# Copyright (c) 2014-2026 Maltrail developers (https://github.com/stamparm/maltrail/)
# See the file 'LICENSE' for copying permission

# Aliases: emmenhtal loader

# Reference: https://malpedia.caad.fkie.fraunhofer.de/details/win.emmenhtal
# Reference: https://x.com/JAMESWT_MHT/status/1868927219021799662
# Reference: https://app.any.run/tasks/a27e753f-8a27-487f-ba4a-0c29779767f2

92.255.57.75:9000
csp-invoices-v5.com
green-pathways.shop
klipxuhaq.shop
cdn-defac18.artcollective-snapclick.com
cndef1.green-pathways.shop
static.klipxuhaq.shop

# Reference: https://x.com/RussianPanda9xx/status/1870210225674035280
# Reference: https://x.com/s1dhy/status/1875864236028526807
# Reference: https://x.com/s1dhy/status/1875986692664185315
# Reference: https://app.any.run/tasks/8902d447-88c3-4627-9ae8-9b3824fb91ba

http://147.45.179.37
http://147.45.50.250
http://185.66.91.182
http://185.66.91.17
http://185.66.91.23
http://84.200.24.34
infomsghub.com
rodgersluciecassy.com

# Reference: https://x.com/CERTCyberdef/status/1900460479778030013
# Reference: https://raw.githubusercontent.com/cert-orangecyberdefense/cti/refs/heads/main/emmenhtal/iocs%20(March%202025)%20-%20Emmenhtalv3

http://195.211.191.120
acepro.shop
adobee.shop
adventurevault.shop
airtbn.shop
amacys.shop
angrybrds.shop
appp.file-factory.pro
asosz.shop
astonishingbuys.shop
atariq.shop
audiomaxx.shop
available-files.oss-ap-northeast-2.aliyuncs.com
avonex.shop
ball-strike-up.shop
bargaincove.shop
bargainland.shop
bigpick.shop
bigsphere.shop
bimola.shop
bizmir.shop
bolddeals.shop
boldway.shop
budgetlane.shop
budgetmart.shop
budgetsphere.shop
budgetvibe.shop
buferingo.shop
buyloom.shop
buyluxe.shop
bytes.microstorage.shop
captivatingkeepsakes.shop
cariz.shop
chicmoments.shop
classicwraps.shop
classydelights.shop
classykeepsakes.shop
collectiblegifts.shop
collectiblejoy.shop
colorfulkeepsakes.shop
colorfulmoments.shop
colorfulpicks.shop
colorfultreasures.shop
creedos.shop
dareglimpse.shop
dawnbloom.shop
dazewave.shop
dazzlejoy.shop
dazzletouch.shop
deepvibes.shop
def.ball-strike-up.shop
desime.shop
desimol.shop
dewdropbliss.shop
dewshine.shop
discoverconicalcrouton.shop
driftcharm.shop
driftpulse.shop
drizzleraving.shop
dulaan.shop
dunewave.shop
durablyscrimmage.rent
dustglow.shop
ebazaarelite.shop
ebuyelite.shop
ebuymore.shop
ecartdirect.shop
echoicedeals.shop
edirect.shop
edonlo.shop
emarketelite.shop
eoutletpro.shop
eprime.shop
eprimemart.shop
