# Copyright (c) 2014-2026 Maltrail developers (https://github.com/stamparm/maltrail/)
# See the file 'LICENSE' for copying permission

# Aliases: apt28, apt-c-20, sednit, sofacy, fancy bear, pawn storm, SNAKEMACKEREL, STRONTIUM, zebrocy, group 74, tsar team, threat troup-4127, TG-4127, ta422, ta426, UAC-0001, UAC-0028, beardshell, lamehug, KTA007, gonepostal
# MITRE: https://attack.mitre.org/groups/G0007/
# CERT-UA: UAC-0001, UAC-0028

# Reference: https://www.alienvault.com/open-threat-exchange/blog/from-russia-with-love-sofacy-sednit-apt28-is-in-town
# Reference: http://permalink.gmane.org/gmane.comp.security.ids.snort.emerging-sigs/22170
# Reference: http://pwc.blogs.com/files/tactical-intelligence-bulletin---sofacy-phishing-.pdf

adawareblock.com
adobeincorp.com
azureon-line.com
checkmalware.info
checkwinframe.com
check-fix.com
hotfix-update.com
microsofi.org
microsof-update.com
scanmalware.info
secnetcontrol.com
securitypractic.com
testservice24.net
testsnetcontrol.com
updatepc.org
updatesoftware24.com
windows-updater.com
checkmalware.org
adawareblock.com
adobeincorp.com
azureon-line.com
checkmalware.info
checkwinframe.com
check-fix.com
hotfix-update.com
microsofi.org
microsof-update.com
scanmalware.info
secnetcontrol.com
securitypractic.com
symanttec.org
testservice24.net
testsnetcontrol.com
updatepc.org
updatesoftware24.com
windows-updater.com
checkmalware.org
symanttec.org

# Reference: https://securelist.com/blog/research/72924/sofacy-apt-hits-high-profile-targets-with-updated-toolset/

drivres-update.info
intelnetservice.com
intelsupport.net
softupdates.info

# Reference: https://www.root9b.com/sites/default/files/whitepapers/R9b_FSOFACY_0.pdf

b-of-americ.com
osce-military.org
bbcnewsweek.com
qov.hu.com
settings-yahoo.com
yovtube.co
googlesetting.com
cbiuaebn.com
cbiuaebank.com
techcruncln.com
un-unicef.org
royalbsuk.com
kwqx.us
middle-eastreview.org
unitednat.org
fbonlinelottery.com
fubnt.com
globeshippers.biz
globeshippers.net
gsandsc.com
gshippers.com
hesselawchambers.com
largefarm.net
regionsbnk.info
seatreasures.org
ssandsc.com
t-d-canadatrust.com
techielawfirms.com
togounoffice.com
ubagroupsgh.com
un-unicef.org
unicomba.com
universalcoba.com

# Reference: https://www.fireeye.com/resources/pdfs/apt28.pdf

standartnevvs.com
novinitie.com
n0vinite.com
qov.hu.com
q0v.pl
mail.q0v.pl
poczta.mon.q0v.pl

# Reference: http://www.symantec.com/security_response/earthlink_writeup.jsp?docid=2014-110315-1233-99

scanmalware.info
malwarecheck.info
adawareblock.com
checkmalware.org

# Reference: https://www.tr1adx.net/intel/public/TIB-00001_IOC_Domain.txt

365msoffice.com
acccountverify.com
accgmail.com
account-close-status.com
accountsteam-en.com
accounts-updated.com
accountverify.com
accountverify.info
adobe-flash-updates.org
adobemainsecurity.com
akadns.info
akamaichecker.com
apple-assistance-localisation.com
apple-care-support.com
apple-cloud-connect.com
applecloudupdate.com
apple-iclouds.net
appleid-security-icloud.com
apple-id-service.com
apple-iphonesecurity-icloud.com
apple-iphone-services.com
apple-location-id.com
apple-security-support.info
apple-support-securityiphone.com
apps4updates.com
arghpxdge01-airgas.com
cavuslawfirm.com
checkfindmyiphone.com
cloud-apple-support.com
cloud-id-localisation.com
csert.net
dateosx.com
defenceglobaladviser.com
delivery-mail-service.com
diplomatscouncil.org
emailprovider.org
emails-aol.com
exchangetrusts.com
facebookonlinenotice.com
facebookservices.org
fbarticles.com
generalscaningcorp.org
generalsecuritycorp.org
generalsecurityscan.com
getwindowsupdates.com
globaldefencetalk.com
gmailservicegroup.com
gmailservices.org
gnpad-gh-gov.org
google-vservice.com
iadb-online.com
icloud-id-en.com
icloud-id-localisation.com
icloud-id-security.com
icloud-id-services.com
icloud-iphonesecurity.com
icloud-iphone-services.com
icloud-localisation-id.com
icloud-security-support.com
icloud-service-apple.com
icloud-support-id.com
identification-apple.com
identification-apple-id.com
identification-icloud-id.com
id-icloud-localisation.com
id-icloud-support.com
imf-eu.org
istoreapple.com
itune-app.com
itunes-helper.net
limited-resolution.com
limited-verification.com
localisation-apple.com
localisation-apple-id.com
localisation-apple-security.com
localisation-id-apple.com
localisation-id-icloud.com
localisation-security.com
localisation-support.com
login-resolve-limitations.com
login-security-center.com
login-security-notification.com
login-security-verifications.com
mailerfeed.net
mail-periodistas.net
microsoftdccenter.com
microsoftfont.com
microsoftofficeupdate.net
mobilehostsvc.com
msfontsrv.com
msmodule.net
msofficeinstall.com
nato-nevvs.org
netcorpscanprotect.com
nvidiagforceup.com
officefont.com
offlineupdates.com
politicsadvertisment.com
pressservices.net
privacy-ukr.net
protectingcorpind.com
proxysys-config.com
reinstate-account.com
reportscanprotecting.org
reservecorpind.com
rsshotmail.com
samsvung.com
secureconnectcompany.com
secure-remove-limitation.com
secure-verification-center.com
security-apple-id.com
security-icloud-apple.com
security-icloud-localisation.com
security-resolution-center.com
security-verification.net
security-verifications.com
shcserv.com
signin-icloudsupport.com
support-icloud-apple.com
support-icloud-localisation.com
support-localisation-icloud.com
support-security-icloud.com
support-svc.com
transfersevices.net
transworldpetroleum.com
twiterservices.org
update-adobe.com
updatepple.com
update-security-information.com
updatesrvx.net
us-facebook.com
windowsofficeupdate.com
winsystemsvc.net
wpadsettings.net
wsusconnect.com
xn--amazo-d8a.com
yuotubc.com

