.vc
nid-user.ips-helpinvoice.mydns.bz
nid-user.ips-nidauth.mydns.vc
nid-user.ips-nidlogin.dns.army
nid-user.ips-notice.mydns.bz
nid-user.ips-taxkr.mydns.bz
nid-user.ipsdeliver.mydns.vc
nid-user.ipsdoc-auth.mydns.vc
nid-user.ipsgoalert.dynv6.net
nid-user.ipsncorp.dns.navy
nid-user.nidinvoice-ips.mydns.vc
nid-user.noticekr-ips.mydns.bz
nid-user.nts-authdoc.mydns.vc
nid-user.reloguser2.dynv6.net
nid-user.tax-nav.dns.army
nid-user.taxalert.dynv6.net
nidinvoice-ips.mydns.vc
nidinvoice-nts.mydns.jp
nidsec-notice.mydns.bz
nmtsv.dynv6.net
noticeips-nid.mydns.bz
noticekr-ips.dynv6.net
noticekr-ips.mydns.bz
nts-checkauth.mydns.vc
nts-edocdeliver.mydns.jp
nts-govkr.mydns.jp
ntsgo-auth.mydns.jp
nuser-login.alertkr.dynv6.net
nuser-login.asntml.dynv6.net
nuser-login.bigdeal.dynv6.net
nuser-login.invoicedoc-ips.mydns.vc
nuser-login.ips-checkauth.mydns.vc
nuser-login.ips-edocdeliver.mydns.bz
nuser-login.ips-helper.mydns.bz
nuser-login.ips-helper.mydns.vc
nuser-login.ips-invoicestore.dynv6.net
nuser-login.ips-nidauth.mydns.vc
nuser-login.ips-notice.mydns.vc
nuser-login.ipsdoc-auth.mydns.vc
nuser-login.nidinvoice-ips.mydns.vc
nuser-login.noticekr-ips.mydns.bz
nuser-login.nts-edocdeliver.mydns.jp
nuser-login.nversf.dynv6.net
nuser-login.tax-sdoc.dynv6.net
nwlogn.dynv6.net
reloguser2.dynv6.net
store-ipscorp.dynv6.net
tax-sdoc.dynv6.net
tax-store.mydns.jp
taxalert.dynv6.net
vpn280621771.softether.net

# Reference: https://www.virustotal.com/gui/ip-address/163.245.215.46/relations

auth.hrstrotage.n-e.kr
bigfile.navcloudstorage.n-e.kr
cloudflareproxy.rinet.ai
delfino.o-r.kr
govkorea.o-r.kr
hrstrotage.n-e.kr
ibizplus.n-e.kr
image.fin-tech.com
ireslution.p-e.kr
load.nidonepass.n-e.kr
navcloudstorage.n-e.kr
navmercorp.n-e.kr
nhls.o-r.kr
nid.navmercorp.n-e.kr
nidonepass.n-e.kr
update.delfino.o-r.kr
webdavclient.o-r.kr

# Reference: https://x.com/skocherhan/status/2047382182000312798
# Reference: https://x.com/skocherhan/status/2048153192563613921
# BODY_SHA1-HOST=79aae2fcc1aebdd40163634cb91f06f83a4a307f

