# Copyright (c) 2014-2026 Maltrail developers (https://github.com/stamparm/maltrail/)
# See the file 'LICENSE' for copying permission

# Aliases: CL-STA-0048, abcdoor

# Reference: https://otx.alienvault.com/pulse/642d624ccd3a7cca31c9e252
# Reference: https://www.virustotal.com/gui/ip-address/43.154.239.14/relations
# Reference: https://www.virustotal.com/gui/file/ca47e4505cc84c087d20cadc78aabc01ff6adb44503d86224eb2bd8015016feb/detection
# Reference: https://www.virustotal.com/gui/file/c8e6da627a59a00f043fed05556b738a86fb0f69029748cff206b96a32644f03/detection
# Reference: https://www.virustotal.com/gui/file/bbaa917065d2ca0ba5151b17598789c0125b91c6d7e96ea9b157309e9bf9e2a4/detection
# Reference: https://www.virustotal.com/gui/file/5b5bf1eae9fdd580e2cd491710fbb2504e2f732b17859081eb29801ba61910d7/detection
# Reference: https://www.virustotal.com/gui/file/4d87ad44fb99c42fd5ae0cdba4efcf887574f533a8576d020a24e1ab98809263/detection

154.197.14.38:1523
43.154.189.105:7093
43.154.239.14:7093
43.154.55.253:7093
43.155.98.18:7093
43.249.30.41:1523
43.249.30.41:1524
haiwai2.xyz
liangjiang33.top
liangjiang3344.top
liangjiang44.top
telegramsi.site
club.liangjiang44.top

# Reference: https://cert.360.cn/warning/detail?id=6528fd63ea0822e915605dc6
# Reference: https://otx.alienvault.com/pulse/652d51197fbe59ec2dd072a8

ccgbub296.qty592.com
dianpiao4-1320808414.cos.ap-nanjing.myqcloud.com
dianpiao5-1320808414.cos.ap-nanjing.myqcloud.com
fapao-1320364328.cos.ap-guangzhou.myqcloud.com

# Reference: https://x.com/malwrhunterteam/status/1817829163186733082
# Reference: https://www.virustotal.com/gui/file/7decebabc2d6d61421f8ee3eb86930aa4748887469d76d153db59af63452991e/detection
# Reference: https://www.virustotal.com/gui/file/911a322297f8fcd094434e0715e276e85adb150454cd36588841cbd77fb7c89d/detection

154.92.19.81:6666
154.92.19.81:8888
39.109.114.74:10009
39.109.114.74:10010

# Reference: https://x.com/JAMESWT_MHT/status/1869343624061989127
# Reference: https://www.virustotal.com/gui/file/7b2d2c13f652b5172c9930aa164163caeda8820935cccd9983d924aa90d294d0/detection

27.50.63.8:10443
27.50.63.8:4433
anydesk17.s3.ap-east-1.amazonaws.com

# Reference: https://www.forescout.com/blog/healthcare-malware-hunt-part-1-silver-fox-apt-targets-philips-dicom-viewers/

8.217.60.40:8917
vien3h.oss-cn-beijing.aliyuncs.com

# Reference: https://x.com/skocherhan/status/1926556842492150221
# Reference: https://www.virustotal.com/gui/file/1f946a4714e8b05d449b4cb75ad0c711c630260075e67dd2adad307b49f9f4c6/detection

43.248.173.209:10471
43.248.173.209:10472
43.248.173.209:18852
k0e.xyz
k0l.xyz

# Reference: https://www.fortinet.com/blog/threat-research/threat-group-targets-companies-in-taiwan

00-1321729461.cos.ap-guangzhou.myqcloud.com
6-1321729461.cos.ap-guangzhou.myqcloud.com
twzfte-1340224852.cos.ap-guangzhou.myqcloud.com
cq1tw.top
twcz.pro
twczb.com
twnc.ink
twnic.icu
twnic.ink
twnic.ltd
twnic.xin
twsa.top
twsw.cc
twsw.club
twsw.info
twsw.ink
twsw.ltd
twsw.pro
twsww.vip
twsww.xin
twswz.top
twswzz.xin
twtgtw.net
twzfw.vip
z2tw.xin

# Reference: https://x.com/Cyber_O51NT/status/1947500223061791178
# Reference: https://mp.weixin.qq.com/s?__biz=MzU2OTcxNjE4Mw==&mid=2247486072&idx=1&sn=ce36707ae3974cc872b4432a8edf2dee&poc_token=HMo1f2ijBV0u5OvP3CmpxsqaacBtvRszX0VCBbPP
# Reference: https://www.virustotal.com/gui/file/061588b2a2b1c2044fe99d99bac0529d99d708802ead6da37aae29b590921bfe/detection

45.13.161.179:8880
ailletll.top

# Reference: https://hunt.io/blog/multilingual-zip-phishing-campaigns-asia-financial-government

11c979baeb8bddc12e79ad4def0964e94.bulinouui.sbs
199cb150cec25af3132ddd4e47b37248.bulinouui.sbs
27160fcce1e199401dde5e01ce829006.ttcskhdl.lol
3381536ffe13739277b0a87c08a66596.bulinouui.sbs
5289c03d6d33ac4cf474de436f6bbf47.bulinouui.sbs
53d9da1f7632f687dde3b0ec4df00710.bulinouui.sbs
6358bdf15f655e7e305eacaf385cd12.bulinouui.sbs
bulinouui.sbs
cq1tw.icu
gaelh.cn
gjqygs.cn
jpjpz1.cc
jpjpz1.top
jpjpz1.vip
qiqi1.xin
twmm.shop
twswzz.icu
vip.gaelh.cn
wojkejys.lat
xinwenwamg.net
z2tw.vip
zcqiyess.vip
zxp0010w.vip

# Reference: https://www.cloudsek.com/blog/silver-fox-targeting-india-using-tax-themed-phishing-lures

2025swmm.cn
dingtalki.cn
ggwk.cc
gov-a.club
gov-a.fit
gov-a.work
gov-c.club
govk.club
gvo-b.club
hhiioo.cn
hhiioo.work
hhimm.work
itdd.club
kkyui.club
swjc2025bjkb.cn
xzghjec.com
yuxuanow.top
b.yuxuanow.top

# Reference: https://x.com/skocherhan/status/2020910341933130197
# Reference: https://www.virustotal.com/gui/file/099da66d8499758ec8fc082f04830d0d89173878c9325202ee74998068fe4f52/detection

202.79.171.236:5050
jd16881988.com

# Reference: https://x.com/anylink20240604/status/2022650902520479988
# Reference: https://bbs.kafan.cn/thread-2288675-1-1.html

8.210.25.225:5050
uuuucome.com

# Reference: https://x.com/skocherhan/status/2030164508153426283
# Reference: https://www.virustotal.com/gui/file/6243e3e29e2178361437e59cca8c1f19d9ecf25b44ea31f7b2159871c317572a/detection

108.187.7.232:6666
108.187.7.232:8888
gghhbb.com
888-1393918816.cos.ap-tokyo.myqcloud.com

# Reference: https://www.linkedin.com/posts/mauricefielenbach_threatintelligence-malwareanalysis-infosec-activity-7436840429180018691-YWcm
# Reference: https://www.virustotal.com/gui/file/fa5d3a9eebf9310148e7b980fefa7bc3f3a8e8ee7a8d0bd21a057c54c5a47560/detection
# Reference: https://www.virustotal.com/gui/file/5841ad433ab199bb784a4d33fd629101d22de6e44dce0606c08b92f8b4709380/detection

61.111.250.139:9899
bifa668.com
www-surfshark.com

# Reference: https://www.virustotal.com/gui/file/7170d7a2281bec9ca149590449417c6ed32ffd47120942c1e71011ec62c2f443/detection

95.40.160.77:5676
cdklskjd.cn

# Reference: https://x.com/Dixit_404/status/2033943350106317065
# Reference: https://www.virustotal.com/gui/file/609baa77a4d38837289f367cd7125d29f36a5401e41df64150ed3dafafd4774c/detection

http://134.122.128.135
156.247.40.59:5050

# Reference: https://asec.ahnlab.com/ko/92924/
# Reference: https://www.virustotal.com/gui/file/7bbfd3ac7ab766c996f80fd414118705ee5e8e822c26513bb3e6920c25efa94d/detection

119.28.70.225:443
192.238.129.47:18852

# Reference: https://hexastrike.com/resources/blog/threat-intelligence/trust-the-tunnel-get-the-trojan-silver-fox-delivers-atlascross-rat-via-weaponized-vpn-installers/

app-zoom.com
eyy-eyy.com
kefubao-pc.com
quickq-quickq.com
signal-signal.com
telegrtam.com.cn
trezor-trezor.com
ultraviewer-cn.com
wwtalk-app.com
www-teams.com