# sinkholed by <sinkhole_sofacy.txt>

34564414564.com
645547657668787.com
access-google.com
account-microsoftonline.com
account-office365.com
accounts-googlc.com
accounts.rsshotmail.com
acledit.com
actblues.com
adfs-senate.email
adfs.senate.qov.info
adfs-senate.services
adobeincorp.com
adobeproduct.com
adobestatistic.com
adobestatistic.org
adobeupdater.org
adobeupdatetechnology.com
advpdxapi.com
akamaicachecdn.com
akamaisoftupdate.com
akamaitechnologysupport.com
akamaitechupdate.com
americanprogress-office365.com
americanprogress-outlook.com
apionedrive.com
apple-checker.org
applecloudupdate.com
apple-iclods.org
apple-iclouds.net
apple-search.info
apple-uptoday.org
app-submitcentre.com
autoupdater.org
bbcnewsweek.com
blacktivist.info
bonjourcheck.com
brookings.sharepoint.liveoffice365.me
changepassword-hotmail.com
checkmalware.info
checkmalware.org
checkwinframe.com
cleanphonetrksftware.com
cloudflarecdn.com
cloudmicrosoft365.com
cloudupgrade.org
dailyforeignnews.com
diplomatnews.org
dncvotebuilder.com
dotnetupdatechecker.com
drivers-update.info
driversupdate.info
dvsservice.com
dvsservice.net
easycache.net
egypressoffice.com
eservicesystems.net
evbrax.org
extad.info
extstat.info
fastcontech.com
faststoragefiles.org
finemagicball.org
generalsecuritycorp.org
globaltechresearch.org
gtranm.com
helpmicrosoft.net
help-msoutlook.com
hotfixmsupload.com
hotmail-monitor.com
hubsg.net
hudsonorg-my-sharepoint.com
info2t.com
inteldrv64.com
intelintelligence.org
intelmeserver.com
intelsupportcenter.com
intelsupportcenter.net
ipv6-microsoft.com
kenlynton.com
lgemon.org
linuxkrnl.net
livemicrosoft.net
liveoffice365.me
login.cloudmicrosoft365.com
login-on-live.com
log-in-osce.org
login-outlook.com
login-security-center.com
loqin-microsoftonline.com
lowprt.org
lucyonmail.org
malwarecheck.info
micoft.com
microsofi.org
microsoftcheckupdate.com
microsoftcorpstatistic.com
microsoftdccenter.com
microsoftdriver.com
microsoftdskservice.com
microsofthelpcenter.info
microsoftonlihe.com
microsoftsecurepolicy.org
microsoftsupp.com
microsoft-update-cdn.com
microsoft-updatecdn.com
microsof-update.com
miropc.org
mlidef.com
mscoresvw.com
ms-drivadptrwin.com
msmodule.com
msmodule.net
msnsupportcare.com
msofficeinstall.com
msoftonline.com
msrdr.com
msrwr.com
ms-update.info
ms-update.net
ms-updates.com
mvsband.com
my-iri.org
mymail-ukr.net
naoasch.com
natoexhibitionff14.com
natoint.com
ndsee.org
netcorpscanprotect.com
networkschecker.net
newfilmts.com
newsdailyworld.com
news.intelsupportcenter.com
nortonupdate.org
noticermk.com
notificationstatus.com
office365-account.com
office365-microsoft.com
office365-onedrive.com
officemicroupdate.com
officeupdater.com
onedrive365.com
onedrivemicrosoft365.com
onedrivemicrosoft.com
onedrive-office365.com
onedriveoffice365.com
one-drive.org
onedrive-outlook.com
outlook-security.org
petropershiyinukra.com
philcfo.org
pldtprv.net
privacy-hotmail.com
profile-hotmail.com
publishdollar.com
qov.info
remsupport.org
reportscanprotecting.org
researchcontinental.org
reservecorpind.com
rsshotmail.com
runssnetworks.com
runvercheck.com
scanmalware.info
sdhjjekfp4k.com
search-microsoft.com
secao.org
secnetcontrol.com
secure.actblues.com
securemicrosoftstatistic.com
securitysls.com
securityupdatereport.com
senate.group
senate.qov.info
seniorsecurityind.com
servicecorptech.com
service-hushmail.com
servicesecupdate.com
service-usa-tre.info
smtprelayhost.com
softwaresupportsv.com
soligro.com
spelns.com
sportszone71.com
supports-microsoft.com
symantecsupport.org
testservice24.net
transparency-office365.com
uber-mails.com
umizg.org
updatepc.org
updatesoftware24.com
updatesvcsys.com
updates-windows.com
updatesystem.info
updatesystems.net
uploader.sytes.net
vascothreatscan.org
webmail-saic.com
webmail-saic.net
whatsapp-in.com
win32support.com
windowofficeupdate.com
windowsappstore.net
windowscheckupdater.net
windowsofficeupdate.com
windowsupdater.net
windowsxupdate.com
winsyscheck.com
winsyschecks.com
winsystemsvc.net
winupdatesysmic.com
wmdmediacodecs.com
worldmilitarynews.org
worldpoliticsnews.org
wsusconnect.com
www.actblues.com
www.adobeupdater.org
www.dailyforeignnews.com
www.diplomatnews.org
www.info2t.com
www.microsoftdriver.com
www.microsofthelpcenter.info
www.mscoresvw.com
www.natoint.com
www.office365-onedrive.com
www.onedrive365.com
www.servicesecupdate.com
www.sportszone71.com
www.symantecsupport.org
www.windowscheckupdater.net
www.winupdatesysmic.com
www.worldmilitarynews.org