00mknjbhy.dynv6.net
0dj87hc.v6.rocks
0jr87375qt.v6.navy
0mvkf48r.v6.army
0reudifh9384.dynv6.net
0twjc657tu.v6.navy
0vjdf88.dynv6.net
158.247.197.123.dynu.net
1exi8anhok2.dns.navy
1hvl4j.2towig8bijd.v6.navy
2923bx1jf4r.dns.navy
2brpj4v0n4f.dns.navy
2ecy51395u.v6.navy
2ndnidct.dynu.org
2towig8bijd.v6.navy
3pc3b9ph4f7.dns.navy
3r5ab8.7bh35m2hwx9.dns.army
3smb1kpyd2.v6.rocks
3t1tjp49cf7.dns.navy
4brti.g3odkh1zx2q.dns.army
4btb8lukrf.dns.navy
534096323617957307546508037974775018829080630954497299794582331.0dj87hc.v6.rocks
5v9h4rkbop.dns.navy
6c874.kvp207shd6.dns.navy
6hnz.t6n0tgju441.v6.navy
6tfdyi2c8x.v6.navy
6unv9e8nulu.v6.navy
711962461520156720836044894757883475388959245303518849804799216.0mvkf48r.v6.army
720753517961603060070649438641558899252698502795484848127684059.cvdvrgvhgbdsg.dynv6.net
772g.vsjlpbrey1d.v6.navy
77ilircskf.dns.navy
7bh35m2hwx9.dns.army
7v.victuslaser.sbs
805137874826147477830706844873128886435834829333288161484629250.0dj87hc.v6.rocks
82ynwbuwlpm6wm96.enav.itpxops.dynv6.net
8lxzbzbtoh.dns.navy
8tvklxdp9e.v6.navy
9a3jpx.3smb1kpyd2.v6.rocks
9hear9ofp5.dns.army
a6rvf4ib57.v6.navy
a93xkcs4y2.v6.army
abandon.dynuddns.net
abcdef.dynuddns.com
abcdef.yyuyy.com
aberta.dynu.net
ability.dynu.org
ability.dynuddns.com
ability.dynuddns.net
able.dynu.net
able.dynu.org
able.dynuddns.net
abntxe.dynu.net
abntxrg.dynu.org
abntxrg.dynuddns.net
about.dynu.net
about.dynu.org
about.dynuddns.net
above.dynu.net
above.dynu.org
above.dynuddns.net
absorb.dynuddns.net
abstract.dynuddns.net
abuse.dynu.org
abuse.dynuddns.net
accaverify.dynu.org
accbverify.dynu.org
accesstargetid.dynv6.net
acchiverify.dynu.org
accident.dynu.org
accident.dynuddns.net
account-login.userauth.mydns.vc
account-seccheck-ko.site
account.dynu.net
account.dynuddns.net
accs.dynu.net
accsep.dynu.net
accuse.dynu.net
accuse.dynu.org
accuse.dynuddns.net
accverify.dynu.org
achannelapp.dynu.net
achannelapps.dynu.net
acsdoc.dynu.org
action.dynuddns.net
activate.dynu.net
activate.dynu.org
activate.dynuddns.net
actor.dynu.org
actor.dynuddns.net
admin.dev2.daliajobs.com
againcheck.dynu.org
agfggdo04u2cq9f7.hometa21x.dns.army
agfggdo04u2cq9f7.ntseno38s.dns.army
aipert.dynuddns.net
aipsocs.dynuddns.net
aisperte.dynuddns.net
aispertes.dynu.net
aispertes.dynuddns.net
alarm-doc-review.site
aleo.dynuddns.com
aleo.dynuddns.net
altntspage.dynu.net
altntspages.dynu.net
amsnvstn.dynu.org
amtscop.dynu.net
amwinmsnt.dynu.org
anav.htscops.dns.army
andocmenu.dynu.net
andocmenu.dynu.org
anhyer.dynu.net
anhyer.dynuddns.net
anhyuse.dynu.net
ansdocpool.dynu.net
ansdocpools.dynu.net
ansidnmt.dynu.org
antxzone.dynu.net
anxtlog.dynuddns.net
app.donply.pw
appinfoercm.dynu.net
appinfoercms.dynu.net
arcnhis.dynu.net
arecedpos.dynu.net
arecedposo.dynu.net
arecepppp.dynu.org
armynid-user.ntxr37os.dns.army
armynids.anav.htscops.dns.army
arped.dynuddns.net
arpntsre.dynuddns.net
asdf.3r5ab8.7bh35m2hwx9.dns.army
asdf.4brti.g3odkh1zx2q.dns.army
asdf.cyf550.g3odkh1zx2q.dns.army
asdnsnid.dynu.org
aspdoc.dynu.net
ataxed.dynuddns.net
attachfile.verymad.net
auction.dynu.net
augustschedule.dynu.net
augustschedules.dynu.net
auth-accounts.dynu.net
auth-accounts.dynu.org
auth-accounts.dynuddns.com
autopartscn.shop
b8fq9189g6.dns.navy
billing-address.abrdns.com
bksei.dynu.org
blmsdert.dynu.org
blogauth.dynuddns.net
blogworks28th.dynv6.net
bndj4daps7.v6.navy
bnhostingdoc.dynu.net
bqvatqsq.nusntx56s.dynv6.net
brahmastra.today
bridge.dynuddns.net
browseblogmenu.dynu.net
browseblogmenus.dynu.net
ca-fe-nhn.com
cafe-nhnarticle.com
calc.noreturn-wetax.forum
cc.attachfile.verymad.net
cdn-verifying.homes
ceo.mmm.mmm.mmm.dynuddns.net
checkinfo.abrdns.com
checkinfo.kro.kr
checkmend.dynu.org
chkidsuts.dynu.org
cipsocs.dynu.org
cipsocs.dynuddns.net
clarifypost.forum
clearnotice.sbs
closecont.casacam.net
cloud.hat9ex.dns.army
cloudvps.ddnsguru.com
clovanote.ohbah.com
cmidmsrt.dynu.org
cmioepr.dynu.net
cmioser.dynu.net
cmoiser.dynuddns.net
cmoisere.dynuddns.net
cmsidntm.dynu.org
cmsignco.dynu.org
cnhisrps.dynu.net
cnhisrps.dynuddns.net
cnxhisrps.dynuddns.net
com-nts.dynu.org
com-nts.dynuddns.net
com-signin.dynv6.net
confirm-url.makeup
confirm-userorder.biz
confirm1.moois-nid.remotewire.net
content.dynuddns.net
creamguide.com
csdvrgrgt45.v6.rocks
ctpnhis.dynu.net
cursed.foundation
cvdvrgvhgbdsg.dynv6.net
cxmfcubfnq.dns.navy
cyf550.g3odkh1zx2q.dns.army
d8hr0a.nyg5bs4d6k.dns.navy
dashboard.stg.daliajobs.com
dbxtbfvj2t.dns.navy
deliver-lot-service.lat
departmentndoc27s.dynv6.net
departmentndoc35s.dynv6.net
dev-crh.daliajobs.com
dev-crm.daliajobs.com
dev-dashboard.daliajobs.com
dev-elwood-staffing.daliajobs.com
dev-hcsg.daliajobs.com
dev-tshc.daliajobs.com
dev1.daliajobs.com
dev3.daliajobs.com
dev4.daliajobs.com
diaxwn61lp.dynv6.net
digital-notice-kr.sbs
digital-post.live
dispsendsvc.dynu.net
dispsendsvcs.dynu.net
dkcbes0zyl.dynv6.net
dns-setup.remotewire.net
dnsncode.dynu.org
doc-deliver-sign.pics
doc-load.abrdns.com
doc-load.ln2jl.xp2xbk8ukme.dns.army
docid.galaxybookthanksparty.com
docinfo.loaden52doc.dynv6.net
docinfo.oercm-7load.dynv6.net
docmoise.dynuddns.net
docnid.vuczu.xp2xbk8ukme.dns.army
docpols.dynu.net
docservices.dynu.net
download.groups.id
e-billing-service.autos
e639kk.wjyx49u3cu3.dns.army
e96b10oymz.v6.navy
eb0bw7j0sr.v6.army
edcmoies.dynuddns.net
edeliever-address-verify.biz
edoc-mand.dns.army
edoc-mane.dns.navy
edoc-mew.dynv6.net
edoc-police.dynu.net
edoc-police.dynu.org
edoc-view-otp.dynuddns.net
edoc-view.dynu.org
edoc-view.dynuddns.net
edoc.abstract.dynuddns.net
edoc.dynu.net
edoc.dynu.org
edoc.dynuddns.com
edoc.dynuddns.net
edoc.external.dynu.net
edoc.galaxybookthanksparty.com
edoc.invoice.dynu.net
edoc.invoice.dynuddns.com
edoc.invoice.dynuddns.net
edoc.mew.dynu.net
edoc.mew.dynu.org
edoc.mew.dynuddns.net
edoc.mew.freeddns.org
edoc.mew.once.dynuddns.net
edoc.mew001.dynuddns.net
edoc.mew002.dynuddns.net
edoc.mew003.dynuddns.net
edoc.mew004.dynuddns.net
edoc.mew005.dynuddns.net
edoc.mew006.dynuddns.net
edoc.mew007.dynuddns.net
edoc.mew008.dynuddns.net
edoc.mew10.dynuddns.net
edoc.mew11.dynuddns.net
edoc.mew12.dynuddns.net
edoc.mew13.dynuddns.net
edoc.naucommunity.dynv6.net
edoc.nhis-view.dynu.net
edoc.nhis-view.dynu.org
edoc.nhis-view.dynuddns.net
edoc.nhis.ability.dynu.org
edoc.nhis.view.dynu.org
edoc.nopdoc33load.dynv6.net
edoc.ntcdoctype83th.dynv6.net
edoc.ntinvoicedoc.kro.kr
edoc.nts-view.dynuddns.net
edoc.ntvalldocs.kro.kr
edoc.officialipsline.ddnsguru.com
edoc.otp-view.dynuddns.net
edoc.otp.dynuddns.net
edoc.qwoefintvsef.dynv6.net
edoc.view.dynu.net
edoc.view.dynuddns.net
edoc.view.mew-otp.dynu.org
edoc.view.mew-otp.dynuddns.net
edoc.view.otp.dynu.net
edoc.view.otp.dynu.org
edoc.view.otp.freeddns.org
edocnlist39in.dynv6.net
edocnlist90in.dynv6.net
edocs-kaka.dynu.net
edocs.kakao-serv.dynuddns.com
edocservice-kakao.dynu.net
edocsevr.dynuddns.net
edomoies.dynuddns.net
edpoces.dynu.org
egbzqa25gw.v6.navy
egmois.dynuddns.net
eifjisjjef.v6.army
eipsalr.dynu.org
eipser.dynu.net
eipser.dynuddns.net
eipsverifys.dynuddns.net
emiosscap.dynu.net
emoisann.dynuddns.net
emoisp.dynu.net
emoisp.dynuddns.net
emosqu.dynu.net
emosqu.dynu.org
enav.itpxops.dynv6.net
encorpverify.dynu.net
encorpverifys.dynu.net
enhisog.dynu.org
eodpoc.dynu.org
eosips.dynu.net
epdf-user-view.quest
epoliceapi.dynu.org
epolicesa.dynu.org
epserviceln75in.dynv6.net
epserviceln85in.dynv6.net
er-edoc.ezgateway.net
ercdepinfo.dynu.net
ercmdocload.dynu.net
ercmload15nd.dynv6.net
ercmload50nd.dynv6.net
ercmload75nd.dynv6.net
ercmloadpro.dynu.net
ercmloadpros.dynu.net
ercmnvid.mydns.bz
ercmpola21s.dynv6.net
ercmpola41s.dynv6.net
ercmpola64s.dynv6.net
ercmpola75s.dynv6.net
ercmpola77s.dynv6.net
ercmpola79s.dynv6.net
ercmpola87s.dynv6.net
ercmpola8s.dynv6.net
ercmpola98s.dynv6.net
ercmrequestverif.dynu.net
ercmrequestverifs.dynu.net
ercmverifopt.dynu.net
ercmverifopts.dynu.net
ercorps-12load.dynv6.net
ercorps-15load.dynv6.net
ercorps-18load.dynv6.net
ercorps-19load.dynv6.net
ercorps-1load.dynv6.net
ercorps-23load.dynv6.net
ercorps-25load.dynv6.net
ercorps-27load.dynv6.net
ercorps-31load.dynv6.net
ercorps-32load.dynv6.net
ercorps-42load.dynv6.net
ercorps-4load.dynv6.net
ercorps-51load.dynv6.net
ercorps-55load.dynv6.net
ercorps-62load.dynv6.net
ercorps-63load.dynv6.net
ercorps-69load.dynv6.net
ercorps-72load.dynv6.net
ercorps-86load.dynv6.net
ercorps-87load.dynv6.net
ercorps-88load.dynv6.net
ercorps-89load.dynv6.net
ercorps-95load.dynv6.net
ercpsvczone0in.dynv6.net
ercpsvczone22in.dynv6.net
ercpsvczone31in.dynv6.net
ercpsvczone32in.dynv6.net
ercpsvczone57in.dynv6.net
ercpsvczone58in.dynv6.net
ercpsvczone72in.dynv6.net
eredsaa.dynu.net
eredsaa.dynu.org
eredsaa.dynuddns.net
erpolicies-0v.dynv6.net
erpolicies-21v.dynv6.net
erpolicies-4v.dynv6.net
erpolicies-58v.dynv6.net
erpolicies-75v.dynv6.net
erpolicies-76v.dynv6.net
erpolicies-85v.dynv6.net
erpolicies-86v.dynv6.net
erpolicies-92v.dynv6.net
erpolicies-96v.dynv6.net
ertnhiso.dynu.net
esmois.dynuddns.net
etnhisr.dynuddns.net
etnhisre.dynuddns.net
execute.dynu.org
explorentdoc.dynu.net
exrnhis.dynu.org
exrnhis.dynuddns.net
external.dynu.net
external.dynuddns.com
external.dynuddns.net
falconfxlabs.com
finory.giize.com
fjyl3b6c83.v6.navy
fklihnz6pb.v6.navy
fnbhrzgh.nipadd54load.dynv6.net
forms.dev4.daliajobs.com
g3odkh1zx2q.dns.army
g4gr.eb0bw7j0sr.v6.army
galaxybookthanksparty.com
gama.dynu.org
gama.dynuddns.com
gama.dynuddns.net
gemini.dynuddns.com
gg8efhpx2o.v6.army
gha84kbfex6.dns.navy
gm2gx.8lxzbzbtoh.dns.navy
gr1jt7j8j0s.dns.navy
hat22ex.dns.army
hat9ex.dns.army
hb-xydq.com
hc.vlkjq328j-q2odlajejfj-vnweq1v.site
health-doc.giize.com
held12tr.dns.army
hello.mwuglp.1exi8anhok2.dns.navy
hets12ex.dns.army
hets16ex.dns.army
hets22ex.dns.army
hh4323bc6mc.dns.navy
hhois.o-r.kr
hometa16x.dns.army
hometa21x.dns.army
hostnid.ezgateway.net
hslnistms.dynu.org
hsmdhosim.dynuddns.com
hsnivnidl.dynu.net
hsnmitns.dynu.org
htax-login.nts-kr.dns.army
htslcpy.dynu.org
hu4e60f2ok.v6.navy
i0bdvsseci.v6.army
i6u25s.i0bdvsseci.v6.army
ia0xaabpip7.v6.navy
iex19snhis.dynuddns.com
iex26snhis.dynuddns.com
iex38snhis.dynuddns.com
iflat0pd7wo7mnrm.hets16ex.dns.army
igyeu61mb4mt6pq9.enav.itpxops.dynv6.net
iii8.xtfsqcm-12.top
ilsmdoeit.dynu.org
image.blinklab.com
immutable.dynu.net
immutable.dynuddns.com
immutable.dynuddns.net
immutable.roxa.org
immutable.yyuyy.com
inblogpublish.dynu.net
inblogpublishs.dynu.net
incoming.dynu.org
indoclist1th.dynv6.net
info.dns-setup.remotewire.net
info.edoc-mand.dns.army
info.edoc-mane.dns.navy
info.edoc-mew.dynv6.net
infocheck.abrdns.com
inlinentcorp.dynu.net
inlinentcorp.dynu.org
inlinentcorps.dynu.net
inlinentcorps.dynu.org
inlinepoldep.dynu.net
inlinepoldeps.dynu.net
inrestrictblock.dynu.net
inrestrictblocks.dynu.net
insproverify.dynu.net
intaxcheck.dynu.net
interdoclist.dynu.net
interdoclists.dynu.net
internal.dynu.net
internal.dynu.org
internal.dynuddns.com
internal.dynuddns.net
internerclist.dynu.net
internerclists.dynu.net
invoice.dynu.net
invoice.dynuddns.com
invoice.dynuddns.net
invoice.loaden26doc.dynv6.net
invoice.nhpolercm14v.dynv6.net
invoice.nopdoc77load.dynv6.net
invoice.nopdoc99load.dynv6.net
invoice.ssltest1.dynv6.net
invoice.uofficialerc45v.dynuddns.com
invoiceinfercm.dynu.net
invoiceinfercms.dynu.net
invoicentmenu.dynu.net
invoicereqload.dynu.net
invoicereqloads.dynu.net
ip-cloud.theworkpc.com
iphdelive14s.dynv6.net
iphdelive22s.dynv6.net
iphdelive31s.dynv6.net
iphdelive63s.dynv6.net
ips-auth-nid.redirect.ydns.eu
ips-co.abrdns.com
ips-doc.webredirect.org
ips-ndoc.dynuddns.net
ips-nidml.dynu.org
ips-otp.dynuddns.net
ips.dynuddns.net
ipsados.dynuddns.net
ipsasg.dynu.org
ipsauths.dynu.org
ipscode.dns.army
ipsdoc.dynuddns.net
ipsdoc.groups.id
ipsedcis.dynu.org
ipsedois.dynu.org
ipshomekr.dynv6.net
ipsnaer.dynuddns.net
ipsnar.dynuddns.net
ipsnasp.dynu.org
ipsnasp.dynuddns.net
ipsnasr.dynuddns.net
ipsnave.dynuddns.net
ipsnavr.dynuddns.net
ipsnctns.dynu.org
ipsnver.jumpingcrab.com
ipsverification.dynu.net
ipsverifications.dynu.net
isdp.ooguy.com
ispd.nts-write.remotewire.net
ispnsntns.dynu.org
itpxops.dynv6.net
iyyfk3jnqbw.v6.navy
j7uv8yww6la.dns.navy
jbyaa6xotk.v6.army
juqc7swtyb.v6.army
jzeyutudey.dynv6.net
k-admin-portal.quest
k6i55ovcoy3.dns.navy
kaka-ecs.dynu.org
kakao-docs.dynu.org
kakao-mew.dynuddns.net
kakao-serv.dynuddns.com
kibana.daliajobs.com
km-link.mois-go.cloud-ip.cc
kvp207shd6.dns.navy
ldtnny.ntenterprise.dynv6.net
li3pg2l17b.v6.army
lmsnitmcp.dynu.net
ln2jl.xp2xbk8ukme.dns.army
loaden17doc.dynv6.net
loaden1doc.dynv6.net
loaden26doc.dynv6.net
loaden39doc.dynv6.net
loaden40doc.dynv6.net
loaden52doc.dynv6.net
loaden53doc.dynv6.net
loaden55doc.dynv6.net
loaden57doc.dynv6.net
loaden68doc.dynv6.net
loaden6doc.dynv6.net
loaden71doc.dynv6.net
loaden79doc.dynv6.net
loaden81doc.dynv6.net
loaden86doc.dynv6.net
loaden88doc.dynv6.net
loaden98doc.dynv6.net
loaden99doc.dynv6.net
loadmenupdoc.dynu.net
loadmenupdocs.dynu.net
loadmis.abrdns.com
localtaxdoc.dynu.net
localtaxdocs.dynu.net
locnhis.dynu.org
log.signer.dns.army
login-accounts.dynu.net
login-accounts.dynu.org
login.checkinfo.kro.kr
loginuserinfo-seccheck.site
logverify.dynu.org
lopm.webredirect.org
lsintdile.dynu.net
lsmintnbs.dynu.org
lsmsnitn.dynu.org
lsnidnmt.dynu.org
m.navre.co.malam.or.id
maerois.dynu.net
mainhis.dynu.org
managers.dns.army
manages.dynu.org
manhis.dynu.org
mas10ox.dns.navy
mas14ox.dns.navy
mas17ox.dns.navy
mas24ox.dns.navy
mas26ox.dns.navy
mas2ox.dns.navy
masineres.dynu.org
masntisme.dynu.org
mdlog.mydns.vc
mdlsnchlog.dynuddns.com
mdsmisty.dynu.org
meblos.dynuddns.net
mega2d.xyz
memmois.dynu.net
memmois.dynu.org
memnhis.dynu.org
menhs.dynu.org
mepoies.dynuddns.net
meprtos.dynu.net
mestoast.dynu.net
mestoast.dynuddns.net
mew-edoc.dynuddns.net
mew-ips.dynu.net
mew-ips.dynuddns.net
mew-otp.dynu.org
mew-otp.dynuddns.net
mew.dynu.net
mew.dynu.org
mew.dynuddns.net
mew.freeddns.org
mew.once.dynuddns.net
mew001.dynuddns.net
mew002.dynuddns.net
mew003.dynuddns.net
mew004.dynuddns.net
mew005.dynuddns.net
mew006.dynuddns.net
mew007.dynuddns.net
mew008.dynuddns.net
mew10.dynuddns.net
mew11.dynuddns.net
mew12.dynuddns.net
mew13.dynuddns.net
mexnhis.dynu.org
mexop.dynu.org
mfandnsdc.dynuddns.com
mhoisnths.dynu.net
midnsidsl.dynu.net
midsance.dynu.org
minsntnsp.dynu.org
minvoiceverify.dynu.net
minvoiceverifys.dynu.net
miosscap.dynuddns.net
miosscop.dynuddns.net
miserty.dynu.net
miwntvmsn.dynu.org
mlsintms.dynu.org
mmm.dynu.net
mmm.dynuddns.com
mmm.dynuddns.net
mnsitnvd.dynu.org
mntp14po.dynv6.net
moeisapis.dynu.net
moeisapis.dynuddns.net
mois-auth-nid.gm2gx.8lxzbzbtoh.dns.navy
mois-cfdoc.dynu.org
mois-doc.dynuddns.net
mois-doc.roxa.org
mois-docs.dynuddns.net
mois-go.cloud-ip.cc
mois-mew.dynu.net
mois-mew.dynu.org
mois-mew.dynuddns.net
mois-mow.dynu.org
mois-news.dynu.org
mois-nun.dynuddns.net
mois-rudoc.dynu.org
mois.cloud-ip.cc
mois.mytunnel.org
moisales.dynu.net
moisanun.dynu.net
moisapie.dynu.net
moisdcdns.dynu.net
moisedc.dynuddns.net
moisedois.dynu.org
moisedois.dynuddns.net
moisedow.dynu.net
moisedow.dynuddns.net
moiselow.dynuddns.net
moisepow.dynuddns.net
moiserq.dynu.net
moiserq.dynu.org
moiserty.dynu.net
moiserty.dynuddns.net
moisetoast.dynu.net
moisguide.g4gr.eb0bw7j0sr.v6.army
moislote.dynuddns.net
moismews.dynu.org
moisopeq.dynu.net
moispers.dynu.net
moisqit.dynu.net
moisrnun.dynuddns.net
moissoc.dynuddns.net
moisth.dynuddns.net
moistoas.dynuddns.net
moistos.dynu.net
moois-nid.remotewire.net
moscop.dynu.net
moscop.dynuddns.net
most-works.freeddns.org
mpcenhis.dynu.org
mpoise.dynu.net
mprse.dynu.net
mprse.dynuddns.net
mprtos.dynuddns.net
mpsc.dynu.net
mrcpol.dynu.org
mrcpol.dynuddns.net
ms-cloud.ezgateway.net
msbenvtms.dynu.org
msc31ox.dns.navy
msc7ox.dns.navy
mscntmsp.dynu.org
mscodedns.dynu.org
mscodeme.dynu.org
msdinswtd.dynu.org
msdnsmt.dynu.org
msdnsmye.dynu.org
msdnsntns.dynu.net
msdntusne.dynu.net
msdntusne.dynuddns.com
msdtnsmsu.dynu.org
msindmsit.dynu.org
msinidnc.dynu.org
msintmsnt.dynu.org
msipsnlog.dynu.org
msldnsmh.dynu.org
mslingid.dynu.org
mslitend.dynu.org
mslnstmsd.dynu.net
mslntsmt.dynu.org
msndimlo.dynu.org
msnhor.dynu.net
msnhor.dynu.org
msnidltn.dynu.org
msnigtmts.dynu.org
msnomsnts.dynu.org
msntmsits.dynu.org
msnvlogd.dynu.org
msnwingne.dynu.org
msoinsnt.dynu.org
mstndmse.dynu.org
mstnsidnl.dynu.org
msutsidmc.dynu.org
msverfmst.dynu.org
msvlognps.dynu.org
mswintnm.dynu.org
mt115ng6nd.dynv6.net
mtnsidc.dynu.org
mtslock.dynu.org
mtsndic.dynu.org
mvlsnise.dynu.org
mwkim.dynu.org
mwuglp.1exi8anhok2.dns.navy
mxot35us.dns.navy
mybox-hg.v6.rocks
mybox.camdvr.org
myinvoicelist.dynu.net
myinvoicelists.dynu.net
myuserinfo-login.site
mziwnitns.dynu.org
n-aver-log.camdvr.org
n-cloud.julgiya.com
n-cloud.nndvdoc.dynv6.net
n-cloud.ntr26edc.dynv6.net
n-cloud.nts-nidmail.dynv6.net
n-corp.hets12ex.dns.army
n-corp.ncallinfo.v6.army
n-store.nskrm.dynv6.net
n-store.ntdersg.mydns.jp
n-store.nversg.mydns.jp
n-store.plice31osp.dns.army
n2gdnw08p4.dns.navy
nacnhis.dynu.org
nahispe.dynu.net
nahispe.dynuddns.net
nanrhis.dynu.org
nap23ox.dns.navy
nap32ox.dns.navy
nap34ox.dns.navy
nap6ox.dns.navy
nappstatic15svc.dynv6.net
nappstatic64svc.dynv6.net
nappstatic76svc.dynv6.net
nappstatic96svc.dynv6.net
napupdate.dynv6.net
nationalts.dynu.net
nationalts.dynuddns.net
naucommunity.dynv6.net
nav-log.moois-nid.remotewire.net
nav-logins.ntpx12ee.dns.army
nav-veirfy.dynu.org
nav38s.dns.army
navcodem.dynu.org
navdistnd.dynu.net
nave-nhis.dynu.org
nave-pols.dynu.org
naver-auth-tax.2ra7.njkdhfptwn.dynv6.net
naver-login.petfoodkorea.kr
naver.cloudbarfbag.com
naver.craftleds.com
naver.dynu.org
naver.electricalone.com
naver.hbmc.net
naver.iswellhung.com
naver.mywire.org
naver.subsoniclabs.com
naveruserlogin.com
naves-pols.dynu.net
navipse.dynuddns.net
navor22s.dns.navy
navor25s.dns.navy
navre.co.malam.or.id
navs.edocnlist90in.dynv6.net
navs.ncodcoverify.dns.navy
navs.ntltax6in.dynv6.net
nbclog.dynu.org
nblog-auty.dynu.org
nblog-verify.dynu.org
nblog4krs.dynu.org
nblogapps.dynu.net
nblogauth.dynuddns.com
nblogauth.dynuddns.net
nblogauthority.dynu.net
nblogauthoritys.dynu.net
nblogsupports.dynu.net
nbloguty.dynu.org
ncafe-articleshare.com
ncafe-postshare.com
ncafearticle-share.com
ncafepost-read.com
ncafepost-view.com
ncallinfo.v6.army
ncertips.dynu.org
ncertnidm.dynu.org
nchdocmnt.dynuddns.com
nchecknts.dynu.net
nchstcept.dynu.org
nclogt.dynu.org
ncloud.yyuyy.com
nclouddocs.bumbleshrimp.com
ncmadedns.dynu.org
ncodbsverify.dynv6.net
ncodbvverify.dynv6.net
ncodbypass.dynv6.net
ncodbyverify.dynv6.net
ncodbzcheck.dynv6.net
ncodcbcheck.dynv6.net
ncodcgpass.dynv6.net
ncodcjpass.dns.army
ncodckpass.dns.navy
ncodclcheck.dns.navy
ncodcmcheck.dns.navy
ncodcnpass.dns.navy
ncodcnverify.dns.navy
ncodcoverify.dns.navy
ncodcpcheck.dns.navy
ncodcqpass.dns.navy
ncodcqverify.dns.navy
ncodctcheck.dns.navy
ncodcuverify.dns.navy
ncodcwcheck.dns.navy
ncodcwpass.dns.navy
ncodeicheck.v6.army
ncodemid.dynu.org
ncodemois.dynuddns.net
ncodencheck.v6.army
ncodenpass.v6.army
ncodenverify.v6.army
ncodeocheck.dynu.org
ncodeopass.dynu.org
ncodeoverify.dynu.org
ncodepcheck.dynu.org
ncodeppass.dynu.org
ncodepverify.dynu.org
ncodeqcheck.dynu.org
ncodeqpass.dynu.org
ncodeqverify.dynu.org
ncodercheck.dynu.org
ncoderpass.dynu.org
ncoderverify.dynu.org
ncodescheck.dynu.org
ncodespass.dynu.org
ncodesverify.dynu.org
ncodetcheck.dynu.org
ncodetpass.dynu.org
ncodetverify.dynu.org
ncodeucheck.dynu.org
ncodeupass.dynu.org
ncodeuverify.dynu.org
ncodevcheck.dynu.org
ncodevpass.dynu.org
ncodevverify.dynu.org
ncodewcheck.dynu.org
ncodewpass.dynu.org
ncodewverify.dynu.org
ncodexcheck.dynu.org
ncodexpass.dynu.org
ncodexverify.dynu.org
ncodeycheck.dynu.org
ncodeypass.dynu.org
ncodeyverify.dynu.org
ncodezcheck.dynu.org
ncodezpass.dynu.org
ncodezverify.dynu.org
ncodgacheck.dynu.org
ncodgapass.dynu.org
ncodgaverify.dynu.org
ncodgbcheck.dynu.org
ncodgbpass.dynu.org
ncodgbverify.dynu.org
ncodgccheck.dynu.org
ncodgcpass.dynu.org
ncodgcverify.dynu.org
ncodgdcheck.dynu.org
ncodgdpass.dynu.org
ncodgdverify.dynu.org
ncodgecheck.dynu.org
ncodgepass.dynu.org
ncodgeverify.dynu.org
ncodgfcheck.dynu.org
ncodgfpass.dynu.org
ncodgfverify.dynu.org
ncodggcheck.dynu.org
ncodggpass.dynu.org
ncodggverify.dynu.org
ncodghcheck.dynu.org
ncodghpass.dynu.org
ncodghverify.dynu.org
ncodgicheck.dynu.org
ncodgipass.dynu.org
ncodgiverify.dynu.org
ncodgjcheck.dynu.org
ncodgjpass.dynu.org
ncodgjverify.dynu.org
ncodgkcheck.dynu.org
ncodgkpass.dynu.org
ncodgkverify.dynu.org
ncodglcheck.dynu.org
ncodglpass.dynu.org
ncodglverify.dynu.org
ncodgmcheck.dynu.org
ncodgmpass.dynu.org
ncodgmverify.dynu.org
ncodgncheck.dynu.org
ncodgnpass.dynu.org
ncodgnverify.dynu.org
ncodgocheck.dynu.org
ncodgopass.dynu.org
ncodgoverify.dynu.org
ncodgpcheck.dynu.org
ncodgppass.dynu.org
ncodgpverify.dynu.org
ncodgqcheck.dynu.org
ncodgqnpass.dynu.org
ncodgqpass.dynu.org
ncodgqpass.dynu.org.dynu.org
ncodgqverify.dynu.org
ncodgrcheck.dynu.org
ncodgrnpass.dynu.org
ncodgrverify.dynu.org
ncodgscheck.dynu.org
ncodgspass.dynu.org
ncodgsverify.dynu.org
ncodgtcheck.dynu.org
ncodgtnpass.dynu.org
ncodgtpass.dynu.org
ncodgtverify.dynu.org
ncodgucheck.dynu.org
ncodgunpass.dynu.org
ncodguverify.dynu.org
ncodgvcheck.dynu.org
ncodgvnpass.dynu.org
ncodgvverify.dynu.org
ncodgxcheck.dynu.org
ncodgxncheck.dynu.org
ncodgxnpass.dynu.org
ncodgxverify.dynu.org
ncodgyncheck.dynu.org
ncodgynpass.dynu.org
ncodgyverify.dynu.org
ncodgzncheck.dynu.org
ncodgznpass.dynu.org
ncodgzverify.dynu.org
ncodhancheck.dynu.org
ncodhanpass.dynu.org
ncodhaverify.dynu.org
ncodhbncheck.dynu.org
ncodhbnpass.dynu.org
ncodhbpass.dynu.org
ncodhbverify.dynu.org
ncodhcncheck.dynu.org
ncodhcpass.dynu.org
ncodhcverify.dynu.org
ncodhdncheck.dynu.org
ncodhdpass.dynu.org
ncodhdverify.dynu.org
ncodhencheck.dynu.org
ncodhepass.dynu.org
ncodheverify.dynu.org
ncodhgncheck.dynu.org
ncodhgpass.dynu.org
ncodhgverify.dynu.org
ncodhincheck.dynu.org
ncodhipass.dynu.org
ncodhiverify.dynu.org
ncodhjncheck.dynu.org
ncodhjpass.dynu.org
ncodhjverify.dynu.org
ncodhkccheck.dynu.org
ncodhkcheck.dynu.org
ncodhkncheck.dynu.org
ncodhkpass.dynu.org
ncodhkverify.dynu.org
ncodhlccheck.dynu.org
ncodhlpass.dynu.org
ncodhlverify.dynu.org
ncodhmccheck.dynu.org
ncodhmpass.dynu.org
ncodhmverify.dynu.org
ncompost.dynu.net
ncomposts.dynu.net
ncpolice.dynu.org
ncsmtcres.dynu.org
ncvlocks.dynu.org
nd8f3lxih4.v6.navy
ndeliver-d21s.dynv6.net
ndeliver-d40s.dynv6.net
ndeliver-d69s.dynv6.net
ndextoast.dynu.org
ndindocnt.dynuddns.com
ndismvnt.dynu.org
ndistmdoc.dynuddns.com
ndistmstm.dynu.net
ndistmstm.dynu.org
ndlchklog.dynu.org
ndlmtms.dynu.org
ndlogns.dynu.org
ndlsidnts.dynu.net
ndoc-deliver.i6u25s.i0bdvsseci.v6.army
ndoc-stoke.accesscam.org
ndoc.1hvl4j.2towig8bijd.v6.navy
ndoc.hhois.o-r.kr
ndoc.hostnid.ezgateway.net
ndoc.nid-sign.opik.net
ndoc.nnclod.ezgateway.net
ndocadverify.dynv6.net
ndocagcheck.dynv6.net
ndocajcheck.dynv6.net
ndocapcheck.dynv6.net
ndocatverify.dynv6.net
ndocaucheck.dynv6.net
ndocauverify.dynv6.net
ndocavverify.dynv6.net
ndocawverify.dynv6.net
ndocayverify.dynv6.net
ndocazverify.dynv6.net
ndocbdcheck.dynv6.net
ndocbecheck.dynv6.net
ndocbqcheck.dynv6.net
ndocload.cloudvps.ddnsguru.com
ndocmenu.dynu.net
ndocmenu23nd.dynv6.net
ndocmenu64nd.dynv6.net
ndocmpjjcoz.ntu5invoice.dynu.org
ndoczcheck.dynv6.net
ndsmnidne.dynu.net
ndsmnidne.dynuddns.com
ndtypes.dynv6.net
ndxmidty.dynu.org
nehispe.dynu.net
neosxrg.dynu.org
nercms-53load.dynv6.net
nercms-63load.dynv6.net
nercms-7load.dynv6.net
netlinkinvoice.dynu.net
netnid-user.enav.itpxops.dynv6.net
netnidloes.ntxreferzone90nd.dynv6.net
network-inspection.forum
newzonedoc.dynv6.net
nhepgroup.dynu.net
nhepgroups.dynu.net
nhidentical.dynu.net
nhiesopeds.dynu.net
nhipayload.dynu.net
nhis-edoc-cigarette.dynuddns.net
nhis-edoc-otp.dynuddns.net
nhis-edoc-sign.dynuddns.net
nhis-edoc-view.dynu.net
nhis-edoc-view.dynuddns.net
nhis-kr.dynu.org
nhis-mew.dynu.org
nhis-mew.dynuddns.net
nhis-mew1.dynuddns.net
nhis-otp.dynu.org
nhis-otp.dynuddns.net
nhis-verifys.dynu.org
nhis-view.dynu.org
nhis-view.dynuddns.net
nhis.abandon.dynu.org
nhis.abandon.dynuddns.net
nhis.ability.dynu.org
nhis.ability.dynuddns.net
nhis.able.dynu.net
nhis.able.dynu.org
nhis.able.dynuddns.net
nhis.about.dynu.net
nhis.about.dynu.org
nhis.about.dynuddns.net
nhis.above.dynu.net
nhis.above.dynu.org
nhis.above.dynuddns.net
nhis.absent.dynuddns.net
nhis.absorb.dynuddns.net
nhis.abuse.dynu.net
nhis.abuse.dynu.org
nhis.abuse.dynuddns.net
nhis.accident.dynu.org
nhis.accident.dynuddns.net
nhis.account.dynu.net
nhis.account.dynuddns.net
nhis.accuse.dynu.net
nhis.accuse.dynu.org
nhis.accuse.dynuddns.net
nhis.action.dynu.net
nhis.action.dynuddns.net
nhis.activate.dynu.net
nhis.activate.dynu.org
nhis.activate.dynuddns.net
nhis.actor.dynu.net
nhis.actor.dynu.org
nhis.actor.dynuddns.net
nhis.bridge.dynuddns.net
nhis.content.dynuddns.net
nhis.dynu.net
nhis.dynu.org
nhis.dynuddns.net
nhis.edoc.abstract.dynuddns.net
nhis.edoc.dynu.net
nhis.edoc.dynu.org
nhis.edoc.external.dynu.net
nhis.edoc.external.dynu.org
nhis.edoc.invoice.dynu.net
nhis.edoc.invoice.dynuddns.com
nhis.edoc.invoice.dynuddns.net
nhis.edoc.view.dynu.net
nhis.execute.dynu.org
nhis.external.dynu.net
nhis.external.dynuddns.com
nhis.gama.dynu.org
nhis.gama.dynuddns.com
nhis.gama.dynuddns.net
nhis.gemini.dynuddns.com
nhis.immutable.dynu.net
nhis.immutable.dynuddns.com
nhis.immutable.dynuddns.net
nhis.immutable.roxa.org
nhis.immutable.yyuyy.com
nhis.internal.dynu.net
nhis.internal.dynu.org
nhis.internal.dynuddns.com
nhis.internal.dynuddns.net
nhis.mmm.mmm.mmm.dynu.net
nhis.mmm.mmm.mmm.dynuddns.com
nhis.mmm.mmm.mmm.dynuddns.net
nhis.otp.edoc.dynuddns.net
nhis.proxy.dynuddns.net
nhis.random.dynu.org
nhis.random.dynuddns.com
nhis.random.dynuddns.net
nhis.security.dynuddns.net
nhis.smart.edoc.dynuddns.com
nhis.ssl.dynu.org
nhis.ssl.dynuddns.com
nhis.ssl.dynuddns.net
nhis.treat.dynu.net
nhis.treat.dynu.org
nhis.treat.dynuddns.net
nhis.view.dynu.org
nhis.view.dynuddns.net
nhis.xrp.dynuddns.net
nhis.yyuyy.com
nhisabp.dynu.net
nhisabp.dynu.org
nhisadocs.dynu.org
nhisann.dynu.org
nhisarp.dynu.org
nhisauth.dynu.org
nhisbps.dynu.net
nhisconfig26in.dynv6.net
nhisconfigopt.dynu.net
nhisconfigopts.dynu.net
nhiscope.dynu.org
nhiscorps.dynu.org
nhisd14s.dns.army
nhisd17s.dns.army
nhisd32s.dns.army
nhisedis.dynu.org
nhisemain.dynu.org
nhiseos.dynu.org
nhiseost.dynu.org
nhisesops.dynuddns.net
nhisgo.dynu.org
nhisko.dynu.org
nhislocks.dynu.org
nhislos.dynu.org
nhismail.dynu.org
nhismem.dynu.org
nhisncorp.dynu.org
nhisoped.dynu.net
nhisorg.dynu.org
nhisorgs.dynu.org
nhisorps.dynu.org
nhisost.dynu.org
nhisotps.dynu.net
nhisper.dynu.org
nhisprse.dynuddns.net
nhissmtp.dynuddns.net
nhisstr.dynu.org
nhisview.dynu.org
nhisview.dynuddns.net
nhisyes.dynu.org
nhiyer.dynu.org
nhiyer.dynuddns.net
nhmethodpost.dynu.net
nhmethodposts.dynu.net
nhn-articleview.cafe
nhn-cafearticles.com
nhn-cafeposts.com
nhn-postsview.cafe
nhnarticle.cafe
nhncafe-articleview.com
nhncontents-share.cafe
nhncontents.cafe
nhpaddr0load.dynv6.net
nhpaddr10load.dynv6.net
nhpaddr11load.dynv6.net
nhpaddr12load.dynv6.net
nhpaddr13load.dynv6.net
nhpaddr14load.dynv6.net
nhpaddr15load.dynv6.net
nhpaddr16load.dynv6.net
nhpaddr17load.dynv6.net
nhpaddr18load.dynv6.net
nhpaddr19load.dynv6.net
nhpaddr1load.dynv6.net
nhpaddr20load.dynv6.net
nhpaddr21load.dynv6.net
nhpaddr22load.dynv6.net
nhpaddr23load.dynv6.net
nhpaddr24load.dynv6.net
nhpaddr25load.dynv6.net
nhpaddr26load.dynv6.net
nhpaddr27load.dynv6.net
nhpaddr28load.dynv6.net
nhpaddr29load.dynv6.net
nhpaddr2load.dynv6.net
nhpaddr30load.dynv6.net
nhpaddr31load.dynv6.net
nhpaddr32load.dynv6.net
nhpaddr33load.dynv6.net
nhpaddr34load.dynv6.net
nhpaddr35load.dynv6.net
nhpaddr36load.dynv6.net
nhpaddr37load.dynv6.net
nhpaddr38load.dynv6.net
nhpaddr3load.dynv6.net
nhpaddr40load.dynv6.net
nhpaddr4load.dynv6.net
nhpaddr56load.dynv6.net
nhpaddr5load.dynv6.net
nhpaddr66load.dynv6.net
nhpaddr79load.dynv6.net
nhpaddr83load.dynv6.net
nhpaddr8load.dynv6.net
nhpaddr9load.dynv6.net
nhpayrestrict.dynu.net
nhpayrestricts.dynu.net
nhpidentical.dynu.net
nhpidenticals.dynu.net
nhpolercm14v.dynv6.net
nhpolercm19v.dynv6.net
nhpolercm25v.dynv6.net
nhpolercm4v.dynv6.net
nhpolercm58v.dynv6.net
nhpolercm83v.dynv6.net
nhpolercm96v.dynv6.net
nhschis.dynu.org
nhsinsur4s.dynuddns.net
nhsintdle.dynu.net
nhsnhis.dynu.org
nhts20os.dynuddns.com
nhts33os.dynuddns.com
nhts35os.dynuddns.com
nhts39os.dynuddns.com
nhts6os.dynuddns.com
nhtslogs.dynu.org
nhyuis.dynu.net
nid-auth.infocheck.abrdns.com
nid-blog.ublogapps54nd.dynv6.net
nid-blog.ublogapps84nd.dynv6.net
nid-naver-auth.com
nid-naveraqf.servemp3.com
nid-naverara.onthewifi.com
nid-naverbln.serveftp.com
nid-naverbvn.servecounterstrike.com
nid-naverdbo.svcma.com
nid-naverdvl.servequake.com
nid-naverege.servegame.com
nid-naverety.onthewifi.com
nid-naverewj.serveftp.com
nid-naverfuf.servepics.com
nid-naverful.theworkpc.com
nid-navergre.serveftp.com
nid-naverhjy.serveftp.com
nid-naverhjz.servepics.com
nid-naverhxt.servecounterstrike.com
nid-naverigm.servepics.com
nid-naverkuf.servehalflife.com
nid-naverlvb.servepics.com
nid-navermar.servegame.com
nid-navermkf.servequake.com
nid-navermox.servemp3.com
nid-navermrw.svcma.com
nid-navernae.servemp3.com
nid-naverotm.servecounterstrike.com
nid-naverovb.svcma.com
nid-naverpzl.servehalflife.com
nid-naverqbj.servehalflife.com
nid-naverrgc.servequake.com
nid-naverrvh.serveftp.com
nid-naverscn.svcma.com
nid-navershg.servecounterstrike.com
nid-naversis.servepics.com
nid-naversoc.servemp3.com
nid-navertdn.serveftp.com
nid-navertfe.servegame.com
nid-navertue.onthewifi.com
nid-navervmt.servemp3.com
nid-naverwuk.servecounterstrike.com
nid-naverxzm.servegame.com
nid-naverydh.onthewifi.com
nid-naveryqr.servepics.com
nid-naverzlx.servegame.com
nid-naverzwi.ooguy.com
nid-naverzyc.onthewifi.com
nid-nhis.dynuddns.net
nid-nver.mybox.camdvr.org
nid-sign.opik.net
nid-support.abrdns.com
nid-token.bumbleshrimp.com
nid-user.hets22ex.dns.army
nid-user.nts-nidstore.dns.navy
nid.6hnz.t6n0tgju441.v6.navy
nid.erpolicies-0v.dynv6.net
nid.galaxybookthanksparty.com
nid.ips-doc.webredirect.org
nid.napupdate.dynv6.net
nid.naver.cloudbarfbag.com
nid.naver.craftleds.com
nid.naver.dynu.org
nid.naver.electricalone.com
nid.naver.hbmc.net
nid.naver.iswellhung.com
nid.naver.mywire.org
nid.naver.subsoniclabs.com
nid.ncodbvverify.dynv6.net
nid.ncodckpass.dns.navy
nid.ncodcnpass.dns.navy
nid.ncodcpcheck.dns.navy
nid.ndocazverify.dynv6.net
nid.nercms-53load.dynv6.net
nid.nid-sign.opik.net
nid.niddirect.dns.army
nid.niws.mysynology.net
nid.nusser.ezgateway.net
nid.oercm-64load.dynv6.net
nid.officialipsline.ddnsguru.com
nid.puoios.o-r.kr
nid.zonetaxload73nd.dynv6.net
nida.trxs32es.dns.navy
niddirect.dns.army
niddnaver.com
nidloes.ncodclcheck.dns.navy
nidloes.nhisconfig26in.dynv6.net
nidloes.ntxreferzone90nd.dynv6.net
nidlogins.ncodcbcheck.dynv6.net
nidlogins.ncodcnverify.dns.navy
nidlogins.ncodencheck.v6.army
nidlogins.ncodenpass.v6.army
nidlogins.ndocatverify.dynv6.net
nidmcheck.dynu.org
nidmcodel.dynu.org
nidmlsit.dynu.org
nidnaver.com
nidnaverauth.com
nidnaverlogin.com
nidnaversecurity.com
nidnaversign.com
nidnnaver.site
nidnoreplynaver.com
nidqlqy.uinvoicezone.dynu.net
nids.nblog4krs.dynu.org
nids.ndocbqcheck.dynv6.net
nids.trxs33es.dns.navy
nids.trxs34es.dns.navy
nidservers.nap34ox.dns.navy
nidservers.ntpx13ee.dns.army
nidservers.tpox17er.dns.army
nidservers.trxs4es.dns.navy
nidsign.772g.vsjlpbrey1d.v6.navy
nidsupport.dns.army
nidvmcts.dynu.org
niercmagent.dynu.net
niercmagents.dynu.net
ninvoice.nclouddocs.bumbleshrimp.com
ninvoice.nmlist.p-e.kr
ninvoice.nmosinvoice.dns.army
ninvoice.officialipsline.ddnsguru.com
nipadd13load.dynv6.net
nipadd17load.dynv6.net
nipadd20load.dynv6.net
nipadd23load.dynv6.net
nipadd24load.dynv6.net
nipadd26load.dynv6.net
nipadd27load.dynv6.net
nipadd28load.dynv6.net
nipadd29load.dynv6.net
nipadd2load.dynv6.net
nipadd30load.dynv6.net
nipadd31load.dynv6.net
nipadd32load.dynv6.net
nipadd33load.dynv6.net
nipadd34load.dynv6.net
nipadd35load.dynv6.net
nipadd36load.dynv6.net
nipadd37load.dynv6.net
nipadd38load.dynv6.net
nipadd39load.dynv6.net
nipadd40load.dynv6.net
nipadd41load.dynv6.net
nipadd43load.dynv6.net
nipadd44load.dynv6.net
nipadd45load.dynv6.net
nipadd46load.dynv6.net
nipadd47load.dynv6.net
nipadd48load.dynv6.net
nipadd49load.dynv6.net
nipadd4load.dynv6.net
nipadd50load.dynv6.net
nipadd51load.dynv6.net
nipadd52load.dynv6.net
nipadd53load.dynv6.net
nipadd54load.dynv6.net
nipadd55load.dynv6.net
nipadd56load.dynv6.net
nipadd57load.dynv6.net
nipadd58load.dynv6.net
nipadd60load.dynv6.net
nipadd61load.dynv6.net
nipadd62load.dynv6.net
nipadd63load.dynv6.net
nipadd64load.dynv6.net
nipadd65load.dynv6.net
nipadd66load.dynv6.net
nipadd67load.dynv6.net
nipadd68load.dynv6.net
nipadd69load.dynv6.net
nipadd6load.dynv6.net
nipadd70load.dynv6.net
nipadd71load.dynv6.net
nipadd72load.dynv6.net
nipadd73load.dynv6.net
nipadd74load.dynv6.net
nipadd75load.dynv6.net
nipadd76load.dynv6.net
nipadd77load.dynv6.net
nipadd78load.dynv6.net
nipadd79load.dynv6.net
nipadd7load.dynv6.net
nipadd80load.dynv6.net
nipadd81load.dynv6.net
nipadd82load.dynv6.net
nipadd83load.dynv6.net
nipadd89load.dynv6.net
nipadd97load.dynv6.net
nipadd99load.dynv6.net
nipadd9load.dynv6.net
nipipes.dynuddns.net
nipsntmlog.dynu.org
nipsverifications.dynu.net
nisoft.yyuyy.com
nivmsade.dynu.org
niws.mysynology.net
nj1oayuy2o.dns.army
njkdhfptwn.dynv6.net
nkagtncqah.v6.navy
nkeps25s.dynv6.net
nkeps33s.dynv6.net
nkeps35s.dynv6.net
nkeps42s.dynv6.net
nkeps45s.dynv6.net
nkeps50s.dynv6.net
nkeps54s.dynv6.net
nkeps58s.dynv6.net
nkeps68s.dynv6.net
nkeps7s.dynv6.net
nkeps8s.dynv6.net
nl-i19sdn12k.replit.app
nld-nhis.dynuddns.net
nlmsuser10doc.dynv6.net
nlmsuser14doc.dynv6.net
nlmsuser19doc.dynv6.net
nlmsuser20doc.dynv6.net
nlmsuser23doc.dynv6.net
nlmsuser28doc.dynv6.net
nlmsuser29doc.dynv6.net
nlmsuser38doc.dynv6.net
nlmsuser67doc.dynv6.net
nlmsuser80doc.dynv6.net
nlrbin.mydns.jp
nlsdtime.dynu.net
nlskghsu.dynu.net
nlsmidn.dynu.org
nlsmintms.dynu.org
nltmdsme.dynu.org
nmalistdc.dynuddns.com
nmancode.dynu.org
nmethodsrc21v.dynuddns.com
nmlist.p-e.kr
nmosinvoice.dns.army
nms.loadmis.abrdns.com
nmsinls.dynu.org
nmsintsm.dynu.org
nmslitend.dynu.org
nmtsnide.dynu.org
nnclod.ezgateway.net
nndvdoc.dynv6.net
nnvcnhs.dynu.org
nnverlog.ezgateway.net
nopdoc12load.dynv6.net
nopdoc21load.dynv6.net
nopdoc29load.dynv6.net
nopdoc33load.dynv6.net
nopdoc34load.dynv6.net
nopdoc39load.dynv6.net
nopdoc55load.dynv6.net
nopdoc60load.dynv6.net
nopdoc64load.dynv6.net
nopdoc69load.dynv6.net
nopdoc77load.dynv6.net
nopdoc81load.dynv6.net
nopdoc87load.dynv6.net
nopdoc88load.dynv6.net
nopdoc8load.dynv6.net
nopdoc93load.dynv6.net
nopdoc95load.dynv6.net
nopdoc97load.dynv6.net
nopdoc99load.dynv6.net
noreplyaccou.dynv6.net
noreplymybox.xyz
noreturn-wetax.forum
notxrg.dynu.org
npayrestrict.dynu.net
npayrestricts.dynu.net
npayvoice.bumbleshrimp.com
npchannel11s.dynv6.net
npchannel17s.dynv6.net
npchannel1s.dynv6.net
npchannel25s.dynv6.net
npchannel2s.dynv6.net
npchannel32s.dynv6.net
npchannel38s.dynv6.net
npchannel39s.dynv6.net
npchannel58s.dynv6.net
npchannel60s.dynv6.net
npchannel77s.dynv6.net
npcinformbox.dynu.net
npigoji16sv.dns.army
npigoji18sv.dns.army
npigoji8sv.dns.army
npinvoicload94in.dynv6.net
npo-doc.workspace.cloud-ip.cc
npofficaaeials14in.dynv6.net
npolice-api.dynu.org
npolicyerc.dynu.net
npolicyercs.dynu.net
nportalch.dynu.net
npoverify.dynv6.net
npreferinvoice38in.dynv6.net
npreferinvoice93in.dynv6.net
nps-authdep32svc.dynv6.net
nps-edoc.dynu.net
nps-load.remotewire.net
nps.ssltest1.dynv6.net
npsadoc.dynuddns.net
npschec.dynu.net
npsdoc.dns.navy
npspartyapp0sv.dns.army
nptpay17s.dynv6.net
nptpay36s.dynv6.net
nptpay38s.dynv6.net
nptpay40s.dynv6.net
nptpay47s.dynv6.net
nptpay8s.dynv6.net
npublishblog.dynu.net
npublishblogs.dynu.net
npvlog1docs.dns.army
nrg644np82.v6.army
ns6docs.dynv6.net
nsamhoism.dynuddns.com
nsbemitn.dynu.org
nsc-nhis.dynuddns.net
nschekcode.dynu.org
nscnidm.dynu.org
nsdimsnth.dynu.net
nseclnk.mydns.bz
nsecload.ncloud.yyuyy.com
nshmsmcop.dynu.org
nsicodeverify.dynu.org
nsidmlog.dynu.org
nsidmstnd.dynu.net
nsintmspt.dynu.org
nskrm.dynv6.net
nslntid.dynu.org
nslognv.dynu.org
nslsbgode.dynuddns.com
nslsndmis.dynu.org
nsmcihsd.dynu.org
nsmditstn.dynu.net
nsmdnsi.dynu.org
nsmhsnpd.dynu.org
nsmidtc.dynu.org
nsmingswm.dynu.org
nsminidms.dynu.org
nsmitnsd.dynu.org
nsmitnwb.dynu.org
nsneitnps.dynu.org
nst.mysynology.net
nstcmlg.dynu.org
nstcodensg.dynu.org
nstcsnad.dynu.org
nstidnv.dynu.org
nstnasnt.dynu.org
nstnitem.dynu.org
nstorecode.dynu.org
nsupport.ipse.ro
nsv-mnstm.dynu.net
nt-taxbill15th.dynv6.net
nt-taxbill70th.dynv6.net
nt-usermem66s.dynv6.net
ntaxe9otp.dynv6.net
ntaxgo.dynu.org
ntaxservice.dynuddns.net
ntbooksvc.dynv6.net
ntc13xt.dns.navy
ntc6xt.dns.navy
ntcdoctype17th.dynv6.net
ntcdoctype31th.dynv6.net
ntcdoctype41th.dynv6.net
ntcdoctype57th.dynv6.net
ntcdoctype64th.dynv6.net
ntcdoctype83th.dynv6.net
ntclos.dynu.net
ntdersg.mydns.jp
ntdmenu6in.dynv6.net
ntdoc-epayload10s.dynv6.net
ntdoc-epayload43s.dynv6.net
ntenterprise.dynv6.net
ntesyh.dynu.net
ntesyh.dynu.org
ntexop.dynu.org
ntextoast.dynu.org
ntinvcertificate.dynu.net
ntinvcertificates.dynu.net
ntinvoicedoc.kro.kr
ntinvoicekdoc.dynu.net
ntjune16th.dynv6.net
ntjune21th.dynv6.net
ntjune2th.dynv6.net
ntjune30th.dynv6.net
ntjune44th.dynv6.net
ntjune73th.dynv6.net
ntjune75th.dynv6.net
ntjunemem18in.dynv6.net
ntloadu10s.dynv6.net
ntloadu11s.dynv6.net
ntloadu12s.dynv6.net
ntloadu13s.dynv6.net
ntloadu14s.dynv6.net
ntloadu15s.dynv6.net
ntloadu16s.dynv6.net
ntloadu17s.dynv6.net
ntloadu18s.dynv6.net
ntloadu19s.dynv6.net
ntloadu20s.dynv6.net
ntloadu21s.dynv6.net
ntloadu22s.dynv6.net
ntloadu23s.dynv6.net
ntloadu24s.dynv6.net
ntloadu25s.dynv6.net
ntloadu26s.dynv6.net
ntloadu27s.dynv6.net
ntloadu29s.dynv6.net
ntloadu30s.dynv6.net
ntloadu31s.dynv6.net
ntloadu32s.dynv6.net
ntloadu33s.dynv6.net
ntloadu34s.dynv6.net
ntloadu35s.dynv6.net
ntloadu46s.dynv6.net
ntloadu63s.dynv6.net
ntloadu70s.dynv6.net
ntloadu71s.dynv6.net
ntloadu7s.dynv6.net
ntloadu80s.dynv6.net
ntloadu87s.dynv6.net
ntltax13in.dynv6.net
ntltax15in.dynv6.net
ntltax6in.dynv6.net
ntmaindoc82th.dns.army
ntnmid.dynu.net
ntnmid.dynuddns.com
ntnsipsm.dynu.org
ntorg-ins24th.dynv6.net
ntorsevr.dynuddns.net
ntpayloaden.dynu.net
ntpayloadens.dynu.net
ntpaymentrec.dynu.net
ntpaymentrecs.dynu.net
ntpx12ee.dns.army
ntpx13ee.dns.army
ntpx15ee.dns.army
ntpx5ee.dns.army
ntr26edc.dynv6.net
ntreferdmenu.dynu.net
ntreferentry.dynu.net
ntreferentrys.dynu.net
ntres.dynu.org
ntrightblog.dynu.net
ntrightblogs.dynu.net
ntrxem.dynu.org
nts-doc.xn73zj.vea4cc4pbgk.dns.army
nts-kr.dns.army
nts-nidmail.dynv6.net
nts-nidstore.dns.navy
nts-team.accesscam.org
nts-uinvoice35th.dynv6.net
nts-uinvoice49th.dynv6.net
nts-uinvoice67th.dynv6.net
nts-uinvoice86th.dynv6.net
nts-view.dynuddns.net
nts-write.remotewire.net
nts-xdocs.dynu.org
nts.dynu.org
nts.dynuddns.net
nts19aed.dns.army
ntschannel0sv.dynv6.net
ntschannel10sv.dynv6.net
ntschannel11sv.dynv6.net
ntschannel12sv.dynv6.net
ntschannel13sv.dynv6.net
ntschannel14sv.dynv6.net
ntschannel15sv.dynv6.net
ntschannel16sv.dynv6.net
ntschannel18sv.dynv6.net
ntschannel19sv.dynv6.net
ntschannel1sv.dynv6.net
ntschannel20sv.dynv6.net
ntschannel22sv.dynv6.net
ntschannel23sv.dynv6.net
ntschannel24sv.dynv6.net
ntschannel25sv.dynv6.net
ntschannel26sv.dynv6.net
ntschannel27sv.dynv6.net
ntschannel28sv.dynv6.net
ntschannel29sv.dynv6.net
ntschannel2sv.dynv6.net
ntschannel30sv.dynv6.net
ntschannel31sv.dynv6.net
ntschannel32sv.dynv6.net
ntschannel3sv.dynv6.net
ntschannel4sv.dynv6.net
ntschannel5sv.dynv6.net
ntschannel6sv.dynv6.net
ntschannel7sv.dynv6.net
ntschannel8sv.dynv6.net
ntschannel9sv.dynv6.net
ntschechange.dynu.net
ntschechanges.dynu.net
ntseno0s.dns.army
ntseno26s.dns.army
ntseno38s.dns.army
ntservicer0th.dns.army
ntservicer13th.dns.army
ntservicer14th.dns.army
ntservicer54th.dns.army
ntservicer66th.dns.army
ntservicer73th.dns.army
ntsgo.dynu.org
ntsgo.dynuddns.net
ntsogeu.yyuyy.com
ntsunidoc2th.dynv6.net
ntsunidoc6th.dynv6.net
ntsunidoc8th.dynv6.net
ntt-suggest.most-works.freeddns.org
ntt-suggest.oijoho.1cooldns.com
ntu5invoice.dynu.org
ntujtxc.nhpaddr31load.dynv6.net
ntuserrequest.dynu.net
ntuserrequests.dynu.net
ntvalldocs.kro.kr
ntvconfirm.dynv6.net
ntvcorp-ins2th.dns.army
ntvcorp-ins61th.dns.army
ntverify.nisoft.yyuyy.com
ntx-go.dynu.org
ntx-mipos.dynu.org
ntx-naver.dynu.net
ntxadoc.dynuddns.net
ntxaldos.dynuddns.net
ntxalerts.dynu.org
ntxalerts.dynuddns.net
ntxarped.dynuddns.net
ntxcdoc.dynu.org
ntxclos.dynu.net
ntxcrfe.dynu.org
ntxelogs.dynuddns.net
ntxentireml.dynu.net
ntxentiremls.dynu.net
ntxesdoc38s.dynv6.net
ntxipos.dynu.org
ntxoge.dynuddns.net
ntxr12os.dns.army
ntxr14os.dns.army
ntxr37os.dns.army
ntxreferzone32nd.dynv6.net
ntxreferzone33nd.dynv6.net
ntxreferzone44nd.dynv6.net
ntxreferzone48nd.dynv6.net
ntxreferzone81nd.dynv6.net
ntxreferzone85nd.dynv6.net
ntxreferzone90nd.dynv6.net
ntxreflist.dynu.net
ntxsourcea15th.dynv6.net
ntxsourcea48th.dynv6.net
ntxsourcea4th.dynv6.net
ntxsourcea63th.dynv6.net
ntxsourcea66th.dynv6.net
ntxsourcea8th.dynv6.net
ntxsourcea91th.dynv6.net
ntxsourcea97th.dynv6.net
ntxstore.dynv6.net
ntxzone.dynu.net
nudoc-check.e639kk.wjyx49u3cu3.dns.army
nuinsconfirm.dynu.net
nuinsconfirms.dynu.net
nupdatelnk.dynv6.net
nuredirect.mydns.bz
nuser-login.julgiya.com
nuser-login.nskrm.dynv6.net
nuser-login.nversg.mydns.jp
nuser.flashhub.net
nuserlogin.julgiya.com
nusntx0s.dynv6.net
nusntx10s.dynv6.net
nusntx11s.dynv6.net
nusntx12s.dynv6.net
nusntx13s.dynv6.net
nusntx14s.dynv6.net
nusntx15s.dynv6.net
nusntx16s.dynv6.net
nusntx17s.dynv6.net
nusntx18s.dynv6.net
nusntx19s.dynv6.net
nusntx1s.dynv6.net
nusntx20s.dynv6.net
nusntx21s.dynv6.net
nusntx22s.dynv6.net
nusntx23s.dynv6.net
nusntx24s.dynv6.net
nusntx25s.dynv6.net
nusntx26s.dynv6.net
nusntx27s.dynv6.net
nusntx28s.dynv6.net
nusntx29s.dynv6.net
nusntx2s.dynv6.net
nusntx30s.dynv6.net
nusntx36s.dynv6.net
nusntx38s.dynv6.net
nusntx39s.dynv6.net
nusntx3s.dynv6.net
nusntx42s.dynv6.net
nusntx43s.dynv6.net
nusntx4s.dynv6.net
nusntx56s.dynv6.net
nusntx5s.dynv6.net
nusntx6s.dynv6.net
nusntx78s.dynv6.net
nusntx7s.dynv6.net
nusntx80s.dynv6.net
nusntx88s.dynv6.net
nusntx89s.dynv6.net
nusntx8s.dynv6.net
nusntx92s.dynv6.net
nusntx9s.dynv6.net
nusrauth.gleeze.com
nusser.ezgateway.net
nutypeinvest.dynu.net
nutypeinvests.dynu.net
nvapptax39s.dynv6.net
nvapptax43s.dynv6.net
nvapptax92s.dynv6.net
nvcntse.dynu.org
nvcodems.dynu.org
nverfind.dynu.org
nverfsnts.dynu.net
nverncall.dynu.org
nversg.mydns.jp
nvfhis.dynu.org
nvlistenld.dynu.org
nvlogmips.dynu.org
nvlogms.dynu.org
nvlsndisn.dynu.net
nvnhis.dynu.org
nvservemd.dynu.org
nvsmlogsm.dynu.org
nvsntnis.dynu.org
nvtsp5s.dns.navy
nvzonedomain.dynv6.net
nwtermlnk.mydns.bz
nxalogs.dynuddns.net
nxealogs.dynuddns.net
nxsign.nuser.flashhub.net
nxtdocs.dynu.org
nyg5bs4d6k.dns.navy
nzintsnm.dynu.org
nzminwmit.dynu.org
o9boxycllsw0ewtg.enav.itpxops.dynv6.net
oercm-10load.dynv6.net
oercm-17load.dynv6.net
oercm-18load.dynv6.net
oercm-1load.dynv6.net
oercm-37load.dynv6.net
oercm-3load.dynv6.net
oercm-41load.dynv6.net
oercm-44load.dynv6.net
oercm-47load.dynv6.net
oercm-56load.dynv6.net
oercm-58load.dynv6.net
oercm-64load.dynv6.net
oercm-68load.dynv6.net
oercm-7load.dynv6.net
oercm-80load.dynv6.net
oercm-84load.dynv6.net
oercm-87load.dynv6.net
oercm-98load.dynv6.net
official-notice.click
officialipsline.ddnsguru.com
ofwajrd6pr.v6.navy
oijoho.1cooldns.com
once.dynuddns.net
onlineblogcon.dynu.net
onlinedepsvc.dynu.net
onlinedepsvcs.dynu.net
onlinepoldep.dynu.net
onlinepoldeps.dynu.net
onlinestyledoc.dynu.net
onlinestyledocs.dynu.net
onsmsntni.dynu.org
oopp.dynu.net
opcnhis.dynu.net
opcnhis.dynu.org
orctnhis.dynu.org
ortnhis.dynu.net
otp.dynu.net
otp.dynu.org
otp.dynuddns.net
otp.edoc.dynuddns.net
otp.freeddns.org
otp.mew.dynuddns.net
oyysys.easypanel.host
paperdoc.nnverlog.ezgateway.net
paperless-korea.one
passnid.lopm.webredirect.org
payment-doc.whois.cloud-ip.cc
paynorelpy.ink
pentxer.dynu.net
picorpe.dynu.net
picorpe.dynu.org
piecoes.dynu.net
pioips.dynu.org
piscorps.dynu.net
pisecors.dynuddns.net
plice31osp.dns.army
plicynaver.com
poclmr.dynu.org
poesdoc.dynu.net
pol-dows.dynu.net
pol-dows.dynuddns.net
pol-eows.dynu.net
pol-eows.dynu.org
pol-ew.dynu.org
pol-mows.dynuddns.net
polals.dynu.net
poldepinfo.dynu.org
poldoc3osp.dns.army
poldocs.dynuddns.net
poldocsinf.dynu.net
poled20s.dns.army
poledos.dynu.net
polep.dynu.net
polercm-19v.dynv6.net
polercm-1v.dynv6.net
polercm-26v.dynv6.net
polercm-27v.dynv6.net
polercm-35v.dynv6.net
polercm-40v.dynv6.net
polercm-43v.dynv6.net
polercm-4v.dynv6.net
polercm-55v.dynv6.net
polercm-56v.dynv6.net
polercm-67v.dynv6.net
polercm-84v.dynv6.net
polic-go-kr.9a3jpx.3smb1kpyd2.v6.rocks
policedoc.dynuddns.net
polices.dynu.net
polrtc.dynuddns.net
polsecu.dynu.net
polsecu.dynuddns.net
polsos.dynuddns.net
poltoast.dynu.net
por4dwim0u.v6.army
portal.clovanote.ohbah.com
posldoces.dynu.net
post-nhncafe.com
postcheck.click
ppolesr.dynu.net
premiatnc.dynu.org
prodetailblog.dynu.net
prodetailblogs.dynu.net
proxy.dynuddns.net
pshidusnt.dynu.org
psnmsind.dynu.org
psverify.dynu.org
public-revenue-info.biz
publishndoc.dynu.net
publishndocs.dynu.net
puoios.o-r.kr
pvckqipp.nipadd17load.dynv6.net
pvcntse.dynu.org
qwer.ncodenverify.v6.army
qwiuefyalsjhdoqw.com
qwoefintvsef.dynv6.net
r461wn14u1.dns.army
random.dynu.org
random.dynuddns.com
random.dynuddns.net
random.jgf674.com
rcpole.dynu.net
rcpole.dynuddns.net
realpicken.dynv6.net
recnhis.dynu.net
recnhis.dynu.org
redirect.ydns.eu
referalntdoc.dynu.org
refertaxcode11in.dynv6.net
refertaxcode15in.dynv6.net
refertaxcode32in.dynv6.net
refertaxcode57in.dynv6.net
refertaxcode83in.dynv6.net
report-email.site
research-nt86in.dynv6.net
resourcentdoc19th.dynv6.net
resourcentdoc7th.dynv6.net
resourcentdoc80th.dynv6.net
resourcentdoc83th.dynv6.net
review-order-check.cfd
rfjx07u0x3.dns.navy
rhkrgun.dynu.net
ripwor.com
rjsfg324.dynv6.net
rpcpol.dynu.net
rqcuwdit.nusntx43s.dynv6.net
rteznby.nipadd20load.dynv6.net
s156a1mqvz7iq9vn.hat22ex.dns.army
s8arkan4ja.dns.army
sandmsid.dynu.org
savips.dynuddns.net
savtax.dynuddns.net
sbnvntns.dynu.org
schecksnd.dynuddns.com
sec-passe.dynv6.net
seccheck-korea.site
secsettingcheck.quest
sectableid13s.dynv6.net
sectableid37s.dynv6.net
securebit.store
security.dynuddns.net
server.dynu.org
service-nid.6c874.kvp207shd6.dns.navy
service-nid.d8hr0a.nyg5bs4d6k.dns.navy
serviceoyload.dynu.net
serviceoyloads.dynu.net
shake-shack.daliajobs.com
shop.favnshield.fun
sidnance.dynu.org
signer.dns.army
signin-verify.dynu.org
skyhighinfo.info
slmtmise.dynu.net
slnsmitn.dynu.org
smaintmsn.dynu.org
smart-bill-korea.cyou
smart.edoc.dynuddns.com
smart.nhis.yyuyy.com
smchecksm.dynu.org
smdmstnsh.dynu.net
smdncoden.dynu.org
smdnistls.dynu.org
sminsmots.dynu.net
sminsmots.dynu.org
smklsnid.dynu.org
smnoz.dynu.org
snamidns.dynu.org
sndisntle.dynu.org
snidnmls.dynu.org
snistnmst.dynu.org
snitnismg.dynu.net
snitnismg.dynu.org
snkenafse.dynu.net
snlmdins.dynu.org
snmidns.dynu.org
snmsntip.dynu.org
snodmtime.dynu.org
snodtsime.dynu.org
srtnhis.dynu.org
ssl.dynu.org
ssl.dynuddns.com
ssl.dynuddns.net
ssltest1.dynv6.net
station.dynu.org
stg.daliajobs.com
sunbunbest.dynu.org
support.nst.mysynology.net
svcntse.dynu.org
t6n0tgju441.v6.navy
tahpuoto94.dns.army
tals1ex.dynv6.net
tals5ex.dynv6.net
tat0donzfr.dynv6.net
tax-guide.f29pvq.v5f6rd4lwz.dynv6.net
tax-guide.unids.com
taxdepright.dynu.net
taxdeprights.dynu.net
taxidentical.dynu.net
taxmarginlv18in.dynv6.net
taxmarginlv24in.dynv6.net
taxmarginlv41in.dynv6.net
taxmarginlv90in.dynv6.net
taxmarginlv98in.dynv6.net
taxmarginlv99in.dynv6.net
taxonload.dynu.net
taxonloads.dynu.net
taxserv.dynuddns.net
tech-nid.z1gd.a93xkcs4y2.v6.army
tinvoice.opik.net
tnt62bh2xgz.dns.navy
toastnhis.dynu.org
tpox17er.dns.army
tpqjswp.dynv6.net
treat.dynu.net
treat.dynu.org
treat.dynuddns.net
trur.interhop.net
trx0alert.dns.navy
trx10alert.dns.navy
trx12alert.dns.navy
trx16alert.dns.navy
trx17alert.dns.navy
trx19alert.dns.navy
trx20alert.dns.navy
trx21alert.dns.navy
trx22alert.dns.navy
trx25alert.dns.navy
trx28alert.dns.navy
trx29alert.dns.navy
trx2alert.dns.navy
trx9alert.dns.navy
trxs0es.dns.navy
trxs25es.dns.navy
trxs32es.dns.navy
trxs33es.dns.navy
trxs34es.dns.navy
trxs35es.dns.navy
trxs37es.dns.navy
trxs38es.dns.navy
trxs39es.dns.navy
trxs4es.dns.navy
ts1-008.trur.interhop.net
txpoise.dynu.net
u4bhx3zo39.v6.navy
ublogapps.dynu.net
ublogapps0nd.dynv6.net
ublogapps12nd.dynv6.net
ublogapps14nd.dynv6.net
ublogapps16nd.dynv6.net
ublogapps26nd.dynv6.net
ublogapps2nd.dynv6.net
ublogapps34nd.dynv6.net
ublogapps40nd.dynv6.net
ublogapps48nd.dynv6.net
ublogapps54nd.dynv6.net
ublogapps68nd.dynv6.net
ublogapps72nd.dynv6.net
ublogapps75nd.dynv6.net
ublogapps77nd.dynv6.net
ublogapps84nd.dynv6.net
ubloginteract.dynu.net
ubloglocker.dynu.net
ubloglockers.dynu.net
ublogpromt.dynu.net
ublogpromts.dynu.net
udoc-nid.freeddns.org
ug72r637rqr.dns.navy
uinfaccess.dynu.net
uinvoiceacces.dynu.net
uinvoicezone.dynu.net
uinvoicezone.dynu.org
uitxlog.dynu.net
uitxlog.dynuddns.net
unitaxdep.dynu.net
untxlog.dynu.net
untxlog.dynu.org
uofficialerc13v.dynuddns.com
uofficialerc14v.dynuddns.com
uofficialerc20v.dynuddns.com
uofficialerc21v.dynuddns.com
uofficialerc28v.dynuddns.com
uofficialerc33v.dynuddns.com
uofficialerc34v.dynuddns.com
uofficialerc45v.dynuddns.com
uofficialerc5v.dynuddns.com
uprofverify.mydns.bz
urgent-notice-check.click
user-login.userauth.mydns.vc
userauth.mydns.vc
userblzone61nd.dynv6.net
userblzone68nd.dynv6.net
usereboardi.dynu.net
usereboardis.dynu.net
usr.nercms-63load.dynv6.net
usr.nhpolercm83v.dynv6.net
usr.oercm-58load.dynv6.net
usrntx47s.dynv6.net
usrntx4s.dynv6.net
usrntx79s.dynv6.net
usrntx86s.dynv6.net
usrntx92s.dynv6.net
usrntx9s.dynv6.net
usrntxverify.dynu.net
usrntxverifys.dynu.net
usrprofileoption.dynu.net
usrprofileoptions.dynu.net
usrrightcorp.dynu.net
usrrightcorps.dynu.net
utsnidm.dynu.org
utvhis.dynu.net
uui90svmzk.dns.navy
uxk-nid.nps-load.remotewire.net
uy0hb4hpg3.dns.navy
v32l8g4nbc3.dns.navy
v5f6rd4lwz.dynv6.net
vcnhisrps.dynuddns.net
vea4cc4pbgk.dns.army
verfiycheck.dynu.org
verify-compliance.monster
verify-nid.suredoc.net
verifymois.dynuddns.net
vernhis.dynu.org
victuslaser.sbs
view.dynu.net
view.dynu.org
view.dynuddns.net
view.mew-otp.dynu.org
view.mew-otp.dynuddns.net
view.otp.dynu.net
view.otp.dynu.org
view.otp.freeddns.org
vipsdoc.dynu.net
vipsdocs.dynu.org
vlkjq328j-q2odlajejfj-vnweq1v.site
vnhisaps.dynu.net
vsjlpbrey1d.v6.navy
vsnlirdm.dynu.org
vuczu.xp2xbk8ukme.dns.army
vyvipbnt5p0.dns.army
web.dev3.daliajobs.com
wetaxofficer.dynu.net
wetaxofficers.dynu.net
wetaxofficrs.dynu.net
whois.cloud-ip.cc
whois.dynuddns.com
wjswkanstj.dynu.org
wjyx49u3cu3.dns.army
workspace.cloud-ip.cc
wos-nver.abrdns.com
wv05i1q670.dns.navy
x5ffq2z8h8.dns.navy
x6nnfysecw.v6.navy
xblhfkri2q.dns.army
xemoies.dynu.net
xemois.dynu.net
xepoies.dynu.net
xepoies.dynuddns.net
xi99w080ra.dynv6.net
xltxe.dynu.org
xmntxe.dynu.org
xn73zj.vea4cc4pbgk.dns.army
xp2xbk8ukme.dns.army
xpentr.dynu.net
xpentr.dynuddns.net
xpmcau.nipadd97load.dynv6.net
xrp.dynuddns.net
xtfsqcm-12.top
xu8c4wc8q3.dns.army
y8fb9ktbd7f.dns.navy
ywcdrzkqzmo.dns.navy
yyuatk.nipadd9load.dynv6.net
z1gd.a93xkcs4y2.v6.army
zbwitnts.dynu.org
zonetaxload1nd.dynv6.net
zonetaxload23nd.dynv6.net
zonetaxload24nd.dynv6.net
zonetaxload4nd.dynv6.net
zonetaxload53nd.dynv6.net
zonetaxload73nd.dynv6.net
zonetaxload92nd.dynv6.net
zonetaxload94nd.dynv6.net
zsg8de2qpw0.dns.navy
zw6znpa0g2rw3pjl.enav.itpxops.dynv6.net

