# Copyright (c) 2014-2026 Maltrail developers (https://github.com/stamparm/maltrail/)
# See the file 'LICENSE' for copying permission

# Aliases: apt10, stone panda, gallium, earth kasha, noopldr

# Reference: http://researchcenter.paloaltonetworks.com/2017/02/unit42-menupass-returns-new-malware-new-attacks-japanese-academics-organizations/

dick.ccfchrist.com
trout.belowto.com
sakai.unhamj.com
zebra.wthelpdesk.com
area.wthelpdesk.com
kawasaki.cloud-maste.com
kawasaki.unhamj.com
fukuoka.cloud-maste.com
scorpion.poulsenv.com
lion.wchildress.com
fbi.sexxxy.biz
cia.toh.info
2014.zzux.com
nttdata.otzo.com
iphone.vizvaz.com
app.lehigtapp.com
jimin.jimindaddy.com
Jepsen.r3u8.com
inspgon.re26.com
nunluck.re26.com
yahoo.incloud-go.com
msn.incloud-go.com
www.mseupdate.ourhobby.com
contractus.qpoe.com
apple.cmdnetview.com
cvnx.zyns.com

# Reference: http://blog.jpcert.or.jp/2017/02/chches-malware--93d6.html
# Reference: https://app.any.run/tasks/b5634afb-0d3a-4d0b-97c8-fbbd25b9aa97/

area.wthelpdesk.com
dick.ccfchrist.com
kawasaki.cloud-maste.com
kawasaki.unhamj.com
sakai.unhamj.com
scorpion.poulsenv.com
trout.belowto.com
zebra.wthelpdesk.com
hamiltion.catholicmmb.com
gavin.ccfchrist.com

# Reference: https://www.fireeye.com/blog/threat-research/2018/09/apt10-targeting-japanese-corporations-using-updated-ttps.html

eservake.jetos.com

# Reference: https://github.com/janhenrikdotcom/iocs/blob/master/APT10/cloud-hopper-indicators-of-compromise-v3.pdf
# Reference: https://raw.githubusercontent.com/jonaslejon/apt10/master/apt_apt10.yar