# Reference: http://researchcenter.paloaltonetworks.com/2016/12/unit42-let-ride-sofacy-groups-dealerschoice-attacks-continue/

adobeupgradeflash.com
akamaisoftupdate.com
appservicegroup.com
apptaskserver.com
globalresearching.org
globaltechresearch.org
joshel.com
postlkwarn.com
researchcontinental.org
securityprotectingcorp.com
uniquecorpind.com
versiontask.com

# Reference: http://researchcenter.paloaltonetworks.com/2016/06/unit42-new-sofacy-attacks-against-us-government-agency/

munimonoce.com
wscapi.com
tabsync.net
storsvc.org
servicecdp.com

# Reference: http://researchcenter.paloaltonetworks.com/2016/02/a-look-into-fysbis-sofacys-linux-backdoor

azureon-line.com
mozilla-plugins.com
mozillaplagins.com

# Reference: http://www.welivesecurity.com/2014/10/08/sednit-espionage-group-now-using-custom-exploit-kit/

msonlinelive.com
windows-updater.com
azureon-line.com

# Reference: http://pwc.blogs.com/files/cto-tib-20150420-01a.pdf

defencereview.net
brnlv-gv.eu
militaryobserver.net
netassistcache.com
asus-service.net
aolnets.com
natopress.org
natopress.com
defencereview.eu
intelsupport.net
globalnewsweekly.com
osce-oscc.org
enisa-europa.com
enisa-europa.org
techcruncln.com
nato-hq.com
iacr-tcc.org
nato-int.com
nato-info.com
bmlv-gv.eu
foreignreview.com
mediarea.org
osce-military.org
europeanda.com
softupdates.info
settings-yahoo.com
settings-live.com
delivery-yahoo.com
privacy-yahoo.com
privacy-live.com
westinqhousenuclear.com
webmail.westinqhousenuclear.com

# Reference: https://www.jigsawsecurityenterprise.com/single-post/2017/11/01/Malicious-Documents-Targeting-Security-Professionals
# Reference: https://app.any.run/tasks/8ac81174-d6d0-43d3-b2d2-c26e167a296b/

200200.duckdns.org
357.duckdns.org
ahr0cdovlzkyljiymi4ymdkundkvywn0a.0.d.255.adobeproduct.com
bonjourcheck.com
carlos88.ddns.net
d6231738c34.john-pc.c.mswordupdate17.com
d6238051c34.placehol-6f699a.c.mswordupdate17.com
d6238111c34.placehol-6f699a.c.mswordupdate17.com
d6238158c34.placehol-6f699a.c.mswordupdate17.com
d6238210c34.placehol-6f699a.c.mswordupdate17.com
d6261013c34.placehol-6f699a.c.mswordupdate17.com
d6261024c34.placehol-6f699a.c.mswordupdate17.com
d6261034c34.placehol-6f699a.c.mswordupdate17.com
elaxo.org
fastfileconverter.org
faststoragefiles.org
flashcontentdelivery.net
fsportal.net
googlea.net63.net
hhcghibvywzedwa2iyvsuzzhx8.2.d.255.adobeproduct.com
ikmtrust.com
ip113.ip-91-134-203.eu
jeremizo888.ddns.net
jflynci.com
maskulan.duckdns.org
maskulan.dynu.com
microsoftupdated.com
msoffice-cdn.comns3.cdnmsnupdate.com
myinvestgroup.com
n.3.f.255.adobeproduct.com
n.n.c.255.adobeproduct.com
n.n.c.26055.adobeproduct.com
n.n.c.303ff7b225c14f1498a2.cdnmsnupdate.com
networkschecker.net
ns1.cdnmsnupdate.com
ns2.cdnmsnupdate.com
ns2.ntpupdateserver.com
ns3.cdnmsnupdate.com
peacefund.eu
protectingsearch.com
runssnetworks.com
vascothreatscan.org
w9umi9wrvzsvlvstvfvslbumdfdvda5tl.1.d.255.adobeproduct.com
windows.mswordupdate17.com
windows81.duckdns.org
adobeproduct.com
cdnmsnupdate.com
sdhjjekfp4k.com