# Reference: https://www.virustotal.com/gui/ip-address/27.102.137.226/relations

http://27.102.137.226
plusmembership.xyz

# Reference: https://www.virustotal.com/gui/ip-address/27.102.138.119/relations

http://27.102.138.119
accountnaver.xyz
kkbblg.com
klooknoreply.xyz
nidenaver.site
nidinaver.site
nidnoreply.xyz
noreplynaver.xyz

# Reference: https://www.virustotal.com/gui/ip-address/27.102.137.212/relations

noreplynever.ydns.eu

# Reference: https://x.com/skocherhan/status/2048839411962396813

abusecenter.eboardreports63s.dynv6.net
abusecenter.ublogrec1s.dynv6.net
auth-umblog98s.dynv6.net
blogasreport18s.dynv6.net
blogasreport23s.dynv6.net
blogasreport3s.dynv6.net
blogasreport53s.dynv6.net
blogasreport57s.dynv6.net
blogasreport64s.dynv6.net
blogasreport6s.dynv6.net
blogasreport82s.dynv6.net
blogasreport89s.dynv6.net
blogasreport90s.dynv6.net
blogasreport95s.dynv6.net
blogasreport98s.dynv6.net
docinf.eboardreport29s.dynuddns.net
eblogflag14s.dynv6.net
eblogflag16s.dynv6.net
eblogflag1s.dynv6.net
eboardreport13s.dynuddns.net
eboardreport14s.dynuddns.net
eboardreport18s.dynuddns.net
eboardreport20s.dynuddns.net
eboardreport23s.dynuddns.net
eboardreport25s.dynuddns.net
eboardreport29s.dynuddns.net
eboardreport5s.dynuddns.net
eboardreports.dynuddns.net
eboardreports0s.dynv6.net
eboardreports14s.dynv6.net
eboardreports20s.dynv6.net
eboardreports35s.dynv6.net
eboardreports38s.dynv6.net
eboardreports63s.dynv6.net
eboardreports65s.dynv6.net
eboardreports73s.dynv6.net
eboardreports84s.dynv6.net
enboardingreport14s.dns.army
enboardingreport18s.dns.army
enboardingreport31s.dns.army
enboardingreport42s.dns.army
enboardingreport85s.dns.army
manage-mublog4id.dynv6.net
mem-authcenter42s.dynv6.net
mem-authcenter44s.dynv6.net
nid-blog.eblogflag16s.dynv6.net
nid-blog.eboardreports14s.dynv6.net
nid-blog.enboardingreport18s.dns.army
nid.blogasreport18s.dynv6.net
nidcenter.blogasreport3s.dynv6.net
nidcenter.eboardreport25s.dynuddns.net
ntha-13s.dynv6.net
ntha-32s.dynv6.net
ntha-36s.dynv6.net
nvtcorp-90bid.dynv6.net
reportml21id.dynv6.net
reportml30id.dynv6.net
ublogrec1s.dynv6.net
ublogrec44s.dynv6.net
ublogrec49s.dynv6.net
ublogrec85s.dynv6.net
unlockeblog10s.dynuddns.net
unlockeblog12s.dynuddns.net
unlockeblog15s.dynuddns.net
unlockeblog17s.dynuddns.net
unlockeblog19s.dynuddns.net
unlockeblog24s.dynuddns.net
unlockeblog27s.dynuddns.net
unlockeblog29s.dynuddns.net
userbreport26s.dynv6.net
userbreport31s.dynv6.net
userbreport3s.dynv6.net
userbreport43s.dynv6.net
userbreport4s.dynv6.net
userbreport6s.dynv6.net
userbreport73s.dynv6.net
userbreport75s.dynv6.net
userbreport86s.dynv6.net