# Reference: https://github.com/hagezi/dns-blocklists/issues/9513

3236dsfdfgt.icu
aionkingdom.online
anydesktaiwan.com
da32a73a-988f-4dc9-b4b6-64957d4d5d0c.djxjcidksndkdkdk.com
dan.sxkj999.vip
djxjcidksndkdkdk.com
domt1.com
febgvh5.gyfunds.cc
fh.domt1.com
fnflpkc.co.cc
gyfunds.cc
inside4rom.com
jiosi.net
kainlian.com.cn
mi.y0303m.top
mtn.pubgdma.vip
pay.gyfunds.cc
pubgdma.vip
s-ed1.cloud.gcore.lu
sen.s-ed1.cloud.gcore.lu
sxkj999.vip
wbaosc.com
xiaoshihou10.top
xiaoshihou11.top
xiaoshihou12.top
xiaoshihou14.top
xiaoshihou15.top
xiaoshihou16.top
xiaoshihou17.top
xiaoshihou18.top
xiaoshihou19.top
xiaoshihou20.top
xiaoshihou21.top
xiaoshihou22.top
xiaoshihou23.top
xiaoshihou25.top
xiaoshihou26.top
xiaoshihou27.top
xiaoshihou29.top
xiaoshihou30.top
xiaoshihou31.top
xiaoshihou32.top
xiaoshihou33.top
xiaoshihou34.top
xiaoshihou35.top
xiaoshihou36.top
xiaoshihou37.top
xiaoshihou4.top
xiaoshihou5.top
xiaoshihou6.top
xiaoshihou7.top
xiaoshihou8.top
xiaoshihou9.top
y0303m.top
youdaoaa.com
youdaoab.com
youdaoae.com
youdaoaf.com
youdaoag.com
youdaob.com
youdaoh.com
youdaok.com
youdaor.com
youdaov.com

# Reference: https://github.com/hagezi/dns-blocklists/issues/9515

10put.site
a-wps.cc
bjyigeng.com
bt-telegram.com.cn
cccoeiasca.com
china-wps.com
cn-wps.cc
cnn-wps.com.cn
cunjijiyu.com
d-google.com.cn
downlld.top
dow.downlld.top
ec2-18-162-54-96.ap-east-1.compute.amazonaws.com
f-wps.cc
facaishunli1.oss-cn-hongkong.aliyuncs.com
keeper.10put.site
kuaifan.name
sogou-th.com.cn
syhaochen.xyz
telegrram.hl.cn
todesk.ac.cn
todeski.com
whaoqking.top
wps-net.com.cn
wps-wps-cn.com
wpscnf.com
wuu.whaoqking.top
wwp-wps.com.cn

# Reference: https://github.com/hagezi/dns-blocklists/issues/9518

360sdgg.com
9010.360sdgg.com
amvcoins.vip
betooo.vip
czxfdz.com
domainct.com
eaxwwyr.cn
fdfhddfss.top
fghs.shlowcarbon.com
fkfjrvfa.cn
fzdoor.vip
host-hunter.com
indiagov.shop
indiagov.eu.cc
jinmai.vip
juanseguros.com
ksudeu.nanguanglu.com
megamovielord.com
mohaazon.com
morecoworking.com
nanguanglu.com
nao.nnnwin.vip
nnnwin.vip
primetechstocks.com
rdhrse.qpon
sdyteq.shop
sgegdvip.vip
sgeshex.vip
shlowcarbon.com
swy.juanseguros.com
wwfygid.biz.id
xqwmwru.top
xueshirencai.com
yigushengjin.com
zptsgryw.cn

# Reference: https://github.com/hagezi/dns-blocklists/issues/9531

drwps.com
jinshan-wps.com.cn
office-wps-zh.hl.cn
ofice-wps.com.cn
pt-wps.com.cn
softs.xznkjzx.cn
wps-download.im
wps-kpi.com
wps-office-zh.hl.cn
wps-office.com
xznkjzx.cn

# Reference: https://github.com/hagezi/dns-blocklists/issues/9535

ai-sogou.com.cn
lj-sogou.com.cn
mysogou.com
pc-sogou.com.cn
pinyin-sogou.cn
pro-sougou.com.cn
sogoushurf.com
sogousoft.com

# Reference: https://github.com/hagezi/dns-blocklists/issues/9546

pensilwarna.com
telegram19.com
telegram21.com
telegram22.com
whatsappb.com
whatsappf.com
whatsappg.com
whatsappi.com
whatsappl.com
whatsappm.com
whatsappo.com
whatsappp.com
whatsappq.com
whatsappv.com
whatsappz.com

# Reference: https://github.com/hagezi/dns-blocklists/issues/9565

bp-sogou.com.cn
qishmusic.com.cn
soougou.com.cn
win-sogou.com
x-sogou.com

# Reference: https://github.com/hagezi/dns-blocklists/issues/9569

85in.com
ai-wps.org
cytest.x241858.cc
dgrkrt.s3.ap-southeast-1.amazonaws.com
ect0a7n4ric.x241597.cc
glmjfejgdoox.pw
h7pshijq0c8.x241466.cc
h7pshijq0c8.x241511.cc
h7pshijq0c8.x241518.cc
h7pshijq0c8.x241526.cc
h7pshijq0c8.x241552.cc
h7pshijq0c8.x241563.cc
h7pshijq0c8.x241568.cc
h7pshijq0c8.x241578.cc
h7pshijq0c8.x241586.cc
h7pshijq0c8.x241595.cc
h7pshijq0c8.x241626.cc
h7pshijq0c8.x241643.cc
h7pshijq0c8.x241653.cc
h7pshijq0c8.x241679.cc
h7pshijq0c8.x241683.cc
h7pshijq0c8.x241710.cc
h7pshijq0c8.x241713.cc
h7pshijq0c8.x241716.cc
h7pshijq0c8.x241732.cc
h7pshijq0c8.x241745.cc
h7pshijq0c8.x241763.cc
h7pshijq0c8.x241794.cc
h7pshijq0c8.x241807.cc
h7pshijq0c8.x241813.cc
h7pshijq0c8.x241825.cc
h7pshijq0c8.x241862.cc
i288nnbgf1s.x241646.cc
idolkoushien.com
ju84p5ihj1.x241558.cc
ko8jdgy3t9.x241523.cc
kuaichen.com.cn
l23z04vul8a.x241524.cc
mlydtwnhlibu.pw
oa73zefvdkh.x241517.cc
oa73zefvdkh.x241523.cc
oa73zefvdkh.x241567.cc
oa73zefvdkh.x241569.cc
oa73zefvdkh.x241579.cc
oa73zefvdkh.x241595.cc
oa73zefvdkh.x241613.cc
oa73zefvdkh.x241627.cc
oa73zefvdkh.x241638.cc
oa73zefvdkh.x241660.cc
oa73zefvdkh.x241668.cc
oa73zefvdkh.x241670.cc
oa73zefvdkh.x241678.cc
oa73zefvdkh.x241683.cc
oa73zefvdkh.x241715.cc
oa73zefvdkh.x241719.cc
oa73zefvdkh.x241732.cc
oa73zefvdkh.x241759.cc
oa73zefvdkh.x241765.cc
oa73zefvdkh.x241771.cc
oa73zefvdkh.x241785.cc
oa73zefvdkh.x241787.cc
oa73zefvdkh.x241794.cc
oa73zefvdkh.x241795.cc
oa73zefvdkh.x241796.cc
oa73zefvdkh.x241797.cc
oa73zefvdkh.x241802.cc
oa73zefvdkh.x241815.cc
oa73zefvdkh.x241827.cc
oa73zefvdkh.x241885.cc
rhb2dm7693d.x241494.cc
rhb2dm7693d.x241515.cc
rhb2dm7693d.x241543.cc
rhb2dm7693d.x241608.cc
rhb2dm7693d.x241696.cc
rhb2dm7693d.x241709.cc
rhb2dm7693d.x241759.cc
rhb2dm7693d.x241765.cc
rhb2dm7693d.x241810.cc
rhb2dm7693d.x241840.cc
tseunxkeop.cc
vmbdq9ngs4r.x241646.cc
x241466.cc
x241494.cc
x241511.cc
x241515.cc
x241517.cc
x241518.cc
x241523.cc
x241524.cc
x241526.cc
x241543.cc
x241552.cc
x241558.cc
x241563.cc
x241567.cc
x241568.cc
x241569.cc
x241578.cc
x241579.cc
x241586.cc
x241595.cc
x241597.cc
x241608.cc
x241613.cc
x241626.cc
x241627.cc
x241638.cc
x241643.cc
x241646.cc
x241653.cc
x241660.cc
x241668.cc
x241670.cc
x241678.cc
x241679.cc
x241683.cc
x241696.cc
x241709.cc
x241710.cc
x241713.cc
x241715.cc
x241716.cc
x241719.cc
x241732.cc
x241745.cc
x241759.cc
x241763.cc
x241765.cc
x241771.cc
x241785.cc
x241787.cc
x241794.cc
x241795.cc
x241796.cc
x241797.cc
x241802.cc
x241807.cc
x241810.cc
x241813.cc
x241815.cc
x241825.cc
x241827.cc
x241840.cc
x241858.cc
x241862.cc
x241885.cc
yhrtn71fhhr.x241646.cc

# Reference: https://github.com/hagezi/dns-blocklists/issues/9567

auth-wps.com
f-sougou.com
login-wps.com
portal-wps.com
safe-wps.com
secure-wps.com
shuruf-sougou.com
update-wps.com
web-wps.com
wins-sogou.com
wpsupdate.com