# Reference: https://www.threatconnect.com/blog/fancy-bear-leverages-blogspot/

access-apple-login-account.gq
account-activity-verification-login.ga
account-verify-comfirmation-info-login.ga
account-verify-comfirmation-info-login.gq
accountlogin-inc.ga
accountverify-disableinfo-login.gq
alert-new-login-com.ga
apple-realertlogin.gq
appleid-login-appleid.ga
appleid-manageaccountloginupdated.ga
appleidcustomer-servicess-com-loginaccount.ga
appleidcustomer-servicess-com-loginaccount.gq
browsersecurity.ga
change-password.gq
cleantarea-customerlogin-com.ga
clientareasecurity1.gq
clientareasecurity4.gq
com-recoverylogin.gq
com-supportlogin-adminverification.ga
darksecurity.ga
dns-sec-login-apple-invoice-confirmations.ga
dns-webapps-login-account-secure-servers.ga
documentation.gq
documentshandler.ga
emailloginerror.gq
facebook-login-page.gq
failure-login.ga
fileshelp.ga
fileshelp.gq
fileshelpprotut.ga
fileshelpprotut.gq
filestore.gq
goldsecurity.ga
info-apple-login-security.gq
jp-login.gq
locked-service-security.ga
login-bancochile-cl.ga
login-pap-web-access.ga
login-recovery.gq
login-sec-apple-secure-account-updated.ga
login-secure1-mobile.ga
login-unlock-account.ga
login-update-unlock.gq
loginapps-info.ga
loginpaypaas-securityuserid.ga
loginservice-maintanceserversecurity.gq
manage-login.gq
manage-logins.gq
mod-files.ga
mydocuments.gq
newaction-loginactivituresource.ga
newfiles.ga
ns-secures-login-accountjp-updates-community.gq
nursingdocumentation.gq
ourfiles.ga
pdf-document.ga
protector-files.ga
recoverylogin-access.ga
reset-password-com.ga
restore-login-account.gq
review-quilogin.ga
secure-bankofamerica--login-com.ga
secure-bankofamerica--login-com.gq
secure-login-helpid-locked.gq
secure-management-login-account-index-webpass.gq
secure-mobile-login1.gq
secure1-client-login.ga
secure1-client-login.gq
secure1-login-apps.gq
secure5647login-com.ga
security-login-information.gq
securitycenter.ga
securitymail.gq
service-account-home-login.gq
service-autoreset-password-youraccount.ga
service-login-apple-verify-account-locked.gq
servicelogin-access-failed.gq
services-loginaccount.ga
sharefiles.gq
signin-login-php.ga
smtprelayhost.com
srilankadocuments.ga
statement-login-update-info.ga
summary-loginconfirmation.ga
unsecured-login-attempt.ga
verify-login-account-iinformation.ga
verify-login-account-iinformation.gq
welcome-apple-protectyourpassword.gq
www-logined-apple-authsecure.ga

# Reference: https://securelist.com/a-slice-of-2017-sofacy-activity/83930/
# Reference: https://app.any.run/tasks/54a21ac9-f915-4556-8800-6f384fbbc6be/
# Reference: https://app.any.run/tasks/50eb1524-d95b-481e-b9d1-766c0a1fda74/
# Reference: https://app.any.run/tasks/396ccb39-ca44-4ae9-8584-96a8093ffc31/
# Reference: https://app.any.run/tasks/9abe2703-3750-4728-a932-129177b2a72a/

nethostnet.com
hostsvcnet.com
etcrem.net
movieultimate.com
newfilmts.com
fastdataexchange.org
liveweatherview.com
analyticsbar.org
analyticstest.net
lifeofmentalservice.com
meteost.com
righttopregnantpower.com
kiteim.org
adobe-flash-updates.org
generalsecurityscan.com
globalresearching.org
lvueton.com
audiwheel.com
online-reggi.com
fsportal.net
netcorpscanprotect.com
mvband.net
mvtband.net
viters.org
treepastwillingmoment.com
sendmevideo.org
satellitedeluxpanorama.com
ppcodecs.com
encoder-info.tk
wmdmediacodecs.com
postlkwarn.com
shcserv.com
versiontask.com
webcdelivery.com
miropc.org
securityprotectingcorp.com
uniquecorpind.com
appexsrv.net
adobeupgradeflash.com