# Reference: https://x.com/skocherhan/status/2048912545444950279

ins10ips.dynv6.net
ins15ips.dynv6.net
ins16ips.dynv6.net
ins19ips.dynv6.net
ins1ips.dynv6.net
ins23ips.dynv6.net
ins27ips.dynv6.net
ins29ips.dynv6.net
ins5ips.dynv6.net
ins6ips.dynv6.net
n-cloud.ins16ips.dynv6.net
n-cloud.ins23ips.dynv6.net
n-corp.ins27ips.dynv6.net
n-store.ins10ips.dynv6.net
n-store.ins19ips.dynv6.net
nid-user.ins5ips.dynv6.net
nid-user.ins6ips.dynv6.net
nos16ips.dynv6.net
ns13ios.dynv6.net
ns18ios.dynv6.net
nuser-login.pes28ip.dynv6.net
pes28ip.dynv6.net

# Reference: https://x.com/skocherhan/status/2049195306487853319

docinfo.inlinepol1s.roxa.org
docinfo.newaltercm33s.roxa.org
edoc.inlinepol14s.roxa.org
edoc.newpolinf46s.dynuddns.com
inlinepol14s.roxa.org
inlinepol17s.roxa.org
inlinepol19s.roxa.org
inlinepol1s.roxa.org
invoice.newaltercm36s.roxa.org
invoice.newaltercm4s.roxa.org
invoice.newpolinf45s.dynuddns.com
newaltercm10s.roxa.org
newaltercm12s.roxa.org
newaltercm17s.roxa.org
newaltercm21s.roxa.org
newaltercm26s.roxa.org
newaltercm27s.roxa.org
newaltercm28s.roxa.org
newaltercm30s.roxa.org
newaltercm33s.roxa.org
newaltercm36s.roxa.org
newaltercm39s.roxa.org
newaltercm3s.roxa.org
newaltercm41s.roxa.org
newaltercm42s.roxa.org
newaltercm47s.roxa.org
newaltercm4s.roxa.org
newpolinf1s.dynuddns.com
newpolinf22s.dynuddns.com
newpolinf28s.dynuddns.com
newpolinf29s.dynuddns.com
newpolinf2s.dynuddns.com
newpolinf33s.dynuddns.com
newpolinf35s.dynuddns.com
newpolinf36s.dynuddns.com
newpolinf3s.dynuddns.com
newpolinf45s.dynuddns.com
newpolinf46s.dynuddns.com
newpolinf47s.dynuddns.com
newpolinf48s.dynuddns.com
nid.newaltercm17s.roxa.org
uofficialerc22v.dynuddns.com

# Reference: https://x.com/skocherhan/status/2049924547810299999

docinfo.ntdepchk87s.dynv6.net
edoc.inlinepol15s.roxa.org
emspol10s.dynuddns.com
emspol1s.dynuddns.com
emspol4s.dynuddns.com
emspol5s.dynuddns.com
emspol6s.dynuddns.com
emspol8s.dynuddns.com
inlinepol15s.roxa.org
inlinepol16s.roxa.org
inlinepol18s.roxa.org
inlinepol20s.roxa.org
inlinepol2s.roxa.org
inlinepol4s.roxa.org
inlinepol6s.roxa.org
inlinepol7s.roxa.org
inlinepol8s.roxa.org
newaltercm19s.roxa.org
newaltercm37s.roxa.org
newaltercm44s.roxa.org
newaltercm48s.roxa.org
newpolinf17s.dynuddns.com
newpolinf30s.dynuddns.com
newpolinf9s.dynuddns.com
nhpolercm6v.dynv6.net
nhpolercm98v.dynv6.net
nmethodsrc15v.dynuddns.com
nps-authdep69svc.dynv6.net
ntdepchk17s.dynv6.net
ntdepchk65s.dynv6.net
ntdepchk87s.dynv6.net
polercm-85v.dynv6.net
uofficialerc29v.dynuddns.com

# Reference: https://x.com/skocherhan/status/2050283519348261205

htr19ies.dynuddns.com
htr6ies.dynv6.net
itx26ps.dns.army
itx8ps.dns.army
itxa16ns.dns.army
mois11ex.dynv6.net
nav-logins.nts19pops.dns.army
nid-login.itx26ps.dns.army
nida.mois11ex.dynv6.net
nida.tpx11sdoc.dns.army
nids.opt17ntesx.dns.army
nids.opt5ntesx.dns.army
nids.trx16nts.dns.army
nts19pops.dns.army
opt17ntesx.dns.army
opt5ntesx.dns.army
tpx11sdoc.dns.army
trx16nts.dns.army
txis3eo.dynv6.net

# Reference: https://x.com/skocherhan/status/2050937729416827256

00a7c185.duckdns.org
441929450c2er.duckdns.org
65af02748d.duckdns.org
8c4a551a.duckdns.org
8e9-721293i-c1efdd26i-0aa5.cpost-ko.com
8e9-721293i-c1efdd26i-0aa5.d9nothjedlights.site
8e9-721293i-c1efdd26i-0aa5.kopostinfo.com
96ad0e.duckdns.org
c95296a.duckdns.org
chill192bbc5.duckdns.org
cisgen.kopostinfo.com
cpost-ko.com
d9nothjedlights.site
devomni.kopostinfo.com
s1rsvhzap9huozkc.d9nothjedlights.site

# Reference: https://x.com/sakaijjang/status/2051002623709610230
# Reference: https://x.com/skocherhan/status/2051006916260680070
# Reference: https://wezard4u.tistory.com/429768
# Reference: https://www.virustotal.com/gui/file/5ef6e43a56e575086ce954ff9032ff9f1609e12ec2ea6ca88c29b4d58afb1b96/detection
# Reference: https://www.virustotal.com/gui/file/6e36060854006f9ed029ab7547f4478f0486ba5256ce9cc9027248882deebdc7/detection
# Reference: https://www.virustotal.com/gui/file/d4e2f8f5a247bf538e55edb73cbd7ef14cd86a47d9380ba5eb9a3f8f710bf366/detection
# Reference: https://www.virustotal.com/gui/file/d918415f00444c30e38a7d277733b3fc142bd5922cc2823c13d02d014f943c8a/detection
# Reference: https://www.virustotal.com/gui/file/29f871bf9bcbf9f12a16504631872871255a9f2b54cf892b4fc1cab3cec30708/detection
# CERT_FINGERPRINT_SHA256-HOST=575493994c0afd4da9ce37d25c960a66099365100a9b0d84778459923b5a8628
# CERT_FINGERPRINT_SHA256-HOST=722c13dcef002cbe7181cce7984eda5961009192339335c127442d5353dc5b46

babelbit.site
backend.totalmassage.site
dcinside.babelbit.site
hostpilot.website
panelcore.shop
serverdock.online
serverdock.shop
shorturi.shop
shorturi.site
totalmassage.site
vmi3110357.contaboserver.net
ws.serverdock.online
/beefxlsx/res/get-command.php
/beefxlsx/res/post_proc.php
/heartbeats/res/get-command.php
/heartbeats/res/post_proc.php

# Reference: https://x.com/skocherhan/status/2050934068489949471

32.yateo.rest
acme-challenge.ms.cdn.dnscloud.contact
asoiwxoin.store
avsoinesoi.site
cagoo.cyou
cisiuowin.site
danwo.cyou
doeiseoivud.store
doieunvdusega.store
dooiuonsi.site
edisoiunido.site
eiociuseioni.site
iocuseripoiu.site
koseg.rest
mgais.hair
oiucsoiginao.site
pakig.bond
soiuniozi.site
sooiwoins.site
sowepcioi.site
yateo.rest

# Reference: https://x.com/skocherhan/status/2050936246638109037

238salksdas-qlaksdhf1938-zxckva124cvarq.site
2o3sahfoq782lweshf.238salksdas-qlaksdhf1938-zxckva124cvarq.site
78y123hosa7ydfl-kjshalkjh12378y1-xzxvql3oilq81o8u1.site
bas098-absbd98basdb-dsbas.site
check.my-kics-info.dns.army
dkr178sdk-13sd9kq-zmeaojk123.site
document.my-kics-info.dns.army
inform.my-kics-info.dns.army
jahsdlqw23oljsfou-cklvjqawer17841jxvla-132948asdkjfqlwery.site
mail.jahsdlqw23oljsfou-cklvjqawer17841jxvla-132948asdkjfqlwery.site
my-kics-info.dns.army
naversecure.site
naveruserlogininfo.site
nbai23-aba-3251c-3a12.site
nid-naverauth.com
nidnaver.online
nidnaverinfo.com
notice.my-kics-info.dns.army
portal.my-kics-info.dns.army
read.my-kics-info.dns.army
record.my-kics-info.dns.army
service.my-kics-info.dns.army
sl381o8vcqad-23ouvzl2934511-cvqwecvjkaw38as.site
system.my-kics-info.dns.army
view.my-kics-info.dns.army
wuifkjadl328-37djhldakjhvk23-vkjetlkj96dafljk28.site

# Reference: https://x.com/skocherhan/status/2050659775428337786

05c0.nkfumxgqxd.v6.rocks
0c50zrvnoi.v6.rocks
0g25r94p96.v6.army
1one6il0oe.dynv6.net
3by9m.0c50zrvnoi.v6.rocks
40n0.uvtiwwmlrl.dns.army
4ub04p5i10.dynv6.net
4vkc4fdduf.dns.navy
5jeqr9bf89.dns.navy
64rp5.kl1j9dkiy7.dynv6.net
75bx4qm42u.dynv6.net
8mko81k7tf.dynv6.net
9im8wurhzo.v6.rocks
acaiqb90ql.v6.navy
aji1dfsici.dns.army
bkkug0us2sj.dns.navy
bns7a.8mko81k7tf.dynv6.net
bux-nid.ips-go.gleeze.com
checkinfo.abrdns.com
d0vtzpoxyw.dynv6.net
da9dz.kpq8p1t81e.dns.army
direct-auth.bns7a.8mko81k7tf.dynv6.net
doc-load.abrdns.com
doc-nid.strangled.net
docinfo.ndocline-st51s.dns.army
fcol.ls31y9be8d.dynv6.net
fpf.ips.user-auth-manage.n-e.kr
g4os5r9e8c.dynv6.net
g7slrbjt7j.dynv6.net
guid-nid-authentication.h9xyka.o73nn803g2.dynv6.net
h9xyka.o73nn803g2.dynv6.net
hazgs.rqs2t5hbzf.dynv6.net
host-nid.mywire.org
hqu.nid.user-auth-manage.n-e.kr
ikx3xd04mj.dynv6.net
info.mois-go.bumbleshrimp.com
info.naver-log.ddnsfree.com
invoice-doc.camdvr.org
ips-check.1cooldns.com
ips-go.gleeze.com
ips-nav.abrdns.com
ips.petfoodkorea.kr
kl1j9dkiy7.dynv6.net
kpq8p1t81e.dns.army
kpxkeugpi6.dynv6.net
l37g2l5nrx.dynv6.net
link-connect-naver.fcol.ls31y9be8d.dynv6.net
ls31y9be8d.dynv6.net
mail-check.cloud-ip.cc
mail-check.duckdns.org
mail-check.ydns.eu
mdmfdu21lh.v6.rocks
mghtx.mydns.bz
mois-go.bumbleshrimp.com
mtf-nid.ips-go.gleeze.com
nauthlogin.dns.army
nav-log.ips-check.1cooldns.com
naver-log.ddnsfree.com
ndoc-auth.ydns.eu
ndoc-void.kozow.com
ndocline-st51s.dns.army
ndocnid.da9dz.kpq8p1t81e.dns.army
net-security.05c0.nkfumxgqxd.v6.rocks
net-security.3by9m.0c50zrvnoi.v6.rocks
net-security.xj9kys.omra9yg7k1.v6.rocks
nid-auth-invoice.64rp5.kl1j9dkiy7.dynv6.net
nid.nauthlogin.dns.army
nidlog.40n0.uvtiwwmlrl.dns.army
ninvoice.nisdn.1cooldns.com
nisdn.1cooldns.com
nkfumxgqxd.v6.rocks
ntauto.a8492.ydns.eu
ntt-suggest.host-nid.mywire.org
ntt-suggest.river-connect.ddnsguru.com
o73nn803g2.dynv6.net
o9ziq78shg.v6.rocks
omra9yg7k1.v6.rocks
passkey.mail-check.cloud-ip.cc
pc3vq8gte2.dynv6.net
pzyyckwlqm.v6.army
qlrkm553jk.v6.army
qx7k2ju0qc.v6.rocks
r8mcc7z7jb.dynv6.net
redirect.abrdns.com
river-connect.ddnsguru.com
rqs2t5hbzf.dynv6.net
stepverify.mail-check.cloud-ip.cc
tax-guide.hazgs.rqs2t5hbzf.dynv6.net
tax-guide.ttl2.rqs2t5hbzf.dynv6.net
tax-guide.zl0s4v.75bx4qm42u.dynv6.net
tdoc.cloud-ip.cc
ttl2.rqs2t5hbzf.dynv6.net
user-auth-manage.n-e.kr
user-info.abrdns.com
uvtiwwmlrl.dns.army
v3i2rde2y5.v6.navy
w18b1g7c1o.dynv6.net
wgjngrxokv.v6.army
x1prl5k1a2.v6.army
x94z3llzz6d.v6.navy
xj9kys.omra9yg7k1.v6.rocks
ya7taxdm520.dns.army
z330woigb3.dns.army
zl0s4v.75bx4qm42u.dynv6.net

# Reference: https://www.virustotal.com/gui/ip-address/125.178.110.74/relations

navercom.duckdns.org

# Reference: https://x.com/skocherhan/status/2051729851124469836
# Reference: https://x.com/skocherhan/status/2051727363067539880

cafe-nhnread.com
cafe-nhnview.com
cafearticle-nhn.com
cafearticles-nhn.com
cafepost-nhn.com
cafeposts-nhn.com
caferead-nhn.com
cafeview-nhn.com
ncafe-article.com
ncafe-article.media
ncafe-articles.com
ncafe-articleviewer.com
ncafe-postread.com
ncafe-posts.com
nhharticles-cafe.com
nhhpost-cafe.com
nhhposts-cafe.com
nhn-cafe.com
nhn-caferead.com
nhn-cafeview.com
nhnarticle-cafe.com
nhncafe-articlesviewer.com
nhncafe-articleviewer.com
nhncafe-read.com
nhncafe-view.com
nid-alert.com

# Reference: https://x.com/skocherhan/status/2052098015180317058

102c928da265b.duckdns.org
1928fjcia025.duckdns.org
412949853a02b.duckdns.org
419298as9bo2.duckdns.org
42019239a0s0be.duckdns.org
48716ba0dea01.duckdns.org
489817asd9bo.duckdns.org
48d9a9120bae.duckdns.org
491va9924abef1.duckdns.org
4c0a910fba9s1235.duckdns.org
4d0q91239eqb5.duckdns.org
a51a.otzo.com
as912jci1.duckdns.org
c0ea0s217.duckdns.org
camcdeliver.libfoobar.com
comdeliv72.entrydns.org
comdeliv72.libfoobar.com
daurora.libfoobar.com
dcamso10.libfoobar.com
deon0capload.entrydns.org
deon0capload.libfoobar.com
dhonexc.libfoobar.com
di812fvz.duckdns.org
dsarapiz9.libfoobar.com
dso9asops.libfoobar.com
dsolanosi.libfoobar.com
dtickaree.libfoobar.com
duxopenor.libfoobar.com
dynazdom.libfoobar.com
e10a9e5.libfoobar.com
e1ia92c90tz.entrydns.org
ec8yxeon.entrydns.org
eclodfast20.entrydns.org
eclodfast20.libfoobar.com
ecxfastpostx.entrydns.org
ecxloadon.entrydns.org
edn8uo7z.entrydns.org
ef125dioaz4.entrydns.org
einfa8a30.entrydns.org
eo90boios.entrydns.org
eonse71hc.entrydns.org
epa12cdiq.entrydns.org
esimdgit1.entrydns.org
evisin193.entrydns.org
fcaset29.libfoobar.com
fearinronz.libfoobar.com
fhopcixim.entrydns.org
fhozinftei.libfoobar.com
fisnispull.libfoobar.com
fkonsqilz.libfoobar.com
flexinfon.libfoobar.com
folkd9info.libfoobar.com
fpericyjin.libfoobar.com
gate.dnsrd.com
gmbxacmels.v6.rocks
gmdqriyusm.v6.rocks
gmeinuljww.v6.rocks
gmfvuwioeweh.twilightparadox.com
gmgwuahbji.twilightparadox.com
gmgwuancky.v6.rocks
gmhbilzscs.v6.rocks
gmjryqloxn.v6.rocks
gmnwdhnupf.v6.rocks
gmvbchibgq.v6.rocks
gmycyrkwsq.v6.rocks
gpointedinfo.twilightparadox.com
gpotmains.twilightparadox.com
gseminuko.twilightparadox.com
hmaiyvhxx.dynv6.net
hmalfgloi.dynv6.net
hmbjutevk.v6.rocks
hmdihnrqd.v6.rocks
hmgysllbn.v6.rocks
hmhlfzokh.dynv6.net
hmhszflpi.v6.rocks
hmitjxofe.v6.rocks
hmlgnwldm.v6.rocks
hmlicoxiy.v6.rocks
hmlojxudi.dynv6.net
hmluuuyqv.v6.rocks
hmlvlkmrx.v6.rocks
hmlwykhre.dynv6.net
hmlxyvdfd.v6.rocks
hmmslgieh.v6.rocks
hmnqgrdvi.dynv6.net
hmpavordl.v6.rocks
hmpomqnzl.dynv6.net
hmpzzjggs.v6.rocks
hmqmrttdo.v6.rocks
hmrtuleuq.dynv6.net
hmshyqlvd.dynv6.net
hmvrbxkgs.v6.rocks
hmxazemwg.v6.rocks
hmxpybvuc.v6.rocks
hmypfihui.dynv6.net
imacfgmbf.v6.army
imawiirlf.v6.rocks
imboeznibuk.abrdns.com
imdildckx.v6.rocks
imeasniku.v6.army
imeij2jof.v6.rocks
imeqlvedp.v6.army
imevznwcg.v6.army
imewesroh.v6.army
imfueakgr.v6.army
imgkbwcaa.v6.army
imhpqwwma.v6.rocks
imhsiexkoyz.abrdns.com
imhsvamtlso.abrdns.com
imhyuyzlmix.abrdns.com
imiiuyuvhfe.abrdns.com
imklevubf.v6.army
imkxrlawh.v6.army
imlbioxai.v6.rocks
imlqzydpehu.abrdns.com
imltrdtzo.v6.rocks
imnnaghfftl.abrdns.com
imnrhbcpg.v6.rocks
imnxofrpdik.abrdns.com
imofwmyzu.v6.army
imorelrlvgj.abrdns.com
impolsmes.abrdns.com
imqkodvnh.v6.rocks
imqyeosse.v6.army
imtzdrlecxv.abrdns.com
imuvtahho.v6.army
imvfptssn.v6.rocks
imweqtnvyqw.abrdns.com
imwfbmotn.v6.army
imwywutdl.v6.army
imxdxzhmtju.abrdns.com
imyflphhjqu.abrdns.com
imypevsnxap.abrdns.com
imzbvmihrfuq.abrdns.com
imzfznmyeovb.abrdns.com
imzhaeuhucba.abrdns.com
imzmfkbbsewp.abrdns.com
imzomshrstkm.abrdns.com
imzrgwbmxiuj.abrdns.com
imzrutppj.v6.army
imzsimgxmjse.abrdns.com
imzsnlfjbutu.abrdns.com
imzvenuidipk.abrdns.com
imzvuhwepflo.abrdns.com
jmezzkwochd.v6.rocks
jmfrpejvtno.v6.rocks
jmiwoyseqiv.v6.rocks
jmmdkbebist.v6.rocks
jmpoemqnmpj.v6.rocks
jmqgollpaij.v6.rocks
jmvtckrtdus.v6.rocks
jmvxsybqika.v6.rocks
jmyappwlwza.v6.rocks
micload4.libfoobar.com
p291z0sin04a9.duckdns.org
sudeliveryn.entrydns.org
sudeliveryn.libfoobar.com
t18delivery.libfoobar.com
t5delivery.entrydns.org
trackinfo0.entrydns.org
trackinfo0.libfoobar.com
us2loadinfo.entrydns.org
us2loadinfo.libfoobar.com

# Reference: https://x.com/skocherhan/status/2052818521093034401
# Reference: https://www.virustotal.com/gui/ip-address/27.102.138.125/relations

http://27.102.138.125
base24s.dynv6.net
base2s.dynv6.net
fill29s.dynv6.net
fill50s.dynv6.net
fill75s.dynv6.net
fill7s.dynv6.net
find30s.dynv6.net
find42s.dynv6.net
find44s.dynv6.net
find47s.dynv6.net
find61s.dynv6.net
find69s.dynv6.net
find77s.dynv6.net
find85s.dynv6.net
find93s.dynv6.net
fine25s.dynv6.net
fine41s.dynv6.net
fine44s.dynv6.net
fine52s.dynv6.net
fine60s.dynv6.net
fine68s.dynv6.net
fine69s.dynv6.net
fine70s.dynv6.net
fine71s.dynv6.net
fine72s.dynv6.net
fine73s.dynv6.net
fine75s.dynv6.net
fine76s.dynv6.net
fine77s.dynv6.net
fine78s.dynv6.net
fine79s.dynv6.net
fine80s.dynv6.net
fine81s.dynv6.net
fine82s.dynv6.net
fine83s.dynv6.net
fine84s.dynv6.net
fine85s.dynv6.net
fine86s.dynv6.net
fine87s.dynv6.net
fine88s.dynv6.net
fine89s.dynv6.net
fine90s.dynv6.net
fine91s.dynv6.net
fine92s.dynv6.net
fine93s.dynv6.net
fine94s.dynv6.net
fine95s.dynv6.net
fine96s.dynv6.net
fine97s.dynv6.net
fine98s.dynv6.net
fine9s.dynv6.net
gosi20s.dynv6.net
gosi22s.dynv6.net
gosi23s.dynv6.net
gosi33s.dynv6.net
gosi48s.dynv6.net
gosi56s.dynv6.net
gosi62s.dynv6.net
gosi66s.dynv6.net
gozi23s.dynv6.net
gozi41s.dynv6.net
gozi50s.dynv6.net
gozi51s.dynv6.net
gozi53s.dynv6.net
gozi69s.dynv6.net
gozi81s.dynv6.net
gozi82s.dynv6.net
gozi87s.dynv6.net
gree12s.dynv6.net
gree22s.dynv6.net
gree25s.dynv6.net
gree37s.dynv6.net
gree3s.dynv6.net
gree47s.dynv6.net
gree53s.dynv6.net
gree57s.dynv6.net
node39s.dynv6.net
now14s.dynv6.net
now50s.dynv6.net
now59s.dynv6.net
now72s.dynv6.net
pill26s.dynv6.net
pill47s.dynv6.net
poll87s.dynv6.net
read0s.dynv6.net
read24s.dynv6.net
read28s.dynv6.net
read43s.dynv6.net
read44s.dynv6.net
read45s.dynv6.net
read47s.dynv6.net
read48s.dynv6.net
read49s.dynv6.net
read50s.dynv6.net
read51s.dynv6.net
read52s.dynv6.net
read53s.dynv6.net
read54s.dynv6.net
read55s.dynv6.net
read56s.dynv6.net
read57s.dynv6.net
read59s.dynv6.net
read61s.dynv6.net
read62s.dynv6.net
read63s.dynv6.net
read64s.dynv6.net
read65s.dynv6.net
read66s.dynv6.net
read67s.dynv6.net
read68s.dynv6.net
read69s.dynv6.net
read70s.dynv6.net
read71s.dynv6.net
read74s.dynv6.net
read76s.dynv6.net
read77s.dynv6.net
read78s.dynv6.net
read79s.dynv6.net
read80s.dynv6.net
read81s.dynv6.net
read82s.dynv6.net
read83s.dynv6.net
read84s.dynv6.net
read85s.dynv6.net
read86s.dynv6.net
read87s.dynv6.net
read89s.dynv6.net
read90s.dynv6.net
read91s.dynv6.net
read92s.dynv6.net
read93s.dynv6.net
read94s.dynv6.net
read95s.dynv6.net
read96s.dynv6.net
read97s.dynv6.net
read98s.dynv6.net
rule10s.dynv6.net
rule11s.dynv6.net
rule12s.dynv6.net
rule13s.dynv6.net
rule14s.dynv6.net
rule15s.dynv6.net
rule16s.dynv6.net
rule17s.dynv6.net
rule18s.dynv6.net
rule19s.dynv6.net
rule20s.dynv6.net
rule21s.dynv6.net
rule22s.dynv6.net
rule23s.dynv6.net
rule24s.dynv6.net
rule25s.dynv6.net
rule26s.dynv6.net
rule27s.dynv6.net
rule28s.dynv6.net
rule29s.dynv6.net
rule30s.dynv6.net
rule31s.dynv6.net
rule32s.dynv6.net
rule33s.dynv6.net
rule34s.dynv6.net
rule35s.dynv6.net
rule36s.dynv6.net
rule37s.dynv6.net
rule38s.dynv6.net
rule43s.dynv6.net
rule46s.dynv6.net
rule47s.dynv6.net
rule48s.dynv6.net
rule49s.dynv6.net
rule50s.dynv6.net
rule51s.dynv6.net
rule54s.dynv6.net
rule55s.dynv6.net
rule56s.dynv6.net
rule57s.dynv6.net
rule58s.dynv6.net
rule59s.dynv6.net
rule5s.dynv6.net
rule60s.dynv6.net
rule61s.dynv6.net
rule63s.dynv6.net
rule64s.dynv6.net
rule7s.dynv6.net
rule82s.dynv6.net
rule84s.dynv6.net
rule95s.dynv6.net
rule9s.dynv6.net
said0s.dynv6.net
said15s.dynv6.net
said18s.dynv6.net
said21s.dynv6.net
said2s.dynv6.net
said46s.dynv6.net
said48s.dynv6.net
said53s.dynv6.net
said70s.dynv6.net
said82s.dynv6.net

# Reference: https://www.virustotal.com/gui/ip-address/27.102.137.185/relations

http://27.102.137.185
natevns.onthewifi.com
nid-naveripq.servehalflife.com
nid-naverkkr.onthewifi.com
nid-naveruzt.servequake.com

# Reference: https://x.com/skocherhan/status/2053188893726437695
# Reference: https://www.virustotal.com/gui/ip-address/51.79.185.184/relations

smartbtc.dynv6.net
cert.smartbtc.dynv6.net

# Reference: https://x.com/skocherhan/status/2053592079918330349

45billmatedoc.mydns.bz
45nhistargetlink.cloud-ip.cc

# Reference: https://x.com/skocherhan/status/2053529359244271800

http://27.102.138.146
k1dash.treeslinks.com
ndocs-asend.dynv6.net
ndocs5link.dns.army
ndocs5send.dns.army
ndocs8send.dns.army

# Reference: https://x.com/skocherhan/status/2053905532377833708

e-zpassiags-april.dynv6.net
etoll-blling-ezpssiags.mysynology.net
etoll-ezpass-notify.bumbleshrimp.com
etoll-ezpssiags.dynuddns.com
ezpassiags-march.dynv6.net
ezpssiags-bill.1cooldns.com
ezpssiags-etoll-02.dynv6.net
jangenam.ooguy.com
member-area-netfilx.dynv6.net
my-etoll-service.vineluxe.store
netfilx-account.dynv6.net
netfilx-membership.dynv6.net
netfilx-rejoin.dynv6.net
updatesubs-netfilx.dynv6.net

