# Copyright (c) 2014-2026 Maltrail developers (https://github.com/stamparm/maltrail/)
# See the file 'LICENSE' for copying permission

# Aliases: etherrat

# Reference: https://securelist.com/tsundere-node-js-botnet-uses-ethereum-blockchain/117979/
# Reference: https://medium.com/@august.vansickle/tsundere-botnet-ebfcc0b4420c

103.246.145.201:1234
185.28.119.179:1234
193.24.123.68:3011
196.251.72.192:1234
62.60.226.179:3001

# Reference: https://x.com/malwrhunterteam/status/1997052508464628058
# Reference: https://x.com/k33b0i/status/1998431456792846521
# Reference: https://x.com/bluish_red_/status/1998432859955012065
# Reference: https://x.com/polygonben/status/2023870916497928312
# Reference: https://www.virustotal.com/gui/file/b8d9ef87b3a7a2cf2509317296baf127100a14838d03e1c158b0d5f17ec5b41b/detection

193.24.123.68:3001
91.215.85.42:3000
91.215.85.42:3001
/gfdsgsdfhfsd_ghsfdgsfdgsdfg.sh

# Reference: https://x.com/nahamike01/status/2028815239001845920
# TITLE-HOST/IP=Tsundere Netto

13.232.56.239:3000
13.232.56.239:8000
130.12.181.161:3000
130.12.181.161:8080
130.12.181.161:8883
178.17.57.194:3000
178.17.57.194:8080
179.60.145.214:3000
179.60.145.214:8080
185.236.25.119:3000
185.236.25.119:3001
193.17.183.126:3000
45.140.17.123:3000
45.153.34.146:3000
62.60.226.195:3000
67.220.74.132:3000
67.220.74.132:4000
67.220.74.132:5000
67.220.74.132:8000
67.220.74.132:8080
67.220.74.132:8443
77.93.155.167:3000
82.147.84.140:3000
82.147.84.140:8080
85.90.197.26:3000
85.90.197.26:8080
91.238.50.168:3000
91.238.50.174:3000
12122.240618.com
accdyn.com
alertflashline.digital
alertfusion.digital
bergind.com
breakingreports.digital
breakingwaves.today
buzzconnectfeed.digital
buzzlivealert.today
buzzliveupdate.digital
buzzreportnow.today
buzzstreamhub.digital
casaos.240618.com
currentnewslive.today
directnewsline.digital
elcrypto.pro
fastnewsnow.digital
flashreporter.today
flashreportnow.digital
freshbuzzfeed.today
happeningfeednow.digital
happeningnowlive.today
idk.1f2e18bbde8ecc30ee3307a4.net
instantnewsline.digital
jellyfin.240618.com
libertytr.ee
livefeednow.digital
liveflamepulse.today
liveflamezone.digital
liveimpactzone.today
livepulsecore.today
liveupdatefeedline.today
mail.rab16-124.pul.pulpower.com
newshappeningnow.today
newsonairlive.digital
newsstreamline.digital
newswirepulse.today
ns1.wt10.ru
openwebui.240618.com
pinnovatech.online
quickbuzzlive.today
randomdomain.me
rushconnect.digital
stormtrove.today
streamhypewave.today
trendstormer.digital
urgentstreamer.today

# Reference: https://app.validin.com/detail?find=microsoft.591704.com&type=dom&ref_id=67f3faa1aa0#tab=host_pairs (# 2026-03-03)