# Reference: https://twitter.com/DrunkBinary/status/1032706788678950914

unimarkstamp.com
tvopen.online
ndsee.org
lowprt.org
evbrax.org
fbcdn.store

# Reference: https://www.bleepingcomputer.com/news/security/microsoft-disrupts-apt28-hacking-campaign-aimed-at-us-midterm-elections/

my-iri.org
hudsonorg-my-sharepoint.com
senate.group
adfs-senate.services
adfs-senate.email
office365-onedrive.com

# Reference: https://threatconnect.com/blog/using-fancy-bear-ssl-certificate-information-to-identify-their-infrastructure/
# Reference: https://app.any.run/tasks/516fee6f-1b98-40d2-8dd1-65b9c79bd05e/
# Reference: https://app.any.run/tasks/41b1658f-1bb2-4891-8053-9401706b3ff7/
# Reference: https://app.any.run/tasks/09da60cd-710f-4466-9942-c4eb4862e7fb/
# Reference: https://app.any.run/tasks/d6a8d1db-52c8-4371-b6d3-bf740408bb10/
# Reference: https://app.any.run/tasks/516fee6f-1b98-40d2-8dd1-65b9c79bd05e/
# Reference: https://app.any.run/tasks/c841c920-8d04-4164-9e22-a288fb6f91d3/

webversionact.org
cdnverify.net
nomartung.org
mdcrewonline.com
supservermgr.com
europehistoricalmuseum.com
vermasterss.com
webviewres.net
funnymems.com
satellitedeluxpanorama.com
space-delivery.com
nanetsdeb.com
fastphotobucket.com
myinvestgroup.com
travelbern.com
rapidfileuploader.org
viters.org
mvtband.net
wmdmediacodecs.com
spelns.com
lgemon.org
lowprt.org
acrobatportable.com
evbrax.org
gtranm.com
reportscanprotecting.org
runvercheck.com
remsupport.org
noticermk.com
globaltechresearch.org
joshel.com
applecloudupdate.com
akamaisoftupdate.com
wsusconnect.com
apptaskserver.com
appservicegroup.com
ppcodecs.com
dateosx.com
dowssys.com
mvsband.com
microsoftstoreservice.com
microsoftdccenter.com
dvsservice.net
dvsservice.com
akamaitechupdate.com
adobeupdatetechnology.com


# Reference: https://www.virustotal.com/#/ip-address/52.28.203.25

updmanager.com
microsoftdriver.com
windowsappstore.net

# Reference: https://github.com/eset/malware-ioc/blob/master/sednit/part2.adoc

1oo7.net
akamaisoft.com
cloudflarecdn.com
driversupdate.info
kenlynton.com
microsoftdriver.com
microsofthelpcenter.info
nortonupdate.org
softwaresupportsv.com
symantecsupport.org
updatecenter.name
updatesystems.net
updmanager.com
windowsappstore.net
ciscohelpcenter.com
microsoftsupp.com
timezoneutc.com
inteldrv64.com
advpdxapi.com

# Reference: https://github.com/eset/malware-ioc/blob/master/sednit/part1.adoc

aljazeera-news.com
ausameetings.com
bbc-press.org
cnnpolitics.eu
dailyforeignnews.com
dailypoliticsnews.com
defenceiq.us
defencereview.eu
diplomatnews.org
euronews24.info
euroreport24.com
kg-news.org
military-info.eu
militaryadviser.org
militaryobserver.net
nato-hq.com
nato-news.com
natoint.com
natopress.com
osce-info.com
osce-press.org
pakistan-mofa.net
politicalreview.eu
politicsinform.com
reuters-press.com
shurl.biz
stratforglobal.net
thediplomat-press.com
theguardiannews.org
trend-news.org
unian-news.info
unitednationsnews.eu
virusdefender.org
worldmilitarynews.org
worldpoliticsnews.org
worldpoliticsreviews.com
worldpostjournal.com
swsupporttools.com
capisp.com
dataclen.org
mscoresvw.com
windowscheckupdater.net
acledit.com
biocpl.org
wscapi.com
tabsync.net
storsvc.org
winupdatesysmic.com