# Reference: https://github.com/hagezi/dns-blocklists/issues/9581

glqxiazai.com
google-cn-chrom.com.cn

# Reference: https://github.com/hagezi/dns-blocklists/issues/9593

360aqllqwindows.cyou
360browser2.com
360ccn.com
360cncn.com
360cpc.com
360pc1.com
360pc2.com
360xiazai.cyou
anydeskaa.com
anydeskii.com
appleais.com
bitbrowserrcn.com
bitbrowserrpc.com
bite-browser.com
bite-browseri.com
deeplgw.cyou
faagazd.com
googleyzq1.com
hellogpt2.com
hellogptcn.com
hellogptpc.com
hellowordpc.com
helloworldf.com
helloworldgw.cyou
helloworldh.com
helloworldj.com
ldmnqpc.com
ldmnqq.com
linerpc.com
lineupc.com
meiqiay.com
mu.mugen888.com
mugen888.com
oraycc.com
ph2025.net
pidjik.net
pub-0e7592b7e88847edb6442b3a32511f2c.r2.dev
pub-0ef83a88d41a4e948752884e11481ba0.r2.dev
pub-5e05a7e3ace44640b25567ef2b1636d4.r2.dev
pub-85249662661641baa2df518d4e2f7d67.r2.dev
pub-9beb8f144f294913b46eac91811cd34b.r2.dev
pub-c3f2ab1ea4954676a2d3b4f999d7aab2.r2.dev
pub-f84bc7b2890c45ab8427f7b6bbfa447a.r2.dev
qishuicc.com
qqemaili.com
qqemaill.com
qqmail1.com
qqmaili.com
qsyygw.cyou
qsyygwxz.cyou
sgbrowser.com
sgbrowser1.com
shunlissll.com
signalrr.com
signaltt.com
sougou-browser.com
sougoubrowser1.com
speedinpc.com
telegrama-apk.com
tg6.ph2025.net
todeskt.com
xiazaiabcd5.cyou
yn.faagazd.com
youdaoq.com
youdaou.com
zaplnhyuuu.cn

# Reference: https://github.com/hagezi/dns-blocklists/issues/9601

116.bei9.xyz
ahh.dexinqa.com
bei9.xyz
dexinqa.com
doebn.com
dowiehksjvuen.cn
dvnofknrf.cn
gy8fe1.oss-cn-beijing.aliyuncs.com
hfeqomclkjxct.cn
idol-sonic.com
ry2ihs.oss-cn-beijing.aliyuncs.com
xiaoshihou39.top
xiazaizhadia57.cyou

# Reference: https://x.com/Nav_the_Sham/status/2045530562480193981
# Reference: https://www.virustotal.com/gui/ip-address/103.115.56.66/relations

happypawsapparel.com
labricotbleu.com
missallanahstarr.com
whxzhlcgtdu.top
xiaodto.xyz
xzmfyuemtzp.top
ly.missallanahstarr.com
m7.happypawsapparel.com

# Reference: https://x.com/k3yp0d/status/1955264469728199005
# Reference: https://app.any.run/tasks/824d5d9b-cf78-4059-9fc0-47cc1077a846
# Reference: https://app.any.run/tasks/158d8312-dc5d-4a35-8501-91149b721eee
# Reference: https://securelist.com/silver-fox-tax-notification-campaign/119575/

45.118.133.203:5000
3mkorealtd.com
doublemobile.com
fetish-friends.com
haijing88.com
ilptour.com
jmbyxx.com
kcii2.com
mcagov.cc
petitechanson.com
protaskpartners.cc
roldco.com
sudsmama.com
tingshuzu8.com
woopami.com
xiekuabao99.com
abc.fetish-friends.com
abc.3mkorealtd.com
abc.sudsmama.com
abc.woopami.com
abc.ilptour.com
abc.petitechanson.com
abc.doublemobile.com
vnc.kcii2.com
abc.haijing88.com

# Reference: https://x.com/ElementalX2/status/2056398120632930634
# Reference: https://www.virustotal.com/gui/file/ac6f79a9986bead7133a4747891c44996b1619d85f7fc46e1c14364abc05ac9a/detection

103.214.172.33:1234

# Reference: https://x.com/tdatwja/status/2062483905463320856
# Reference: https://www.virustotal.com/gui/file/f4d85aaa2236a70daa016853c754f0a3378f4873f8d10047b890580a328f6d07/detection
# HOST-TITLE=Embed XZ Page

43.128.26.132:778
43.128.26.132:779
15f50bd7-8565-4481-aef8-4a0f16aa0d3c.somemoni.com
360se.club
51.51xgttc.com
51.51xgttc.help
51.xgttc123.com
51.xgttc123.org
51xgttc.com
51xgttc.help
7g.yes88ewallet.com
a2.51ek.com
admin.winkolm.com
agent.51ek.com
agent1.51ek.com
aliyunguanjiaok.com
aliyunlaijshn3.com
api2.51ek.com
apibob.51ek.com
bob.51ek.com
bsueoweathki.cn
center.seappservice.work
chemehiso.cc
csbroadband.cn
cxg003.helovpn003.xyz
dfhuw.cn
e1.winkolm.com
evgaprecisionx.360se.club
feivhfgev.cn
fisjggm.com
gdvefsrcfwsax.com
ggiuyd.com
gredfhh.vip
herdfb.cc
hjsdbjas.cc
hk-cn2-gia-1g.somemoni.com
hk1.chans.xyz
homeysion.work
htdfwhdfkewedsjtrkltrsgfryerhfkrws.com
htrdrx.cc
i1.winkolm.com
imagedjcae.com.cn
indk.club
jkasndznqmza.com
jobkorea.cn
jobkortb.cn
lansikejijiweimazhihuiminyegelaina.com
laofa16888.cn
liaopiaojseds.com
lmidogds.cn
lymehrsu.info
m8m8.net
maoshiyanquyongguinongmuye.com
md.51ek.com
mehrsagov.cn
mehrsioa.icu
mehrsiov.it.com
mehrsiov.txpfproxy.vip
mybob.51ek.com
newbob.51ek.com
nix-hk.armlfs.org
o1.winkolm.com
p1.winkolm.com
piaoadsehcmqal.com
piaodcvgdfxaz.com
piaogdbgxdv.com
piaoguanjiafuwuanzk.com
piaojudiansa.com
piaoniuyunali.com
piaoscmzamqa1.com
piaoshujulja01.com
piaosncmkamxwa.com
piaotongshuxnjaanp.com
q1.winkolm.com
qelknmbh.club
qucc1688.cn
qucc1788.cn
qucc2689.cn
quefa1788.cn
r1.winkolm.com
requesthost.work
reviewcshtb.cn
seappservice.work
sesvc.cc
setraynotify64.site
shandongyiyang.work
shudianyunpiaoaaliokn.com
st.szdsmjs.cn
suihongsdnamzq.com
systemmsg.work
szdsmjs.cn
t1.winkolm.com
tianweitamuyingerjiaju.com
tq.azmvarlik.com
txpfproxy.work
u1.winkolm.com
ufeovssir.cc
vsdusx.cn
w1.winkolm.com
webctrlex.fit
winkolm.com
xdnxkmaqencadcbh.com
xg-ttc-999.buzz
xg-ttc-999.cfd
xg-ttc.my
xg-ttc.xyz
xgttc123.cc
xgttc123.com
xgttc123.org
xigaodianqi.com.cn
xinxingjianzhu.com
xudianyunpiaoaaliokn.com
y1.winkolm.com
y3.mehrsagov.cn
yaoyeyilongshuziyoudao.com
yes88ewallet.com
yongyouaskdjamkadn.com
youbianhaoma.cn
yuandongzhenhuazhonggongliantaidaduhuifushi.com
zengzhishuishudianp.com
laonasj-1422102728.cos.ap-hongkong.myqcloud.com

# Reference: https://x.com/smica83/status/1983509251248062783
# Reference: https://x.com/FatzQatz/status/1985246357981196752
# Reference: https://x.com/volrant136/status/1985752805060304938
# Reference: https://x.com/Huntio/status/1983913997695893533
# Reference: https://x.com/Malwarehunterr/status/2062972660049666255
# Reference: https://hunt.io/blog/multilingual-zip-phishing-campaigns-asia-financial-government
# Reference: https://www.virustotal.com/gui/ip-address/154.36.165.51/relations
# Reference: https://www.virustotal.com/gui/ip-address/47.83.166.230/relations
# Reference: https://www.virustotal.com/gui/file/249d2d1d6cfcf34d48ac0465ede688759a3c90b7412723373ea5a434d6d64c9c/detection
# CERT_FINGERPRINT_SHA256-HOST=c6c62333794d341e9ac5262570dec6ade960ef9688902776dc12c9dfd2c5017e
# CERT_FINGERPRINT_SHA256-HOST=30531dd80a5521861297669d41e53b06f49398c24f39c3a488d3aaf34ef4ace8
# CERT_FINGERPRINT_SHA256-HOST=22467a7f3552f3ee5a1d6cd4e490eaceea7e5c59092729d1baa6912b7616b98a
# CERT_FINGERPRINT_SHA256-HOST=210c4428808b5e42ce82e3ac77becd7d588ef34bf0ce9913ca176bd23ba5b7ed
# CLASS_0_HASH-HOST=5792f3fafb3c62b08cf732422b0788e9
# TITLE-HOST=कर दंड सूचना - भारत सरकार