002562066559681.r3u8.com
031168053846049.r3u8.com
0625.have8000.com
1.gadskysun.com
100fanwen.com
11.usyahooapis.com
19518473326.r3u8.com
1960445709311199.r3u8.com
1j.www1.biz
1z.itsaol.com
2012yearleft.com
2014.zzux.com
202017845.r3u8.com
2139465544784.r3u8.com
2789203959848958.r3u8.com
5590428449750026.r3u8.com
5q.niushenghuo.info
6r.suibian2010.info
9gowg.tech
hamiltion.catholicmmb.com
a.wubangtu.info
a1.suibian2010.info
ab.4pu.com
abc.wikaba.com
abcd120719.6600.org
abcd120807.3322.org
acc.emailfound.info
acc.lehigtapp.com
acsocietyy.com
ad.getfond.info
ad.webbooting.com
additional.sexidude.com
af.zyns.com
afc.https443.org
ako.ddns.us
androidmusicapp.onmypc.us
announcements.toythieves.com
anvprn.com
aotuo.9966.org
apec.qtsofta.com
app.lehigtapp.com
apple.cmdnetview.com
apple.defensewar.org
apple.ikwb.com
appledownload.ourhobby.com
appleimages.itemdb.com
appleimages.longmusic.com
applelib120102.9966.org
applemirror.organiccrap.com
applemirror.squirly.info
applemusic.isasecret.com
applemusic.itemdb.com
applemusic.wikaba.com
applemusic.xxuz.com
applemusic.zzux.com
apples.sytes.net
appleupdate.itemdb.com
architectisusa.com
area.wthelpdesk.com
army.xxuz.com
art.p6p6.net
asfzx.x24hr.com
av.ddns.us
availab.wikaba.com
availability.justdied.com
ba.my03.com
baby.macforlinux.net
baby.myie12.com
baby.usmirocomney.net
back.jungleheart.com
back.mofa.dynamic-dns.net
bak.have8000.com
bak.ignorelist.com
bak.un.dnsrd.com
balance1.wikaba.com
balk.n7go.com
banana.cmdnetview.com
barrybaker.6600.org
bbs.jungleheart.com
bdoncloud.com
be.mrslove.com
be.yourtrap.com
belowto.com
bethel.webhop.net
bexm.cleansite.biz
bezu.itemdb.com
bk56.twilightparadox.com
blaaaaaaaaaaaa.windowsupdate.3-a.net
blog.defensewar.org
brand.fartit.com
bridgeluxlightmadness.com
bulletproof.squirly.info
cao.p6p6.net
cata.qtsofta.com
catholicmmb.com
cc.dynamicdns.co.uk
ccfchrist.com
ccupdatedata.authorizeddns.net
cd.usyahooapis.com
cdn.incloud-go.com
center.shenajou.com
cgei493860.r3u8.com
chaindungeons.com
chibashiri.com
childrenstow.com
cia.ezua.com
cia.toh.info
ciaoci.chickenkiller.com
civilwar123.authorizeddns.org
civilwar520.onmypc.org
ckusshani.com
cloud-kingl.com
cloud-maste.com
cloudns.8800.org
cmdnetview.com
cms.sindeali.com
cnnews.mylftv.com
commissioner.shenajou.com
commons.onedumb.com
contactus.myddns.com
contactus.onmypc.us
contract.4mydomain.com
contractus.qpoe.com
contractus.zzux.com
coreck.suayay.com
cpu.4pu.com
cs.lflink.com
ctdl.windowsupdate.itsaol.com
ctdl.windowsupdate.nsatcdns.com
ctldl.appledownload.ourhobby.com
ctldl.applemusic.itemdb.com
ctldl.itunesmusic.jkub.com
ctldl.microsoftmusic.onedumb.com
ctldl.microsoftupdate.qhigh.com
ctldl.windowsupdate.authorizeddns.org
ctldl.windowsupdate.authorizeddns.us
ctldl.windowsupdate.dnset.com
ctldl.windowsupdate.esmtp.biz
ctldl.windowsupdate.ezua.com
ctldl.windowsupdate.gettrials.com
ctldl.windowsupdate.itsaol.com
ctldl.windowsupdate.lflinkup.com
ctldl.windowsupdate.mrface.com
ctldl.windowsupdate.nsatcdns.com
ctldl.windowsupdate.organiccrap.com
ctldl.windowsupdate.x24hr.com
cvnx.zyns.com
cwiinatonal.com
daddy.gostudyantivirus.com
dcc.jimingroup.com
dd.ddns.us
de.onmypc.info
dear.loveddos.com
dec.seyesb.acmetoy.com
dedgesuite.net
dedydns.ns01.us
defensewar.org
demoones.com
department.shenajou.com
details.squirly.info
development.shenajou.com
devilcase.acmetoy.com
dfgwerzc.3322.org
dick.ccfchrist.com
digsby.ourhobby.com
disruptive.https443.net
dlmix.ourdvs.com
dnspoddwg.authorizeddns.org
do.ddns.ms
document.methoder.com
document.shenajou.com
domainnow.yourtrap.com
download.applemusic.itemdb.com
download.microsoftmusic.onedumb.com
download.windowsupdate.authorizeddns.org
download.windowsupdate.dedgesuite.net
download.windowsupdate.dnset.com
download.windowsupdate.itsaol.com
download.windowsupdate.lflinkup.com
download.windowsupdate.nsatcdns.com
download.windowsupdate.x24hr.com
downloadlink.mypicture.info
drives.methoder.com
dst.1dumb.com
duosay.com
dyncojinf.6600.org
dynsbluecheck.7766.org
ea.onmypc.info
ea.rebatesrule.net
edgar.ccfchrist.com
ehshiroshima.mylftv.com
emailfound.info
eric-averyanov.wha.la
essashi.com
eu.acmetoy.com
eu.wha.la
eu.zzux.com
everydayfilmlink.com
ewe.toshste.com
eweek.2waky.com
exprenum.com
express.lflinkup.com
extraordinary.dynamic-dns.net
f068v.site
fabian.ccfchrist.com
fastemail.dnsrd.com
fastmail2.com
fbi.sexxxy.biz
fbi.zyns.com
fcztqbg.zj.r3u8.com
feed.jungleheart.com
fftpoor.com
fg.v4.download.windowsupdates.dnsrd.com
fgipv6.download.windowsupdate.com.mwcname.com
file.zzux.com
files.architectisusa.com
film.everydayfilmlink.com
filmlist.everydayfilmlink.com
findme.epac.to
fire.mrface.com
fish.toh.info
fiveavmersi.websegoo.net
fjs.wikaba.com
flea.poulsenv.com
flynews.edns.biz
fo.mysecondarydns.com
foal.wchildress.com
follow.wha.la
foo.shenajou.com
for.ddns.mobi
fr.wikaba.com
franck.demoones.com
ftp.2014.zzux.com
ftp.additional.sexidude.com
ftp.afc.https443.org
ftp.announcements.toythieves.com
ftp.apple.ikwb.com
ftp.appledownload.ourhobby.com
ftp.appleimages.itemdb.com
ftp.appleimages.longmusic.com
ftp.appleimages.organiccrap.com
ftp.applemirror.organiccrap.com
ftp.applemirror.squirly.info
ftp.applemusic.isasecret.com
ftp.applemusic.itemdb.com
ftp.applemusic.wikaba.com
ftp.applemusic.xxuz.com
ftp.applemusic.zzux.com
ftp.appleupdate.itemdb.com
ftp.architectisusa.com
ftp.asfzx.x24hr.com
ftp.availab.wikaba.com
ftp.availability.justdied.com
ftp.back.jungleheart.com
ftp.balance1.wikaba.com
ftp.be.mrslove.com
ftp.brand.fartit.com
ftp.bulletproof.squirly.info
ftp.cia.ezua.com
ftp.cia.toh.info
ftp.civilwar123.authorizeddns.org
ftp.civilwar520.onmypc.org
ftp.cloudfileserverbs.dynamicdns.co.uk
ftp.cnnews.mylftv.com
ftp.commons.onedumb.com
ftp.contractus.qpoe.com
ftp.cvnx.zyns.com
ftp.de.onmypc.info
ftp.details.squirly.info
ftp.devilcase.acmetoy.com
ftp.disruptive.https443.net
ftp.domainnow.yourtrap.com
ftp.ea.onmypc.info
ftp.ehshiroshima.mylftv.com
ftp.eric-averyanov.wha.la
ftp.eu.acmetoy.com
ftp.eu.wha.la
ftp.eu.zzux.com
ftp.fbi.sexxxy.biz
ftp.file.zzux.com
ftp.findme.epac.to
ftp.fire.mrface.com
ftp.fjs.wikaba.com
ftp.fr.wikaba.com
ftp.fuck.ikwb.com
ftp.fuckmm.dns-dns.com
ftp.generat.almostmy.com
ftp.goldtoyota.com
ftp.goodmusic.justdied.com
ftp.helpus.ddns.info
ftp.hii.qhigh.com