# Reference: https://x.com/skocherhan/status/2054269866534953072

docinfo.ercm-uinvoice12s.dynv6.net
docinfo.ercm-uinvoice13s.dynv6.net
docinfo.ercm-uinvoice72s.dynv6.net
docinfo.ndeliver-d28s.dynv6.net
docinfo.ndeliver-d36s.dynv6.net
docinfo.ndeliver-d94s.dynv6.net
docinfo.newaltercm45s.roxa.org
docinfo.ntdepchk26s.dynv6.net
edoc.ndeliver-d52s.dynv6.net
edoc.ntkeep-udoc62s.dns.army
edoc.ntlogodoc88s.dynv6.net
emebaspol40s.dynv6.net
emspol2s.dynuddns.com
emspol3s.dynuddns.com
emspol9s.dynuddns.com
ercm-uinvoice11s.dynv6.net
ercm-uinvoice12s.dynv6.net
ercm-uinvoice13s.dynv6.net
ercm-uinvoice1s.dynv6.net
ercm-uinvoice21s.dynv6.net
ercm-uinvoice25s.dynv6.net
ercm-uinvoice3s.dynv6.net
ercm-uinvoice49s.dynv6.net
ercm-uinvoice4s.dynv6.net
ercm-uinvoice72s.dynv6.net
ercm-uinvoice73s.dynv6.net
ercm-uinvoice74s.dynv6.net
ercm-uinvoice75s.dynv6.net
ercm-uinvoice82s.dynv6.net
ercm-uinvoice83s.dynv6.net
ercm-uinvoice90s.dynv6.net
ercm-uinvoice92s.dynv6.net
ercorps-37load.dynv6.net
erpolicies-11v.dynv6.net
inlinepol10s.roxa.org
inlinepol13s.roxa.org
invoice.ndeliver-d23s.dynv6.net
invoice.ntdepchk33s.dynv6.net
invoice.ntlogodoc82s.dynv6.net
mhjwsf.reverifyblogmid19s.dns.army
nappstatic42svc.dynv6.net
nappstatic75svc.dynv6.net
naveblogedit33s.dns.army
ndeliver-d10s.dynv6.net
ndeliver-d18s.dynv6.net
ndeliver-d19s.dynv6.net
ndeliver-d22s.dynv6.net
ndeliver-d23s.dynv6.net
ndeliver-d28s.dynv6.net
ndeliver-d31s.dynv6.net
ndeliver-d32s.dynv6.net
ndeliver-d33s.dynv6.net
ndeliver-d35s.dynv6.net
ndeliver-d36s.dynv6.net
ndeliver-d45s.dynv6.net
ndeliver-d49s.dynv6.net
ndeliver-d4s.dynv6.net
ndeliver-d50s.dynv6.net
ndeliver-d52s.dynv6.net
ndeliver-d57s.dynv6.net
ndeliver-d62s.dynv6.net
ndeliver-d73s.dynv6.net
ndeliver-d79s.dynv6.net
ndeliver-d80s.dynv6.net
ndeliver-d82s.dynv6.net
ndeliver-d8s.dynv6.net
ndeliver-d94s.dynv6.net
newaltercm15s.roxa.org
newaltercm31s.roxa.org
newaltercm34s.roxa.org
newaltercm40s.roxa.org
newaltercm45s.roxa.org
newpolinf12s.dynuddns.com
newpolinf23s.dynuddns.com
newpolinf41s.dynuddns.com
newpolinf42s.dynuddns.com
newpolinf6s.dynuddns.com
nhpaddr70load.dynv6.net
nhpolercm10v.dynv6.net
nid.ndeliver-d10s.dynv6.net
nid.ndeliver-d22s.dynv6.net
nid.ndeliver-d35s.dynv6.net
nid.ndeliver-d57s.dynv6.net
nid.ndeliver-d73s.dynv6.net
nid.npload-mdoc12s.dns.army
nid.nrec-taxdoc10s.yyuyy.com
nid.nrec-taxdoc19s.yyuyy.com
nlmsuser5doc.dynv6.net
nmethodsrc13v.dynuddns.com
npload-mdoc12s.dns.army
npload-mdoc13s.dns.army
npload-mdoc23s.dns.army
npload-mdoc39s.dns.army
nrec-taxdoc10s.yyuyy.com
nrec-taxdoc19s.yyuyy.com
ntdepchk10s.dynv6.net
ntdepchk19s.dynv6.net
ntdepchk22s.dynv6.net
ntdepchk26s.dynv6.net
ntdepchk29s.dynv6.net
ntdepchk33s.dynv6.net
ntdepchk51s.dynv6.net
ntdepchk72s.dynv6.net
ntdepchk75s.dynv6.net
ntdepchk77s.dynv6.net
ntdepchk86s.dynv6.net
ntdepchk88s.dynv6.net
ntdepchk89s.dynv6.net
ntdepchk95s.dynv6.net
ntkeep-udoc0s.dns.army
ntkeep-udoc19s.dns.army
ntkeep-udoc2s.dns.army
ntkeep-udoc30s.dns.army
ntkeep-udoc45s.dns.army
ntkeep-udoc49s.dns.army
ntkeep-udoc51s.dns.army
ntkeep-udoc62s.dns.army
ntkeep-udoc72s.dns.army
ntkeep-udoc87s.dns.army
ntlogodoc26s.dynv6.net
ntlogodoc32s.dynv6.net
ntlogodoc38s.dynv6.net
ntlogodoc39s.dynv6.net
ntlogodoc44s.dynv6.net
ntlogodoc45s.dynv6.net
ntlogodoc47s.dynv6.net
ntlogodoc56s.dynv6.net
ntlogodoc57s.dynv6.net
ntlogodoc5s.dynv6.net
ntlogodoc69s.dynv6.net
ntlogodoc75s.dynv6.net
ntlogodoc80s.dynv6.net
ntlogodoc82s.dynv6.net
ntlogodoc85s.dynv6.net
ntlogodoc88s.dynv6.net
ntlogodoc92s.dynv6.net
ntlogodoc95s.dynv6.net
polercm-34v.dynv6.net
polercm-41v.dynv6.net
polercm-53v.dynv6.net
polercm-94v.dynv6.net
qxnhdalc.naveblogedit33s.dns.army
reverifyblogmid0s.dns.army
reverifyblogmid19s.dns.army
uhmymkd.reverifyblogmid0s.dns.army
uofficialerc26v.dynuddns.com
usernps-mid21s.dynv6.net
usernps-mid33s.dynv6.net
usernps-mid68s.dynv6.net
usernps-mid69s.dynv6.net
usernps-mid77s.dynv6.net
usernps-mid94s.dynv6.net
usr.ercm-uinvoice25s.dynv6.net
usr.ndeliver-d82s.dynv6.net
usr.ntdepchk51s.dynv6.net
usr.usernps-mid21s.dynv6.net

# Reference: https://x.com/blackorbird/status/2054518266958320099
# Reference: https://mp.weixin.qq.com/s/Ibz3FeA7twg-VCujA3cV_g
# Reference: https://www.virustotal.com/gui/ip-address/112.216.9.171/relations
# Dynamic DNS domains from 112.216.0.0/13 subnet

112-216-240-98.softether.net
a.edc.kro.kr
a.i.edc.kro.kr
a.i.ujm.kro.kr
a.jxj.kro.kr
a.ujm.kro.kr
a09ed646f2da43f8846f7122d4ad8cf76.asuscomm.com
a6580.asuscomm.com
aa436a1f794250cecbeffd0a72844189a.asuscomm.com
adestech.i234.me
admin.zms.kro.kr
aju.myds.me
an.colla.n-e.kr
an.zooms.kro.kr
anybackup.familyds.net
appknot-krrrghpjnqc.dynamic-m.com
appknot-qbmqwpkpnqc.dynamic-m.com
appwrite.zms.kro.kr
april7.myds.me
artcivil40.iptime.org
asus.wangjumeok.duckdns.org
asustor.cheminets.duckdns.org
auth-profile.servehttp.com
auth-proinfo.servehttp.com
auth.edc.kro.kr
auth.ujm.kro.kr
axlabs.duckdns.org
aysdch.duckdns.org
aysdch.iptime.org
b4f9975cd9c36c9447fe0bd4d7662ae51.asuscomm.com
b5d09bc0649eb170c2d1e5dc7fd3f6da8.asuscomm.com
babytree1.iptime.org
babytree2.iptime.org
baileyadmin.vpnplus.to
baipleai.asuscomm.com
be1fb0fbe7d7ced8fceb9d80301d3e2ef.asuscomm.com
biblo.duckdns.org
bigmit.iptime.org
bigprimetour.iptime.org
bmc-mobile-test.duckdns.org
bnbsungwon.myds.me
borim.i234.me
borim2.myds.me
bsinfo.myds.me
buchang.duckdns.org
budi.zms.kro.kr
bugxa.myds.me
bxgjiujitsu.kro.kr
bxgjiujitsulab.kro.kr
bymall.myds.me
c.edc.kro.kr
c.jxj.kro.kr
c.ujm.kro.kr
car.pdb.kro.kr
carol.edc.kro.kr
carol.ujm.kro.kr
cbe3u17ar2.diskstation.me
cdsnas3.myds.me
chat.sinwon21c.kro.kr
chemchat.webhop.biz
cheminet.gotdns.com
cheminetfile.duckdns.org
cheminetfile.webhop.org
cheminetnas.webhop.org
cheminets.duckdns.org
cho.myds.me
churu.duckdns.org
cj1.i234.me
cjenc.i234.me
cloud.colla.n-e.kr
cloud.zooms.kro.kr
cloversw.asuscomm.com
cmh224nas.i234.me
cmtportal.fortiddns.com
cnffurdl.dscloud.biz
code.dynu.net
colla.colla.n-e.kr
colla.n-e.kr
colla.zooms.kro.kr
comnas.i234.me
concosystem.myds.me
coorger2.myds.me
corebd.softether.net
coreverse.duckdns.org
ctunnel.wangjumeok.duckdns.org
d.i.edc.kro.kr
d.i.ujm.kro.kr
damapay.kro.kr
daoncopy.myds.me
dapanda25.kro.kr
dasantestsmarthome.duckdns.org
data.sinwon21c.kro.kr
dbe.myds.me
dcue87549guw.zms.kro.kr
dd-b2c.fortiddns.com
ddc12.duckdns.org
deepqure.diskstation.me
denvereng.myds.me
designcats.asuscomm.com
dev.form.zz.am
devmon.asuscomm.com
dfgitlab.duckdns.org
dgat.i234.me
dhptec.dsmynas.com
diaworld.duckdns.org
diaworld2.duckdns.org
docker.colla.n-e.kr
docker.jxj.kro.kr
docplenas.myds.me
domemehub.duckdns.org
donet0080.asuscomm.com
dongmoonict.duckdns.org
down.hopediary.myds.me
download.sexidude.com
downs.hopediary.myds.me
dscadmin.myds.me
dsm.hopediary.myds.me
dsms.hopediary.myds.me
dtzx0057.softether.net
duruter.myds.me
dv.i234.me
dwdw.myds.me
dweng.myds.me
ebridgewd.myds.me
ecomind.iptime.org
edc.kro.kr
eempire.myds.me
efsasia.i234.me
egtron.iptime.org
elinu.duckdns.org
elite29.dscloud.biz
email.webredirect.org
emtek01.asuscomm.com
ensyskorea.asuscomm.com
epass.duckdns.org
error.axddc.mrbasic.com
eunitech.duckdns.org
fantaplan.iptime.org
fezh.duckdns.org
fezh2.duckdns.org
file.colla.n-e.kr
file.hopediary.myds.me
file.jxj.kro.kr
files.hopediary.myds.me
flfi.duckdns.org
foodnamoo.dsmynas.com
foodnamoonas1.dsmynas.com
foodnamoonas2.dsmynas.com
form.zz.am
forsnd.asuscomm.com
fyfpv.diskstation.me
g.edc.kro.kr
g.i.edc.kro.kr
g.i.ujm.kro.kr
g.ujm.kro.kr
gagaeboo.duckdns.org
gauritech.asuscomm.com
genopsy.myds.me
ghdn2.asuscomm.com
giant.myds.me
giantstar9.asuscomm.com
gitlab-brighten.kro.kr
gitsnsupport.diskstation.me
gjend.myds.me
glch.i234.me
globiz.iptime.org
glt.duckdns.org
goo.ringobee.kro.kr
goodeffect.asuscomm.com
gotest.i234.me
grampus.kro.kr
grampustest2.kro.kr
groogroup.dsmynas.com
grouphan.myds.me
gs5artfw.fortiddns.com
gstbu.myds.me
gstha.myds.me
gstsu.myds.me
gsug.myds.me
gusal1984.asuscomm.com
haeam.zz.am
haeka.i234.me
haemalgeum.i234.me
haesom.duckdns.org
hanait.kro.kr
hanguo9.softether.net
hansanls.iptime.org
hansecurity.iptime.org
hcp-hiib.asuscomm.com
hcp-hitj.asuscomm.com
hdcad.iptime.org
hip-00128-1.asuscomm.com
hip-00128.asuscomm.com
hip-00378.asuscomm.com
hip-sdcentralpark.asuscomm.com
hip-ycity.asuscomm.com
hokudo.ddns.net
home176.myds.me
hon.myds.me
hopediary.myds.me
hosun.myds.me
hpchurch.i234.me
huenrdp.asuscomm.com
huonsglobal.3utilities.com
huonsglobal.myvnc.com
hyperion-tech.duckdns.org
i.edc.kro.kr
i.ujm.kro.kr
i.zms.kro.kr
ifamdiskm.familyds.com
ifamily03.vpnplus.to
ifammstate1.vpnplus.to
ifs.zms.kro.kr
img2sellermoa.duckdns.org
imgsellermoa.duckdns.org
ims.kro.kr
innocosma3f.softether.net
innodep.myds.me
innodep1.myds.me
insprotech.duckdns.org
iotmit.iptime.org
irisbright.myds.me
irna.duckdns.org
isfpp.duckdns.org
itn.myds.me
itstech.diskstation.me
jaebang.kro.kr
jaemc2.myds.me
janghak.asuscomm.com
jaram1.asuscomm.com
jccoffice.duckdns.org
jewan.ddns.net
jgl.diskstation.me
jhchohome.duckdns.org
jienem.asuscomm.com
jikrtmc.iptime.org
jinip2.asuscomm.com
jjangsepd.myds.me
joeunddns.iptime.org
jogiclub.asuscomm.com
joindevmain.duckdns.org
joinwith.duckdns.org
jonghyun.iptime.org
jungwoo.myds.me
jxj.kro.kr
k.edc.kro.kr
k.ujm.kro.kr
kc8djq.softether.net
kcbs.diskstation.me
kcmc.iptime.org
kdadls.iptime.org
keycloak.ujm.kro.kr
kfes119.asuscomm.com
kgamja.diskstation.me
kglkorea.softether.net
kim841003.asuscomm.com
kimgaram.duckdns.org
kirikil.duckdns.org
kjradio.myds.me
kklim.dedyn.io
klims.softether.net
knpeople.ddns.net
knpeople.i234.me
koesenergy.myds.me
koreautos.iptime.org
koreawide.iptime.org
koreawide2.iptime.org
koreawide3.iptime.org
korimpact.iptime.org
korinstar.dscloud.biz
ks3.i234.me
ky2k.duckdns.org
kylove.iptime.org
la.colla.n-e.kr
la.zooms.kro.kr
la1.colla.n-e.kr
la1.zooms.kro.kr
la2.colla.n-e.kr
la2.zooms.kro.kr
la3.colla.n-e.kr
la3.zooms.kro.kr
la4.colla.n-e.kr
la4.zooms.kro.kr
lab.edc.kro.kr
lab.jxj.kro.kr
lab.ujm.kro.kr
laem-server.asuscomm.com
laravel.colla.n-e.kr
laravel1.colla.n-e.kr
laravel2.colla.n-e.kr
laravel3.colla.n-e.kr
laravel4.colla.n-e.kr
lck1006.asuscomm.com
ldplus2.i234.me
ledasnas.myds.me
leebanana.iptime.org
leejeonghun112.asuscomm.com
legaltech.mynetgear.com
lge-aaas-ws.duckdns.org
limjoosung.duckdns.org
limotech.asuscomm.com
longplayssong.asuscomm.com
ltc.fortiddns.com
mail.code.dynu.net
mail.dweng.myds.me
main-profile.myvnc.com
main-progito.myvnc.com
mbuzzer.iptime.org
mc365.asuscomm.com
media186.myds.me
meltem.myds.me
memo.sinwon21c.kro.kr
menco.myds.me
mencoz.myds.me
meta.joindevmain.duckdns.org
metacui.fortiddns.com
mgelec.i234.me
mini-tndlife.duckdns.org
minicat0305.asuscomm.com
miridih-wired-dwcmbmhbgz.dynamic-m.com
mirincom.asuscomm.com
mirincom.duckdns.org
mirincom.dyndns.org
mirweb.duckdns.org
mirweb1.duckdns.org
mirweb2.duckdns.org
mirweb3.duckdns.org
mmmdbox.duckdns.org
modolitm.myds.me
modolnasf.myds.me
modolnasvideo.myds.me
moohan1.iptime.org
mordekai.iptime.org
mta-sts.email.webredirect.org
mta-sts.glt.duckdns.org
mta-sts.mta-sts.glt.duckdns.org
mta-sts.mta-sts.kirikil.duckdns.org
mta-sts.mta-sts.mta-sts.glt.duckdns.org
mymathapp.duckdns.org
n.i.edc.kro.kr
n.i.ujm.kro.kr
nafdata.duckdns.org
nanumict.i234.me
nanumitech.myds.me
neowise1008.iptime.org
netplex.dscloud.biz
netplex.familyds.net
netplex.myds.me
newtech.diskstation.me
newtech1.diskstation.me
ngiswebdev.webredirect.org
ngiswebtest.webredirect.org
npm.wangjumeok.duckdns.org
nrmotors.dsmynas.com
ocaysu.myds.me
oe.asuscomm.com
okjeon.duckdns.org
oldnassolueta.myds.me
onetoon.myds.me
onglch.i234.me
op-code.duckdns.org
opensg-dt.diskstation.me
orijin.myds.me
ortusgames.asuscomm.com
osolit-office.asuscomm.com
osstemone.myds.me
p.edc.kro.kr
p.ujm.kro.kr
p.zms.kro.kr
panaxtos.i234.me
partdb.kro.kr
partdbcar.kro.kr
pass1golf.asuscomm.com
pay.ad.zms.kro.kr
pay.dg.zms.kro.kr
pay.gm.zms.kro.kr
pay.gu.zms.kro.kr
pay.net.zms.kro.kr
pay.yj.zms.kro.kr
pay.zms.kro.kr
pbot.iptime.org
pdb.kro.kr
pdsol.kro.kr
pfdb.i234.me
pfdb1.i234.me
pfdb2.i234.me
pfssusko.gotdns.com
pfsvr.i234.me
pfsync.ddns.net
photocube6.duckdns.org
pitapat.asuscomm.com
pitapat1.asuscomm.com
pixelcruise.diskstation.me
plco.i234.me
plex.wangjumeok.duckdns.org
pp.zms.kro.kr
ppg-korea-wired-rbbqwrdhkh.dynamic-m.com
primary.mynetgear.com
privat99.myds.me
pt7001sv3.dsmynas.net
ptsuwon.dsmynas.org
qaz.i234.me
qiuhome.myds.me
rcsvr.myds.me
recosys.asuscomm.com
recosys.dsmynas.net
rental.colla.n-e.kr
rexgen.dscloud.me
rtnw.myds.me
s.colla.n-e.kr
s.edc.kro.kr
s.jxj.kro.kr
s.ujm.kro.kr
s.zooms.kro.kr
sb.da.zms.kro.kr
sb.zms.kro.kr
sbbowl.iptime.org
sbbowl.mynetgear.com
sdp-bp.asuscomm.com
secondcampus.iptime.org
secureonesslvpn.duckdns.org
sekonixfac1.fortiddns.com
selenium.wangjumeok.duckdns.org
senwebhard.iptime.org
seobo.myds.me
seoktae2.duckdns.org
seoktae3.duckdns.org
seoktae4.duckdns.org
seoktae5.duckdns.org
seoktae6.duckdns.org
seoktae7.duckdns.org
seoktae8.duckdns.org
seoul11f.softether.net
seoulin.myds.me
seven4power.iptime.org
shimbang.asuscomm.com
shinancloud.myds.me
shinrouter.i234.me
shinwon.us.to
sinwon.kro.kr
sinwon21c.i234.me
sinwon21c.kro.kr
siyeul.myds.me
sjkim0416.myds.me
sjss.myds.me
sjtech.myds.me
sjva.wangjumeok.duckdns.org
sk.edc.kro.kr
sk.ujm.kro.kr
sky1000.myds.me
skydev2.ddns.net
sl.edc.kro.kr
sl.ujm.kro.kr
slowmiracle.kro.kr
smartcost.iptime.org
smchurch.asuscomm.com
smic0728.myds.me
smlnas.iptime.org
smoon.zz.am
softstonedev.asuscomm.com
solbini.myds.me
solvix.iptime.org
spot.iptime.org
ss.edc.kro.kr
ss.ujm.kro.kr
ssluser.biz.tm
sstest.ddns.net
star.dsmynas.com
stekhq.fortiddns.com
stimes.duckdns.org
stl.iptime.org
sungro.myds.me
sungwon.myds.me
supportec.i234.me
supportec.myds.me
suwoncca.vpnplus.to
sw.sinwon21c.kro.kr
sw2k.duckdns.org
synology.wangjumeok.duckdns.org
systemcore.iptime.org
t.edc.kro.kr
t.jxj.kro.kr
t.ujm.kro.kr
t1.edc.kro.kr
t1.ujm.kro.kr
t2.edc.kro.kr
t2.ujm.kro.kr
t20.kro.kr
t3.edc.kro.kr
t3.ujm.kro.kr
t4.edc.kro.kr
t4.ujm.kro.kr
t5.edc.kro.kr
t5.ujm.kro.kr
takorea.dscloud.biz
tamo.us.to
tax.colla.n-e.kr
tax.zooms.kro.kr
tax2.colla.n-e.kr
tax2.zooms.kro.kr
tax3.colla.n-e.kr
tax3.zooms.kro.kr
tckmd.fortiddns.com
teamwave.o-r.kr
test.colla.n-e.kr
test.zooms.kro.kr
tgcus.myds.me
thehole2024.myds.me
thelen.asuscomm.com
thelimomain.asuscomm.com
thelimomain1.asuscomm.com
theplus.softether.net
thevoicein2.dscloud.me
thevoicein3.dscloud.me
tienipia-work.tplinkdns.com
tkbank.iptime.org
tmms.iptime.org
tndlife.duckdns.org
toby-house.duckdns.org
toptel.iptime.org
torrssen2.wangjumeok.duckdns.org
totob.iptime.org
twinvpn3.softether.net
twobeone.asuscomm.com
tymict.iptime.org
tytuz.asuscomm.com
uact.myds.me
uiseongpv.iptime.org
ujin.myds.me
ujm.kro.kr
ukchan2.asuscomm.com
umssw.asuscomm.com
unmansol.asuscomm.com
vestek.iptime.org
vetec.myds.me
viccns.iptime.org
vionn.asuscomm.com
vird.fortiddns.com
viron.i234.me
vlemental.iptime.org
voicein-chemtro.dscloud.me
voicein-lgerobot.dscloud.me
volvo2k.duckdns.org
volvo2k.mooo.com
volvo3k.duckdns.org
vowbroad.myds.me
vpn287980672.softether.net
vpn298587525.softether.net
vpn336597887.softether.net
vpn647287778.softether.net
vpn669847786.softether.net
vpn715709953.softether.net
vpn758083486.softether.net
vpn894854855.softether.net
vpn896967813.softether.net
w.jxj.kro.kr
wangjumeok.asuscomm.com
wangjumeok.duckdns.org
wants.myds.me
wany0904.duckdns.org
webdav.wany0904.duckdns.org
wedu-en.dedyn.io
wellcar.i234.me
wineaudio.diskstation.me
wired-mnthqhbggz.dynamic-m.com
wonhie75.asuscomm.com
wonseok.myds.me
woorim.myds.me
worldnet21.iptime.org
wysevent.duckdns.org
xpp162.softether.net
xpp163.softether.net
xrf070.iptime.org
xslab-test.asuscomm.com
xslab.duckdns.org
y.i.edc.kro.kr
y.i.ujm.kro.kr
yangkwang.iptime.org
ygnas.iptime.org
yingfeng6.dynv6.net
yldo.mylenovoemc.com
youngnaknasfin.diskstation.me
yunwoo.myds.me
yunwoonas.myds.me
yyarts.iptime.org
z.edc.kro.kr
z.jxj.kro.kr
z.ujm.kro.kr
zb.edc.kro.kr
zb.ujm.kro.kr
zdev.i234.me
zerogames.asuscomm.com
zigbang2.asuscomm.com
zms.colla.n-e.kr
zms.edc.kro.kr
zms.jxj.kro.kr
zms.jzj.kro.kr
zms.kro.kr
zms.ujm.kro.kr
zms1.colla.n-e.kr
zms2.colla.n-e.kr
zms3.colla.n-e.kr
zn.edc.kro.kr
zn.ujm.kro.kr
zn2.ujm.kro.kr
zoom.colla.n-e.kr
zoom.zooms.kro.kr
zooms.colla.n-e.kr
zooms.kro.kr
zooms.zooms.kro.kr
zoomsbak.colla.n-e.kr
zoomsbak.zooms.kro.kr
zsm.colla.n-e.kr

# Reference: https://x.com/skocherhan/status/2054631705630359914

htr33ies.dynuddns.com
htr7edc.dynv6.net
itx4ps.dns.army
itx6ps.dns.army
nid-login.htr7edc.dynv6.net
nid-login.ntpo14ke.dynv6.net
nida.opt36ntesx.dns.army
nids.tpx2ee.dns.army
nidservers.htr33ies.dynuddns.com
nidservers.itx6ps.dns.army
nidservers.ntpo13ke.dynv6.net
nidservers.opt38ntesx.dns.army
nidservers.opt39ntesx.dns.army
ntpo13ke.dynv6.net
ntpo14ke.dynv6.net
opt36ntesx.dns.army
opt38ntesx.dns.army
opt39ntesx.dns.army
otx19ntp.dns.army
otx3ntp.dns.army
tpx2ee.dns.army

# Reference: https://x.com/hypen1117/status/2054890343041319144
# Reference: https://securelist.com/kimsuky-appleseed-pebbledash-campaigns/119785/
# BANNER_0_HASH-HOST=3e14f4853e7ab2d95cd05252984a1162
# BANNER_0_HASH-HOST=efe6b20204336754c3ba181274800b25

afweq.chickenkiller.com
ahnlabepp.n-e.kr
auth.fastsupport.n-e.kr
auth.kcubeon.o-r.kr
auth.ssangyongce.o-r.kr
auth.yjcc.o-r.kr
bigcloud.n-e.kr
bigfile.freestorage.n-e.kr
bizmeka.o-r.kr
booi.giize.com
check.fullservice.n-e.kr
check.verymad.net
cloudroute.o-r.kr
cms.spaceyou.o-r.kr
demo.robotcheck.n-e.kr
document.krf.o-r.kr
doosanenc.n-e.kr
download.birdriver.org
email.naveira.tk
erp.spaceme.p-e.kr
ezesso.bizmeka.o-r.kr
fastsupport.n-e.kr
file.bigcloud.n-e.kr
file.navcollection.n-e.kr
file.nidstorage.n-e.kr
file.postimages.o-r.kr
fourcloud.o-r.kr
freestorage.n-e.kr
fullservice.n-e.kr
ggly.n-e.kr
gw.munhwam.o-r.kr
hiwork.n-e.kr
hworks.o-r.kr
icloudfare.o-r.kr
jan.lastdate.o-r.kr
kaonicloud.o-r.kr
kcube.o-r.kr
kcubeon.o-r.kr
ksdhfeks.o-r.kr
laskdfd.o-r.kr
lastdate.o-r.kr
load.fourcloud.o-r.kr
load.icloudfare.o-r.kr
load.navclub.n-e.kr
load.shapcloud.o-r.kr
load.ssangyongcne.o-r.kr
load.swapcloud.o-r.kr
load.yearcloud.n-e.kr
load.yju.o-r.kr
log.cloudroute.o-r.kr
log.smsproxy.n-e.kr
login.hiwork.n-e.kr
login.office.hworks.o-r.kr
mail.nav-help.kro.kr
mail.sasq.p-e.kr
mail.srf.o-r.kr
mas.laskdfd.o-r.kr
mportal.doosanenc.n-e.kr
munhwam.o-r.kr
nav-help.kro.kr
navaercorp.n-e.kr
navarcorp.n-e.kr
navclub.n-e.kr
navcollection.n-e.kr
navecorp.n-e.kr
naveira.tk
navercorp.n-e.kr
nhealth.n-e.kr
nid.navaercorp.n-e.kr
nid.navarcorp.n-e.kr
nid.navecorp.n-e.kr
nid.navercorp.n-e.kr
nidstorage.n-e.kr
noticiaspiura.sytes.net
nov.specialdocument.o-r.kr
npvg.n-e.kr
office.hworks.o-r.kr
online-doc.zanity.net
online.ksdhfeks.o-r.kr
pipeline.embeddedonline.org
postimages.o-r.kr
robotcheck.n-e.kr
s3l.r-e.kr
sasq.p-e.kr
shapcloud.o-r.kr
smsproxy.n-e.kr
spaceme.p-e.kr
spaceyou.o-r.kr
specialdocument.o-r.kr
srf.o-r.kr
ssangyongce.o-r.kr
ssangyongcne.o-r.kr
sso.ahnlabepp.n-e.kr
sso.kaonicloud.o-r.kr
swapcloud.o-r.kr
time.kcube.o-r.kr
update.vpnfire.o-r.kr
vpn563012993.softether.net
vpn799113809.softether.net
vpnfire.o-r.kr
wzga1.strangled.net
yearcloud.n-e.kr
yjcc.o-r.kr
yju.o-r.kr
female-disorder-beta-metropolitan.trycloudflare.com
newjo-imd.com/common/include/library/default.php
pyrotech.co.kr/common/include/tech/default.php
yespp.co.kr/common/include/code/out.php