# Reference: https://pwc.blogs.com/files/tactical-intelligence-bulletin---sofacy-phishing-.pdf

northropgrumman.org.uk
counterterorexpo.com
nato.nshq.in
bostondynamlcs.com
natoexhibitionff14.com
vice-news.com
world-oil-company.com
hushmali.com
mfanews.info
azureon-line.com
us-mg6mail-service.com
mail.telecharger-01.com
ns1.mfanews.org
updatepc.org
ya-support.com
changepassword-hotmail.com
mail.sofexjordanx.com
kavkazcentr.info
webmail.windows-updater.com
abbott-export.com
mfapress.com
www.eurosatory-2014.com
yavuz16.org
mfauz.com
mrthelp.org
egreetingsfrom.us
kitegacc.net
kitegacc.com
mail.rnil.am
hothookup.net
netschecker.com
webmail-saic.com
intuitstatistics.info
flickr-service.com
n0vinite.com
assaas.org
rnil.cl
helpfromhome.co
gdforum.net
set121.com
academl.com
changepassword-yahoo.com
greetingcardproject.com
adawareblock.com
securitypractic.com
rnil.am
ya-login.com
mx1.g0b.mx
product-update.com
memoinfo.ru
privacy-live.com
tolonevvs.com
us-westmail-undeliversystem.com
test.chmail.in
kakashka.chmail.in
gov.hu.com
us-mg6-transfermail-service.com
us-mg6-mailreport.com
aadexpo2014.co.za
www.gdforum.info
militaryinf.com
valuetable.hk
googlesetting.com
hotmail-monitor.com
junlper.net
www.ya-support.com
g-analytics.net
www.sofexjordanx.com
privacy-yahoo.com
yahoo.chmail.in
windous.kz
youtubeclip.org
aa.69.mu
qov.hu.com
vvorthyhands.org
dkvnz.com
mail.account-flickr.com
bulletin-center.com
yovtube.co
skidkaturag.com
defenceiq.us
mail-google.info
soft-storage.com
clickchekkker.com
intuitanalys.com
sofexjordanx.com
intuitstatistic.com
militaryexponews.com
caciltd.com
windows-updater.com
mail.securitypractic.com
www.surll.me
heidelberqcement.com
armypress.org
sweetcherry.org
account-flickr.com
setnewpass-yahoo.com
scanmalware.info
greetingcardsproject.com
q0v.pl
link-google.com
www.forsvaret.co
link-google.com
cubic.com.co
mail.mrthelp.org
www.us-mg7mail-transferservice.com
vvorthyhands.org
www.vljaihln.com
ifcdsc.org
smigroup-online.co.uk
100plusapps.com
pruintco.com
www.yahoo-monitor.com
www.chmail.in
litu.su
www.dkvnz.com
mail.yahoo-monitor.com
us-mg7mail-transferservice.com
evrosatory.com
wind0ws.kz
farnboroughair2014.com
mfa-gov.info
y-privacy.com
login-osce.org
helpmicrosoft.net
sofexjordan2014.com
malwarecheck.info
update-hub.com
mx3.set121.com
srv-yahoo.com
us-westmail-undeliversystem.com
bostondyn.com
aerospacesystem.us.com
eurosatary.com
telecharger-01.com
chmali.ir
privacy.google-settings.com
yandex-site.com
www.7daysinabudhabi.org
www.account-flickr.com
google-settings.com
ns1.greetingcardproject.com
eurosator.com
update-zimbra.com
asisonlline.org
mfapress.org
ya-login.com
stockliquidationgroup.com
pasport-yandex.com
konami-game.com
www.adawareblock.com
persa124.in
eurosatory-2014.com
clickchekker.com
al-wayi.com
molodirect.net
com-0cd.net
us-mg6mailyahoo.com
finance-reports.everyday.com-w13.net
apple-iclouds.com
unizg.net
mfanews.org
mail.ya-support.com
checkmalware.org
geaviations.com
flashsecurity.org
imperialc0nsult.com
cublc.com
evronaval.com
xuetue2013.com
www.valuetable.hk
mail.chmail.in
nshq.in
forsvaret.co
in-eternal-memory-of.com
www.us-westmail-undeliversystem.com
gdforum.info
sex-toy-shop.org
novinitie.com
yahoo-monitor.com
standartnevvs.com
pornforyou.in
mail.q0v.pl
mail.windows-updater.com
allcashin.com
changepassword-yahoo.com
arnf.bg
gpwpl.com
updateapi.longmusic.com
chmail.in
brokersads.com
testservice24.net
kavkazjlhad.com
livemicrosoft.net
surll.me
accesd-de-desjardins.com
mail.hushmali.com
sunmicrosystem.info
bytly.org
mx.rnil.cl
poczta.mon.q0v.pl
ns.mfanews.org
7daysinabudhabi.org
privacy-hotmail.com
ns1.al-wayi.com
ecards-yahoo.com
eurosatory2014.com
yahoo-analytics.com
www.srv-yahoo.com
set133.com

# Reference: https://www.fireeye.com/blog/threat-research/2015/04/probable_apt28_useo.html
# Reference: https://otx.alienvault.com/pulse/55346adeb45ff536ca3ffd2c/

updatecenter.name
securitypractic.com
pass-google.com
drivers-update.info
nato-press.com

# Reference: https://www.symantec.com/security_response/writeup.jsp?docid=2016-031520-4610-99&tabid=2

azureon-line.com
mozilla-plugins.com
mozillaplagins.com

# Reference: https://blog.trendmicro.com/trendlabs-security-intelligence/pawn-storm-ramps-up-spear-phishing-before-zero-days-get-patched/

microsoftstoreservice.com
servicetlnt.net
windowsdefltr.net
appexsrv.net
securityprotectingcorp.com
uniquecorpind.com
versiontask.com

# Reference: https://www.welivesecurity.com/wp-content/uploads/2018/09/ESET-LoJax.pdf

secao.org
ikmtrust.com
sysanalyticweb.com
lxwo.org
jflynci.com
remotepx.net
rdsnets.com
rpcnetconnect.com
webstp.com
elaxo.org