ftp.innocent-isayev.sexidude.com
ftp.invoices.sexxxy.biz
ftp.iphone.vizvaz.com
ftp.itlans.isasecret.com
ftp.itunesdownload.jkub.com
ftp.itunesdownload.wikaba.com
ftp.itunesimages.itemdb.com
ftp.itunesimages.itsaol.com
ftp.itunesimages.qpoe.com
ftp.itunesmirror.fartit.com
ftp.itunesmirror.itsaol.com
ftp.itunesmusic.ikwb.com
ftp.itunesmusic.jetos.com
ftp.itunesmusic.jkub.com
ftp.itunesmusic.zzux.com
ftp.itunesupdate.itsaol.com
ftp.itunesupdates.organiccrap.com
ftp.japanfilmsite.ikwb.com
ftp.jimin.mymom.info
ftp.jp.serveuser.com
ftp.key.zzux.com
ftp.knowledge.sellclassics.com
ftp.lan.dynssl.com
ftp.latestnews.epac.to
ftp.latestnews.organiccrap.com
ftp.leedong.longmusic.com
ftp.macfee.mrface.com
ftp.maffc.mrface.com
ftp.malware.dsmtp.com
ftp.manager.jetos.com
ftp.martin.sellclassics.com
ftp.mason.vizvaz.com
ftp.mediapath.organiccrap.com
ftp.microsoft.got-game.org
ftp.microsoft.mrface.com
ftp.microsoftimages.organiccrap.com
ftp.microsoftmusic.mrbasic.com
ftp.microsoftqckmanager.pcanywhere.net
ftp.microsoftupdate.mrbasic.com
ftp.microsoftupdate.qhigh.com
ftp.micrsoftware.dsmtp.com
ftp.mircsoft.compress.to
ftp.mmy.ddns.us
ftp.mod.jetos.com
ftp.mofa.dynamic-dns.net
ftp.mofa.ns01.info
ftp.moscowdic.trickip.org
ftp.msg.ezua.com
ftp.musicfile.ikwb.com
ftp.musicjj.zzux.com
ftp.mymusicbox.vizvaz.com
ftp.myphpwebsite.itsaol.com
ftp.myrestroomimage.isasecret.com
ftp.na.americanunfinished.com
ftp.na.onmypc.org
ftp.newsdata.jkub.com
ftp.newsroom.cleansite.info
ftp.no.authorizeddns.org
ftp.nsa.mefound.com
ftp.nt.mynumber.org
ftp.nttdata.otzo.com
ftp.nz.compress.to
ftp.ol.almostmy.com
ftp.oracleupdate.dns04.com
ftp.portal.mrface.com
ftp.portal.sendsmtp.com
ftp.portalser.dynamic-dns.net
ftp.praskovya-matveyeva.mefound.com
ftp.praskovya-ulyanova.dumb1.com
ftp.products.almostmy.com
ftp.products.cleansite.us
ftp.products.serveuser.com
ftp.purchase.lflinkup.org
ftp.recent.dns-stuff.com
ftp.recent.fartit.com
ftp.referred.gr8domain.biz
ftp.referred.yourtrap.com
ftp.register.ourhobby.com
ftp.registration2.instanthq.com
ftp.registrations.4pu.com
ftp.registrations.organiccrap.com
ftp.remeberdata.iownyour.org
ftp.reserveds.onedumb.com
ftp.rethem.almostmy.com
ftp.sdmsg.onmypc.org
ftp.se.toythieves.com
ftp.secertnews.mrbasic.com
ftp.senseye.ikwb.com
ftp.senseye.mrbonus.com
ftp.septdlluckysystem.jungleheart.com
ftp.seraphim-yurieva.justdied.com
ftp.serv.justdied.com
ftp.server1.proxydns.com
ftp.seyesb.acmetoy.com
ftp.shugiin.jkub.com
ftp.singed.otzo.com
ftp.sstday.jkub.com
ftp.support1.mrface.com
ftp.supportus.mefound.com
ftp.svc.dynssl.com
ftp.synssl.dnset.com
ftp.tamraj.fartit.com
ftp.tfa.longmusic.com
ftp.thunder.wikaba.com
ftp.ticket.instanthq.com
ftp.ticket.serveuser.com
ftp.tokyofile.2waky.com
ftp.tophost.dynamicdns.co.uk
ftp.transfer.lflinkup.org
ftp.transfer.mrbasic.com
ftp.transfer.vizvaz.com
ftp.ugreen.itemdb.com
ftp.uk.dynamicdns.org.uk
ftp.un.ddns.info
ftp.un.dnsrd.com
ftp.usa.itsaol.com
ftp.well.itsaol.com
ftp.well.mrbasic.com
ftp.wike.wikaba.com
ftp.windowfile.itemdb.com
ftp.windowsimages.itemdb.com
ftp.windowsimages.qhigh.com
ftp.windowsmirrors.vizvaz.com
ftp.windowsupdate.2waky.com
ftp.windowsupdate.3-a.net
ftp.windowsupdate.authorizeddns.us
ftp.windowsupdate.dns05.com
ftp.windowsupdate.esmtp.biz
ftp.windowsupdate.ezua.com
ftp.windowsupdate.fartit.com
ftp.windowsupdate.gettrials.com
ftp.windowsupdate.instanthq.com
ftp.windowsupdate.jungleheart.com
ftp.windowsupdate.lflink.com
ftp.windowsupdate.mrface.com
ftp.windowsupdate.mylftv.com
ftp.windowsupdate.rebatesrule.net
ftp.windowsupdate.sellclassics.com
ftp.windowsupdate.serveusers.com
ftp.yandexr.sellclassics.com
fu.epac.to
fuck.ikwb.com
fuck.wikaba.com
fuckanti.com
fuckdd.8800.org
fuckmm.8800.org
fuckmm.dns-dns.com
fukuoka.cloud-maste.com
g3ypf.online
gadskysun.com
gavin.ccfchrist.com
generat.almostmy.com
generousd.hopto.org
gensuzuki.6600.org
getfond.info
gh.mysecondarydns.com
gifuonlineshopping.mynumber.org
glicense.shenajou.com
globalnews.wikaba.com
gmail.com.mailsserver.com
gmpcw.com
gold.polopurple.com
goldtoyota.com
goodmusic.justdied.com
goodsampjp.com
gooesdataios.instanthq.com
google.macforlinux.net
google.usrobothome.com
googlemeail.com
gostudyantivirus.com
gostudymbaa.com
gotourisma.com
gt4study.com
gtsofta.com
haoyujd.info
happy.workerisgood.com
have8000.com
helpus.ddns.info
helshellfucde.8866.org
hg8fmv.racing
hii.qhigh.com
hk.2012yearleft.com
hk.cmdnetview.com
hk.have8000.com
hk.loveddos.com
home.trickip.org
hostport9.net
hotmai.info
hotmail.com.mailsserver.com
hukuoka.cloud-maste.com
iamges.itunesmusic.jkub.com
ibmmsg.strangled.net
icfeds.cf
idpmus.hostport9.net
ijica.in
im.suibian2010.info
image.websago.info
images.itunesmusic.jkub.com
images.thedomais.info
images.tyoto-go-jp.com
images.windowsupdate.organiccrap.com
imap.architectisusa.com
imap.dnset.com
imap.lflink.com
imap.onmypc.net
imap.ygto.com
img.station155.com
improvejpese.com
incloud-go.com
incloud-obert.com
ingemar.catholicmmb.com
innocent-isayev.sexidude.com
innov-tec.com.ua
inspgon.re26.com
interpreter.shenajou.com
invoices.sexxxy.biz
io.jkub.com
iphone.vizvaz.com
ipv4.applemusic.itemdb.com
ipv4.itunesmusic.jkub.com
ipv4.japanenvnews.qpoe.com
ipv4.microsoftmusic.onedumb.com
ipv4.microsoftupdate.mrbasic.com
ipv4.microsoftupdate.qhigh.com
ipv4.windowsupdate.3-a.net
ipv4.windowsupdate.authorizeddns.org
ipv4.windowsupdate.authorizeddns.us
ipv4.windowsupdate.dnset.com
ipv4.windowsupdate.esmtp.biz
ipv4.windowsupdate.ezua.com
ipv4.windowsupdate.fartit.com
ipv4.windowsupdate.gettrials.com
ipv4.windowsupdate.itsaol.com
ipv4.windowsupdate.lflink.com
ipv4.windowsupdate.lflinkup.com
ipv4.windowsupdate.mrface.com
ipv4.windowsupdate.mylftv.com
ipv4.windowsupdate.nsatcdns.com
ipv4.windowsupdate.x24hr.com
ipv6microsoft.dlmix.ourdvs.com
itlans.isasecret.com
itunesdownload.jkub.com
itunesdownload.vizvaz.com
itunesdownload.wikaba.com
itunesimages.itemdb.com
itunesimages.itsaol.com
itunesimages.qpoe.com
itunesmirror.fartit.com
itunesmirror.itsaol.com
itunesmusic.ikwb.com
itunesmusic.jetos.com
itunesmusic.jkub.com
itunesmusic.zzux.com
itunesupdate.itsaol.com
itunesupdates.organiccrap.com
iw.mrslove.com
ixrayeye.com
james.tffghelth.com
janpan.bigmoney.biz
janpun.americanunfinished.com
jap.japanmusicinfo.com
japan.fuckanti.com