# Reference: https://x.com/skocherhan/status/2055029645125296604

0751u9n4lg.v6.rocks
0s2snxin4t.v6.navy
12e9w4hp1f.v6.army
17ej3.t1wcwln96d.v6.rocks
1d0h72.777vfumk8a0.dns.army
1zankmyc0d.v6.rocks
2974pm.thu8cl13up.v6.rocks
2e2yvueuot.v6.rocks
2ermxe.th7s18w5abl.dns.army
2rk6.nnztcxy6uc.v6.navy
31mz639cjr.dns.army
32r2lfkhyf.v6.army
3u5x5.6tip2gtb4f1.dns.army
42yqeg15z7.v6.navy
4gog2.rfywn135de.dns.army
4zjg6ezmr1.v6.rocks
55t2vtuhx2.dns.army
59v067xp0k.v6.rocks
5b77w.l94i8b2wi8.v6.rocks
6tip2gtb4f1.dns.army
777vfumk8a0.dns.army
7jqzrt3nvn.v6.navy
7nj9.yc4yfcbhap.v6.rocks
8ayvym1fak.v6.rocks
8dj4dr.covbq4shvb5.dns.army
92ssiovzua.v6.rocks
95mqw.42yqeg15z7.v6.navy
979b9n.r55jmmvgp3s.dns.army
9t82.y7sxucb2iv.v6.rocks
9ysj9j3toq.v6.army
aai1khooe8.v6.navy
ab761b9sni.dynv6.net
al22nhs.dns.navy
al4nhs.dns.navy
azwihailbl.dynv6.net
baqcf4rz7n.v6.rocks
booking-doc.gd8d.92ssiovzua.v6.rocks
c9ip.thu8cl13up.v6.rocks
cbgx8hfgym.v6.rocks
cfqcn6txfo.dynv6.net
cha5vp65tc.dns.army
cogu4qno4o.v6.rocks
conifir-mx.abrdns.com
covbq4shvb5.dns.army
cti.nts-go.ips-auth-user.n-e.kr
d0ft3sxfx3.dynv6.net
dns.php-config.bumbleshrimp.com
dns.ssl-connect.webredirect.org
doc-suggest.mywire.org
doc-verification.s1x5lf.vitheq17yl.dynv6.net
docsupport.v6.navy
dwcri4wrof.v6.army
ehr8afl0mf.v6.navy
f24giigz4s.dynv6.net
fdf51nswgh.dns.navy
gbouy8fn5i.dynv6.net
gd8d.92ssiovzua.v6.rocks
global-works.17ej3.t1wcwln96d.v6.rocks
global-works.2974pm.thu8cl13up.v6.rocks
global-works.5b77w.l94i8b2wi8.v6.rocks
global-works.9t82.y7sxucb2iv.v6.rocks
global-works.c9ip.thu8cl13up.v6.rocks
global-works.iu3zd.j4m2q9x0xg.v6.rocks
global-works.mlc9l.t1wcwln96d.v6.rocks
global-works.v6f1.cogu4qno4o.v6.rocks
gm8n.ehr8afl0mf.v6.navy
gng9kybi9k.v6.rocks
go-kr-doc.idmbz.1zankmyc0d.v6.rocks
guidevline.abrdns.com
hgx3c2aynw.v6.navy
i2fh7k.sqpo7udsee0.v6.navy
idmbz.1zankmyc0d.v6.rocks
invoice-deliver.mu7p0.rs0kin1d9c.dynv6.net
invoicecheck-jqk.pont-vner.mydns.vc
ip67ig0ffq.dns.navy
ipmo.loseyourip.com
ips-auth-user.n-e.kr
ips-doc-auth.xvn58.ip67ig0ffq.dns.navy
ips-work.abrdns.com
iu3zd.j4m2q9x0xg.v6.rocks
j4m2q9x0xg.v6.rocks
k6d1cwxcvc.v6.rocks
kgbi5cd292.dynv6.net
ktvw0gpwhq.dns.army
kufgi5a66x.v6.navy
l94i8b2wi8.v6.rocks
law-doc-alert.zxxz0k.fdf51nswgh.dns.navy
mareqsutxn.v6.navy
me6rc5j08q.v6.rocks
mlc9l.t1wcwln96d.v6.rocks
mois-doc.cloud-ip.cc
mp1bchmkf3.dynv6.net
mtoken.nugge.cloud-ip.cc
mu7p0.rs0kin1d9c.dynv6.net
mviw0y.2e2yvueuot.v6.rocks
mw8vszy21b.dns.army
ncog10ks.dns.navy
ndoc-nid.mydns.jp
ndoc.nusrtx.dns.army
ndoc.pnosw.loseyourip.com
ndoc.ssl-connect.webredirect.org
ndocnver.3u5x5.6tip2gtb4f1.dns.army
ndocnver.8dj4dr.covbq4shvb5.dns.army
nid-auth.petfoodkorea.kr
nid-check.o-r.kr
nid-opiohy.4gog2.rfywn135de.dns.army
nid-policy.7nj9.yc4yfcbhap.v6.rocks
nid-policy.mviw0y.2e2yvueuot.v6.rocks
nid-tax.dynuddns.net
nid-user.al22nhs.dns.navy
nid.nid-check.o-r.kr
nid.nusrtx.dns.army
nid.thuide.bumbleshrimp.com
nidlog.scheculetx.1cooldns.com
ninvoice.i2fh7k.sqpo7udsee0.v6.navy
ninvoice.noiduser.dns.army
nndq.abrdns.com
nnztcxy6uc.v6.navy
noiduser.dns.army
npigoji2sv.dns.army
npooo.opik.net
npspartyapp49sv.dns.army
nstk.nid-tax.dynuddns.net
nts-doc-auth.x82ad.cfqcn6txfo.dynv6.net
nts-go.ips-auth-user.n-e.kr
nugge.cloud-ip.cc
nusrtx.dns.army
nv-check-log.v1jbv.mp1bchmkf3.dynv6.net
nv-confirm.xubi.org
nv-token.crabdance.com
nverdoc.2ermxe.th7s18w5abl.dns.army
nverdoc.979b9n.r55jmmvgp3s.dns.army
or393dt7k0.v6.army
passkey-info.abrdns.com
pc3wnc0sb5.dns.army
pdoc-load-77.doc-suggest.mywire.org
php-config.bumbleshrimp.com
pload.accesscam.org
pm2djbx5ne.v6.rocks
pnosw.loseyourip.com
po-doc.2rk6.nnztcxy6uc.v6.navy
po-doc.95mqw.42yqeg15z7.v6.navy
po-doc.gm8n.ehr8afl0mf.v6.navy
pol-nav-joi.pont-vner.mydns.vc
pol-nav-kov.pont-vner.mydns.vc
pol-nav-puz.ndoc-nid.mydns.jp
pont-vner.mydns.vc
pufyw1fgwq.dynv6.net
pxkq0mjbe6.dynv6.net
qqdfhtrhlv.v6.army
r55jmmvgp3s.dns.army
rfywn135de.dns.army
robyritrl0.v6.navy
rs0kin1d9c.dynv6.net
s1x5lf.vitheq17yl.dynv6.net
s7rc7llnw9.v6.navy
scheculetx.1cooldns.com
sgv5lblons.v6.army
sqpo7udsee0.v6.navy
ssl-connect.webredirect.org
swat-check.ezgateway.net
t1wcwln96d.v6.rocks
t71oxe7g8r.v6.army
tax-search.cloud-ip.cc
tgide.xubi.org
th7s18w5abl.dns.army
thu8cl13up.v6.rocks
tlogn.ddnsgeek.com
txlozah984.dynv6.net
txproblem.1d0h72.777vfumk8a0.dns.army
ufood.ddnsguru.com
ugogqmfezq.v6.navy
uide.bumbleshrimp.com
urgtte.naver.ydns.eu
user-doc.ips-work.abrdns.com
v1jbv.mp1bchmkf3.dynv6.net
v5uol9d3ld.v6.rocks
v6f1.cogu4qno4o.v6.rocks
vitheq17yl.dynv6.net
x82ad.cfqcn6txfo.dynv6.net
xvn58.ip67ig0ffq.dns.navy
y05jqzxey7.v6.rocks
y7sxucb2iv.v6.rocks
y8eserofr9.v6.navy
y9mq7t3h11.dynv6.net
yc4yfcbhap.v6.rocks
ysxvh5w2yn.v6.rocks
z8jreih14d.v6.army
znn4zk2xc3.dynv6.net
zxxz0k.fdf51nswgh.dns.navy

# Reference: https://x.com/malwrhunterteam/status/2033509348396212689
# Reference: https://x.com/lazarusholic/status/2055249391662084191
# Reference: https://hybrid-analysis.blogspot.com/2026/05/velvet-chollima-infostealer-campaign.html

161.97.113.34:3001
creativetera.org
endava.online
talert.online
talert.site
talert.space
talert.store
tralert.app
tralert.online
tralert.site
tralert.store
tralert7.com
trumpalert.store

# Reference: https://x.com/skocherhan/status/2055709288539050134
# Reference: https://www.virustotal.com/gui/ip-address/118.194.249.36/relations

gov.ydns.eu
noreply.gov.ydns.eu

# Reference: https://x.com/skocherhan/status/2056180345528094986

234.traffice-safe.dns.navy
from.mail-deliver.v6.rocks
invoice.traffic-mail.dynv6.net
mail.police-of-traffic.dynv6.net
nav.virgocx.site
neonrecon.site
texwe.chickenkiller.com
verify.neonrecon.site
virgocx.site
ws.neonrecon.site

# Reference: https://x.com/skocherhan/status/2056103734854426639

docinfo.myndocapp35s.dns.navy
docinfo.myndocapp7s.dns.navy
docinfo.myndocapp9s.dns.navy
docinfo.openuasermdoc21s.dns.army
edoc.myndocapp11s.dns.navy
invoice.myndocapp11s.dns.navy
invoice.myndocapp29s.dns.navy
invoice.myndocapp3s.dns.navy
k1be.yu95pzwvz84.dns.navy
myndocapp11s.dns.navy
myndocapp29s.dns.navy
myndocapp35s.dns.navy
myndocapp3s.dns.navy
myndocapp4s.dns.navy
myndocapp7s.dns.navy
myndocapp9s.dns.navy
ndocfrxjnax.ntu1invoice.dynu.org
ndocsuppport.dns.army
nid-naverdlc.servequake.com
nid.ndocsuppport.dns.army
nid.openuasermdoc19s.dns.army
nid.openuasermdoc1s.xubi.org
nidsec.dns.army
nidsign.k1be.yu95pzwvz84.dns.navy
nopts.xubi.org
npload-mdoc4s.xubi.org
ntu1invoice.dynu.org
openuasermdoc19s.dns.army
openuasermdoc1s.xubi.org
openuasermdoc21s.dns.army
openuasermdoc34s.dns.army
openuasermdoc4s.xubi.org
usr.myndocapp11s.dns.navy
usr.openuasermdoc34s.dns.army
usr.openuasermdoc4s.xubi.org
yu95pzwvz84.dns.navy

# Reference: https://x.com/skocherhan/status/2056439110336700759

dectaur8upb.dns.navy
ilhvhrz2ize.dns.navy
lmpr.p7w3p3anpr7.dns.navy
mi4q.ilhvhrz2ize.dns.navy
n4zsbi0vab.dns.army
nid-check.lmpr.p7w3p3anpr7.dns.navy
nid-sign.mi4q.ilhvhrz2ize.dns.navy
nidlog.q6xir.dectaur8upb.dns.navy
nivercloud.d-n-s.name
nsign.hardsoft.nu
p7w3p3anpr7.dns.navy
q6xir.dectaur8upb.dns.navy

# Reference: https://logpresso.com/ko/blog/2026-05-15-1Q-Kimsuky-report

nelark.icu
/xftaswx/res/bb.php
/xftaswx/res/bypass.b
/xftaswx/res/get-command.php
/xftaswx/res/index.php
/xftaswx/res/post_proc.php

# Reference: https://x.com/skocherhan/status/2056808020622090594
# Reference: https://www.virustotal.com/gui/ip-address/152.32.139.126/relations

copjkc.sbs
hmbufwche.dynv6.net
hmbxkidkc.dynv6.net
hmoppemjg.dynv6.net
hmpizcoxy.abrdns.com
hmqglabnc.dynv6.net
hmsraopyt.dynv6.net
hmyergrch.dynv6.net
imasagzhu.v6.army
imaxhscik.v6.army
imeekhczw.v6.army
imjbfveie.v6.army
imtuwvtmo.v6.army
kmcwqxcdh.libfoobar.com
kmgkgphux.libfoobar.com
kmjoguxzi.libfoobar.com
kmjtjlqqv.libfoobar.com
kmlqaqvdq.libfoobar.com
kmplvpwbd.libfoobar.com
kmsiaiozim.cloud-ip.cc
kmtisopbi.abrdns.com
kmurxenly.libfoobar.com
kmxgfgmqi.libfoobar.com
lmdi1dia.libfoobar.com
mminfo-account-0q3qfpbyw.libfoobar.com
mminfo-account-4x05qlubg.libfoobar.com
mminfo-account-98o4fkv0l.libfoobar.com
mminfo-account-9h0mp8edg.libfoobar.com
mminfo-account-b024ksgll.libfoobar.com
mminfo-account-e7vs45uo4.libfoobar.com
mminfo-account-f4cf68k7a.libfoobar.com
mminfo-account-fmst329le.libfoobar.com
mminfo-account-g3aemnu87.libfoobar.com
mminfo-account-hx28a8wvl.libfoobar.com
mminfo-account-p71yo6nq2.libfoobar.com
mminfo-account-snfaf62fu.libfoobar.com
mminfo-account-utw9ou5ce.libfoobar.com
mminfo-account-vo8z7wrep.libfoobar.com
mminfo-account-zz5ew336m.libfoobar.com
mminfo-account-zzwh30zyk.libfoobar.com
nminfo-account-163uhrfdsqx.domainerati.com
nminfo-account-1hyhac8kd94.quor8.com
nminfo-account-bshjhjy16ze.quor8.com
nminfo-account-hp3qst0i26t.domainerati.com
nminfo-account-jc3r5vxqhvk.quor8.com
nminfo-account-q66f2w6hrfi.domainerati.com
nminfo-account-ty8fc6xcfw8.domainerati.com
nminfo-account-uv5mimq9oy8.domainerati.com
nminfo-account-x21r01v8hkn.domainerati.com
nminfo-account-zh9gtsp7z11.domainerati.com
t18delivery.entrydns.org

# Reference: https://x.com/skocherhan/status/2057172575889789202

2u9f.2usrmmwwduz.dns.navy
2usrmmwwduz.dns.navy
6td4w.mj9tqlj86sz.dns.navy
923h5qvvzq2.v6.navy
flbsbn.zsf31ayvobt.dns.navy
guidetx.suredoc.net
mareqsutxn.v6.navy
mj9tqlj86sz.dns.navy
ncloud.casacam.net
ndoc.ncloud.casacam.net
nid-log-pl.2u9f.2usrmmwwduz.dns.navy
nid-token.tkho.mareqsutxn.v6.navy
nidmois.p0fx8.923h5qvvzq2.v6.navy
nidsign.mylogisoft.com
ninvoice.parentinvolvement.in
ninvoice.taxcloud.kro.kr
p0fx8.923h5qvvzq2.v6.navy
pol-go-nid.6td4w.mj9tqlj86sz.dns.navy
pol-go-nid.flbsbn.zsf31ayvobt.dns.navy
taxcloud.kro.kr
tkho.mareqsutxn.v6.navy
toxcloud.dns.army
vvg1ylsb4a7.dns.navy
zsf31ayvobt.dns.navy

# Reference: https://x.com/skocherhan/status/2057180776865874178

nid-naverclz.servecounterstrike.com
nid-naverhjk.servehalflife.com
nid-naverhow.servequake.com
nid-naveriqy.servepics.com
nid-naverjog.servemp3.com
nid-naverkdq.serveftp.com
nid-naversrl.servehalflife.com
nid-navervyu.servequake.com
nid-naverwjx.onthewifi.com

# Reference: https://x.com/skocherhan/status/2057532420128153905
# TITLE-HOST=Naver Login

101.36.114.235:8899
115.193.38.156:3000
115.195.112.167:3000
115.197.193.142:3000
123.58.200.110:8899
125.118.95.227:8899
138.197.235.123:8899
138.68.112.220:8899
139.208.63.224:8899
152.32.138.120:8899
frequent-paypin.surge.sh
tos-industry.surge.sh

# Reference: https://x.com/skocherhan/status/2057895474393493637

cniskakaoinfo.online
acclive.m365.cniskakaoinfo.online
accms.m365.cniskakaoinfo.online
accounts.cniskakaoinfo.online
accounts.gle.cniskakaoinfo.online
adminms.m365.cniskakaoinfo.online
cdn-1.m365.cniskakaoinfo.online
cdn-2.m365.cniskakaoinfo.online
cdn-3.m365.cniskakaoinfo.online
cdn-4.m365.cniskakaoinfo.online
cdn-afd.m365.cniskakaoinfo.online
cdn-eu.m365.cniskakaoinfo.online
cdn-jp.m365.cniskakaoinfo.online
cdn-jp1.m365.cniskakaoinfo.online
cdn-usc.m365.cniskakaoinfo.online
cdn-usw.m365.cniskakaoinfo.online
cdn.cniskakaoinfo.online
copilot.m365.cniskakaoinfo.online
dkaptcha.cniskakaoinfo.online
events.m365.cniskakaoinfo.online
fpt.m365.cniskakaoinfo.online
login.m365.cniskakaoinfo.online
loginms.m365.cniskakaoinfo.online
m365.cniskakaoinfo.online
m365portal.m365.cniskakaoinfo.online
m365web.m365.cniskakaoinfo.online
office.m365.cniskakaoinfo.online
office1.m365.cniskakaoinfo.online
officelive.m365.cniskakaoinfo.online
outlook.m365.cniskakaoinfo.online
portal.m365.cniskakaoinfo.online
portof.m365.cniskakaoinfo.online
sso.m365.cniskakaoinfo.online
teams.m365.cniskakaoinfo.online
wwwms.m365.cniskakaoinfo.online

# Reference: https://x.com/skocherhan/status/2058204055315300603

againchecker.dynv6.net
anisds.dynv6.net
askinfo.dynv6.net
maincheck.dynv6.net
mlsch-nid.dynv6.net
n-cloud.againchecker.dynv6.net
n-cloud.anisds.dynv6.net
n-cloud.askinfo.dynv6.net
n-cloud.masterlg.dns.army
n-cloud.nstnvd.dns.army
n-corp.askinfo.dynv6.net
n-corp.mlsch-nid.dynv6.net
n-store.askinfo.dynv6.net
n-store.callingsin.dns.army
n-store.mlsch-nid.dynv6.net
n-store.nt0s-smt.dns.army
navdock.dynv6.net
nid-user.almsalert.dynv6.net
nid-user.mlsch-nid.dynv6.net
nid-user.navdock.dynv6.net
nn-corp.ipsmkt.dynv6.net
nuser-login.anisds.dynv6.net
nuser-login.askinfo.dynv6.net
nuser-login.mlsch-nid.dynv6.net
nuser-login.navdock.dynv6.net
nuser-login.ysadc.dynv6.net
txstorage.dynv6.net

# Reference: https://x.com/skocherhan/status/2058617342477701164

adduserprof.mydns.bz
aewfawtsefg.dynv6.net
allowuseraccess.dynv6.net
bmatytxe.ntxreauths.mydns.bz
bmcmiy.ntax-memd83s.dynv6.net
bxzzqeau.offichannel26id.dynv6.net
bywcssex.nxdeliv-24id.dynv6.net
cdqspvi.ntax-memd86s.dynv6.net
cejyfjq.nxdeliv-43id.dynv6.net
clrkxqve.postmethod1s.dynv6.net
departmentndoc17s.dynv6.net
departmentndoc49s.dynv6.net
departmentndoc77s.dynv6.net
departmentndoc99s.dynv6.net
docinfo.ntdelivery.cloud-ip.cc
docinfo.realsync.ai
edoc.envelopecheck.webredirect.org
edoc.investinfdoc.mydns.bz
edoc.usernhpost.dynv6.net
entlshte.dynv6.net
envelopecheck.webredirect.org
hicekjp.taxsecret57s.dynv6.net
hostlinedeliver.dynv6.net
insntx60s.dynv6.net
insntx61s.dynv6.net
insntx62s.dynv6.net
insntx63s.dynv6.net
insntx64s.dynv6.net
insntx65s.dynv6.net
insntx66s.dynv6.net
insntx67s.dynv6.net
insntx68s.dynv6.net
insntx69s.dynv6.net
insntx70s.dynv6.net
insntx71s.dynv6.net
insntx72s.dynv6.net
insntx73s.dynv6.net
insntx74s.dynv6.net
insntx75s.dynv6.net
insntx76s.dynv6.net
insntx77s.dynv6.net
insntx78s.dynv6.net
insntx79s.dynv6.net
insntx80s.dynv6.net
insntx81s.dynv6.net
insntx82s.dynv6.net
insntx83s.dynv6.net
insntx84s.dynv6.net
insntx85s.dynv6.net
insntx90s.dynv6.net
invoice.ntdelivery.cloud-ip.cc
invoice.uidentitycorp.dynv6.net
irc.reverifsession.mydns.bz
kjvywk.ntxruv48s.dynv6.net
naprildtype.dynv6.net
ndonatelnk.dynv6.net
nhsinsur1v.dynv6.net
nid-user.entlshte.dynv6.net
ninsurance-22id.dynv6.net
ninsurance-34id.dynv6.net
ninsurance-38id.dynv6.net
ninvoice.allowuseraccess.dynv6.net
nonreg7d-idtype.dynv6.net
npc5invocie.dynu.org
npvlog43docs.dns.army
npvlog45docs.dns.army
nregtaxinfo24s.dns.army
nsmspol51doc.dynv6.net
nsmspol55doc.dynv6.net
nsmspol81doc.dynv6.net
nsmspol82doc.dynv6.net
nt-usermem56s.dynv6.net
nt-usermem66s.dynv6.net
nt-usermem89s.dynv6.net
ntaline.dynv6.net
ntalter-dep24s.dynv6.net
ntalter-dep58s.dynv6.net
ntax-memd83s.dynv6.net
ntax-memd86s.dynv6.net
ntcategory.dynv6.net
ntdelivery.cloud-ip.cc
ntdoc-epayload1s.dynv6.net
ntdoc-epayload34s.dynv6.net
ntdoc-epayload48s.dynv6.net
ntdoc-epayload63s.dynv6.net
ntdoc-epayload75s.dynv6.net
ntdocnpkximg.npc5invocie.dynu.org
nte-corp.mydns.bz
ntelcorp.dynv6.net
ntlshte.dynv6.net
nts-playloads.dynv6.net
ntsp-load0type.dynv6.net
ntsp-load29type.dynv6.net
ntstaticlog15s.dynv6.net
ntv-method38type.dynv6.net
ntv-method39type.dynv6.net
ntv-method40type.dynv6.net
ntv-method41type.dynv6.net
ntv-method42type.dynv6.net
ntv-method43type.dynv6.net
ntv-method44type.dynv6.net
ntv-method45type.dynv6.net
ntv-method46type.dynv6.net
ntv-method47type.dynv6.net
ntv-method48type.dynv6.net
ntv-method49type.dynv6.net
ntv-method50type.dynv6.net
ntv-method51type.dynv6.net
ntv-method52type.dynv6.net
ntv-method53type.dynv6.net
ntv-method54type.dynv6.net
ntv-method55type.dynv6.net
ntv-method56type.dynv6.net
ntv-method57type.dynv6.net
ntv-method58type.dynv6.net
ntv-method59type.dynv6.net
ntv-method60type.dynv6.net
ntv-method61type.dynv6.net
ntv-method62type.dynv6.net
ntv-method63type.dynv6.net
ntv-method64type.dynv6.net
ntv-method65type.dynv6.net
ntv-method66type.dynv6.net
ntv-method67type.dynv6.net
ntv-method68type.dynv6.net
ntv-method69type.dynv6.net
ntv-method70type.dynv6.net
ntv-method71type.dynv6.net
ntv-method72type.dynv6.net
ntv-method73type.dynv6.net
ntv-method74type.dynv6.net
ntv-method75type.dynv6.net
ntv-method76type.dynv6.net
ntv-method77type.dynv6.net
ntv-method78type.dynv6.net
ntv-method79type.dynv6.net
ntv-method80type.dynv6.net
ntv-method81type.dynv6.net
ntv-method82type.dynv6.net
ntv-method83type.dynv6.net
ntv-method84type.dynv6.net
ntv-method85type.dynv6.net
ntv-method86type.dynv6.net
ntv-method87type.dynv6.net
ntv-method88type.dynv6.net
ntv-method89type.dynv6.net
ntv-method90type.dynv6.net
ntv-method91type.dynv6.net
ntv-method92type.dynv6.net
ntv-method93type.dynv6.net
ntv-method94type.dynv6.net
ntv-method95type.dynv6.net
ntv-method96type.dynv6.net
ntv-method97type.dynv6.net
ntv-method98type.dynv6.net
ntvlog23invoice.dns.army
ntvlog24invoice.dns.army
ntxreauths.mydns.bz
ntxruv0s.dynv6.net
ntxruv12s.dynv6.net
ntxruv31s.dynv6.net
ntxruv33s.dynv6.net
ntxruv37s.dynv6.net
ntxruv3s.dynv6.net
ntxruv41s.dynv6.net
ntxruv48s.dynv6.net
ntxruv59s.dynv6.net
ntxruv60s.dynv6.net
ntxruv61s.dynv6.net
ntxruv62s.dynv6.net
ntxruv63s.dynv6.net
ntxruv64s.dynv6.net
ntxruv65s.dynv6.net
ntxruv66s.dynv6.net
ntxruv67s.dynv6.net
ntxruv7s.dynv6.net
ntxruv8s.dynv6.net
ntxruv9s.dynv6.net
nxdeliv-24id.dynv6.net
nxdeliv-43id.dynv6.net
nxdeliv-53id.dynv6.net
offichannel26id.dynv6.net
pbessfs.uidentitycorp.dynv6.net
phgfze.ntstaticlog15s.dynv6.net
postmethod1s.dynv6.net
postmethod2s.dynv6.net
postntv36s.dynv6.net
pqzxzxbd.nxdeliv-53id.dynv6.net
reverifsession.mydns.bz
rqxoeug.nregtaxinfo24s.dns.army
taebkq.nt-usermem66s.dynv6.net
taxdoc.realsync.ai
taxsecret57s.dynv6.net
taxsecret94s.dynv6.net
tprecord23id.dynv6.net
tprecord24id.dynv6.net
tprecord25id.dynv6.net
tprecord26id.dynv6.net
tprecord27id.dynv6.net
tprecord28id.dynv6.net
tprecord29id.dynv6.net
tprecord30id.dynv6.net
tprecord33id.dynv6.net
tprecord35id.dynv6.net
tprecord36id.dynv6.net
tprecord37id.dynv6.net
tprecord38id.dynv6.net
tprecord39id.dynv6.net
tprecord40id.dynv6.net
tprecord41id.dynv6.net
tprecord42id.dynv6.net
tprecord43id.dynv6.net
tprecord44id.dynv6.net
tprecord45id.dynv6.net
tprecord46id.dynv6.net
tprecord47id.dynv6.net
tprecord48id.dynv6.net
tprecord49id.dynv6.net
tprecord50id.dynv6.net
tprecord51id.dynv6.net
tprecord52id.dynv6.net
tprecord53id.dynv6.net
tprecord54id.dynv6.net
tprecord55id.dynv6.net
tprecord56id.dynv6.net
tprecord57id.dynv6.net
tprecord58id.dynv6.net
tprecord59id.dynv6.net
tprecord60id.dynv6.net
tprecord61id.dynv6.net
tprecord62id.dynv6.net
tprecord63id.dynv6.net
tprecord64id.dynv6.net
tprecord66id.dynv6.net
tprecord67id.dynv6.net
tprecord68id.dynv6.net
tprecord71id.dynv6.net
tprecord72id.dynv6.net
tprecord73id.dynv6.net
tprecord75id.dynv6.net
tprecord76id.dynv6.net
tprecord77id.dynv6.net
tprecord78id.dynv6.net
tprecord79id.dynv6.net
tprecord80id.dynv6.net
tprecord81id.dynv6.net
tprecord82id.dynv6.net
tprecord83id.dynv6.net
tprecord85id.dynv6.net
tprecord87id.dynv6.net
tprecord95id.dynv6.net
userdocnt.mydns.bz
userinfo.uidentitycorp.dynv6.net
usernhpost.dynv6.net
usrdoc.8bit.ca
wmtsyb.taxsecret94s.dynv6.net

# Reference: https://x.com/skocherhan/status/2058661946719654013
# Reference: https://www.virustotal.com/gui/ip-address/118.193.69.44/relations