# Reference: https://twitter.com/Bank_Security/status/1048113406597910528
# Reference: https://www.ncsc.gov.uk/content/files/protected_files/article_files/IOC-APT28-malware-advisory.pdf

bbcweather.org
beststreammusic.com
brownvelocity.org
bulgariatripholidays.com
coindmarket.com
creekcounty.net
daysheduler.org
escochart.com
fnbcorporate.co.za
fundseats.com
genericnetworkaddress.com
georgia-travel.org
globaltechengineers.org
iboxmit.com
loungecinemaclub.com
malaytravelgroup.com
moderntips.org
moldtravelgroup.com
narrowpass.net
picturecrawling.com
pointtk.com
politicweekend.com
powernoderesources.com
protonhardstorage.com
thepiratecinemaclub.org
topcinemaclub.com
truefashionnews.com
virtsvc.com
worldimagebucket.com

# Reference: https://twitter.com/Jan0fficial/status/1053227074792706048
# Reference: https://pastebin.com/44bJm0Gf

185.203.118.198/en_action_device/center_correct_customer/drivers-i7-x86.php
45.124.132.127/action-center/centerforserviceandaction/service-and-action.php

# Reference: https://blog.trendmicro.com/trendlabs-security-intelligence/update-pawn-storm-new-targets-politically-motivated-campaigns/

adfs.senate.group
adfs-senate.email
adfs-senate.services
adfs.senate.qov.info
chmail.ir.udelivered.tk
webmail-ibsf.org
fil-luge.com
biathlovvorld.com
mail-ibu.eu
fisski.ca
iihf.eu

# Reference: https://unit42.paloaltonetworks.com/unit42-sofacy-continues-global-attacks-wheels-new-cannon-trojan/

188.241.58.170/local/s3/filters.php
188.241.58.170/live/owa/office.dotm
200.122.181.25/catalog/products/books.php

# Reference: https://unit42.paloaltonetworks.com/dear-joohn-sofacy-groups-global-campaign/

188.241.58.170/local/s3/filters.php
185.203.118.198/en_action_device/center_correct_customer/drivers-i7-x86.php
145.249.105.165/resource-store/stockroom-center-service/check.php
109.248.148.42/agr-enum/progress-inform/cube.php

# Reference: https://www.emanueledelucia.net/apt28-sofacy-seduploader-under-the-christmas-tree/

photopoststories.com

# Reference: https://asert.arbornetworks.com/lojax-fancy-since-2016/

elaxo.org
hp-apps.com
jflynci.com
moldstream.md
msfontserver.com
ntpstatistics.com
oiagives.com
oiatribe.com
peacefund.eu
regvirt.com
remotepx.net
sysanalyticweb.com
treckanalytics.com
unigymboom.com
visualrates.com
vsnet.co
webstp.com

# Reference: https://www.accenture.com/t20190213T141124Z__w__/us-en/_acnmedia/PDF-94/Accenture-SNAKEMACKEREL-Threat-Campaign-Likely-Targeting-NATO-Members-Defense-and-Military-Outlets.pdf

photopoststories.com
proposalprogram.com

# Reference: https://twitter.com/kyleehmke/status/1105151293486710785

radioplaymusicus.com
servertest123.tk

# Reference: https://threatconnect.com/finding-nemohost-fancy-bear-infrastructure/
# Note: SSL certificate f27c4270b9b9291f465ba5962c36ce38f438377acff300b5c82b3b145f0c9e94

90update.com
aljazeera-news.com
ambcomission.com
ckgob.com
connectsmd.net
cryptokind.com
deshcoin.com
dmsclock.org
dochardproofing.com
driverfordell.com
ebramka.info
fes-auth.com
hello76.com
hostedopenfiles.net
hostsvcnet.com
intelstatistics.com
kiteim.org
knightconsults.com
kremotevn.net
lasarenas.lt
lopback.com
megauploadfiles.org
ndsee.org
nemaskalitnium.com
neoderb.com
netcorpscanprotect.com
nethostnet.com
networkfilehosting.com
networkxc.net
news-almasirah.net
newsfromsource.com
perfect-remote-service.com
platnosci.biz
postmarksmtp.com
probenet.eu
remnet.org
remonitor.net
remotemanagesvc.net
remsvc.net
rhfcoin.com
sa7efa.com
searchbrain.net
serbview.com
showitem.lt
societyatcuriousteacher.com
spelns.com
startthedownload.com
systemfromcuriousmoment.com
unisecproper.org
unitedprosoftcompany.org
uploadsforyou.com
wintwinbtc.com
wmiapp.com
zpfgr.com