japan.linuxforover.com
japan.loveddos.com
japanenvnews.qpoe.com
japanfilmsite.ikwb.com
japanfst.japanteam.org
japanmusicinfo.com
japanteam.org
jcie.mofa.ns01.info
jepsen.r3u8.com
jica-go-jp.bike
jica-go-jp.biz
jimin-jp.biz
jimin.jimindaddy.com
jimin.mymom.info
jimindaddy.com
jimingroup.com
jimintokoy.com
jj.mysecondarydns.com
jmuroran.com
jp.rakutenmusic.com
jp.serveuser.com
jpcert.org
jpn.longmusic.com
jpnxzshopdata.authorizeddns.org
jpstarmarket.serveusers.com
kaka.lehigtapp.com
kawasaki.cloud-maste.com
kawasaki.unhamj.com
kennedy.tffghelth.com
key.zzux.com
kikimusic.sellclassics.com
kmd.crabdance.com
knowledge.sellclassics.com
ktgmktanxgvn.r3u8.com
kxsbwappupdate.dhcp.biz
kztmusiclnk.dnsrd.com
lan.dynssl.com
last.p6p6.net
latestnews.epac.to
latestnews.organiccrap.com
leedong.longmusic.com
lehigtapp.com
lennon.fftpoor.com
license.shenajou.com
lie.jetos.com
linuxforover.com
linuxsofta.com
lion.wchildress.com
lizard.poulsenv.com
logon-live.com
lottedfstravel.webbooting.com
loveddos.com
lzf550.r3u8.com
ma.vizvaz.com
mac.goldtoyota.com
mac.methoder.com
macfee.mrface.com
macforlinux.net
maffc.mrface.com
mail.architectisusa.com
mail.macforlinux.net
mailcarriage.co.uk
mailj.hostport9.net
mailserever.com
mailsserver.com
mailvserver.com
malcolm.fftpoor.com
malware.dsmtp.com
manager.architectisusa.com
manager.jetos.com
markabcinfo.dynamicdns.me.uk
martin.sellclassics.com
mason.vizvaz.com
mbaby.macforlinux.net
medexplor.thedomais.info
mediapath.organiccrap.com
meiji-ac-jp.com
mesjm.emailfound.info
message.emailfound.info
message.p6p6.net
messagea.emailfound.info
methoder.com
mf.ddns.info
microcnmlgb.3322.org
microdef.2288.org
microhome.wikaba.com
microsoft.got-game.org
microsoft.mrface.com
microsoftdownload.zzux.com
microsoftempowering.sendsmtp.com
microsoften.com
microsoftgame.mrface.com
microsoftgetstarted.sexidude.com
microsoftimages.organiccrap.com
microsoftmirror.mrbasic.com
microsoftmusic.itemdb.com
microsoftmusic.mrbasic.com
microsoftmusic.onedumb.com
microsoftqckmanager.pcanywhere.net
microsoftstore.jetos.com
microsoftstores.itemdb.com
microsoftupdate.mrbasic.com
microsoftupdate.qhigh.com
microsoftupdates.vizvaz.com
micrsoftware.dsmtp.com
mircsoft.compress.to
mivsee.website0012.net
mmofoojap.2288.org
mmy.ddns.us
mobile.2waky.com
mocha.100fanwen.com
mod.jetos.com
mofa-go-jp.com
mofa.dynamic-dns.net
mofa.ns01.info
mofa.strangled.net
mofaess.com
mongoles.3322.org
monkey.2012yearleft.com
moscowstdsupdate.toythieves.com
mrsloveaqx.mrslove.com
ms.ecc.u-tokyo-ac-jp.com
mseupdate.ourhobby.com
msg.ezua.com
msn.incloud-go.com
muller.exprenum.com
music.applemusic.itemdb.com
music.cleansite.us
music.websegoo.net
musicfile.ikwb.com
musicinfo.everydayfilmlink.com
musiclinker.jkub.com
musicsecph.squirly.info
mx.yetrula.eu
myie12.com
mymusicbox.lflinkup.org
mymusicbox.vizvaz.com
myphpwebsite.itsaol.com
myrestroomimage.isasecret.com
mytwhomeinst.sendsmtp.com
myurinikoreaaps.ninth.biz
na.americanunfinished.com
na.onmypc.org
nasa.xxuz.com
nec.website0012.net
news.100fanwen.com
newsdata.jkub.com
newsfile.toythieves.com
newsreport.justdied.com
newsroom.cleansite.info
nezwq.ezua.com
ngcc.8800.org
niushenghuo.info
nk10.belowto.com
nk20.belowto.com
nlddnsinfo.https443.org
nmrx.mrbonus.com
nn.dynssl.com
no.authorizeddns.org
node.mofaess.com
nodns2.qipian.org
nposnewsinfo.qhigh.com
ns1.belowto.com
ns1.tlchs2.ml
ns2.belowto.com
ns21.belowto.com
ns22.belowto.com
ns4.belowto.com
ns5.belowto.com
nsa.mefound.com
nsatcdns.com
nt.mynumber.org
nttdata.otzo.com
nunluck.re26.com
nz.compress.to
oipbl.com
ol.almostmy.com
oldbmwy.com
oms.sindeali.com
openmofa.8866.org
oracleupdate.dns04.com
osaka-jpgo.com
outlook.otzo.com
owlmedia.mefound.com
p6p6.net
peopleinfodata.3-a.net
phptecinfohelp.itemdb.com
pictures.everydayfilmlink.com
pj.qpoe.com
points.mofaess.com
polopurple.com
pop.architectisusa.com
pop.loveddos.com
portal.mrface.com
portal.sendsmtp.com
portalser.dynamic-dns.net
poulsenv.com
praskovya-matveyeva.mefound.com
praskovya-ulyanova.dumb1.com
premium.redforlinux.com
products.almostmy.com
products.cleansite.us
products.serveuser.com
program.acmetoy.com
prrmes4019.r3u8.com
purchase.lflinkup.org
q6.niushenghuo.info
qtsofta.com
quick.oldbmwy.com
r3u8.com
radiorig.com
rain.orctldl.windowsupdate.authorizeddns.us
rakutenmusic.com
rdns-4.infoproduto1.tk
re26.com
read.xxuz.com
recent.dns-stuff.com
recent.fartit.com
record.hostport9.net
record.webssl9.info
record.wschandler.com
redforlinux.com
referred.gr8domain.biz
referred.yourtrap.com
register.ourhobby.com
registration2.instanthq.com
registrations.4pu.com
registrations.organiccrap.com
reports.tomorrowforgood.com
reserveds.onedumb.com
resources.applemusic.itemdb.com
rethem.almostmy.com
rg197.win
rlbeiydn.hi.r3u8.com
saiyo.exprenum.com
sakai.unhamj.com
salvaiona.com
sappore.cloud-maste.com
sapporo.cloud-maste.com
sapporot.com
sat.suayay.com
saverd.re26.com
sbuudd.webssl9.info
sc.weboot.info
scholz-versand.com
scorpion.poulsenv.com
scrlk.exprenum.com
sdmsg.onmypc.org
se.toythieves.com
sea.websegoo.net
secertnews.mrbasic.com
secmicrosooo.6600.org
secnetshit.com
secserverupdate.toh.info
sell.mofaess.com
sema.linuxsofta.com
send.have8000.com
send.mofa.ns01.info
sendmsg.jumpingcrab.com
senseye.ikwb.com
senseye.mrbonus.com
septdlluckysystem.jungleheart.com
seraphim-yurieva.justdied.com
serv.justdied.com
server1.proxydns.com
seyesb.acmetoy.com
sha.25u.com
sha.ikwb.com
shenajou.com
shoppingcentre.station155.com
shrimp.usffunicef.com
shrimp.bdoncloud.com
shugiin.jkub.com
sindeali.com
singed.otzo.com
siteinit.info
sky.oldbmwy.com
sma.jimindaddy.com
smo.gadskysun.com
smtp.architectisusa.com
smtp.macforlinux.net
smtp230.toldweb.com
somthing.re26.com
sstday.jkub.com
start.usrobothome.com
station155.com
stevenlf.com
stone.jumpingcrab.com
style.u-tokyo-ac-jp.com
suayay.com
suibian2010.info
support1.mrface.com
supportus.mefound.com
suzukigooogle.8866.org
svc.dynssl.com
synssl.dnset.com
sz.thedomais.info
taipei.yourtrap.com
taipeifoodsite.ocry.com
tamraj.fartit.com
telegraph.mefound.com
test.usyahooapis.com
tfa.longmusic.com
tffghelth.com
thedomais.info
ticket.instanthq.com
ticket.jetos.com
ticket.serveuser.com
tidatacenter.shenajou.com
tisdatacenter.shenajou.com
tisupdateinfo.faqserv.com
tokyo-gojp.com
tokyofile.2waky.com
