# Copyright (c) 2014-2026 Maltrail developers (https://github.com/stamparm/maltrail/)
# See the file 'LICENSE' for copying permission

# Aliases: taxoff, team46

# Reference: https://twitter.com/k3yp0d/status/1782082055905690092
# Reference: https://x.com/blackorbird/status/1935254424789860703
# Reference: https://twitter.com/k3yp0d/status/1782068601534517624
# Reference: https://securelist.com/operation-forumtroll/115989/
# Reference: https://global.ptsecurity.com/analytics/pt-esc-threat-intelligence/team46-and-taxoff-two-sides-of-the-same-coin
# Reference: https://habr.com/ru/companies/pt/articles/841176/
# Reference: https://app.validin.com/detail?find=Future%20Bull&type=raw&ref_id=41bde129bf6#tab=host_pairs (# 2025-06-18)
# Reference: https://www.virustotal.com/gui/ip-address/188.40.151.88/relations
# Reference: https://www.virustotal.com/gui/file/bada45186ac6a13e2d5dbe0633ea1584f6fa6463986a5fb304cc6d9eb04ed676/detection
# Reference: https://www.virustotal.com/gui/file/736abfe5541b4175ff013b442a673b8387209e324e3e343a628838f3e428e526/detection
# Reference: https://www.virustotal.com/gui/file/896934c20fecc7f76a6db3ddd62750be70acd3a8305325bb1e2c7929ef0cb963/detection
# Reference: https://www.virustotal.com/gui/file/823d625481fe8b0299850e9758e43b717b6874d42e0112f1b8281bcefedadd31/detection

2025primakovreadings.info
cybers46.team
cybers4646.my.id
futurebull.live
futurebull.net
globaloneai.com
infosecteam.info
kpmedia.city
mil-by.info
mstn-ru.com
peerflix.net
primakovreadings.info
primakovreadings2025.info
rabotnik.today
srv480138.hstgr.cloud
srv484118.hstgr.cloud
ads-stream-api-v2.global.ssl.fastly.net
browser-time-stats.global.ssl.fastly.net
clip-rdp-api.global.ssl.fastly.net
common-rdp-front.global.ssl.fastly.net
fast-telemetry-api.global.ssl.fastly.net
front-static-api.global.ssl.fastly.net
main-front-api.global.ssl.fastly.net
ms-appdata-fonts.global.ssl.fastly.net
ms-appdata-main.global.ssl.fastly.net
ms-appdata-query.global.ssl.fastly.net
rdp-api-front.global.ssl.fastly.net
rdp-query-api.global.ssl.fastly.net
rdp-statistics-api.global.ssl.fastly.net

# Reference: https://x.com/blackorbird/status/2001300384737083890
# Reference: https://www.virustotal.com/gui/ip-address/45.11.181.96/relations
# Reference: https://securelist.com/operation-forumtroll-new-targeted-campaign/118492/

e-library.wiki
elibrary.wiki
bus-pod-tenant.global.ssl.fastly.net
perf-service-clients2.global.ssl.fastly.net
status-portal-api.global.ssl.fastly.net

# Reference: https://twitter.com/k3yp0d/status/1787851479421772047
# Reference: https://twitter.com/k3yp0d/status/1787852438591910201
# Reference: https://www.virustotal.com/gui/file/387252ca8e89f7c3daceb48ab1279dfe597a9043095624a485aa5820b3c446b9/detection
# Reference: https://www.virustotal.com/gui/file/608009b402c00bb8ef65cc8d805e1522ddf1632c7479be05244ebd38483e22df/detection

advertnow.org
adverty.info
corptravel.org
feedstream.info
kantiana.info
mediaoprosso.ru
planitprima.digital
planitprima.info
planitprima.tech
svobody.org
yandeks.info
kant300.kantiana.info
moscow.corptravel.org
passport.yandeks.info
ulitsa.svobody.org