5w9y60z9yy.dynv6.net

# Reference: https://x.com/skocherhan/status/2058662939301904825

access.ips-nifty.dns.navy
djhl.edoc.ips-bang.dynv6.net
edoc-manc.dns.navy
edoc-mane.dns.army
edoc-one.dns.navy
edoc.ips-bang.dynv6.net
edoc.ips-mew.dynv6.net
edoc.pol-otp.dns.navy
info.edoc-manc.dns.navy
info.edoc-mane.dns.army
info.edoc-one.dns.navy
ips-bang.dynv6.net
ips-mew.dynv6.net
ips-nifty.dns.navy
mew-pol.dns.navy
mld.edoc.pol-otp.dns.navy
mood.navers.mew-pol.dns.navy
mood.police-service.dns.army
navers.mew-pol.dns.navy
ndbp.political-view.dns.army
pol-otp.dns.navy
police-service.dns.army
political-view.dns.army
taeo.edoc.ips-mew.dynv6.net
zxzc.edoc.ips-bang.dynv6.net

# Reference: https://x.com/skocherhan/status/2058672128015106427

00pr43.picid1fdl6.dynv6.net
086k3a.93vf4b71cv.dynv6.net
0a1fi7nsne.dynv6.net
0grde8ebon.dns.army
0sv8.qiz172u9i01.dns.army
1br8jch4r2l.dns.army
1gb5eoww4y.dynv6.net
1jjrv5oset8.dns.navy
1k2j842o08.dynv6.net
1kgz2l.ze5aip8t1r.dynv6.net
1l8wzyn09e.dynv6.net
1lelpu.5jzttrmpkf.dynv6.net
1w0izrjp8f.v6.navy
238hl.sk48350fzc.v6.army
249h2syiju.v6.army
24ilry.sk48350fzc.v6.army
26kp3x.jghs63qw5w.v6.army
2cpuaxmkws.v6.army
2ea1fm3lj0.v6.army
2fmx5tfk22.dynv6.net
2ohjwx1f7e.v6.navy
2ra7.njkdhfptwn.dynv6.net
2ta9vkc3b2.dns.navy
2tj40eda2f.dynv6.net
2vm4g1ro8j.dns.navy
2yvl15.hfxq7cbqv5.dynv6.net
3d3mt6lf1x.v6.army
3gxf.du0oakjsbs.dynv6.net
3ol2k.ie7up41y3x.dynv6.net
3oqhgj.1l8wzyn09e.dynv6.net
3sd5y62mi2.dynv6.net
3t2jh7awf0.dynv6.net
49wlf.3t2jh7awf0.dynv6.net
4nu00ypt6u.dynv6.net
4sifx.ug4kghrroou.dns.navy
5a8zsghait2.dns.army
5jzttrmpkf.dynv6.net
5m2ub.jlej4dom3m.dynv6.net
6545f.3sd5y62mi2.dynv6.net
6hpgd.1br8jch4r2l.dns.army
6pzmcnjfl7e.dns.navy
733h2kubch.dynv6.net
73tlkp3alr.dynv6.net
77sg7t.2tj40eda2f.dynv6.net
7f44zhxz1x2.dns.navy
7itl05g1mj.dns.navy
7l30nhkxuv.dynv6.net
83cn.0grde8ebon.dns.army
85xcwj.se4z5cvxnk.v6.navy
8lqx92qwn3.v6.army
93vf4b71cv.dynv6.net
9a8zp.2ta9vkc3b2.dns.navy
9jhf95.i3idbzcf7m.dynv6.net
9k2i.73tlkp3alr.dynv6.net
9ok90wamt4.dns.navy
9u8dnvzzim.dynv6.net
a1fi7nsne.dynv6.net
auth-check-nvr.6545f.3sd5y62mi2.dynv6.net
auth-check-nvr.77sg7t.2tj40eda2f.dynv6.net
auth-check-nvr.hflax.ylhej608mk.dynv6.net
auth-check-nvr.jpnqb.e6phj0xnr0.dynv6.net
auth-check-nvr.ptdmu1.d9z5fqxt49.dynv6.net
auth-check-nvr.ycq2.ylhej608mk.dynv6.net
b45zyjuecl.dns.navy
bbxnc.1k2j842o08.dynv6.net
browse-naver.x8co6.2ohjwx1f7e.v6.navy
btee.dynuddns.net
c9q0l37ffb.dns.navy
cddp00ow2m.dynv6.net
cgv8ijdqybf.dns.navy
ch4l.oz3oqqrrxl.dns.army
check.nid-user.kro.kr
cloud-doc.abrdns.com
confirm-ver.ttgdoc.cloud-ip.cc
connection.n-e.kr
count-doc.tax-doc.abrdns.com
cox7y4ipua.dns.navy
cpnikyd43jh.dns.army
cupon-log.tax-kor.mytunnel.org
d9z5fqxt49.dynv6.net
deliver-tax-auth.3ol2k.ie7up41y3x.dynv6.net
deliver-tax-auth.duqf6.nvet6v0ryy.dynv6.net
demp.tax-auth.ydns.eu
dhif24bvt7.dynv6.net
djq2wz7jsv.dns.navy
doc-auth.check.nid-user.kro.kr
docinfo.cloud-ip.cc
du0oakjsbs.dynv6.net
duqf6.nvet6v0ryy.dynv6.net
e063y2.w6quflavdm.dynv6.net
e6phj0xnr0.dynv6.net
e6ro1jnzss.dynv6.net
fak1.7l30nhkxuv.dynv6.net
fiw.security.token-manage.o-r.kr
fm4yoenkfru.dns.navy
fmgu300wg6.dynv6.net
fpau3zk7hi.dynv6.net
gabia.kozow.com
gbotlft7b7.dynv6.net
gpi7ynn4oqp.dns.navy
guider.serverpit.com
hflax.ylhej608mk.dynv6.net
hfxq7cbqv5.dynv6.net
hgpzb1szps.v6.army
hkn1a.il0qjijik3.v6.army
hlbr31s20w.v6.army
hrdxnu.zwrymm61og4.dns.army
i0zhs.o46r3ey36xw.dns.navy
i3idbzcf7m.dynv6.net
ie7up41y3x.dynv6.net
il0qjijik3.v6.army
invoice.bumbleshrimp.com
invoicedoc.abrdns.com
irg8gqizqz.dns.army
ivugt.irg8gqizqz.dns.army
jfp9wd3hht.v6.army
jghs63qw5w.v6.army
jir0gq4huk.v6.army
jlej4dom3m.dynv6.net
jpnqb.e6phj0xnr0.dynv6.net
kd0wcadw5v.dns.army
ke6jp62jt2.dynv6.net
kgw0xm.fmgu300wg6.dynv6.net
kqtc.uc78hw71gb.dynv6.net
l5m2cxdaxjy.dns.navy
l9rmt5.fmgu300wg6.dynv6.net
ldspau7pxy8.dns.navy
lodni.ntesdoc.1cooldns.com
luhp.xtfcnu7acx.v6.army
ly5x0d.p4nbsl4cli.dns.navy
m0dfmjbfj7.dns.navy
m5i7.qhwfwllupj.dynv6.net
maincert.1cooldns.com
mbzgitbhj6.v6.navy
mois-nid.i0zhs.o46r3ey36xw.dns.navy
mos-nid.wazd9.7f44zhxz1x2.dns.navy
mphfy4zbpb.v6.navy
mvtv7vr0nr.dynv6.net
nav-log.check.nid-user.kro.kr
naver-auth-tax.2ra7.njkdhfptwn.dynv6.net
naver-auth-tax.q83s.2fmx5tfk22.dynv6.net
naver-auth.s8liln.4nu00ypt6u.dynv6.net
nchosedirect.connection.n-e.kr
nchosedirect.maincert.1cooldns.com
nchosedirect.nooeg.1cooldns.com
ndco.abrdns.com
ndcondi.nooeg.1cooldns.com
ndoc-post.cloud-ip.cc
ndoc.ndoctax.dns.navy
ndoc.nidcloud.dns.army
ndoctax.dns.navy
ndsp-ventor.ndoc-post.cloud-ip.cc
nem1fg.ucc8pb4qud.v6.army
nid-auth-tax.9jhf95.i3idbzcf7m.dynv6.net
nid-doc-auth.00pr43.picid1fdl6.dynv6.net
nid-doc-auth.1lelpu.5jzttrmpkf.dynv6.net
nid-doc-auth.2yvl15.hfxq7cbqv5.dynv6.net
nid-doc-auth.3gxf.du0oakjsbs.dynv6.net
nid-doc-auth.9k2i.73tlkp3alr.dynv6.net
nid-doc-auth.bbxnc.1k2j842o08.dynv6.net
nid-doc-auth.nyhf.hfxq7cbqv5.dynv6.net
nid-log.9a8zp.2ta9vkc3b2.dns.navy
nid-log.yml63.cox7y4ipua.dns.navy
nid-session.govt.hu
nid-tax-auth.49wlf.3t2jh7awf0.dynv6.net
nid-tax-doc.1kgz2l.ze5aip8t1r.dynv6.net
nid-tax-doc.5m2ub.jlej4dom3m.dynv6.net
nid-tax-doc.e063y2.w6quflavdm.dynv6.net
nid-tax-doc.hkn1a.il0qjijik3.v6.army
nid-tax-doc.m5i7.qhwfwllupj.dynv6.net
nid-tax.abrdns.com
nid-user.kro.kr
nid.ndoctax.dns.navy
nid.nloginvoice.dns.navy
nid.nusersec.dns.navy
nid_doc_check.086k3a.93vf4b71cv.dynv6.net
nidauth.4sifx.ug4kghrroou.dns.navy
nidcloud.dns.army
nidtax.hrdxnu.zwrymm61og4.dns.army
nidtax.ntndoc.abrdns.com
nidtax.o4e82.5a8zsghait2.dns.army
ninvoice.nloginvoice.dns.navy
ninvoice.ntsscan.dns.navy
ninvoice.nusersec.dns.navy
ninvoice.nusetx.dns.army
njkdhfptwn.dynv6.net
njnbm6648f.dns.navy
nloginvoice.dns.navy
nooeg.1cooldns.com
nopts.xubi.org
np-doc-nid.85xcwj.se4z5cvxnk.v6.navy
nps-hall.cloud-ip.cc
npskol.1cooldns.com
nstlog.store
nt-deliver.cloud-ip.cc
ntax.abrdns.com
ntclss.cloud-ip.cc
ntdocs.abrdns.com
ntesdoc.1cooldns.com
ntexq.mydns.vc
ntlog.gabia.kozow.com
ntlog.upd-log.ezgateway.net
ntndoc.abrdns.com
nts-load.twilightparadox.com
ntsdoc.dynuddns.com
ntsg.tvoice-doc.ddnsguru.com
ntsscan.dns.navy
nupt-log.dynuddns.com
nusersec.dns.navy
nusetx.dns.army
nusr-doc.83cn.0grde8ebon.dns.army
nusr-doc.ch4l.oz3oqqrrxl.dns.army
nusr-doc.st2zeg.y4rs6m4w3z.dns.army
nusrdoc.1cooldns.com
nv-team.mysynology.net
nvere-log.abrdns.com
nvet6v0ryy.dynv6.net
nvoice.flashhub.net
nvoice.nv-team.mysynology.net
nvoictax.6hpgd.1br8jch4r2l.dns.army
nyhf.hfxq7cbqv5.dynv6.net
o46r3ey36xw.dns.navy
o4e82.5a8zsghait2.dns.army
omtj8m.qj4xml8hxh.dynv6.net
omyfdwsxnd.dns.army
oz3oqqrrxl.dns.army
p4nbsl4cli.dns.navy
p9tfgmd5r5.v6.army
p9woh.qj4xml8hxh.dynv6.net
pay-voice.cloud-ip.cc
pd-redirect.cloud-ip.cc
perfect.bumbleshrimp.com
pgul.gbotlft7b7.dynv6.net
picid1fdl6.dynv6.net
psxyqs93is.dynv6.net
ptdmu1.d9z5fqxt49.dynv6.net
q83s.2fmx5tfk22.dynv6.net
qhwfwllupj.dynv6.net
qiz172u9i01.dns.army
qj4xml8hxh.dynv6.net
qs0gvu97ec.dynv6.net
r7xy4u626e.dynv6.net
rea5wljzgp.dns.army
redirect-nid.ivugt.irg8gqizqz.dns.army
s8liln.4nu00ypt6u.dynv6.net
se4z5cvxnk.v6.navy
security.token-manage.o-r.kr
securityconfirm.perfect.bumbleshrimp.com
shdgud.abrdns.com
si63k8gmso.v6.army
sk48350fzc.v6.army
st2zeg.y4rs6m4w3z.dns.army
st406.m0dfmjbfj7.dns.navy
statistics.mysynology.net
suyny3rnd6.v6.army
talkcloud.abrdns.com
tax-auth-notification.238hl.sk48350fzc.v6.army
tax-auth-notification.24ilry.sk48350fzc.v6.army
tax-auth-notification.26kp3x.jghs63qw5w.v6.army
tax-auth-notification.luhp.xtfcnu7acx.v6.army
tax-auth-notification.tvua0.suyny3rnd6.v6.army
tax-auth-notification.udw1vs.suyny3rnd6.v6.army
tax-auth.ydns.eu
tax-deliver-auth.3oqhgj.1l8wzyn09e.dynv6.net
tax-deliver-auth.fak1.7l30nhkxuv.dynv6.net
tax-deliver-auth.y26b.r7xy4u626e.dynv6.net
tax-deliver-auth.zsp8.0a1fi7nsne.dynv6.net
tax-doc.abrdns.com
tax-guide.abrdns.com
tax-kor.mytunnel.org
tax-link-nid.kgw0xm.fmgu300wg6.dynv6.net
tax-link-nid.kqtc.uc78hw71gb.dynv6.net
tax-link-nid.l9rmt5.fmgu300wg6.dynv6.net
tax-link-nid.omtj8m.qj4xml8hxh.dynv6.net
tax-link-nid.p9woh.qj4xml8hxh.dynv6.net
tax-link-nid.pgul.gbotlft7b7.dynv6.net
tax-link-nid.y8f3.9u8dnvzzim.dynv6.net
tax-link-nid.yrpwqd.ke6jp62jt2.dynv6.net
tax.petfoodkorea.kr
taxinvoice.mydns.jp
tdoc-noreply.ly5x0d.p4nbsl4cli.dns.navy
tdoc-noreply.st406.m0dfmjbfj7.dns.navy
tdoc.cloud-ip.cc
tdrive.camdvr.org
te2kmk0f5x.v6.army
tech-nid.nem1fg.ucc8pb4qud.v6.army
tguidelink.0sv8.qiz172u9i01.dns.army
tguider.cloud-ip.cc
token-manage.o-r.kr
triect.abrdns.com
ttgdoc.cloud-ip.cc
ttsuget.nvoice.flashhub.net
tvoice-doc.ddnsguru.com
tvua0.suyny3rnd6.v6.army
tx-reply.server-on.net
uc78hw71gb.dynv6.net
ucc8pb4qud.v6.army
udw1vs.suyny3rnd6.v6.army
ug4kghrroou.dns.navy
uh431hluirw.dns.navy
upd-log.ezgateway.net
ve-us.check.nid-user.kro.kr
vmdm9xw4swx.dns.navy
w6quflavdm.dynv6.net
wazd9.7f44zhxz1x2.dns.navy
wlxvtiw7h7.v6.army
x21a945ebj.v6.army
x8co6.2ohjwx1f7e.v6.navy
xtfcnu7acx.v6.army
y26b.r7xy4u626e.dynv6.net
y4rs6m4w3z.dns.army
y8f3.9u8dnvzzim.dynv6.net
ycq2.ylhej608mk.dynv6.net
ylhej608mk.dynv6.net
yml63.cox7y4ipua.dns.navy
yrpwqd.ke6jp62jt2.dynv6.net
ze5aip8t1r.dynv6.net
zp2mfm42al.v6.army
zsp8.0a1fi7nsne.dynv6.net
zwrymm61og4.dns.army

# Reference: https://x.com/skocherhan/status/2058608475404382446

5pj699tmhd.dynv6.net
ar2aqxha855.dns.navy
hkt77mguo03.dns.navy
orizsuaeo-jp.icu
s62zzsmd7cq.dns.navy
thuide.bumbleshrimp.com
uykqg44ikx.v6.army
wcatc7r8701.dns.navy

# Reference: https://x.com/skocherhan/status/2058977098442670300

cbcl.cert-view.dns.army
cdcb.edoc.ips-mew.dns.army
cert-view.dns.army
cgre.ips-activate.dns.navy
cid.nts-top.dns.army
edoc-manc.dns.army
edoc-one.dns.army
edoc.ips-mew.dns.army
edoc.nts-docview.dns.army
edoc.once-view.dns.army
epost-kr.dns.army
info.edoc-manc.dns.army
info.edoc-one.dns.army
ips-activate.dns.navy
ips-bang.dns.army
ips-cert.dns.army
ips-mew.dns.army
link.epost-kr.dns.army
mois-view.dns.army
mood.mois-view.dns.army
nood.nts-xor.dns.army
nood.police-service.dns.navy
nts-docview.dns.army
nts-top.dns.army
nts-xor.dns.army
once-view.dns.army
pc.ips-cert.dns.army
police-service.dns.navy
rii.ips-bang.dns.army

# Reference: https://x.com/malwrhunterteam/status/2059385553569644592
# Reference: https://www.virustotal.com/gui/file/63fbcd476ac21c3eddc6e450e9fd7c7397f801b32b9e8269f0a42dc88328f0d6/detection

developedindia.ink
files.developedindia.ink
verify.developedindia.ink

# Reference: https://x.com/skocherhan/status/2059706390990483908

mls1sl.dns.navy
moie1oc.dynu.org
mois7al.dns.army
nav-logins.nsc35tx.dns.navy
nid-login.pax38cs.dns.navy
nids.ntc18xt.dns.navy
nids.ntx2exp.dns.navy
nidservers.mls1sl.dns.navy
nsc0tx.dns.navy
nsc12tx.dns.navy
nsc23tx.dns.navy
nsc33tx.dns.navy
nsc35tx.dns.navy
ntc11xt.dns.navy
ntc13xt.dns.navy
ntc14xt.dns.navy
ntc15xt.dns.navy
ntc16xt.dns.navy
ntc18xt.dns.navy
ntc19xt.dns.navy
ntc1xt.dns.navy
ntc2xt.dns.navy
ntc32xt.dns.navy
ntc33xt.dns.navy
ntc35xt.dns.navy
ntc6xt.dns.navy
ntc9xt.dns.navy
ntx0exp.dns.navy
ntx2exp.dns.navy
ntx4exp.dns.navy
ntx5exp.dns.navy
op21ntyx.dns.navy
op6ntyx.dns.navy
pax12cs.dns.navy
pax17cs.dns.navy
pax19cs.dns.navy
pax30cs.dns.navy
pax31cs.dns.navy
pax33cs.dns.navy
pax34cs.dns.navy
pax35cs.dns.navy
pax37cs.dns.navy
pax38cs.dns.navy

# Reference: https://www.enki.co.kr/en/media-center/blog/kimsuky-s-advanced-attack-techniques-jsonping-webex-spoofing-and-a-new-httpspy-variant

bigfile.crabdance.com
conference.birdriver.org
hdrgdrfes.chickenkiller.com

# Reference: https://x.com/skocherhan/status/2060069310840844770

0t3ofn4r21.dns.navy
41mhzh442tc.dns.navy
46fy9m5lc2.dns.navy
4x97qnzirrl.dns.navy
52f6qb4jai.dns.navy
c4f0rhn5qdp.dns.navy
dns.reward.freeddns.org
nusetx.dns.army
ooolde0khlq.dns.navy
reward.freeddns.org
rffiuystub.dns.navy
zalcjrft0zv.dns.navy

# Reference: https://x.com/skocherhan/status/2060432300375150977

access.edoc.korea-app.dns.army
coupang.dns.navy
cp10523.epost-kr.dns.army
dmf.ips-cert.dns.army
edoc.korea-app.dns.army
ips-nifty.dns.army
jfzb.coupang.dns.navy
korea-app.dns.army
kr-edoc.xubi.org
nid.kr-edoc.xubi.org
view.ips-nifty.dns.army
xpo.coupang.dns.navy

# Reference: https://x.com/skocherhan/status/2061152537529528508

aanhjrq.myblog-nauth79s.dynv6.net
abusecenter.unlockeblog11s.dynuddns.net
abusecenter.uprocessblog9s.dynuddns.net
auth-umblog1s.dynv6.net
auth-umblog3s.dynv6.net
blog-gcxikz.ublogcom24avs.dns.army
blog-sfdvaob.ublogcom21avs.dns.army
blogasreport2s.dynv6.net
blogasreport83s.dynv6.net
blogrighof10id.dynv6.net
blogrighof1id.dynv6.net
blogrighof27id.dynv6.net
blogworks14th.dynv6.net
blogworks26th.dynv6.net
blogworks67th.dynv6.net
blogworks6th.dynv6.net
blogworks93th.dynv6.net
chposting0s.dynv6.net
chposting10s.dynv6.net
chposting11s.dynv6.net
chposting12s.dynv6.net
chposting13s.dynv6.net
chposting14s.dynv6.net
chposting15s.dynv6.net
chposting16s.dynv6.net
chposting17s.dynv6.net
chposting18s.dynv6.net
chposting1s.dynv6.net
chposting20s.dynv6.net
chposting22s.dynv6.net
chposting23s.dynv6.net
chposting24s.dynv6.net
chposting26s.dynv6.net
chposting27s.dynv6.net
chposting28s.dynv6.net
chposting29s.dynv6.net
chposting30s.dynv6.net
chposting31s.dynv6.net
chposting32s.dynv6.net
chposting33s.dynv6.net
chposting34s.dynv6.net
chposting35s.dynv6.net
chposting36s.dynv6.net
chposting37s.dynv6.net
chposting38s.dynv6.net
chposting39s.dynv6.net
chposting3s.dynv6.net
chposting40s.dynv6.net
chposting41s.dynv6.net
chposting42s.dynv6.net
chposting43s.dynv6.net
chposting44s.dynv6.net
chposting45s.dynv6.net
chposting46s.dynv6.net
chposting6s.dynv6.net
chposting8s.dynv6.net
clbazqrl.reverifyblogmid1s.dns.army
cndgre.naveblogedit64s.dns.army
ctxuqxwd.temppos61s.dynv6.net
dazlvgk.ndeblogreceive65s.dynv6.net
docinf.reportml14id.dynv6.net
docinf.ubposting36s.dynv6.net
eblogflag10s.dynv6.net
eblogflag11s.dynv6.net
eblogflag15s.dynv6.net
eboardreport10s.dynuddns.net
eboardreport17s.dynuddns.net
eboardreport26s.dynuddns.net
eboardreport28s.dynuddns.net
eboardreports32s.dynv6.net
eboardreports96s.dynv6.net
edoc.reportml10id.dynv6.net
edoc.reportml16id.dynv6.net
ejcvdv.naveblogedit42s.dns.army
enboardingreport12s.dns.army
enboardingreport47s.dns.army
enboardingreport70s.dns.army
enboardingreport91s.dns.army
enboardingreport93s.dns.army
enboardingreport98s.dns.army
etucgwb.ndeblogreceive31s.dynv6.net
ghblwiua.nreceiveopt74s.dynv6.net
gysszbr.ublogcom14avs.dns.army
hcmjgjjj.nlockblogera.mydns.bz
info.nbreceip29id.dynv6.net
info.userblogreqt1s.dynv6.net
jwcstpii.myblog-nauth21s.dynv6.net
jypxdcy.temppos95s.dynv6.net
kuvcboxi.ndeblogreceive48s.dynv6.net
ltvhogf.reverifyblogmid8s.dns.army
mgoqkht.nrepcenter2blog.dns.army
mlxdicgz.reverifyblogmid18s.dns.army
myblog-nauth0s.dynv6.net
myblog-nauth21s.dynv6.net
myblog-nauth36s.dynv6.net
myblog-nauth37s.dynv6.net
myblog-nauth41s.dynv6.net
myblog-nauth49s.dynv6.net
myblog-nauth54s.dynv6.net
myblog-nauth73s.dynv6.net
myblog-nauth74s.dynv6.net
myblog-nauth79s.dynv6.net
naveblogedit30s.dns.army
naveblogedit42s.dns.army
naveblogedit64s.dns.army
nbclouds1avs.dynu.org
nbclouds28avs.dynu.org
nbclouds46avs.dynu.org
nblogwork10th.dns.army
nblogwork18th.dns.army
nblogwork19th.dns.army
nblogwork20th.dns.army
nblogwork21th.dns.army
nblogwork23th.dns.army
nblogwork30th.dns.army
nblogwork32th.dns.army
nblogwork41th.dns.army
nblogwork54th.dns.army
nblogwork57th.dns.army
nblogwork6th.dns.army
nblogwork76th.dns.army
nblogwork78th.dns.army
nblogwork79th.dns.army
nblogwork93th.dns.army
nblogwork99th.dns.army
nbreceip29id.dynv6.net
ndajofp.myblog-nauth54s.dynv6.net
ndeblogreceive14s.dynv6.net
ndeblogreceive2s.dynv6.net
ndeblogreceive31s.dynv6.net
ndeblogreceive48s.dynv6.net
ndeblogreceive55s.dynv6.net
ndeblogreceive58s.dynv6.net
ndeblogreceive5s.dynv6.net
ndeblogreceive63s.dynv6.net
ndeblogreceive65s.dynv6.net
ndeblogreceive90s.dynv6.net
ndeblogreceive96s.dynv6.net
ndocline-st36s.dns.army
ndocline-st42s.dns.army
ndocline-st44s.dns.army
ndocline-st48s.dns.army
ndocline-st57s.dns.army
ndocline-st64s.dns.army
ndocline-st73s.dns.army
netauth-umblog70s.dynv6.net
netctxuqxwd.temppos61s.dynv6.net
netmem-authcenter31s.dynv6.net
netrequestmbl27s.dynv6.net
nhsinsur10s.dynuddns.net
nhsinsur1s.dynuddns.net
nhsinsur2s.dynuddns.net
nhsinsur5s.dynuddns.net
nhsinsur6s.dynuddns.net
nhsinsur7s.dynuddns.net
nhsinsur8s.dynuddns.net
nhsreports74s.dynv6.net
nid-blog.uprocessblog7s.dynuddns.net
nid.npt-memdoc23s.dynv6.net
nid.userblogreqt7s.dynv6.net
nidcenter.unlockeblog16s.dynuddns.net
nidcenter.unlockeblog22s.dynuddns.net
nidcenter.unlockeblog9s.dynuddns.net
nidcenter.uprocessblog2s.dynuddns.net
nlockblogera.mydns.bz
npt-memdoc10s.dynv6.net
npt-memdoc11s.dynv6.net
npt-memdoc13s.dynv6.net
npt-memdoc16s.dynv6.net
npt-memdoc17s.dynv6.net
npt-memdoc21s.dynv6.net
npt-memdoc23s.dynv6.net
npt-memdoc24s.dynv6.net
npt-memdoc31s.dynv6.net
npt-memdoc33s.dynv6.net
npt-memdoc36s.dynv6.net
npt-memdoc3s.dynv6.net
npt-memdoc6s.dynv6.net
nreceiveopt30s.dynv6.net
nreceiveopt42s.dynv6.net
nreceiveopt53s.dynv6.net
nreceiveopt55s.dynv6.net
nreceiveopt74s.dynv6.net
nreceiveopt78s.dynv6.net
nreceiveopt96s.dynv6.net
nrepcenter17blog.dns.army
nrepcenter29blog.dns.army
nrepcenter2blog.dns.army
nrepcenter31blog.dns.army
nrepcenter33blog.dns.army
nstaticblogera.mydns.bz
ntblog-post25s.dynv6.net
ntblog-post27s.dynv6.net
ntblog-post39s.dynv6.net
ntblog-post57s.dynv6.net
ntblog-post65s.dynv6.net
ntblog-post71s.dynv6.net
ntblog-post77s.dynv6.net
ntblog-post90s.dynv6.net
nworkposting12s.dynv6.net
nworkposting20s.dynv6.net
nworkposting2s.dynv6.net
nworkposting30s.dynv6.net
nworkposting33s.dynv6.net
nworkposting34s.dynv6.net
nworkposting38s.dynv6.net
nworkposting40s.dynv6.net
nworkposting50s.dynv6.net
nworkposting57s.dynv6.net
nworkposting66s.dynv6.net
nworkposting86s.dynv6.net
nworkposting88s.dynv6.net
nzudvvsv.reverifyblogmid1s.dns.army
oqjplre.nrepcenter2blog.dns.army
pbedxvnl.ndeblogreceive5s.dynv6.net
reportml10id.dynv6.net
reportml14id.dynv6.net
reportml16id.dynv6.net
reportml18id.dynv6.net
reportml19id.dynv6.net
reportml29id.dynv6.net
reportml2id.dynv6.net
reportml31id.dynv6.net
reportml34id.dynv6.net
reportml46id.dynv6.net
reportml94id.dynv6.net
reverifyblogmid18s.dns.army
reverifyblogmid1s.dns.army
reverifyblogmid24s.dns.army
reverifyblogmid47s.dns.army
reverifyblogmid49s.dns.army
reverifyblogmid8s.dns.army
scqrzon.naveblogedit30s.dns.army
sfamehx.reverifyblogmid49s.dns.army
tdjqlo.nrepcenter17blog.dns.army
temppos61s.dynv6.net
temppos95s.dynv6.net
ublog.nworkposting34s.dynv6.net
ublogcom14avs.dns.army
ublogcom17avs.dns.army
ublogcom20avs.dns.army
ublogcom21avs.dns.army
ublogcom22avs.dns.army
ublogcom24avs.dns.army
ublogcom32avs.dns.army
ublogrec18s.dynv6.net
ublogrec42s.dynv6.net
ublogrec87s.dynv6.net
ubposting12s.dynv6.net
ubposting36s.dynv6.net
unlockeblog11s.dynuddns.net
unlockeblog16s.dynuddns.net
unlockeblog1s.dynuddns.net
unlockeblog20s.dynuddns.net
unlockeblog22s.dynuddns.net
unlockeblog3s.dynuddns.net
unlockeblog9s.dynuddns.net
uprocessblog10s.dynuddns.net
uprocessblog1s.dynuddns.net
uprocessblog2s.dynuddns.net
uprocessblog3s.dynuddns.net
uprocessblog5s.dynuddns.net
uprocessblog7s.dynuddns.net
uprocessblog8s.dynuddns.net
uprocessblog9s.dynuddns.net
userblogreqt1s.dynv6.net
userblogreqt2s.dynv6.net
userblogreqt3s.dynv6.net
userblogreqt5s.dynv6.net
userblogreqt7s.dynv6.net
userinfo.reportml34id.dynv6.net
userinfo.reportml46id.dynv6.net
userinfo.ubposting12s.dynv6.net
userpinv.mydns.bz
uszgaz.nrepcenter33blog.dns.army
viwfjugh.nreceiveopt55s.dynv6.net
whfscqen.reverifyblogmid24s.dns.army
zaajew.ndeblogreceive96s.dynv6.net
zczaoa.nlockblogera.mydns.bz
ztphnms.nworkposting2s.dynv6.net
zwjqve.ublogcom20avs.dns.army
zwsrbab.nrepcenter31blog.dns.army