tomorrowforgood.com
tophost.dynamicdns.co.uk
toshste.com
toya.7766.org
transfer.lflinkup.org
transfer.mrbasic.com
transfer.vizvaz.com
trasul.mypicture.info
travelyokogawafz.fartit.com
trendmicroupdate.shenajou.com
trendsecurity.shenajou.com
trout.belowto.com
tv.goldtoyota.com
tw.2012yearleft.com
twmusic.proxydns.com
twpeoplemusicsite.my03.com
twtravelinfomation.toythieves.com
twx.mynumber.org
tyoto-go-jp.com
u-tokyo-ac-jp.com
u1.fartit.com
u1.haoyujd.info
ubuntusofta.com
ugreen.itemdb.com
ui.hdcdui.com
uk.dynamicdns.org.uk
ukuoka.cloud-maste.com
ultimedia.vmmini.com
un.ddns.info
un.dnsrd.com
unhamj.com
update.yourtrap.com
updatemirrors.fartit.com
updates.itsaol.com
ups.improvejpese.com
urearapetsu.com
usa.got-game.org
usa.itsaol.com
usa.japanteam.org
usffunicef.com
usmirocomney.net
usrobothome.com
usyahooapis.com
uu.logon-live.com
uu.niushenghuo.info
ux.niushenghuo.info
v4.appledownload.ourhobby.com
v4.itunesmusic.jkub.com
v4.microsoftmusic.onedumb.com
v4.microsoftupdate.mrbasic.com
v4.windowsupdate.dedgesuite.net
v4.windowsupdate.authorizeddns.org
v4.windowsupdate.dnset.com
v4.windowsupdate.itsaol.com
v4.windowsupdate.lflinkup.com
v4.windowsupdate.mrface.com
v4.windowsupdate.nsatcdns.com
v4.windowsupdate.x24hr.com
v4.windowsupdates.dnsrd.com
veryhuai.info
video.vmdnsup.org
vmdnsup.org
vmmini.com
vmyiersend.websago.info
vmyisan.website0012.net
vscue.com
wchildress.com
wcwname.com
wcxh.mynetav.net
wdsupdates.com
webbooting.com
webdirectnews.dynamicdns.biz
webinfoseco.ygto.com
webmailentry.jetos.com
weboot.info
websago.info
websegoo.net
website0012.net
websiteboo.website0012.net
websqlnewsmanager.ninth.biz
webssl9.info
well.itsaol.com
well.mrbasic.com
whale.toshste.com
whellbuy.wschandler.com
whyis.haoyujd.info
wike.wikaba.com
windowfile.itemdb.com
windowsimages.itemdb.com
windowsimages.qhigh.com
windowsmirrors.vizvaz.com
windowsstores.gettrials.com
windowsstores.organiccrap.com
windowsupdate.2waky.com
windowsupdate.3-a.net
windowsupdate.acmetoy.com
windowsupdate.authorizeddns.net
windowsupdate.authorizeddns.org
windowsupdate.authorizeddns.us
windowsupdate.com.mwcname.com
windowsupdate.dedgesuite.net
windowsupdate.dns05.com
windowsupdate.dnset.com
windowsupdate.esmtp.biz
windowsupdate.ezua.com
windowsupdate.fartit.com
windowsupdate.gettrials.com
windowsupdate.instanthq.com
windowsupdate.itsaol.com
windowsupdate.jungleheart.com
windowsupdate.lflink.com
windowsupdate.mrface.com
windowsupdate.mylftv.com
windowsupdate.nsatcdns.com
windowsupdate.organiccrap.com
windowsupdate.rebatesrule.net
windowsupdate.sellclassics.com
windowsupdate.serveusers.com
windowsupdate.vizvaz.com
windowsupdate.wcwname.com
windowsupdate.x24hr.com
windowsupdate.ygto.com
windowsupdates.dnset.com
windowsupdates.ezua.com
windowsupdates.ikwb.com
windowsupdates.itemdb.com
windowsupdates.proxydns.com
workerisgood.com
woyaofanwen.com
wschandler.com
wthelpdesk.com
wubangtu.info
www-meti-go-jp.tyoto-go-jp.com
www.2014.zzux.com
www.97sm.com
www.9gowg.tech
www.abdominal.faqserv.com
www.additional.sexidude.com
www.afc.https443.org
www.androidmusicapp.onmypc.us
www.announcements.toythieves.com
www.anx-own-334.mrbasic.com
www.apple.ikwb.com
www.appledownload.ourhobby.com
www.appleimages.itemdb.com
www.appleimages.longmusic.com
www.appleimages.organiccrap.com
www.applejuice.itemdb.com
www.applemirror.organiccrap.com
www.applemirror.squirly.info
www.applemusic.isasecret.com
www.applemusic.itemdb.com
www.applemusic.wikaba.com
www.applemusic.xxuz.com
www.applemusic.zzux.com
www.appleupdate.itemdb.com
www.appleupdateurl.2waky.com
www.architectisusa.com
www.army.xxuz.com
www.art.p6p6.net
www.asfzx.x24hr.com
www.availab.wikaba.com
www.availability.justdied.com
www.babymusicsitetr.mymom.info
www.back.jungleheart.com
www.balance1.wikaba.com
www.be.mrslove.com
www.belowto.com
www.billing.organiccrap.com
www.blaaaaaaaaaaaa.windowsupdate.3-a.net
www.brand.fartit.com
www.bulletproof.squirly.info
www.cabbage.iownyour.biz
www.ccupdatedata.authorizeddns.net
www.cdn.incloud-go.com
www.center.shenajou.com
www.chaindungeons.com
www.cia.ezua.com
www.cia.toh.info
www.civilwar123.authorizeddns.org
www.civilwar520.onmypc.org
www.cloud-maste.com
www.cnnews.mylftv.com
www.commissioner.shenajou.com
www.commons.onedumb.com
www.contractus.qpoe.com
www.corp-dnsonline.itsaol.com
www.courier.jetos.com
www.cress.mynetav.net
www.ctdl.windowsupdate.nsatcdns.com
www.ctldl.microsoftupdate.qhigh.com
www.ctldl.windowsupdate.authorizeddns.us
www.ctldl.windowsupdate.esmtp.biz
www.ctldl.windowsupdate.mrface.com
www.cwiinatonal.com
www.dasoftactivemodule.toythieves.com
www.dasonews.youdontcare.com
www.daughter.vizvaz.com
www.de.onmypc.info
www.details.squirly.info
www.development.shenajou.com
www.devilcase.acmetoy.com
www.disruptive.https443.net
www.dns-hinettw.25u.com
www.document.shenajou.com
www.domainnow.yourtrap.com
www.download.windowsupdate.nsatcdns.com
www.ea.onmypc.info
www.eddo.qpoe.com
www.ehshiroshima.mylftv.com
www.eric-averyanov.wha.la
www.eu.acmetoy.com
www.eu.wha.la
www.express.lflinkup.com
www.extraordinary.dynamic-dns.net
www.f068v.site
www.facefile.fartit.com
www.fertile.authorizeddns.net
www.file.zzux.com
www.findme.epac.to
www.fire.mrface.com
www.firstnews.jkub.com
www.fjs.wikaba.com
www.foal.wchildress.com
www.fr.wikaba.com
www.freegamecenter.onedumb.com
www.fruit.qhigh.com
www.fuck.ikwb.com
www.fuckmm.dns-dns.com
www.fukuoka.cloud-maste.com
www.g3ypf.online
www.garlic.dyndns.pro
www.generat.almostmy.com
www.glicense.shenajou.com
www.goldtoyota.com
www.goodmusic.justdied.com
www.gooesdataios.instanthq.com
www.grammar.jkub.com
www.helpus.ddns.info
www.hii.qhigh.com
www.hinetonlinedns.dns05.com
www.incloud-go.com
www.innocent-isayev.sexidude.com
www.interpreter.shenajou.com
www.invoices.sexxxy.biz
www.iphone.vizvaz.com
www.ipv4.microsoftupdate.mrbasic.com
www.ipv4.windowsupdate.3-a.net
www.ipv4.windowsupdate.esmtp.biz
www.ipv4.windowsupdate.fartit.com
www.ipv4.windowsupdate.lflink.com
www.ipv4.windowsupdate.mrface.com
www.ipv4.windowsupdate.mylftv.com
www.ipv4.windowsupdate.nsatcdns.com
www.itlans.isasecret.com
www.itunesdownload.jkub.com
www.itunesdownload.vizvaz.com
www.itunesdownload.wikaba.com
www.itunesimages.itemdb.com
www.itunesimages.itsaol.com
www.itunesimages.qpoe.com