alertnewsline.today
baltora.digital
bazpal.digital
berpal.digital
blycor.live
bonrex.live
breakinglinefeed.digital
breakinglivefeed.digital
brolixa.live
brupila.digital
brynel.live
brysol.live
burkano.digital
buzzlinknow.digital
buzzonair.digital
buzzwhisperer.today
contexte.digital
crenvio.digital
dalrox.digital
dalxira.digital
derkira.digital
dexnol.live
deznira.digital
diltrix.digital
dolzino.live
donrexa.digital
dronvila.live
dulfira.live
durnika.digital
durxina.live
dynpal.live
dynven.digital
dyrmol.live
dyrvex.digital
falven.live
farmol.live
farnexa.live
faxnilo.live
felpar.live
feltrano.digital
fenxilo.live
ferzona.live
fixrel.live
fizval.live
folmexo.digital
folparo.live
forlena.digital
fralxino.live
freshnewsstream.today
freshwirefeed.digital
frevilo.digital
frovela.digital
furnika.digital
fuzlera.live
galvex.live
garnira.live
gelvano.digital
grypira.digital
gylnira.live
happeninglive.today
harnika.digital
hotbuzzwire.digital
hotfeednow.today
hotnewsline.today
hyperbuzznews.today
immediastream.digital
impactwavezone.digital
instantlivefeed.today
instantnewsroom.today
instantwire.digital
jalkiro.digital
jalpina.live
jalven.digital
jarnika.digital
jarpex.live
jastrix.digital
javmira.digital
javmol.live
javpol.live
jaxpel.live
jelven.digital
jentiro.digital
joflero.live
jolven.digital
jortina.digital
jurxina.digital
karlax.digital
karnilo.digital
kartilo.live
kavtrix.digital
keldira.digital
kelparo.live
kelvina.digital
kelwiro.digital
kemlino.digital
kemzino.live
kolvira.digital
levzano.live
linvero.digital
liveblaststorm.digital
livebuzzline.digital
livefeedalert.digital
liveflashwave.digital
liveheadlinefeed.digital
liveheatwave.digital
livehotstream.today
livepulsewatch.today
livestreamhub.today
liveupdatefeed.digital
liveupdatehub.today
liveupdatezone.digital
livewirezone.today
livezapnews.today
livezapwire.today
livpar.live
lokrino.digital
lomkura.live
lopxina.live
ludxira.live
lynpira.digital
malzino.live
melfira.digital
melzino.live
merkiva.live
mervexo.live
merzulo.live
mexvira.digital
mokvira.live
molpen.digital
molquro.digital
montex.live
mornixa.live
morvexa.digital
morwila.live
movalx.digital
murtrix.live
mydlox.live
mylpina.live
nalmira.live
narfeno.live
nevporo.digital
newsclashfeed.digital
newsdirectfeed.today
newsflareout.today
newshypeblast.today
newslinehub.today
newslinker.digital
nexlimo.live
noltira.digital
nowflashfire.digital
nowlivebuzz.digital
nowonair.digital
nowreportlive.digital
nowstreamer.digital
nowstreamfeed.digital
onlinenewshub.digital
parmol.live
pelvora.live
plurnik.digital
polzin.live
pontex.digital
praxilo.digital
pressconnectlive.today
pressflashlive.today
pressrushlive.today
pulsewhirl.digital
pyrlen.live
qarxeno.live
qimporo.live
qornexa.live
quickalertnow.digital
quickbuzzline.today
quickreportnow.today
quickupdateshub.digital
qunpero.live
rapidflarezone.today
rapidnewsfeed.today
rapidstormfeed.digital
relxino.digital
renxilo.digital
romxino.live
rulparo.live
rushstreamlive.today
ryzpel.digital
selquno.live
selvira.live
senvora.live
sobpal.digital
streamfeedline.today
streaminghotline.today
streaminglivefeed.today
streamrushnow.digital
sulpar.live
sylran.digital
telnaro.digital
tentavo.digital
tervino.digital
tevrino.digital
tolpira.live
tornilo.digital
torxira.digital
toxrel.live
trevano.live
truniko.digital
trunvilo.digital
typral.live
tyrpel.digital
updatenowlive.digital
updatenowlive.today
urgentlinker.digital
urgentreportnow.today
valxiro.digital
varkel.live
vekrono.digital
vikren.live
vontrix.digital
vunrika.digital
vymlox.live
wastina.digital
wazlira.digital
wexpira.live
wolnira.digital
wompira.digital
worzina.live
wunpiro.live
wylxina.live
xalper.live
xerjano.live
xerpal.digital
xerpina.digital
xerwina.digital
xultrina.live
xulveno.live
zanpiro.digital
zarplix.digital
zenxilo.live
zolneva.digital
zolvan.digital
zompar.live
zonrel.digital
zopnilo.digital
zultrix.digital
zuvpero.digital

# Reference: https://x.com/skocherhan/status/2010037491743764737
# Reference: https://x.com/g0njxa/status/2020975743707336822
# Reference: https://x.com/RacWatchin8872/status/2021374272137199959
# Reference: https://www.virustotal.com/gui/file/02ee182859bc4084b8ff96e65256eb7867e75468f9e12c732f63036d4d1f4359/detection
# Reference: https://www.virustotal.com/gui/file/606dd4d7b4f7755136f53ed442a1eebd1c36a671eaf91c494a1627788b64e819/detection
# BANNER_0_HASH-HOST=cc4de13f50929bae86864bddb62391ac
# BANNER_0_HASH-HOST=399471f53993e2d20efddcfab90a5305
# BANNER_0_HASH-HOST=5e624502b5ebcf16c471f563cbf325a8
# BANNER_0_HASH-HOST=733af76edaf1f55dab63dd3d4a5450ce