# Reference: https://x.com/skocherhan/status/2062235639362265177

mybox.nid.ydns.eu
naver-me.dynv6.net
nid.ydns.eu
openinfo.dynv6.net
signin.ydns.eu
upbit.signin.ydns.eu

# Reference: https://x.com/skocherhan/status/2062611489358532731

6441056b613c32a9.apollo.r-e.kr
accounts.google.corn.v3.cut-com.eu
apollo-page.r-e.kr
apollo-page.r-e.nidlogin.apollo.r-e.kr
apollo.r-e.kr
corn.v3.cut-com.eu
ekyc.naver-page.o-r.kr
google.corn.v3.cut-com.eu
http-nidlogin.apollo.r-e.kr
http-r-e.nidlogin.apollo.r-e.kr
https-nidlogin.apollo.r-e.kr
https-r-e.nidlogin.apollo.r-e.kr
idlogin.apollo.r-e.kr
invoice-document.n-e.kr
krnidlogin.apollo.r-e.kr
mail.apollo-page.r-e.kr
mail.apollo-page.r-e.nidlogin.apollo.r-e.kr
mail.apollo.r-e.kr
naver-page.o-r.kr
nid.xn--3e0b39ycvbh9d.kro.kr
nidlogin.apollo.r-e.kr
nidloging.apollo.r-e.kr
nidlongin.apollo.r-e.kr
r-e.krnidlogin.apollo.r-e.kr
r-e.nidlogin.apollo.r-e.kr
sscyber-samsungcard.kro.kr
uld.invoice-document.n-e.kr
v3.cut-com.eu
xn--299a1v.xn--on3bi6m2sa41xa.xn--h32bi4v.xn--3e0b707e
xn--3e0b39ycvbh9d.kro.kr
xn--nidlogin-2p3d.apollo.r-e.kr
xn--on3bi6m2sa41xa.xn--h32bi4v.xn--3e0b707e

# Reference: https://x.com/byrne_emmy12099/status/2062502763880390851
# Reference: https://www.virustotal.com/gui/file/9be8f2be7ad882e8423c269a0540b7c73d6470311ddfcfcd318ff9d1983e2935/detection

/fereraluoip/lauonchon/

# Reference: https://x.com/skocherhan/status/2062633445843489195

account-login.userauth.dynv6.net
account-login.userauth.o-r.kr
communitysize.kro.kr
global.communitysize.kro.kr
userauth.dynv6.net
userauth.o-r.kr

# Reference: https://x.com/skocherhan/status/2062632228509946089

jptower.dns.army
lloizou.dynv6.net
metapola.dns.army
schet.dns.army
si1901.dynv6.net
store.jptower.dns.army
store.lloizou.dynv6.net
store.metapola.dns.army
store.si1901.dynv6.net
store.unikoreamc.dynv6.net
unikoreamc.dynv6.net
vaml.schet.dns.army

# Reference: https://x.com/_IMalihi_/status/2062916327182893501

022hucku25u.dns.navy
27p5m.dns.army
2chs.pobb0fec9oy.v6.navy
2mao5r.5szam0syb9u.v6.navy
39cunkk67we.dns.navy
3c2q8.obr3jxs5ie4.dns.navy
5ji71.v6.rocks
5np5cfu3uqi.v6.navy
5szam0syb9u.v6.navy
6ez92.dns.navy
88q118.com
9frf.j26f2jp0q6v.v6.navy
9iywpm.mg21vmhrnuc.dns.army
aekfz.ips-bank.dns.navy
al17nhs.dns.navy
al30nhs.dns.navy
al39nhs.dns.navy
asl10ips.dns.navy
asl28ips.dns.navy
asl38ips.dns.navy
auth.notification-kmcc.dns.navy
b473s1.022hucku25u.dns.navy
bing-tost15.com
cagh03wcpld.dns.army
ccsxfcgr9iq.dns.navy
check-document-nid.dtvsf.dns.army
delivery-info-review.dns.army
dhl2.cagh03wcpld.dns.army
doc-naver.x111a.dxavr1fqe8.dynv6.net
dtvsf.dns.army
dxavr1fqe8.dynv6.net
eae1usfwr2x.v6.navy
edoc-mana.dns.army
edoc.ips-mew.dns.navy
edoc.kr-info.dns.army
edoc.nts-hkiyum.dns.navy
email-verification.k5ae0.v6.rocks
email-verification.wavo4.v6.rocks
embrj3y4f79.dns.navy
ezarki-eron.icu
g0uiyz.wrg82twv1kl.dns.navy
gk47z2guhfv.dns.army
guck.top
h48g65.o7dtm8hqny3.v6.navy
hdoc10ns.dns.navy
hdoc14ns.dns.navy
hdoc1ns.dns.navy
hdoc5ns.dns.navy
hdoc6ns.dns.navy
hdoc7ns.dns.navy
hdoc8ns.dns.navy
hel33ko.dynv6.net
hel35ko.dynv6.net
hls15ro.dns.army
hlx7kro.dns.army
http-nld.xn--939a1gynmpm0ukuoxtbq59g.xn--lu5bv5y.xn--hk3b17f.xn--3e0b707e
https-nld.xn--939a1gynmpm0ukuoxtbq59g.xn--lu5bv5y.xn--hk3b17f.xn--3e0b707e
hwquo.v6.navy
info.edoc-mana.dns.army
inform.delivery-info-review.dns.army
ips-bank.dns.navy
ips-bank.dynv6.net
ips-kr.dns.army
ips-mew.dns.navy
j26f2jp0q6v.v6.navy
jg66oli7quk.v6.navy
jjki.political-view.dns.navy
jjzg.edoc.nts-hkiyum.dns.navy
k-delivery-post.v6.rocks
k1qsa.v6.rocks
k5ae0.v6.rocks
kcdxy.dns.army
korbit.work.gd
kr-info.dns.army
legx2.dns.army
login.nodc-view.dns.navy
lufhn.dns.army
m7ayhqorgds.dns.navy
mail.appvpensan.com
mg21vmhrnuc.dns.army
mhoc11ls.dns.navy
mhoc13ls.dns.navy
mhoc17ls.dns.navy
mhoc19ls.dns.navy
mhoc7ls.dns.navy
mois-auth-log.ttl.ydns.eu
msc16ox.dns.navy
msc19ox.dns.navy
msc6ox.dns.navy
mtx0cs.dns.navy
mtx6cs.dns.navy
my-epost-order.dns.navy
n-cloud.police26cs.dns.navy
n-corp.pld8ker.dynv6.net
n-store.pxl28op.dns.army
nauthorize.r-e.kr
nav-logins.tpox18er.dns.army
naver.lifepixeled.com
naver.strangersduo.com
navs.ncodcbverify.dynv6.net
navs.ncodcgverify.dynv6.net
navs.ncodcipass.dns.army
navs.ncodcncheck.dns.navy
navs.ncodcppass.dns.navy
navs.ncodcrverify.dns.navy
ncodbzverify.dynv6.net
ncodcbverify.dynv6.net
ncodcdverify.dynv6.net
ncodcgverify.dynv6.net
ncodcipass.dns.army
ncodcjverify.dns.army
ncodckverify.dns.navy
ncodclpass.dns.navy
ncodcmverify.dns.navy
ncodcncheck.dns.navy
ncodcocheck.dns.navy
ncodcppass.dns.navy
ncodcrverify.dns.navy
ncodcsverify.dns.navy
ncodctpass.dns.navy
ncodcvverify.dns.navy
ncodcypass.v6.army
ncoddbverify.v6.army
ncog30ks.dns.navy
ncog3ks.dns.navy
ndoc-support.2chs.pobb0fec9oy.v6.navy
ndoc.h48g65.o7dtm8hqny3.v6.navy
ndoc.nauthorize.r-e.kr
ndoc.niduser.1cooldns.com
ndoc.ntsdcom.dns.army
ndoc.tg8s.y3a40i9umdr.v6.navy
ndoc0nhs.dns.navy
ndoc22nhs.dns.navy
ndoc23nhs.dns.navy
ndoc27nhs.dns.navy
ndoc36nhs.dns.navy
ndocreply.giize.com
nhl2vc.dynu.org
nid-log.9frf.j26f2jp0q6v.v6.navy
nid-login.tsx4is.dynuddns.com
nid-redirect.s1zis.dns.army
nid-sign.g0uiyz.wrg82twv1kl.dns.navy
nid-user.al17nhs.dns.navy
nid-user.hdoc1ns.dns.navy
nid-user.mhoc17ls.dns.navy
nid.2mao5r.5szam0syb9u.v6.navy
nid.naver.lifepixeled.com
nid.naver.strangersduo.com
nid.ncodclpass.dns.navy
nid.ncodcrverify.dns.navy
nidauth.b473s1.022hucku25u.dns.navy
nidloes.ncodcbverify.dynv6.net
nidlogins.ncodcbverify.dynv6.net
nidlogins.ncodcdverify.dynv6.net
nidlogins.ncodcipass.dns.army
nidlogins.ncodcppass.dns.navy
nids.ncodckverify.dns.navy
nids.ncodcocheck.dns.navy
nids.ncodcvverify.dns.navy
niduser.1cooldns.com
ninvoice.tjepqo.5np5cfu3uqi.v6.navy
ninvoice.vnbz.39cunkk67we.dns.navy
nodc-view.dns.navy
notification-kmcc.dns.navy
npigoji24sv.dns.army
nsc13tx.dns.navy
nstaticorg67th.dynv6.net
nstaticorg70th.dynv6.net
nstaticorg83th.dynv6.net
nt-taxbill51th.dynv6.net
ntag8ks.dns.navy
ntc16ks.dns.navy
ntdoc-epayload65s.dynv6.net
ntjune14th.dynv6.net
ntjune1th.dynv6.net
ntjune27th.dynv6.net
ntjune37th.dynv6.net
ntjune57th.dynv6.net
ntjune76th.dynv6.net
ntjune80th.dynv6.net
ntmaindoc12th.dns.army
ntorg-ins25th.dynv6.net
ntorg-ins81th.dynv6.net
nts-doc.9iywpm.mg21vmhrnuc.dns.army
nts-doc.dns.army
nts-hkiyum.dns.navy
ntsdcom.dns.army
ntservicer68th.dns.army
ntservicer97th.dns.army
ntservicer98th.dns.army
ntvcorp-ins6th.dns.army
ntxes10cs.dns.navy
ntxes20cs.dns.navy
ntxes31cs.dns.navy
ntxes33cs.dns.navy
ntxes36cs.dns.navy
ntxes38cs.dns.navy
ntxsourcea10th.dynv6.net
ntxsourcea18th.dynv6.net
ntxsourcea2th.dynv6.net
ntxsourcea36th.dynv6.net
ntxsourcea40th.dynv6.net
ntxsourcea45th.dynv6.net
ntxsourcea62th.dynv6.net
ntxsourcea65th.dynv6.net
ntxsourcea72th.dynv6.net
ntxsourcea73th.dynv6.net
nudoc-check.dhl2.cagh03wcpld.dns.army
nuser-login.nhl2vc.dynu.org
nuser-login.pos26ps.dns.army
nuser-login.pos32ps.dns.army
o7dtm8hqny3.v6.navy
obr3jxs5ie4.dns.navy
pax11cs.dns.navy
pax14cs.dns.navy
pax32cs.dns.navy
pax36cs.dns.navy
peld38or.dynv6.net
pinvoice-nid.3c2q8.obr3jxs5ie4.dns.navy
pl10als.dns.navy
pl15als.dns.navy
pld8ker.dynv6.net
plod17kor.dynv6.net
pobb0fec9oy.v6.navy
poce10cs.dns.navy
poce22cs.dns.navy
poce31cs.dns.navy
poce32cs.dns.navy
poce8cs.dns.navy
pol4vz.dynu.org
pold13kr.dynv6.net
police12cs.dns.navy
police14cs.dns.navy
police16cs.dns.navy
police26cs.dns.navy
police2cs.dns.navy
police30cs.dns.navy
police35cs.dns.navy
police3cs.dns.navy
police5cs.dns.navy
police8cs.dns.navy
police9cs.dns.navy
political-view.dns.navy
pos26ps.dns.army
pos32ps.dns.army
pos38ps.dns.army
pox10ep.dns.army
pox16ep.dns.army
pox22ep.dns.army
pox23ep.dns.army
pox25ep.dns.army
pox28ep.dns.army
pox2ep.dns.army
pox34ep.dns.army
pox6ep.dns.army
pox7ep.dns.army
pxes11es.dns.navy
pxes13es.dns.navy
pxes19es.dns.navy
pxes20es.dns.navy
pxes25es.dns.navy
pxl16op.dns.army
pxl1op.dns.army
pxl21op.dns.army
pxl24op.dns.army
pxl28op.dns.army
pxl29op.dns.army
pxl32op.dns.army
pxl7op.dns.army
q6vvv.v6.rocks
qfgh.edoc.ips-mew.dns.navy
qjktp.v6.rocks
qkqir.v6.rocks
qp3lwuwy7lk.dns.navy
read.security-kisa-info.dns.navy
request.my-epost-order.dns.navy
resourcentdoc86th.dynv6.net
rhi1altf5vc.dns.navy
s1zis.dns.army
secure-delivery-net.v6.army
security-kisa-info.dns.navy
skb375.com
smubo-seurs.com
srghftui.cc
ss3pr6a1ae2.dns.navy
tablenote.dynv6.net
taxs8mxkhp.dynv6.net
tg8s.y3a40i9umdr.v6.navy
tjepqo.5np5cfu3uqi.v6.navy
token.k-delivery-post.v6.rocks
tpox18er.dns.army
tsx4is.dynuddns.com
ttl.ydns.eu
uood.ips-kr.dns.army
uterdsxz.cc
vnbz.39cunkk67we.dns.navy
wavo4.v6.rocks
wrg82twv1kl.dns.navy
x111a.dxavr1fqe8.dynv6.net
x835dbumebh.dns.navy
xfh.political-view.dns.navy
xmu61.v6.rocks
xn--lu5bv5y.xn--hk3b17f.xn--3e0b707e
xpyen.dns.navy
y3a40i9umdr.v6.navy
y4e0e.v6.navy
z1fsd.v6.rocks
zbtnvpxgykzo.top

# Reference: https://x.com/smica83/status/2063496293092110394
# Reference: https://tria.ge/260607-gcfy6shv2z/behavioral1

inini.kesug.com

# Reference: https://x.com/v0lundr_/status/2063925757542277397
# Reference: https://www.virustotal.com/gui/file/e291ee630a58c405f86ca83d9364bfc3dbf13aecff9000cca4f2602158dac845/detection

/anti-box/jang/main/povjrg.pdf

# Reference: https://x.com/skocherhan/status/2064418614216622388

pal0osp.dns.army
pal14osp.dns.army
pal22osp.dns.army
pal35osp.dns.army
pal7osp.dns.army
pass25op.dns.army
pass2op.dns.army
pass5op.dns.army
pass6op.dns.army
peld12or.dynv6.net
peld2or.dynv6.net
peld7or.dynv6.net
pld1ker.dynv6.net
plice22osp.dns.army
plice32osp.dns.army
plice35osp.dns.army
plice8osp.dns.army
plod5kor.dynv6.net
pnx4ods.dynv6.net
pol15sx.dynv6.net
pol35odr.dynv6.net
pold9kr.dynv6.net
poldoc10osp.dns.army
poldoc12osp.dns.army
poldoc13osp.dns.army
poldoc1osp.dns.army
poldoc23osp.dns.army
poldoc34osp.dns.army
poldoc35osp.dns.army
poldoc36osp.dns.army
poldoc4osp.dns.army
polr10es.dynv6.net
polr35es.dynv6.net
polr6es.dynv6.net
polr7es.dynv6.net
pols11kc.dynv6.net
pols32kc.dynv6.net
pot10sx.dynv6.net
pot16ice.dns.army
pot18ice.dns.army
pot28sx.dynv6.net
pot32sx.dynv6.net
pot39sx.dynv6.net
pxl34op.dns.army
n-cloud.pass5op.dns.army
n-cloud.peld7or.dynv6.net
n-corp.pal22osp.dns.army
n-corp.plod5kor.dynv6.net
n-corp.pold9kr.dynv6.net
n-corp.polr10es.dynv6.net
n-corp.polr35es.dynv6.net
n-store.plice32osp.dns.army
n-store.pol35odr.dynv6.net
n-store.polr7es.dynv6.net
n-store.pot28sx.dynv6.net
nid-user.pnx4ods.dynv6.net
nuser-login.pol15sx.dynv6.net
nuser-login.poldoc34osp.dns.army

# Reference: https://x.com/skocherhan/status/2064423269063704732

astrovaultnet.site
cryptonexium.store
dynavoltmedia.site
eagleapple.sbs
echoanswer.website
edgeanimal.cyou
effectangry.cfd
electricapril.space
emotionarea.homes
energyagree.store
escapeafraid.site
failuremiss.site
fangtongen.homes
fatherbismake.sbs
fusionmatrixx.cfd
gamesticky.homes
gerogemelt.sbs
ghanacity.cyou
goalkeeperwrok.store
happycamera.sbs
healthcookie.store
historycredit.homes
hopecotton.cyou
horsecircle.site
housecandle.cfd
hypernexlogic.sbs
infinitexlabs.cyou
lunargridnet.space
mountainspeedon.org
nexorafusion.space
ngtoscieuebxsdt.xn--hu5b25b77nvwc.xn--3e0b707e
nkvcyephcwxsosun.n-e.kr
noovpnqcompsi.p-e.kr
odawruxpawp.p-e.kr
olqptwmezvwkg.n-e.kr
omnicorelabs.shop
opkffbeqgsfg.xn--hk3b17f.xn--3e0b707e
orbitalsphere.cyou
oufhwfumzgu.xn--2i0b10rqve.xn--3e0b707e
pckeafrycrzhfk.xn--oi2b61z32a.xn--3e0b707e
pifibkwurbvnt.p-e.kr
pijrhhdfjvvywzgs.xn--yq5b.xn--3e0b707e
pixelstormhub.online
pnciwegahznhkccn.o-r.kr
pnivrdywbhd.xn--2i0b10rqve.xn--3e0b707e
potgdxontxnx.p-e.kr
ppsfzamdsndrac.n-e.kr
ptombmttnprrvo.n-e.kr
qsplzhqgvvtjfu.n-e.kr
quantivexhub.shop
qvitzgacvng.r-e.kr
rltkbqbyftuchkkg.xn--hu5b25b77nvwc.xn--3e0b707e
rmrhpktxugxggmso.o-r.kr
rqudcadaburuxbb.xn--h32bi4v.xn--3e0b707e
rsmvoomcxhsp.xn--oi2b61z32a.xn--3e0b707e
sbfdaxewcrusybq.n-e.kr
siwqajimxmhj.o-r.kr
snrhbyerfgfashr.kro.kr
solarisfusion.cfd
tauvzgtnkvzyaxn.p-e.kr
tjatcyabvqv.xn--h32bi4v.xn--3e0b707e
touxaxhrpuut.n-e.kr
trionexglobal.store
tykqgpsmqaoh.o-r.kr
veltronicbase.website
vertexialink.website
vortexchainx.sbs
xn--2i0b10rqve.xn--3e0b707e
xn--h32bi4v.xn--3e0b707e
xn--hk3b17f.xn--3e0b707e
xn--hu5b25b77nvwc.xn--3e0b707e
xn--oi2b61z32a.xn--3e0b707e
xn--yq5b.xn--3e0b707e
zenithcorelab.online

# Reference: https://x.com/_IMalihi_/status/2065448396836495551

cert.tomlee.dns.army
doc-check.dynv6.net
tomlee.dns.army

# Reference: https://x.com/skocherhan/status/2064784809990234184

berginiya.n-e.kr
history.berginiya.n-e.kr
xn--910b562a6sdnpb.xn--9i1b01onwqqzd.xn--3e0b707e
xn--9i1b01onwqqzd.xn--3e0b707e
xn--xj2b562c.xn--9i1b01onwqqzd.xn--3e0b707e

# Reference: https://x.com/byrne_emmy12099/status/2070441663668039825
# Reference: https://www.virustotal.com/gui/file/254d585ad9e536457987fe575c35552884fd94260e562909c7b30835d8c99e1c/detection

tommy-v.lol

# Reference: https://www.virustotal.com/gui/ip-address/104.200.67.46/relations
# Reference: https://www.virustotal.com/gui/ip-address/153.75.224.171/relations

accounts.google.pakasak.com
accounts.google.twilightparadox.com
acounts-gooogle.servehttp.com
acouuts-goooglsec.myvnc.com
auth.home.kg
authorize.serverpit.com
bigcorn.p-e.kr
bigfile.dnload.synoserver.com
binance.ddnsking.com
binance.serveftp.com
dnload.synoserver.com
dropbox.servepics.com
google-twg.servehalflife.com
google.chickenkiller.com
google.crabdance.com
google.pakasak.com
google.twilightparadox.com
googleamo.servehalflife.com
googleatn.3utilities.com
googleazp.serveftp.com
googlebuz.serveirc.com
googlebvn.serveftp.com
googlecad.serveftp.com
googlecag.onthewifi.com
googlecgf.servehalflife.com
googleclw.myvnc.com
googlecni.servehalflife.com
googlecpk.servepics.com
googlecto.servepics.com
googledcq.serveftp.com
googledgn.servemp3.com
googledpx.servemp3.com
googleecd.myvnc.com
googleecf.onthewifi.com
googleekm.onthewifi.com
googleemy.serveftp.com
googleeuw.servemp3.com
googlefam.ddnsking.com
googlefbg.servehalflife.com
googlefeh.3utilities.com
googlefjw.myvnc.com
googlegoz.servepics.com
googlehyg.servemp3.com
googleibj.onthewifi.com
googleinn.serveftp.com
googleins.myvnc.com
googleipi.3utilities.com
googleipp.onthewifi.com
googleiww.3utilities.com
googlejac.servemp3.com
googlejgs.myvnc.com
googlejog.serveftp.com
googlejsv.servemp3.com
googlejuz.servequake.com
googlejyx.servemp3.com
googlejzi.servehalflife.com
googlekal.onthewifi.com
googleket.onthewifi.com
googlekoy.servepics.com
googlekqn.myvnc.com
googlelaz.myvnc.com
googlelei.servehalflife.com
googlelsn.ddnsking.com
googlemaq.servepics.com
googlemjt.onthewifi.com
googlemux.myvnc.com
googlemvi.servequake.com
googlemwu.myvnc.com
googlenfk.onthewifi.com
googlenkv.servepics.com
googleoba.servequake.com
googleofa.servehalflife.com
googleojt.onthewifi.com
googleoor.servequake.com
googleoxn.serveftp.com
googlepda.serveirc.com
googlepnx.onthewifi.com
googlepwq.servequake.com
googleqgb.3utilities.com
googleqlv.myvnc.com
googleqrc.myvnc.com
googleqsv.servequake.com
googlerhm.ddnsking.com
googlerou.myvnc.com
googlerxh.servehalflife.com
googlesij.servemp3.com
googlestd.3utilities.com
googlesti.servepics.com
googletdv.servehalflife.com
googletmg.onthewifi.com
googletmh.serveftp.com
googletmw.servepics.com
googletpa.myvnc.com
googleuiq.3utilities.com
googlevap.ddnsking.com
googlevht.onthewifi.com
googlevpl.servehalflife.com
googlewpm.myvnc.com
googlewso.servehalflife.com
googlewxe.serveftp.com
googlewya.3utilities.com
googlewzc.servequake.com
googlexau.myvnc.com
googlexcz.onthewifi.com
googlexfk.onthewifi.com
googlexgo.3utilities.com
googlexua.servequake.com
googleyle.onthewifi.com
googleymc.onthewifi.com
googleyqv.servepics.com
googleyte.myvnc.com
googleywh.3utilities.com
googleyxj.servepics.com
googlezgl.servemp3.com
googlezjb.servepics.com
googlezki.serveirc.com
googleztd.serveftp.com
googlezxl.3utilities.com
googlezzw.serveftp.com
gooogle-serv.myvnc.com
goooglesecs.ddnsking.com
library.boxathome.net
login-yahoo.ddnsking.com
login-yahoofho.ddnsking.com
mailyahoo.ddnsking.com
micros0ft.update.server.chickenkiller.com
microsoft.bigcorn.p-e.kr
myaccount-google.servequake.com
myaccount.google.chickenkiller.com
myaccount.google.crabdance.com
phantom.fin-tech.com
phantom.okzk.com
phantomsec.servehttp.com
polling.myftp.org
qooqlesecsrv.ddnsking.com
server.chickenkiller.com
univercity.library.boxathome.net
update.server.chickenkiller.com
vscode.auth.home.kg
vscode.authorize.serverpit.com
yahoohbf.ddnsking.com
yahoolkr.ddnsking.com
yahoomxb.ddnsking.com
yahoopfh.onthewifi.com
yahoosec.ddnsking.com
yahoousu.ddnsking.com

# Reference: https://www.virustotal.com/gui/file/f9ebb2e9fc119f73898c361b13ca5494a18b3242929bc2ceb8e7ed344b947a07/detection

aplore.kesug.com

# Reference: https://www.enki.co.kr/media-center/blog/analysis-of-kimsuky-s-attack-on-a-south-korean-groupware-vendor-using-a-new-gomir-family-variant
# BANNER_0_HASH-HOST=2f095e99176cd30b495c94479f6dc5b9

69.10.50.165:8080
69.10.50.165:8443
auth.samecloud.o-r.kr
commit.hanbiro.o-r.kr
global.hanbiro.o-r.kr
global.webjine.o-r.kr
hanbiro.o-r.kr
hiperxrp.o-r.kr
ilskdeid.o-r.kr
intra.hiperxrp.o-r.kr
kfkfkfkf.r-e.kr
nanotim.o-r.kr
oauth.shacloud.o-r.kr
oct.kfkfkfkf.r-e.kr
oobe.webjine.o-r.kr
phunsk.wangdoo.o-r.kr
phunsk.wangduuu.o-r.kr
pikopiko.o-r.kr
pumtech.o-r.kr
samecloud.o-r.kr
shacloud.o-r.kr
sso.nanotim.o-r.kr
sso.pumtech.o-r.kr
update.pikopiko.o-r.kr
wangdoo.o-r.kr
wangduuu.o-r.kr
webjine.o-r.kr

# Reference: https://asec.ahnlab.com/en/94552/

http://167.88.165.122
103.212.120.253:8080
153.75.233.17:8080
173.214.170.58:8080
edcvbgtrf.medianewsonline.com
fsfhsfgsfsnxcvbasfsgsrhsf234fsd.mywebcommunity.org
mpo4wj.scienceontheweb.net
p563q1.sportsontheweb.net
pg50kb75nh.mywebcommunity.org

# Reference: https://x.com/cyberwar_15/status/2086442417197318279

stoks.great-site.net

# APK

/Kisa%20Vaccine.apk
/KisaAndroidSecurity.apk