www.itunesmirror.fartit.com
www.itunesmirror.itsaol.com
www.itunesmusic.ikwb.com
www.itunesmusic.jetos.com
www.itunesmusic.jkub.com
www.itunesmusic.zzux.com
www.itunesupdate.itsaol.com
www.itunesupdates.organiccrap.com
www.japanenvnews.qpoe.com
www.jd978.com
www.jimin.jimindaddy.com
www.jimin.mymom.info
www.jp.serveuser.com
www.jpnappstore.ourhobby.com
www.jpnewslogs.sendsmtp.com
www.jpnxzshopdata.authorizeddns.org
www.kawasaki.cloud-maste.com
www.kawasaki.unhamj.com
www.key.zzux.com
www.knowledge.sellclassics.com
www.lan.dynssl.com
www.last.p6p6.net
www.latestnews.epac.to
www.latestnews.organiccrap.com
www.leedong.longmusic.com
www.leeks.mrbonus.com
www.liberty.acmetoy.com
www.license.shenajou.com
www.lion.wchildress.com
www.loveddos.com
www.macfee.mrface.com
www.macforlinux.net
www.maffc.mrface.com
www.malware.dsmtp.com
www.manager.jetos.com
www.markabcinfo.dynamicdns.me.uk
www.mason.vizvaz.com
www.mediapath.organiccrap.com
www.meiji-ac-jp.com
www.messagea.emailfound.info
www.microsoft.got-game.org
www.microsoft.mrface.com
www.microsoftempowering.sendsmtp.com
www.microsoftgame.mrface.com
www.microsoftgetstarted.sexidude.com
www.microsoftimages.organiccrap.com
www.microsoftmirror.mrbasic.com
www.microsoftmusic.itemdb.com
www.microsoftmusic.mrbasic.com
www.microsoftqckmanager.pcanywhere.net
www.microsoftupdate.mrbasic.com
www.microsoftupdate.qhigh.com
www.micrsoftware.dsmtp.com
www.mircsoft.compress.to
www.mmy.ddns.us
www.mod.jetos.com
www.mofa.dynamic-dns.net
www.mofa.ns01.info
www.moonnightthse.zyns.com
www.moscowdic.trickip.org
www.moscowstdsupdate.toythieves.com
www.mseupdate.ourhobby.com
www.msg.ezua.com
www.msn.incloud-go.com
www.musicfile.ikwb.com
www.musicjj.zzux.com
www.musicsecph.squirly.info
www.mymusicbox.lflinkup.org
www.mymusicbox.vizvaz.com
www.myrestroomimage.isasecret.com
www.mytwhomeinst.sendsmtp.com
www.myurinikoreaaps.ninth.biz
www.na.americanunfinished.com
www.na.onmypc.org
www.networkjpnzee.mynetav.org
www.newcityoforward.rebatesrule.net
www.newdnssec-info.4mydomain.com
www.newsdata.jkub.com
www.newsfile.toythieves.com
www.newsroom.cleansite.info
www.nlddnsinfo.https443.org
www.no.authorizeddns.org
www.nposnewsinfo.qhigh.com
www.nsa.mefound.com
www.nt.mynumber.org
www.nttdata.otzo.com
www.nuisance.serveusers.com
www.nz.compress.to
www.ol.almostmy.com
www.oldbmwy.com
www.onion.jkub.com
www.onlinednsserver.sendsmtp.com
www.oracleupdate.dns04.com
www.oyster.jkub.com
www.p6p6.net
www.packetsdsquery.dns05.com
www.pepper.sexxxy.biz
www.phptecinfohelp.itemdb.com
www.pickled.myddns.com
www.polopurple.com
www.portal.mrface.com
www.portal.sendsmtp.com
www.portalser.dynamic-dns.net
www.praskovya-matveyeva.mefound.com
www.praskovya-ulyanova.dumb1.com
www.products.almostmy.com
www.products.cleansite.us
www.products.serveuser.com
www.purchase.lflinkup.org
www.rainbow.mypop3.org
www.re26.com
www.read.xxuz.com
www.recent.dns-stuff.com
www.recent.fartit.com
www.redflower.isasecret.com
www.referred.gr8domain.biz
www.referred.yourtrap.com
www.register.ourhobby.com
www.registration2.instanthq.com
www.registrations.4pu.com
www.registrations.organiccrap.com
www.remeberdata.iownyour.org
www.reserveds.onedumb.com
www.rethem.almostmy.com
www.rg197.win
www.sakai.unhamj.com
www.sapporo.cloud-maste.com
www.sauerkraut.sellclassics.com
www.saverd.re26.com
www.sbuudd.webssl9.info
www.sdmsg.onmypc.org
www.se.toythieves.com
www.secertnews.mrbasic.com
www.secnetshit.com
www.secserverupdate.toh.info
www.senseye.ikwb.com
www.senseye.mrbonus.com
www.septdlluckysystem.jungleheart.com
www.seraphim-yurieva.justdied.com
www.serv.justdied.com
www.server1.proxydns.com
www.seyesb.acmetoy.com
www.showy.almostmy.com
www.shugiin.jkub.com
www.sindeali.com
www.singed.otzo.com
www.sojourner.mypicture.info
www.sstday.jkub.com
www.support1.mrface.com
www.supportus.mefound.com
www.svc.dynssl.com
www.sweetheart.sexxxy.biz
www.synssl.dnset.com
www.tamraj.fartit.com
www.telegraph.mefound.com
www.tfa.longmusic.com
www.thunder.wikaba.com
www.ticket.instanthq.com
www.ticket.serveuser.com
www.tisupdateinfo.faqserv.com
www.tokyofile.2waky.com
www.tophost.dynamicdns.co.uk
www.transfer.lflinkup.org
www.transfer.mrbasic.com
www.transfer.vizvaz.com
www.twgovernmentinfo.acmetoy.com
www.twsslpopservupro.dynssl.com
www.ugreen.itemdb.com
www.uk.dynamicdns.org.uk
www.un.ddns.info
www.un.dnsrd.com
www.unhamj.com
www.usa.itsaol.com
www.usffunicef.com
www.usliveupdateonline.ygto.com
www.ut-portal-u-tokyo-ac-jp.tyoto-go-jp.com
www.v4.windowsupdate.mrface.com
www.v4.windowsupdate.nsatcdns.com
www.vmmini.com
www.wchildress.com
www.webdirectnews.dynamicdns.biz
www.webmailentry.jetos.com
www.websqlnewsmanager.ninth.biz
www.well.itsaol.com
www.well.mrbasic.com
www.windowfile.itemdb.com
www.windowsimages.itemdb.com
www.windowsimages.qhigh.com
www.windowsmirrors.vizvaz.com
www.windowsupdate.2waky.com
www.windowsupdate.3-a.net
www.windowsupdate.acmetoy.com
www.windowsupdate.authorizeddns.net
www.windowsupdate.authorizeddns.org
www.windowsupdate.authorizeddns.us
www.windowsupdate.dns05.com
www.windowsupdate.dnset.com
www.windowsupdate.esmtp.biz
www.windowsupdate.ezua.com
www.windowsupdate.fartit.com
www.windowsupdate.gettrials.com
www.windowsupdate.instanthq.com
www.windowsupdate.itsaol.com
www.windowsupdate.jungleheart.com
www.windowsupdate.lflink.com
www.windowsupdate.mrface.com
www.windowsupdate.mylftv.com
www.windowsupdate.nsatcdns.com
www.windowsupdate.organiccrap.com
www.windowsupdate.rebatesrule.net
www.windowsupdate.sellclassics.com
www.windowsupdate.serveusers.com
www.windowsupdate.x24hr.com
www.yahoo.incloud-go.com
www.yandexr.sellclassics.com
www.yeahyeahyeahs.3322.org
www.yokohamajpinstaz.mrbonus.com
www.zaigawebinfo.rebatesrule.net
www.zebra.incloud-go.com
www2.qpoe.com
www2.zyns.com
www2.zzux.com
x7.usyahooapis.com
xi.dyndns.pro
xi.sexxxy.biz
xread10821.9966.org
xsince.tk
xt.dnset.com
xyrn998754.2288.org
yahoo.incloud-go.com
yallago.cu.cc
yandexr.sellclassics.com
yeahyeahyeahs.3322.org
yeap1.jumpingcrab.com
yfrfyhf.youdontcare.com
yo.acmetoy.com
za.myftp.info
zabbix.servercontrols.pw
zaigawebinfo.rebatesrule.net
zccw.cc
zebra.usffunicef.com
zebra.bdoncloud.com
zebra.incloud-go.com
zebra.unhamj.com
zebra.wthelpdesk.com
zero.pcanywhere.net
zg.ns02.biz
zone.demoones.com