1.gdgzxykj.top
3.110.184.116.nip.io
3.110.184.116.sslip.io
34519999.com.cn
37cang.com.cn
38fulent.com.cn
4.v66.asia
52lbsz.com.cn
52wyx.com.cn
56626648.xyz
56tk.com.cn
5yqsl.cn
602ssll.wang
720dushi.com.cn
86n1h37.cn
aaaswzcsdfz.shop
aawqwadazc.shop
adasdwqdqd.shop
admin.amazonfgyrs.com
airfind.com.cn
ajddx.icu
ajhgkjgkllnz.shop
akgaind.com
amazonfgyrs.com
amvcoins.vip
ancrypteml.top
aochjn.com.cn
aogvewps.top
api-sjbb.hantanqing.top
app.zgfzvip.vip
asdasdafgewwfsd.shop
asdfdwerzc.shop
asdfffzzzooo.shop
asdsaczcx.shop
asdzcwezsadfw.shop
ashengad.top
auiouiouio.cc
auto-linked.com.cn
aymdkese.love
baurtervrwe.eu.cc
bauydvuyuwt.eu.cc
bcaisuyer.live
bcsuytraw.gu.cc
bctetagrg.love
bcyer.qdysxd.com
bet33.com.cn
betmmm.vip
betooo.vip
bhzwoo.com
biwgg.vip
bjmacrc.com
bjxdd.uyjrtfyuuk.help
bjzsywrtua.eu.cc
bkw.gdgzxykj.top
bkwz.gdgzxykj.top
boke.gdgzxykj.top
bvjse.eu.cc
bxyaetrtaw.eu.cc
bxyawrgr.love
bystce.icu
bzusdty.live
bzusydyea.live
cebcfc.com
chsuyetrsd.gu.cc
cksxmviu.love
cn-new-youzhibo.com
cnxvbsjdy.live
cnzh-caike.com
contentery.cc
covliinada.us.cc
crazyparty.com.cn
cs.gdgzxykj.top
cswz1.gdgzxykj.top
csyssh.cn
cuntu.dewakartu.top
cvwbrwrs.live
cwtsh.eu.cc
cyiaytefet.eu.cc
cysta.eu.cc
deaips.com
dewakartu.top
dfaeuy.eu.cc
dfyue.eu.cc
dgdskfds.uk.cc
dghdghs.cyou
dhnsdhmskl.uk.cc
disir.twpfktuf.me
djhldl.icu
djhlodg.icu
djsnsg.icu
djxentertainment.com
dlfex.com
documenter.cc
documentewr.cc
dogist.top
domainca.top
donggangyujia.com
dontbemoory.space
download.zgfzvip.vip
downloaderi.cc
dsgrezb.cn
dtrar.eu.cc
duyey.eu.cc
dwass.cc
dyaeuyarw.gu.cc
dyrys.tasykdwa.icu
dyste.usdiuasrcvb.qpon
e-bandaosports.cn
eajbz.com
encrypteml.top
enzedi.com
etyhf2458.shop
etyhf2488.icu
etymcz.top
evaet.eu.cc
exiaodou.com
exsular.com
faeuuatui.eu.cc
faeytrdeaw.gu.cc
fanghong.xin
fasytwa.eu.cc
fatw.eu.cc
fdcmsjrsw.live
fddrdh.ifuaytes.icu
fdshj.fit
fduaywayst.live
fefdd.cc
fegeu.eu.cc
fenguanyihao.com
fgjdrt.iosdfiwra.shop
fhauifhyileydhfl.com
fhfhjn.pw
fhfhjndgh.asia
fhykb.fit
ficjseytea.love
figyuyrqwr.gu.cc
fiusyevr.live
fkaewjyttw.eu.cc
flsiuety.love
fojda.com
fstawrxvy.love
fuavyexr.love
fuaytrwese.love
fuerubuiaie.eu.cc
fvguy.cn
fvxcuvuyte.live
fwgij.fit
fwiu.eu.cc
fwrodifer.cc
fxuawyje.love
fychdstjse.live
fzdoor.vip
gasyvjara.eu.cc
gatjobs.top
gb.cn-new-youzhibo.com
gdgdeg.icu
gdgwefsaec.eu.cc
gdgzxykj.top
gdhe.eu.cc
gfexco.com
gfmqvip.vip
gfurt.juytygjty.shop
gfvgddgd.shop
gfvgddgd.site
ghre.eu.cc
gjlascx.shop
global-yibeisports.com
gogldha.shop
googledfg.cyou
googlefg.cyou
googlehfgj.icu
googlexa.top
googlle.xin
gool.goole.email
goole.email
gov2.xin
gova.bar
goviinada.us.cc
govinada.us.cc
govliinada.us.cc
govs.qpon
govs.top
gsawytex.love
guotoujgvip.vip
gxapi.vip
gxncjsuefre.live
gyhtdes.top
h5.wpvip.top
h5.zgfzvip.vip
haiwang.exiaodou.com
hantanqing.top
hauajyvtaw.eu.cc
hauwtcbe.love
hauwuncjyq.eu.cc
hawsu.eu.cc
hawuetcrei.gu.cc
haywtrbcye.live
hcsyds.eu.cc
hdiuxusyte.gu.cc
hdtgr.eu.cc
hduywtt.love
heaqw.eu.cc
heloman.top
hfdusryyea.gu.cc
hfrrhfhfhjf.icu
hfyuayustrv.gu.cc
hiaoei.eu.cc
hlsdleu.eu.cc
hnxte.bond
hsagu.luxuantang.com
hsahyteiows.gu.cc
hsauyeet.live
hsawtse.eu.cc
hscabw.icu
hsdieika.biz.id
hsieuygrw.love
hsiueteas.live
hsncjdyea.live
hsubd.cc
hsudyweed.gu.cc
hsurtytctrse.life
hsutfa.eu.cc
hsxcqes.com
htdfs.eu.cc
htgsds.eu.cc
htiauwi.eu.cc
htsdjey.eu.cc
httcay.eu.cc
httgasi.eu.cc
httpasyt.biz.id
httpks.eu.cc
httplai.icu
httpxiauydse.eu.cc
httpxnusyseke.eu.cc
httqays.eu.cc
httriuyw.eu.cc
httvdfr.eu.cc
httyust.eu.cc
htvdaey.eu.cc
htxeat.eu.cc
htysytvd.biz.id
huameihome.com
hudnz.com
huiboimg.bj.bcebos.com
huimeiyongchuang.com.cn
hycndn.top
hykpdm.top
hyryrurtu.shop
hystaerie.gu.cc
iauwdiufuew.eu.cc
iayueate.live
iboosisy.eu.cc
ifey.eu.cc
ifuaytes.icu
img.goole.email
importanter.cc
importanter.vip
in.aogvewps.top
in.exiaodou.com
incometaxindia.xin
incometaxindiaefiling.help
incometaxonline.my.id
inconsistenter.cc
inder.exiaodou.com
india.imedikate.com
india152366.cc
indiaaba.com
indiacy.xyz
indiasdfds.uk.cc
indiaxyne.us.cc
indiaxyqe.us.cc
indiaxyre.us.cc
indiaxyte.us.cc
indiaxyz.top
indiaxyz.xyz
indiaxyzac.us.cc
indiaxyzbc.us.cc
indiaxyze.us.cc
indiaxyzq.bond
indiaxyzq.sbs
indiaxyzq.us.cc
indiaxyzqa.us.cc
indiaxyzqaq.us.cc
indiaxyzqc.us.cc
indiaxyzqd.us.cc
indiaxyzqx.us.cc
instengneededinstengacross.com
iosdfiwra.shop
irregularities.cc
isauwtsq.love
isdhdwhw.love
isee.ajddx.icu
iseuae.eu.cc
isfuaytwe.eu.cc
isfya.eu.cc
isriy.eu.cc
isyawtgxe.love
isyraw.quidoaehse.icu
ixufruwig.love
jaiehsycres.live
jaiwuydr.love
jaiydteds.love
jamyaclay.cc
jd-vip0507.icu
jd-vip0590.icu
jd-vip05901.icu
jdfksyaw.live
jdshduyw.love
jhmrrru.cn
jiaobanchandou.com
jinmai.vip
jiruyrwvefer.eu.cc
jiwigwsisy.eu.cc
jrmx.cn
jrtsw.eu.cc
jshukg.shop
jsiruytrawey.gu.cc
jskdfkayaw.gu.cc
juxsyena.love
juytygjty.shop
jxcxt.gdgzxykj.top
jxcxt.pmd.gdgzxykj.top
jxsdry.ydwnb009.me
kaieuryfete.eu.cc
kaip11vip.top
kairtyayede.love
kaisufyyte.love
kaiwettece.gu.cc
kaiwtwa.eu.cc
kaiwyrey.eu.cc
kakiwuyder.live
kasicjnasye.eu.cc
kasiemmu.love
kawosyetw.gu.cc
kawuuterta.gu.cc
kcetbftaw.love
kdieushyfer.eu.cc
kdsuyrse.live
kdtaywdewa.gu.cc
kedsw2366.cn
kenshuoshuo.com
kerpalr.cc
kiafewoey.icu
kisuytbze.love
kiufusete.love
kixuseteh.love
kjfuwyce.love
kjiujjt.hnxte.bond
kncjxdhyers.live
komjhhd.com
ksauwerd.love
ksidueyhy.gu.cc
ksiduttdtes.gu.cc
ksiduyee.love
ksiey.eu.cc
ksiscwe.cc
ksuiriyuuse.eu.cc
kudkgoay.love
kxisetcblg.love
kxjnbsagt.live
kxuaicnvyet.love
l9.5yqsl.cn
laiuatexqw.cc
laiuatexqw.gu.cc
laiuatexqwgg.bond
laiuatexqwgg.sbs