http://89.124.77.234
http://91.215.85.42
http://91.84.126.84
185.117.72.215:8888
193.200.17.66:3005
89.124.77.234:8080
1-apaylo.com
1stlosstrading.com
78-153-140-17.cprapid.com
9jaarenaxtra.com
a6.appstartlabs.com
aabq.info
aabstone.com
abum.info
abzs.info
acaringtouchseniorservice.com
accountingandfinancejobs.com
acube-contract.com
ad633dfa41b3a8465b7f195bf5b185a2.appliancerefrigeration.co.za
ager-stp.org
ahdaratlegalservices.com
api-gateway-prod.com
api-gateway-softupdate.io
api.hayesmed.com
app.hayesmed.com
appistartes.com
appstartlabs.com
articlehaul.com
atagkeukentechniek.com
audvidfisher.com
aurekh.com
babao.info
bammi.info
bdstop.net
breakbulkconf.com
bugdroid.xyz
bullabs.info
carkva.info
carsaggregator.com
catalog-telegram.com
ccppeptides.art
cerumo.shop
charlyetmax.com
citamx-online.com
citamxpass.com
citamxpass.social
codeframe.digital
codexa.best
cpcontacts.appstartlabs.com
d3691308f2a4c2f6983f2880d32e29c84.everest-hcg.com
databui.cfd
depretory.com
detailingoff.com
devarch.sbs
devsdiamonds.com
dmors.com
doclinebox.com
dreambigworkharddomore.com
dssence.net
egyptinfo.shop
ersh.info
essayajewelry.com
exteddex.com
fluxnet.life
gateway001kir.com
globalwork.best
go.citamxpass.com
go.tramites-mexico.net
gobmx-online.com
goonus.xyz
gooogle.today
hayesmed.com
honorai.com
imata.info
interactiveportraits.com
ip55.ip-135-125-255.eu
ipkdh.com
islat.info
ivyz.info
jariosos.com
jkershaw.info
johnsonej.digital
kadmecnp-643laolmd.com
keyiwl.info
koleknor.com
laishishi.com
lbimuseum.org
lepaniermagic.com
lermontov-656idlop.com
luminer.work
lwsirxr.info
maslovdisign.com
masoretgames.com
mastluner.club
mbml-writer-info.info
mecmatica.digital
microsoft-tools.com
millersteel.digital
mmdis-worls.com
mwsiik.info
myloyaldoggy.com
mymarathilearning.com
mymexico.social
mysoretgames.club
mytkart.com
nastilka.com
ncdxbk.com
ncwlwtd.info
nevv-mmc.com
new--mmc.com
northcroft.digital
nuvilifeglobal.com
oirac.info
olsovay.digital
oqsxv.info
orkneygateway.com
owab.info
pagedit.shop
pass.gooogle.today
perrine90-deltajohnsons.com
pinimg.ru
pkrou.info
pmkdds.info
publicspeakingtip.org
publisherresolution.com
remnett.shop
rencaihuainan.com
resumeacceptable.com
scooplacrosse.com
searchmscon.com
seoanalitics.marketing
ses6.getsdeal.com
shape-paiement.com
sistemablackatz.com
skob.info
solidactivate.com
sslgateway001.com
syhmen.com
sysora.life
tel.orkneygateway.com
tokio-sallys.net
tramites-mexico.net
tramites.today
tranzed.org
twicegrand.com
tyspnnx.info
uipvme.info
uktaxiservice.com
uohiu.info
vehu.info
vmgarage.work
vpn577667741.softether.net
vpn662648768.softether.net
vstoki.com
wideresearcher.com
wowrehberi.com
www-zinia-consumers.tenacityprop.co.za
www-zinia-customer.filipintoucheu.eu
www-ziniacuonsumer.pouipoer.com
www-ziniastumers.bazfalao.com
yourboggbag.us
youtuberu.lol
zoomnutrition.appstartlabs.com

# Reference: https://x.com/RacWatchin8872/status/2038361372275122503

apparatus-contributions-understood-accommodation.trycloudflare.com
dealing-economics-enrollment-firms.trycloudflare.com
permission-resident-lots-ebooks.trycloudflare.com
scott-spring-netscape-monica.trycloudflare.com
true-presents-thereafter-und.trycloudflare.com

# Reference: https://x.com/RacWatchin8872/status/2040580434363314252

corp-embassy-finds-marked.trycloudflare.com
depot-reunion-listings-targets.trycloudflare.com
extended-king-tone-polar.trycloudflare.com
icq-flooring-procedure-rap.trycloudflare.com
imported-spread-amplifier-chemicals.trycloudflare.com
kde-blink-buried-flower.trycloudflare.com
might-tribute-christina-vacuum.trycloudflare.com
terminal-labels-fan-witness.trycloudflare.com
zonasteni.com