# Reference: https://brica.de/alerts/alert/public/1214983/apt10-using-cobalt-strike-confirm-new-attack-with-apt-attacker-group-menupass-apt10/
# Reference: https://otx.alienvault.com/pulse/5b02d669f283a83d0cc4e7b5

jadl-or.com

# Reference: https://unit42.paloaltonetworks.com/menupass-playbook-and-iocs/

belowto.com
keyscratch.com

# Reference: https://otx.alienvault.com/pulse/5ce7e40de8145f2cd9272a4e
# Reference: https://blog.ensilo.com/uncovering-new-activity-by-apt10

caibi379.com
kaspresksy.com
miscrosofts.com
microsofts.org
tencentchat.net

# Reference: https://www.cybereason.com/blog/operation-soft-cell-a-worldwide-campaign-against-telecommunications-providers
# Reference: https://www.microsoft.com/security/blog/2019/12/12/gallium-targeting-global-telecom/
# Reference: https://otx.alienvault.com/pulse/5d120d47d09d67b4d8dc5241

asyspy256.ddns.net
cvdfhjh1231.ddns.net
cvdfhjh1231.myftp.biz
cvdfhjh12311.ddns.net
dffwescwer4325.myftp.biz
hotkillmail9sddcc.ddns.net
rosaf112.ddns.net
sz2016rose.ddns.net

# Reference: https://github.com/pan-unit42/iocs/blob/master/menuPass

1j.www1.biz
2014.zzux.com
abcd100621.3322.org
abcd120719.6600.org
algorithm.ddnsgeek.com
amsidgoo.thedomais.info
aotuo.9966.org
app.lehigtapp.com
apple.cmdnetview.com
apple.ikwb.com
applelib120102.9966.org
area.wthelpdesk.com
arkouowi.com
army.xxuz.com
art.p6p6.net
av.ddns.us
baby.macforlinux.net
babyprintf.2288.org
bak.have8000.com
bak.ignorelist.com
be.yourtrap.com
belowto.com
bk56.twilightparadox.com
bulk.tmpxctl.com
cao.p6p6.net
ccfchrist.com
cia.toh.info
cloud-maste.com
cmdnetview.com
contacts.rvenee.com
cpu.4pu.com
creatos.kozow.com
cvnx.zyns.com
davidgagnon.org
dedydns.ns01.us
diamond.ninth.biz
dick.ccfchrist.com
document.methoder.com
domain.casacam.net
drives.methoder.com
ducksow.ddnsgeek.com
emailfound.info
fbi.sexxxy.biz
firefoxcomt.arkouowi.com
firtstdata.kozow.com
fiveavmersi.websegoo.net
forward.davidgagnon.org
friendlysupport.giize.com
fuckanti.com
fukuoka.cloud-maste.com
gadskysun.com
gold.polopurple.com
goldtoyota.com
google.macforlinux.net
google.usrobothome.com
grandeur.kozow.com
have8000.com
herring.kozow.com
hk.cmdnetview.com
hk.have8000.com
hostport9.net
idpmus.hostport9.net
im.suibian2010.info
img.microtoo.info
info.uroljp.com
inspgon.re26.com
iphone.vizvaz.com
iu.niushenghuo.info
jadl-or.com
janpan.bigmoney.biz
japan.fuckanti.com
jepsen.r3u8.com
jimin.jimindaddy.com
jimindaddy.com
jpn.longmusic.com
js001.3322.org
kawasaki.cloud-maste.com
kawasaki.unhamj.com
keyscratch.com
kmd.crabdance.com
last.p6p6.net
lehigtapp.com
lion.wchildress.com
macforlinux.net
mailj.hostport9.net
malware.DSMTP.COM
meibubaker.3322.org
messagea.emailfound.info
microcnmlgb.3322.org
microtoo.info
music.websegoo.net
nttdata.otzo.com
nunluck.re26.com
oldbmwy.com
p6p6.net
polopurple.com
poulsenv.com
quick.oldbmwy.com
r3u8.com
radiorig.com
re26.com
record.hostport9.net
record.wschandler.com
resource.arkouowi.com
rvenee.com
sakai.unhamj.com
sbuudd.webssl9.info
scorpion.poulsenv.com
sdmsg.onmypc.org
send.have8000.com
send.mofa.ns01.info
sendmsg.jumpingcrab.com
services.arkouowi.com
sh.chromeenter.com
sky.oldbmwy.com
smo.gadskysun.com
sstday.Jkub.com
sstday.jkub.com
start.usrobothome.com
stone.jumpingcrab.com
suibian2010.info
support1.mrface.com
synssl.dnset.com
sz.thedomais.info
taipei.yourtrap.com
thedomais.info
tmpxctl.com
trasul.myPicture.info
trems.rvenee.com
tv.goldtoyota.com
un.dnsrd.com
unhamj.com
unspa.hostport9.net
uroljp.com
usa.radiorig.com
usrobothome.com
video.vmdnsup.org
vm.vmdnsup.org
vmyiersend.websago.info
voov.2288.org
wchildress.com
web.casacam.net
websago.info
websegoo.net
webssl9.info
weile3322a.3322.org
weile3322b.3322.org
whellbuy.wschandler.com
wike.wikaba.com
wschandler.com
wthelpdesk.com
yz.chromeenter.com
zebra.wthelpdesk.com
zone.usrobothome.com