eptidown1.b-cdn.net
eretailpro.shop
eretailzone.shop
espardo.shop
estorepro.shop
evaluehub.shop
ferrysurgicallustily.shop
fersiko.shop
file-factory.pro
fuzzyz.shop
gabrize.shop
ganderbrisklyonly.shop
gapdevoutlycitrus.shop
giddinessrebirth.shop
goatstuff.shop
gossipsurrender.shop
grazine.shop
grumpilos.shop
hismajesty.shop
holker.shop
ialpha.shop
ialphaboost.shop
ialphazone.shop
iarenablaze.shop
ibattleboost.shop
iepic.shop
iepicboost.shop
iepicplay.shop
igamedash.shop
igameforge.shop
igameinfinity.shop
igamerblast.shop
igamercore.shop
igamexp.shop
igamezone.shop
iinfinitybattle.shop
ilegendrush.shop
incognito.uploads.it.com
ineobattle.shop
ipixelblaze.shop
ipixeledge.shop
ipixelquest.shop
iquestzone.shop
ishadowquest.shop
ishadowstrike.shop
itechvortex.shop
items.kycc-camera.shop
ixpforge.shop
ixpzone.shop
jekin.shop
jizil.shop
jozeni.shop
jumpcelibateencounter.shop
kiddoloom.shop
klipderiq.shop
klipdesak.shop
klipjaqemiu.shop
klipzynigou.shop
kp.ferrysurgicallustily.shop
kycc-camera.shop
leksion.shop
likinom.shop
luxeway.shop
markitos.shop
megahive.shop
microstorage.shop
monekam.shop
ne1.discoverconicalcrouton.shop
oldiger.shop
opisso.shop
optdropper.shop
overuseunderuse.shop
pegas.durablyscrimmage.rent
perent.ganderbrisklyonly.shop
perent1.ganderbrisklyonly.shop
perent2.ganderbrisklyonly.shop
perent3.ganderbrisklyonly.shop
perent4.ganderbrisklyonly.shop
pinmore.shop
pn5.gapdevoutlycitrus.shop
pomppie.shop
possibleshimmer.shop
previewcapped.shop
puckerlinguist.shop
refereng.shop
rekono.shop
requinos.shop
resmuna.shop
rtshoop.shop
rubana.shop
sazak.shop
servicelandingkaraoke.shop
sesimok.shop
shalebrussels.shop
sharethewebs.shop
shredderradar.shop
shufflerline.shop
silver-card-maker.cloud
sparticus.shop
stungoverhaul.shop
sumala.shop
superheroomen.shop
suzixoxo.shop
tag.shufflerline.shop
tesnok.shop
timing.silver-card-maker.cloud
trendys.cloud
u1.drizzleraving.shop
u1.giddinessrebirth.shop
u1.gossipsurrender.shop
u1.jumpcelibateencounter.shop
u1.optdropper.shop
u1.overuseunderuse.shop
u1.possibleshimmer.shop
u1.previewcapped.shop
u1.puckerlinguist.shop
u1.servicelandingkaraoke.shop
u1.shalebrussels.shop
u1.shredderradar.shop
u1.stungoverhaul.shop
u1.superheroomen.shop
u1.wannabeclobber.shop
usa.trendys.cloud
utahano.shop
vedingo.shop
vermano.shop
w66.discoverconicalcrouton.shop
wannabeclobber.shop
warsad.shop
woolav.shop
x22.eioae.shop
x73.eioae.shop
x75.eioae.shop
yallano.shop
yezmil.shop
zeemaro.shop