laiuatexqwgg.top
laiuatexqwgg.xyz
laiuatexqwgov.cc
laiuatexqwgu.cc
laiutexqwgua.cc
laiutexqwgub.cc
laiutexqwguc.cc
laiutexqwgun.cc
laiwnndye.love
laiwutrencr.gu.cc
laiwyfbtw.live
laiwyhvge.love
laosiyetvrx.eu.cc
laowettraws.gu.cc
lasdyyterc.live
lasiduutfe.gu.cc
lasodtetr.love
lckawybdy.live
lcvajwyt.love
ldiruttew.love
learn.thesugarista.com
licduytrdse.live
liciuseret.love
lisiutegrm.live
lisudted.love
llipeiyue.com
lncometaxindia.top
lodiisuede.live
love.onlinetaxdept.com
lsdifuuwea.love
luoyangjunlin.com
lxcosetrs.love
m.jiaobanchandou.com
m.yuxinwenhua.top
maietxdea.love
mail.mybmtest999.net
mail.thesugarista.com
maiqkaiik.com
maishiwh.com
maisytawe.gu.cc
maiuueytw.love
manageret.top
manbiripoint.vip
mansoma.com
mckajwyd.live
mdsyahaew.eu.cc
mdwrohgs.eu.cc
meiev.com
mggsjvip.com
michaelscleaners.com
mksfuuerwo.live
monph.com.cn
moonbox.in
mrcxsy.com
mtxx.xingguw.cn
mxdjkuaeyyr.eu.cc
mxnnshya.love
mxodsiuuy.live
mxshteaye.love
mxziyuve.live
mybmtest999.net
nanguateng.vip
ncduuyese.live
nciyeyrawoe.gu.cc
ncvjstytarew.gu.cc
ng.incometaxonline.my.id
nicolasbedel.com
nkjtkj.shop
nnfex.com
nnnwin.vip
nsdusb.shop
nsisuyete.live
nviuawusye.gu.cc
nvsieyrrawe.gu.cc
nxhsuscy.love
nxjdfysead.live
nzsjdyzw.live
oakwusya.love
oieuis.ydwnb007.me
olofopbwgxgodt.net
ompcwj.com
onlinetaxdept.com
only-qiutan.com
only-youzhibo.com
opkllasyy.icu
opkllasyy.shop
opsib.shop
osieuatwu.gu.cc
ouriyatea.gu.cc
paeiyuytwe.love
paiwudyea.love
pasoiuewuy.love
pawoidutte.love
pbcgsrwre.love
pdijcsuet.love
pdiujsyetua.gu.cc
pdsishf.eu.cc
pegasus-cash-spree.com
phkinteltech.com
pifuytawjne.love
piumbtaw.love
piuygbd.vip
pmcjsuyraw.gu.cc
pmd.gdgzxykj.top
pmrravwg.love
poaker.info
poeisyerdfa.gu.cc
pooioigw.eu.cc
psaofwiqw.love
psiawute.eu.cc
psufuyvaw.love
psvcsw.icu
pxnzsdgre.live
qaywtfse.eu.cc
qbasw.com
qcvmsdtqa.gu.cc
qeqokgoo.me
qeuasytua.love
qiat.eu.cc
qiawmcue.love
qicxgreae.live
qin.exiaodou.com
qisdyetvcae.live
qisuduegfr.gu.cc
qiuafs.eu.cc
qiuysytsra.gu.cc
qmcsjeus.live
qodyeytax.live
qq-taopiaoxcx0501.icu
qsrt.cn
qtxdsh.top
quidoaehse.icu
qxcddrse.live
ratishog.top
rctsbetaw.love
rdyue.eu.cc
rsmzth.com
rsmzth.shop
rtga.eu.cc
rvajhdfdhsy.eu.cc
ryesrh.top
saasda.cc
sadfvxvz.cc
sadsdz.com
scytatyweg.live
sdkncn.top
sdubba.eu.cc
secswift.com.cn
sendinger.cc
sgdncvkd.com
sgeshex.vip
sgeshgold.vip
sgeshjys.vip
sgevip.vip
sgov.xin
shihuarui.dewakartu.top
siaw.eu.cc
sieur.qeqokgoo.me
siyer.shinengdan.com
sjisanhsv.icu
sjlc8.com
skjsayeyd.love
smfslb.com
sneira.com
sqwroioigw.eu.cc
srljjc.com
srtis.eu.cc
strdi.eu.cc
suadgw.global-yibeisports.com
suawytde.eu.cc
sudyw.wjusqlct.me
sueysu.ysieiuhaw.icu
suitr.dueykah.cyou
suiyerjser.cyou
sunbro.vip
suye.twveytem.me
svuatwea.love
sxzqios.vip
syatuefaw.eu.cc
syeg.eu.cc
syfiaydytea.live
system32.sbs
sytae.eu.cc
syxhtejkdr.love
t-lebosports.cn
taayt.eu.cc
tangliren.vip
tarey.eu.cc
tasdhwia.love
tasydiauw.eu.cc
tatwrd.eu.cc
tawdnasew.love
tawuiutfe.live
taxation.imedikate.com
taxationgg.top
taxeiit8.cn
taxenrs.com
taxind.name
taxindn.com
taxindn.name
tbckduurs.love
telem.top
tepujc.com
tgdyyrfuh.icu
thesugarista.com
threadet.top
tianyi5g.cn
tmnykj.com
tp6.1.gdgzxykj.top
trgmsp.shop
tsbwufyrsw.live
tt.602ssll.wang
tushshraer.eu.cc
twpfktuf.me
tyisbx.icu
uasydaw.eu.cc
udste.xidyuyedg.qpon
uejhffblkuiwgdf.com
uetrsd.suiyerjser.cyou
uiaef.eu.cc
usdiuasrcvb.qpon
usetr.uydsecbjyge.cyou
uwqlvza.cn
uydsecbjyge.cyou
uyfbbnstet.love
uyjrtfyuuk.help
v7.taxindn.com
valuechemie-tech.com
vaytw.eu.cc
vcfdt.eu.cc
vcsyevglii.eu.cc
vdsfv.cc
vethshrarty.eu.cc
vfhfgh.click
vfhfgh.shop
vfhfgh.site
vfhfgh.website
viewporter.cc
viuyeyrwqs.gu.cc
vm.taxenrs.com
vnbhaytysw.live
vrnvku.com
vusuydryt.love
vuyat.eu.cc
vxfs.gdgzxykj.top
vxiduyga.live
vyztavhsuw.eu.cc
waf.gdgzxykj.top
walzes.shop
wbaaa.top
web.amvcoins.vip
weipengi.com
whatnnnnn.top
winii.vip
wkstx.icu
wobu.ws
wqewzzccwraas.shop
ws4962.com
wushi.exiaodou.com
wyctridea.love
wzcwaadrtwazcxzc.shop
xafgdvctw.love
xauysfhyte.live
xayetcyrwr.eu.cc
xbgsetewt.live
xciwuerse.eu.cc
xcndyteer.love
xcsudoaidw.gu.cc
xcuyeaet.love
xcxkdkuayx.live
xdie.eu.cc
xfofaow.cn
xhastyese.love
xhuar.com
xiaueyvos.gu.cc
xiawytee.love
xidyuyedg.qpon
xijbdgecr.love
xingguw.cn
xinhuachat.com
xinhualive.com
xiuyaertwa.eu.cc
xjgfst.ydwnb014.me
xkcifgieusr.gu.cc
xnbscuya.love
xnjatwrtwe.vip
xnyyxe.com
xoeyu.eu.cc
xoqu.eu.cc
xrcsmo.icu
xsiw.eu.cc
xsiyrytttde.live
xstvchfhd.live
xteue.eu.cc
xuaidjay.live
xuastyrdqk.love
xuaytedgv.live
xuaywttsa.love
xucnvgjte.love
xudysytes.live
xusadtraw.love
xusdtmcdra.love
xusytawtd.eu.cc
xxgzbts.cn
xybk.gdgzxykj.top
xzystrbvnse.live
y8uo8qn.top
yajnvsiuyaw.gu.cc
yasyciuste.love
yatna.eu.cc
ychaot.com
yd.56626648.xyz
yda.56626648.xyz
ydsyii.com
ydufwyaxe.love
ydwnb009.me
yhseyanw.eu.cc
yicoweytcbtw.gu.cc
ysicgtes.love
ysieiuhaw.icu
ysnts.icu
ystwesiawsw.gu.cc
yswhg.kiafewoey.icu
ytahf.eu.cc
ytdwealiwd.eu.cc
ytrud.eu.cc
yudfsdgjae.eu.cc
yunpeng.vip
yunvxi.com
yurthd.senshanyuan.com
yuxinwenhua.top
yvxyngw.cn
yxtrvctwrfar.eu.cc
yy.ydsyii.com
yygzbts.cn
yzytsrasca.live
zctgts.shop
zcxzsdw.cc
zdtrebdhr.live
zetaholdings.com.cn
zgfzvip.vip
zh-chs-leqiu.com
zhixiangqian.vip
zklsaz.shop
zlvbvyer.love
zmnnlhjhz.shop
zo5oyv.top
zocuyuefgd.love
zoom.xingguw.cn
zpclzc.cc
zsmba.com.cn
zsqtmp.cn
zsuydiatyse.gu.cc
zsyrtcmke.love
zsyxmyur.live
zusyyredrs.love
zuxywrjcie.love
zxaiasuye.love
zxcjyeahd.live
zxcwwsazze.shop
zxcxwaasaaa.shop
zxysevre.eu.cc
zzhaopin.com.cn
zzisudted.live
zziyyterser.live
zzsrgrrywd.eu.cc
zzthm.com.cn
zzwwzz.cc
zzzwin.vip