# Reference: https://twitter.com/Vishnyak0v/status/1239908264831311872
# Reference: https://twitter.com/Vishnyak0v/status/1239908305117552644
# Reference: https://www.ptsecurity.com/ru-ru/research/pt-esc-threat-intelligence/shadowpad-novaya-aktivnost-gruppirovki-winnti/ (# Related Domains chapter)

g00gle_jp.dynamic-dns.net
g00gle_kr.dns05.com
g00gle_mn.dynamic-dns.net
g0ogle_mn.dynamic-dns.net
oseupdate.dns-dns.com
yandex2unitedstated.dns05.com
yandex2unitedstated.dynamic-dns.net

# Reference: https://twitter.com/KorbenD_Intel/status/1243668874102321152
# Reference: https://otx.alienvault.com/indicator/ip/185.117.88.80

185.117.88.80:8088

# Reference: https://app.any.run/tasks/875fe058-ade2-4d26-86fc-411417e33dff/

zebra.wthelpdesk.com

# Reference: http://jsac.jpcert.or.jp/archive/2021/pdf/JSAC2021_202_niwa-yanagishita_en.pdf
# Reference: https://otx.alienvault.com/pulse/601832343e90a9658287a666/

rare-coisns.com

# Reference: https://unit42.paloaltonetworks.com/pingpull-gallium/
# Reference: https://www.virustotal.com/gui/file/861abfc3ca4e8b450afdc33af689219505ad9bb9fbc6f4b6ed9c3c036e25cbda/detection

61.221.66.85:8080
hinitial.com
micfkbeljacob.com
df.micfkbeljacob.com
jack.micfkbeljacob.com
goodjob36.publicvm.com
goodluck23.jp.us
helpinfo.publicvm.com
mailedc.publicvm.com
t1.hinitial.com
v2.hinitial.com
v3.hinitial.com
v4.hinitial.com
v5.hinitial.com

# Reference: https://ics-cert.kaspersky.com/publications/reports/2022/06/27/attacks-on-industrial-control-systems-using-shadowpad/

cargobussiness.site
defineyourid.site
grandfoodtony.com
kankuedu.org
musicweb.xyz
obj.services
videocenter.org
documents.kankuedu.org
houwags.defineyourid.site
live.musicweb.xyz
noub.crabdance.com
obo.videocenter.org
order.cargobussiness.site
tech.obj.services

# Reference: https://unit42.paloaltonetworks.com/alloy-taurus/
# Reference: https://www.virustotal.com/gui/file/5ba043c074818fdd06ae1d3939ddfe7d3d35bab5d53445bc1f2f689859a87507/detection
# Reference: https://www.virustotal.com/gui/file/cb0922d8b130504bf9a3078743294791201789c5a3d7bc0369afd096ea15f0ae/detection

204.79.197.200:8443
5.181.25.99:8443
saspecialforces.co.za
vpn729380678.softether.net
yrhsywu2009.zapto.org

# Reference: https://twitter.com/malwrhunterteam/status/1659534793124593665
# Reference: https://www.virustotal.com/gui/file/70c4600d6920dadc1899603b131119427784fcd83d04da5c886bcad5a7af913b/detection

info.publicvm.com

# Reference: https://unit42.paloaltonetworks.com/alloy-taurus-targets-se-asian-government/
# Reference: https://otx.alienvault.com/pulse/651aca1636127242b4dd6af9

cdn-sina.tw
images.cdn-sina.tw
shell.cdn-sina.tw

# Reference: https://blog-en.itochuci.co.jp/entry/2024/01/24/134100
# Reference: https://otx.alienvault.com/pulse/65b7c5ce83210bf49833afdd

http://45.76.222.130
http://45.77.183.161
45.76.222.130:443
45.77.183.161:443

# Reference: https://1275.ru/ioc/8083/earth-kasha-apt10-apt-iocs/

tlsart.com
ns1.tlsart.com
ww12.tlsart.com

# Reference: https://community.emergingthreats.net/t/ruleset-update-summary-2024-12-02-v10781/2210

srmbr.com
tw8sl.com

# Reference: https://x.com/skocherhan/status/1901765548670955804
# Reference: https://www.virustotal.com/gui/file/5896dbc54fe973c18bc0a4505f4a8cfc215f6743609cb29e9d9738c087797e08/detection

89.117.79.31:100
serviceusa.duckdns.org

# Reference: https://x.com/malwrhunterteam/status/1924559400242454554
# Reference: https://www.virustotal.com/gui/file/0a4888750a50461effd10757fc9bebfacbc661a9ad57fd4c23eefbc735f7ca94/detection

89.117.79.31:88
myststemsgame.com

# Reference: https://www.virustotal.com/gui/ip-address/89.117.79.31/relations
# Reference: https://www.virustotal.com/gui/file/0b798ce8880a01eaf5496830e31cde3adceb933b15da8e1cdab6e8796993e23a/detection
# Reference: https://www.virustotal.com/gui/file/117b4adb50bb27641f732f7e8b70ade5acf74d17e74b4242ed289f9d5c2b7679/detection
# Reference: https://www.virustotal.com/gui/file/661f649f83451c344879cebcc7d56d275377c9ec3ed385e93aa4a04238c390e0/detection
# Reference: https://www.virustotal.com/gui/file/62c4d17c1e5ed099efcbd26725837b4e4226a6bd5228554a6b3eb2ce2a3ad101/detection

31.220.92.125:11
89.117.79.31:2
89.117.79.31:3
win32updates.duckdns.org
windows-11.duckdns.org
windows-com.duckdns.org
windows-defender.com

# Reference: https://www.trendmicro.com/en_us/research/25/d/earth-kasha-updates-ttps.html
# Reference: https://documents.trendmicro.com/images/TEx/Earth-Kasha-Blog-IoCshFxTmpo.txt

kyolpon.com
srmbr.net