# Reference: https://x.com/1ZRR4H/status/1908174715614634257
# Reference: https://app.validin.com/detail?type=hash&find=58d465585e4c55729bb1372aea2891b3#tab=host_pairs (# 2025-04-04)

cat-frog-lamp.today
cherry-pink.shop
fish-cloud-jar.us
fox-chair-dust.xyz
grey-nuke-camera.us
horse-shadow-key.vip
moon-river-coin.xyz
silver-map-generator.shop
zoo-ciry.shop
cdn.horse-shadow-key.vip
clo.grey-nuke-camera.us
message.zoo-ciry.shop
ok.fish-cloud-jar.us
power.moon-river-coin.xyz
run.fox-chair-dust.xyz
sandbox.silver-map-generator.shop
text.cherry-pink.shop
webnet.cat-frog-lamp.today

# Reference: https://x.com/smica83/status/1954856380357100027
# Reference: https://www.virustotal.com/gui/file/5381e7787bec221bf35ba5f4c95e8841ac0f129d6eef36c1edc7969e918cb3dd/detection

opezdol.org
teiehram.org
abntvw.opezdol.org
alhksryaqv.opezdol.org
amrhep.opezdol.org
aptkz.opezdol.org
auxifpy.opezdol.org
bbpgl.opezdol.org
bbpq.opezdol.org
bhovcqnis.opezdol.org
bumkmutuc.opezdol.org
cakyp.opezdol.org
ccvkxjcxv.opezdol.org
czfpbev.opezdol.org
dathqflvmm.opezdol.org
dejlgz.opezdol.org
dlnudo.opezdol.org
dqnatx.opezdol.org
emeclmaf.opezdol.org
eqbfsxxys.opezdol.org
fbnuvatdu.opezdol.org
fekuc.opezdol.org
ffpjtj.opezdol.org
ffyqauft.opezdol.org
fgguukkrji.opezdol.org
fqtcddnzz.opezdol.org
frhuct.opezdol.org
fwdshkfrh.opezdol.org
gdzqzefzw.opezdol.org
ggttj.opezdol.org
hbvxjxc.opezdol.org
hkonesc.opezdol.org
hnxkzmeob.opezdol.org
hyvyvbtsbd.opezdol.org
ihmhuzutpd.opezdol.org
ihsue.teiehram.org
ikflneari.opezdol.org
iluhgji.opezdol.org
itzsk.opezdol.org
izresbpa.opezdol.org
jbvrqkp.opezdol.org
kazjnf.opezdol.org
kkemdt.opezdol.org
ksslb.opezdol.org
ktyswpud.opezdol.org
lcnheolt.opezdol.org
lgggtocveh.opezdol.org
lptqmax.opezdol.org
lwteoij.opezdol.org
lxxotgmjyc.opezdol.org
mdjgkjheb.opezdol.org
mgzfxrc.opezdol.org
mnojs.opezdol.org
negpqaht.opezdol.org
nfnitjsyq.opezdol.org
nhymvt.opezdol.org
ntdld.opezdol.org
nwugqxqyah.opezdol.org
nwxnog.teiehram.org
nypqiww.opezdol.org
odswyn.opezdol.org
oduhgfjk.opezdol.org
ovtbikoei.opezdol.org
pfnzqc.opezdol.org
pohbvi.opezdol.org
pxfmwj.opezdol.org
pxvziod.opezdol.org
qidppt.opezdol.org
qmejgqflz.opezdol.org
qvoal.opezdol.org
qxjprd.opezdol.org
rehjfjpxj.opezdol.org
rlwihqtxpz.teiehram.org
rqfgdwesxh.opezdol.org
rvyqi.opezdol.org
rzcfstx.teiehram.org
sbipvtd.opezdol.org
sjnixli.opezdol.org
slzfmkg.opezdol.org
snvqfxfc.opezdol.org
soiizdnj.opezdol.org
support.teiehram.org
swfgak.opezdol.org
theyaparc.opezdol.org
tiorwxgr.opezdol.org
tkuzzsd.opezdol.org
tmaeq.opezdol.org
tmuhv.opezdol.org
tpdxjxbdgd.opezdol.org
tunreb.opezdol.org
udpmxlzuan.opezdol.org
udwpehv.opezdol.org
ueojebqztf.opezdol.org
vnocwfen.opezdol.org
vzzdzsb.opezdol.org
wfdjamr.opezdol.org
widxgqu.opezdol.org
wimgkxgn.opezdol.org
wiyhcynpjo.opezdol.org
wqput.teiehram.org
wxnog.teiehram.org
wyxjajc.opezdol.org
xbmcpgf.opezdol.org
xevvl.opezdol.org
xjeoludhz.opezdol.org
xmncd.opezdol.org
xnqomhbize.opezdol.org
ycdtmr.opezdol.org
ydeak.opezdol.org
ygsdye.opezdol.org
yjklmnu.opezdol.org
ykvvhby.opezdol.org
ynvhqnrna.opezdol.org
yrtwx.opezdol.org
yvlrvnsh.opezdol.org
ywtesjg.opezdol.org
yxrbt.opezdol.org
zaobs.opezdol.org
zetqojtbxo.opezdol.org
ziahyroade.opezdol.org
zqwfb.opezdol.org

# Reference: https://x.com/smica83/status/2009350637046386911
# Reference: https://www.virustotal.com/gui/file/01b5c6acb20e41799a0e96d9d1d6e1c44791883706b6285e874fcb15cc93b31a/detection

d2nq35tel3ucuo.cloudfront.net
oisadjfoinsiduhfnoisdnfosdnoifnsoid.pages.dev