# Reference: https://x.com/plebourhis/status/2032417385076957667
# Reference: https://www.zscaler.com/blogs/security-research/zscaler-threat-hunting-catches-evasive-sidewinder-apt-campaign
# Reference: https://www.esentire.com/blog/weaponized-in-china-deployed-in-india-the-syncfuture-espionage-targeted-campaign
# Reference: https://urlscan.io/search/#dea8c5c9e40f0901033dcc9a4996369d6246d394a7378765be4c3d02682ef0a8
# Reference: https://www.virustotal.com/gui/file/cf36607a670996c7b8b275132bef9e8faacf5f97a3268edaa23b5e2e5a3fdf29/detection
# BANNER_0_HASH-HOST=1e0112925b4b969c6b87642725af9c64
# CLASS_0_HASH-HOST=5981e2e8500226e9f774d6349dd87de8
# HEADER_HASH-HOST=e5e13f08dae4184ecdec

7v.superyantra.com
aaqoown.icu
aaqoown.top
abgcrap.icu
aeqfjsa.icu
akyfgse.icu
aniibip.icu
aniibip.top
api.us2-webex.com
atybsmz.icu
autodiscover.rajshreewin.com
autodiscover.vinhetadj.com.br
avqehep.icu
awiekek.icu
axggtec.icu
bawgzin.icu
bbnxpkak.icu
bbrkopsj.icu
bcjhlhuhq.icu
bcxrceak.icu
bdasree.icu
befzmdwo.icu
bejceqef.icu
benchmarkly.bond
bfpovwio.icu
bfqzdes.icu
bfzjwbaa.top
bgoamup.icu
bhhhwimp.icu
bhnvdmpke.icu
birbmcmp.icu
bkvwxwiu.icu
blyuaex.icu
blzgeuuz.icu
bmatdyz.icu
bnhootik.icu
bohpenqk.icu
boicvwh.icu
bpaxfcn.icu
bpbzllcp.icu
bpowvok.icu
brpuwfyu.icu
bstixopdn.icu
buhmmgkj.icu
buyqjas.icu
bvbwwewo.icu
bvlcnicrt.icu
bvxterge.icu
bxaeah.eu.cc
bxdtviiff.icu
bxfrhysa.icu
bxiyeqc.icu
byplussa.icu
bytytxkz.icu
byzdssku.icu
bzabwir.icu
bzstbzst.icu
cbwvtuf.icu
ccqwzkc.icu
chopgih.icu
cigpqom.icu
clqslgx.icu
cml1d3j2n99q08h8n9dpdx7e1.rajshreewin.com
cnaiuks.icu
cpanel.vinhetadj.com.br
cpcalendars.vinhetadj.com.br
cpcontacts.vinhetadj.com.br
cqarzqf.icu
cqoqpcc.icu
ctytkun.icu
czgthur.icu
dadasf.qpon
dagibgk.icu
dahrexmj.icu
daohetong.com
dbbbovyo.icu
ddfwzpua.icu
ddpoupmu.icu
ddqqtyu.icu
de.rajshreewin.com
dewrp.beestvpn.ru
dezikjuu.icu
dfnejoie.icu
dgtkbzmdy.icu
dgxywiqe.icu
dhrigguj.icu
dhxncbce.icu
diihbam.icu
djgekcf.icu
dkjawhgf.icu
dlwkwsx.icu
dmntzbrkt.icu
dmnvhbck.icu
dmqmfsp.icu
dnhmozop.icu
dnxknuok.icu
dpauxka.icu
dpydxoh.icu
dqpmknko.icu
dqzooska.icu
drofjqv.icu
drvcrgmwa.icu
dsigsgr.icu
dthtgksk.icu
dunwlvakg.icu
duynegf.icu
dvwokwc.icu
dwplwlez.icu
dxpzowau.icu
dxvxnrap.icu
dzxqrdmj.icu
eaygjik.icu
ejiwvof.icu
elazkeu.icu
elazkeu.top
emwenep.icu
enqbwgi.icu
eoohfwe.icu
eqajrys.icu
erykamp.icu
etiajsk.icu
evygvib.icu
ewwdeku.icu
exodoqz.icu
faayuuk.icu
fbyaduc.icu
fcpqocgz.icu
fddnrmeiz.icu
fdhaev.icu
ffdafpoe.icu
ffhneugk.icu
ffvevmkwl.icu
ffxvjuoj.icu
fgrhuook.icu
fgsdol.icu
fipxgnku.icu
fivcfikp.icu
fjpmmgwu.icu
fkzgcawu.icu
fldhxasz.icu
flgrvqu.icu
fmbgdrao.icu
fmhechaj.icu
fnwthsi.icu
fofbrgwa.icu
folrblfjr.icu
foquqie.icu
fplgfmaj.icu
fpowzix.icu
fppqxzia.icu
fqbwptjpu.icu
fqgbcis.icu
fqpkktqa.icu
fraclyp.icu
fsnazsmk.icu
fsxsusee.icu
fsyeuah.icu
fthkgqyp.icu
fttaxlamy.icu
fttqjixua.top
fvfxpkmo.icu
fwfrcemo.icu
fxqvzcz.icu
fybzbisgo.icu
fyosies.icu
fyxpflyk.icu
fzhyybuk.icu
fznwxwuf.icu
gainlgh.icu
gbasogc.icu
gcypxiv.icu
gdwvgyr.icu
gfmqvip.vip
ghwmbue.icu
gjionus.icu
gmixpaf.icu
gofjasj.help
googelm.com
googleaxc.shop
googledsf.cc
googlehfgj.cyou
googlehfgj.qpon
googlehfgj.shop
googlehguk.com
googlehkcom.com
googlevip.icu
googlevip.shop
googlewery.cyou
googlewww.qpon
goolgme.net
goolmor.cyou
gooomld.top
gooomoel.icu
gooomoel.shop
govbr.icu
govbrk.shop
government1.cyou
government1.icu
government2.cyou
gpqokux.icu
gsarcmh.icu
gsrydkjz.cyou
gtwrpsm.icu
gyqktqs.icu
gywbae.cyou
handlingk.icu
haofwsh.icu
hbfchgoo.icu
hcahiuv.icu
hdyiokr.icu
hebttzhpf.icu
hetyqraftryt.cyou
hexuxhak.icu
hfopamf.icu
hhvzpziu.icu
hhzmoeaa.icu
hiftftqu.icu
hiwgvgx.icu
hjjhpzcbt.icu
hknbpnef.icu
hlgjnyh.icu
hlhlwqqk.icu
hlwkxmk.icu
hmyjaem.icu
hnhjlz.com
hnlghkmp.icu
hnlufgclc.icu
hnpjzxuz.icu
hnvhryjs.it.com
hogsscu.icu
hovaxzmp.icu
hpdlnghio.icu
hpimswx.icu
hpprecyu.icu
hqdyxlye.icu
hqxabqqj.icu
hrtmpruz.icu
hrxphjcj.icu
hshjudkj.icu
hsvpryxfs.icu
hufzgcga.icu
hugfzsc.icu
hungzycce.icu
huwgjgf.icu
hvfopvsa.icu
hxdozaqzi.icu
hxtjapof.icu
hxxwzuge.icu
hyxqmoge.icu
hzqenck.icu
hzvfhvvnu.icu
ieyciwk.icu
ifqclwf.icu
ifqclwf.top
ihifdou.icu
imap.rajshreewin.com
imgdhmz.icu
incometax.biz.id
inyyrsf.icu
iqigmip.icu
itqseeh.icu
ivgzqgv.icu
ivwaasx.icu
iwaazwr.icu
iwqbjiu.icu
iygdvki.icu
jaayyox.icu
jaljxoio.icu
japwwtau.icu
jctkhnwz.icu
jddzngqz.icu
jdxbrlie.icu
jffzrsua.icu
jgftemua.icu
jgvgjdqo.icu
jhoxoau.icu
jigxygz.icu
jilwjmzun.icu
jitosgqf.icu
jjnyzeck.icu
jkxsmykk.icu
jlqatyk.icu
jmfazxyo.icu
jnaqcef.icu
jnzrgvka.icu
jojfltebi.icu
joyslex.icu
jpdmrpgf.icu
jpjslqpkt.icu
jpwtuuu.icu
jqngejgf.icu
jqotxup.icu
jrbjplvym.icu
jrhqohsk.icu
jrivgwi.icu
jrnvncsf.icu
jsgwpme.icu
jsvehqsu.icu
jtllzbop.icu
jtnodtzep.icu
jtporowz.icu
juqmysz.icu
juwdbos.icu
juzieiez.icu
jwddpcae.icu
jwjixnnsc.icu
jxautik.icu
jxxuzamj.icu
jywpdop.icu
jzfvjzau.icu
jzlikuio.icu
kfajnwc.icu
kiorfom.icu
kjgmsus.icu
kjqligp.icu
kkaobuk.icu
kmqunkc.icu
koafwqx.icu
kpygfgu.icu
kqwioim.icu
kronrii.icu
ksdfuefagfrukayhfka.eu.cc
ktgqjax.icu
kwqtbqh.icu
lbtouzce.icu
lcdihtce.icu
lciedgs.icu
lcntctcf.icu
lelqrsqp.icu
lffayqcu.icu
lfvfxlkp.icu
lfwhvwc.icu
lhnqhzxeh.icu
liuliu.cyou
lixsoroj.icu
ljdefxsz.icu
ljxggcse.icu
lkggmgk.icu
lkjupwnkl.icu
lklnclko.icu
llahswh.icu
llfejjwa.icu
lmfywdea.icu
lnqjeyv.icu
looknor.icu
lpndrvek.icu
lqddnysrg.icu
lqyazum.icu
lrvlbuao.icu
lsffooao.icu
lstibgxxj.icu
ltiirkx.icu
luadeqc.icu
lvjpibia.icu
lvlmfdndn.icu
lwwlmch.icu
lxlimnmu.icu
lxolwim.icu
lyvczhuu.icu
lzptgfgz.icu
mail.vinhetadj.com.br
mcorlsr.icu
mcxvne.it.com
mditusk.icu
metricflow.bond
mfsgsa.top
mfyzgic.icu
mjajtrax.shop
mmawmkz.icu
mndgsab.eu.cc
mpoehck.icu
mrysaqw.qpon
msgasatry.eu.cc
msyhcsu.icu
muixlyp.icu
mxwfgqz.icu
myoaqwf.icu
naivtyu.icu
nanijrok.icu
ncyxfai.icu
ndlnbjwu.icu
ndvfzjoo.icu
nfgoxwz.icu
ngjuassa.icu
ngyoawu.icu
nhnehvef.icu
nhtmjvee.icu
ninyukef.icu
niqwsoj.icu
niqwsoj.top
njlojjkdy.icu
nklojjap.icu
nkpyybiz.icu
nlvdpcmp.icu
nndbsoqe.icu
nnzyawiu.icu
nonvfiye.icu
npdgrtpcr.icu
nqlsrhuo.icu
nqysrcz.icu
nrfcbfya.icu
nrlhaago.icu
nrqsbif.icu
nrvxvtuqd.icu
nuavwyp.icu
nudjxouz.icu
nungdqkwh.icu
nxbosgcj.icu
nxvqtqco.icu
nzopkix.icu
obiknmm.icu
oewsfex.icu
ofigiiz.icu
ohyiukn.icu
oiwjdyj.icu
ojqlmac.icu
okiqmax.icu
oldwinfree665h.click
omatesm.icu
ooicrcu.icu
oopae.icu
oopv.shop
orwfmue.icu
osqhvux.icu
ougnhkp.icu
ovapqmi.icu
oytdwzz.shop
padopkez.icu
pajak77.eu.cc
pajak8.cyou
pajak9.web.id
pajakpmy.my.id
pajakww.top
pcfhtwia.icu
pclfprio.icu
pdbthcmj.icu
peyvz.com
pfjrkjqf.icu
pgtlxdqf.icu
pjbqsvyp.icu
pjlstayu.icu
pjvdraqo.icu
pjwdumc.icu
pkoyhsh.icu
pljycuua.icu
pmggpem.icu
pmjspoua.icu
pnnjzmgf.icu
pnygzks.icu
pojaplmvl.icu
powdikk.icu
pprekgck.icu
ppvhztku.icu
pqbrtgrjx.icu
pqijuac.icu
pqvbpnsu.icu
pr.rajshreewin.com
prbetdcsi.icu
pstrbmoe.icu
pswzggx.icu
ptdghfae.icu
pttvbdigb.icu
pttvbdigb.top
punaxzae.icu
puocvym.icu
pvgcyyh.icu
pvloreop.icu
pwvihyop.icu
pxyfqqw.icu
pzomcqk.icu
pztnzqwz.icu
qbihfuz.icu
qdqqseh.icu
qgatkwr.icu
qiedoudou.com
qjobfmc.icu
qoyvtwk.icu
qqooe.click
qridoou.icu
qtwoxuq.icu
ququgkm.icu
qvorpmf.icu
qwgwsma.icu
qxaxbcw.icu
qyyzkcp.icu
rajshreewin.com
rarccxek.icu
rbhgkqyj.icu
rbltjvqp.icu
rboungz.icu
rcguamf.icu
redlzwce.icu
rftsrhgz.icu
rhaneik.icu
rhbquoko.icu
rilkhiko.icu
rkoqzau.icu
rljpcasf.icu
rlnjbfke.icu
rnrxmzoj.icu
robyztoj.icu
rpvijrao.icu
rpypnkd.icu
rqdyrqalc.icu
rqgpmmw.icu
rqvqk.zjhxfj.com
rqwqwaz.icu
rrdgjyek.icu
rrjdulwa.icu
rrtqpuaf.icu
rsisicn.icu
rsjxhfwa.icu
rstdfyerm.icu
rsvpvqfzv.icu
rtgtosj.icu
rubvkmip.icu
rulqlriu.icu
rulujykfy.icu
rvqjaye.icu
rvvfrkuu.icu
rxdnbjif.icu
rxzaceqz.icu
ryarvop.icu
rydhrdif.icu
ryjusyqz.icu
rzwmfuu.icu
sdgjuyx.icu
sgqrmqh.icu
siacywc.icu
sjyihmz.icu
skk.yoihksk.icu
skqikmu.icu
slokton.icu
smilzej.icu
sot.bcxrceak.icu
sot.dkjawhgf.icu
sot.dnxknuok.icu
sot.dxvxnrap.icu
sot.dzxqrdmj.icu
sot.ffdafpoe.icu
sot.fppqxzia.icu
sot.fqpkktqa.icu
sot.hiftftqu.icu
sot.hlhlwqqk.icu
sot.hxtjapof.icu
sot.hyxqmoge.icu
sot.jaljxoio.icu
sot.jitosgqf.icu
sot.lfvfxlkp.icu
sot.ndvfzjoo.icu
sot.nndbsoqe.icu
sot.nonvfiye.icu
sot.nrlhaago.icu
sot.pgtlxdqf.icu
sot.pjvdraqo.icu
sot.pljycuua.icu
sot.pmjspoua.icu
sot.punaxzae.icu
sot.rbltjvqp.icu
sot.rrtqpuaf.icu
sot.rsjxhfwa.icu
sot.ryjusyqz.icu
sot.vijgbyia.icu
sot.vmbnasgp.icu
sot.vpzzskoz.icu
sot.vsrbsdck.icu
sot.xehdsnyj.icu
sot.xhpinfga.icu
sot.xotthxaf.icu
sot.xsbspjip.icu
sot.xxhfuaek.icu
sot.zgzccssz.icu
sot.zkhbkeij.icu
sot.zmzjudwu.icu
sot.zspncwqa.icu
sot.zwxmkiyk.icu
sot.zzvrfagu.icu
sot.zzzeefya.icu
sow4.shop
srwfqos.icu
ssw.avqehep.icu
ssw.bawgzin.icu
ssw.blyuaex.icu
ssw.bmatdyz.icu
ssw.bpaxfcn.icu
ssw.cnaiuks.icu
ssw.cqoqpcc.icu
ssw.diihbam.icu
ssw.djgekcf.icu
ssw.dpauxka.icu
ssw.ejiwvof.icu
ssw.elazkeu.icu
ssw.evygvib.icu
ssw.fyosies.icu
ssw.gainlgh.icu
ssw.ghwmbue.icu
ssw.hmyjaem.icu
ssw.imgdhmz.icu
ssw.itqseeh.icu
ssw.iwaazwr.icu
ssw.jsgwpme.icu
ssw.kjqligp.icu
ssw.kpygfgu.icu
ssw.lciedgs.icu
ssw.llahswh.icu
ssw.looknor.icu
ssw.muixlyp.icu
ssw.naivtyu.icu
ssw.ofigiiz.icu
ssw.pxyfqqw.icu
ssw.qoyvtwk.icu
ssw.rqgpmmw.icu
ssw.sdgjuyx.icu
ssw.skqikmu.icu
ssw.tiohpuw.icu
ssw.tjavpyz.icu
ssw.tmodkqj.icu
ssw.usoxsak.icu
ssw.uwotnwx.icu
ssw.vbwrlsw.icu
ssw.vyijqam.icu
ssw.wiiztiz.icu
ssw.wliiymn.icu
ssw.wxynyij.icu
ssw.xhydbqx.icu
ssw.xkgutko.icu
ssw.xnqxocz.icu
ssw.yjwyesm.icu
ssw.ymgbwkw.icu
ssw.zlosbga.icu
ssw.zpqgcck.icu
ssw.zxwfcwm.icu
ssyeqgu.icu
stockjp.top
sugniec.icu
superyantra.com
svgyct.hnhjlz.com
svihlye.icu
sxqvdwm.icu
tallxdcj.icu
taracdkp.icu
tavnbico.top
tddstfkf.icu
tdjqsvka.icu
tdzfuasz.icu
tegdlmq.icu
tengxxi.com
tfaeucm.icu
tfhkfhaw.eu.cc
tgvkjgwu.icu
thlrbmap.icu
thqggea.icu
thrwahak.icu
tiohpuw.icu
tjavpyz.icu
tjtpeyee.icu
tkdjrsee.icu
tkyxyar.icu
tmodkqj.icu
tnbvmkmo.icu
tniftqc.icu
toaadwh.icu
tpjdweaz.icu
tqtxjyiz.icu
trnhtbue.icu
trvsdlckg.icu
ttk.bstixopdn.icu
ttk.fqbwptjpu.icu
ttk.hpdlnghio.icu
ttk.pojaplmvl.icu
ttk.trvsdlckg.icu
ttk.ttnjhlhys.icu
ttnjhlhys.icu
ttrceqqj.icu
twibckx.icu
twjspdxew.icu
twjuuwcf.icu
txdlbuok.icu
txjbmcya.icu
tzrzmokp.icu
tzwexch.icu
uawyrqa.icu
ugatoqf.icu
uiqzagw.icu
ujobjgp.icu
unosecc.icu
uogsoih.icu
urqvjar.icu
us2-webex.com
usghask.eu.cc
usoxsak.icu
uwotnwx.icu
uxiqwyp.icu
uygwfom.icu
uzywioh.icu
vayqcca.icu
vbjfwtef.icu
vbwrlsw.icu
vcjzjnef.icu
vfbwcfej.icu
vfreefmp.icu
vglqpzmj.icu
vidjtlqk.icu
vijgbyia.icu
vinhetadj.com.br
vip.rajshreewin.com
vjdxlwuf.icu
vjjvkrua.icu
vjqtrsp.icu
vlnqvlqf.icu
vmbnasgp.icu
vozkmruz.icu
vpghiwa.icu
vptuwpge.icu
vpzzskoz.icu
vqbmxyzda.icu
vrypqgf.icu
vsdnk.top
vslwticp.icu
vsqpdmk.icu
vsrbsdck.icu
vtormod.icu
vttqfvpae.icu
vvasveu.icu
vvjboakz.icu
vvlhjqvxq.icu
vvzgkvku.icu
vwyuegn.icu
vybtbbwo.icu
vyijqam.icu
vzglzce.icu
vzhfshae.icu
vzrhwmsj.icu
wcwgcep.icu
wdogpku.icu
webdisk.vinhetadj.com.br
webmail.vinhetadj.com.br
webnestic.cfd
wgooglegoogle.com
wgyjhce.icu
whm.vinhetadj.com.br
wiiztiz.icu
wliiymn.icu
wlwhoyk.icu
wogkgqu.icu
wtqexac.icu
wuokdqz.icu
wvihmss.icu
ww7.rajshreewin.com
wwampsn.icu
wwsxcpl.shop
wwwqqo.icu
wwwtax.icu
wxynyij.icu
wzidkoe.icu
xaisbax.icu
xatzlgqe.icu
xazxkbqz.icu
xbzlcmmu.icu
xdwawsh.icu
xehdsnyj.icu
xeovgyn.icu
xggdrks.icu
xhjdokgf.icu
xhpinfga.icu
xhtvmkyz.icu
xhydbqx.icu
xitpzegz.icu
xkgutko.icu
xkhkkyce.icu
xkigwgh.icu
xlbuuwoj.icu
xmwwfmc.icu
xnfpfqko.icu
xnjsudsf.icu
xnqxocz.icu
xotthxaf.icu
xpdgvlxwn.icu
xpgeaen.icu
xqrjwwop.icu
xrrycpip.icu
xsbspjip.icu
xsvkdintr.icu
xujaciwa.icu
xunbhdsqk.top
xvozxer.icu
xxhfuaek.icu
xyrzhumk.icu
xyyhsuc.icu
ygiqjac.icu
yhavmax.icu
yiysvcp.icu
yjwyesm.icu
yliaqua.icu
ymgbwkw.icu
yoihksk.icu
yoqriqr.icu
ypirlqn.icu
yraudgc.icu
yryrshgj.shop
yswunmh.icu
ywdtwss.icu
yxqnrkm.icu
zagixmx.icu
zcrdulkp.icu
zddsnuxow.icu
zdhkmrgk.icu
zfzipdsz.icu
zgzccssz.icu
zhantugaokao.com
zhuhong.vip
ziakgop.icu
zibenbang.vip
zilbfurak.icu
zjhhxkaj.icu
zjhxfj.com
zjlutpsp.icu
zkhbkeij.icu
zkwnyge.icu
zlosbga.icu
zlpphjou.icu
zmzjudwu.icu
zngvqwp.icu
zntabbiz.icu
zpbyenmo.icu
zpqgcck.icu
zpxvpvee.icu
zqhpcpee.icu
zqrfwtqj.icu
zrbexvkml.icu
zrgmosc.icu
zsaouuu.icu
zsjiggif.icu
zspncwqa.icu
ztfuxhmo.icu
ztjxmzcf.icu
ztwjhaa.icu
zutrztcf.icu
zwbzjnqj.icu
zwgrcsk.icu
zwjntvfyz.icu
zwxmkiyk.icu
zxvmnr.it.com
zxwfcwm.icu
zyisykm.shop
zzvrfagu.icu
zzzeefya.icu

# Reference: https://x.com/suyog41/status/2065407928249495664
# Reference: https://www.virustotal.com/gui/file/0d9945bd02c1debd7fc36f599b0caf6f599d9256846c87d657c8244238b3bfd4/detection

103.231.12.27:4444
2d.yunczfkm.cyou
asfxbtuym.shop
fgmvaeavqnvt.top
harivo.vip
kgxhrtuk.xyz
mketdsd.com
postoen.vip
sm.harivo.vip
taxassessment.cyou
whmfsj.com
yunczfkm.cyou

# Reference: https://x.com/naumovax/status/2070512434352112038
# Reference: https://www.securonix.com/blog/taxtrident-indian-fax-lures/
# Reference: https://tria.ge/260406-pekzxafx8p/behavioral1

202.61.160.201:8383

# Reference: https://x.com/Dixit_404/status/2072207264157765932
# Reference: https://www.virustotal.com/gui/file/6b05b09d13cbb81ab4246b98f35b49f6915d31f140acacf6d42e260066fed543/detection

154.23.184.251:3389
154.23.184.251:53
qishuiwg.com

# Reference: https://x.com/GenThreatLabs/status/2072335910042050819
# Reference: https://www.virustotal.com/gui/file/520304a1cabdd9aa05c0a769c3874bc3cc2608d8e71ae607ca2bdf96b298b5de/detection

jxuw3.com
sjickdeh.org
3w.jxuw3.com
df.sjickdeh.org

# Reference: https://x.com/bsforvt727/status/2073674947747323997

mq12ote0.com

# Reference: https://www.virustotal.com/gui/file/31a303a06e7ceda98f9561ea2df564ffb5b0704e2df267fbdc38ce94dc5d448b/detection

babyyyi.com

# Reference: https://x.com/smica83/status/2064974323132121555
# Reference: https://www.virustotal.com/gui/file/446aad1d86aaf82a32f7e63bd0dd34cb2ac85ca2a412b9bea2122fb5506ddac1/detection

8.218.196.168:22
jiugui22.com

# Reference: https://x.com/smica83/status/2069727987876896894
# Reference: https://www.virustotal.com/gui/file/a54318d38eb5b85ffa139155072f9581b55eab73b03aed1cfba6431dda1fc7c6/detection

154.23.182.117:22
facaai3.com
faccai22.com

# Reference: https://x.com/smica83/status/2075555001854755172
# Reference: https://tria.ge/260710-phhc7abv4l/behavioral1
# Reference: https://www.virustotal.com/gui/file/ad6b7658635192bbbb428c0b8b78db842c7d4f3501a4998cd69def8a1fa84b20/detection

137.220.153.172:22
baiweii22.com
xieerbi2.com

# Reference: https://x.com/smica83/status/2077489662554238995
# Reference: https://www.virustotal.com/gui/file/1e7a7cf87fad4c2fd29547514d3065311246037efbbb734bbef0e0f2fd85a73f/detection

137.220.156.123:53
babyy5.com

# Reference: https://x.com/smica83/status/2077757678961545508
# Reference: https://www.virustotal.com/gui/file/0e8553970999b60c3a0a2637e0c282ca52b33d3e3ae88c99b6fa426bddc0075d/detection

38.181.22.171:22
shunliuu168.com

# Reference: https://x.com/smica83/status/2078054634342519271
# Reference: https://www.virustotal.com/gui/file/8a72afcb3bdd892ae106b2e6c7bd3df4e4be98f151342509603e31d7efd555f3/detection

206.119.81.53:22
zhugel5.com

# Reference: https://x.com/smica83/status/2078053124187582618
# Reference: https://www.virustotal.com/gui/file/e4283d10ea2d8bfe524e2da68870d67653ce895ff4fcafdef68edc47576a5e3c/detection

47.243.59.62:45
sa3wd.com