# Passive DNS for sofacy sinkhole 52.45.178.122 (on 2019-03-13)

1oo7.net
34564414564.com
5thelementq8.com
645547657668787.com
access-google.com
acledit.com
adobeincorp.com
adobeproduct.com
adobeupdater.org
advpdxapi.com
akamaicachecdn.com
akamaisoftupdate.com
apple-checker.org
applecloudupdate.com
apple-iclods.org
apple-search.info
apple-uptoday.org
app-submitcentre.com
autoupdater.org
blacktivist.info
bonjourcheck.com
brownvelocity.org
cdnmsnupdate.com
checkmalware.info
checkmalware.org
checkwinframe.com
cleanphonetrksftware.com
cloudflarecdn.com
dateosx.com
decisionoverpregnantroad.com
dncvotebuilder.com
drivers-update.info
driversupdate.info
dvsservice.net
ecitcom.net
egypressoffice.com
eservicesystems.net
evbrax.org
extad.info
extstat.info
fastdataexchange.org
fastfileconverter.org
faststoragefiles.org
fbcdn.store
fsportal.net
generalsecuritycorp.org
globaltechresearch.org
gtranm.com
hubsg.net
iboxmit.com
iforgot-verification.com
intelmeserver.com
jflynci.com
kenlynton.com
legacydiner.org
lgemon.org
linuxkrnl.net
log-in-osce.org
login-security-center.com
lowprt.org
malwarecheck.info
meteost.com
micoft.com
microsofi.org
microsoftupdated.com
miropc.org
mlidef.com
msrdr.com
msrwr.com
mswordupdate17.com
mvband.net
mvsband.com
mvtband.net
nanetsdeb.com
naoasch.com
natoexhibitionff14.com
ndsee.org
netcorpscanprotect.com
networkschecker.net
newfilmts.com
nortonupdate.org
noticermk.com
petropershiyinukra.com
pldtprv.net
pointtk.com
rapidfileuploader.org
rdsnets.com
remsupport.org
reportscanprotecting.org
reservecorpind.com
rpcnetconnect.com
runssnetworks.com
runvercheck.com
satellitedeluxpanorama.com
scanmalware.info
sdhjjekfp4k.com
secao.org
secnetcontrol.com
securitysls.com
securityupdatereport.com
servicecorptech.com
servicesecupdate.com
servicetlnt.net
service-usa-tre.info
smtprelayhost.com
soft-storage.com
softwaresupportsv.com
softwaresupportsv.name
soligro.com
space-delivery.com
spelns.com
statisticsnetworks.com
supservermgr.com
svit-zer.com
tablebeforehelpfulperson.com
testservice24.net
treckanalytics.com
treepastwillingmoment.com
tvopen.online
uber-mails.com
um10eset.net
umizg.org
unimarkstamp.com
updatepc.org
updatesoftware24.com
updatesvcsys.com
updatesystem.info
updatesystems.net
vascothreatscan.org
vermasterss.com
viters.org
watertolargeprice.com
webstp.com
windowsdefltr.net
wmdmediacodecs.com
wsusconnect.com

# Passive DNS for sofacy sinkhole 52.45.178.122 (on 2020-01-14)

1oo7.net
acledit.com
adobeincorp.com
adobeupdater.org
akamaisoftupdate.com
ambcomission.com
analyticsrequest.com
appservicegroup.com
as23-updater-symantec.org
bbcweather.org
brownvelocity.org
cdnverify.net
cgna.info
checkmalware.info
checkmalware.org
cmdswitch.xyz
coindmarket.com
docs77.com
drivers-update.info
driversupdate.info
dxtveuux.com
eservicesystems.net
esetsmart.org
eskvortsov.com
experiencewithweakkid.com
extstat.info
fastfileconverter.org
faststoragefiles.org
ikmtrust.com
intelmeserver.com
kenlynton.com
linuxkrnl.net
malwarecheck.info
meteost.com
ministernetwork.org
miropc.org
msrwr.com
mvband.net
mysent.org
nanetsdeb.com
netcorpscanprotect.com
nethostnet.com
newfilmts.org
nomartung.org
ntpstatistics.com
pandadefender.com
powerpolymerindustry.com
ppcodecs.com
rapidfileuploader.org
rdsnets.com
reasonwithusefulpolicy.com
reservecorpind.com
rpcnetconnect.com
scanmalware.info
servicetlnt.net
soft-storage.com
softwaresupportsv.name
soligro.com
sourcerepolist.org
statisticsnetworks.com
streetunderrelevantpeople.com
svit-zer.com
systembeforeniceparent.com
tablebeforehelpfulperson.com
testservice24.net
thepiratecinemaclub.org
treepastwillingmoment.com
umizg.org
unimarkstamp.com
updatesoftware24.com
updatesystems.net
varuhusmc.org
virtsvc.com
watertolargeprice.com

# Reference: https://twitter.com/VK_Intel/status/1092324957772750848

/company-device-support/values/correlate-sec.php

# Reference: https://twitter.com/Mao_Ware/status/1092797858301034496

/action-center/centerforserviceandaction/service-and-action.php

# Reference: https://twitter.com/VK_Intel/status/1088145389356806146

/locale/protocol/volume.php

# Reference: https://twitter.com/VK_Intel/status/1076912689119748096

/technet-support/library/online-service-description.php

# Reference: https://twitter.com/VK_Intel/status/1075307666434600960

/advanced/portable_version/service.php

# Reference: https://twitter.com/blackorbird/status/1107593605252677633

appleupdate.org 

# Reference: https://twitter.com/kyleehmke/status/1105151293486710785

radioplaymusicus.com
servertest123.tk

# Reference: https://twitter.com/dewan202/status/1107348923826491392
# Reference: https://www.virustotal.com/gui/ip-address/104.171.117.216/relations

http://104.171.117.216
goldenbuckz.com
zoomailer.org

# Reference: https://unit42.paloaltonetworks.com/unit42-sofacy-uses-dealerschoice-target-european-government-agency/

ndpmedia24.com

# Reference: https://twitter.com/kyleehmke/status/1113085089909440513

historicalfilms720hd.com
jazzradiostream.com
rockradiostream.com
msofficelab.com
onlineubersplit.com
renodesmart.com

# Reference: https://twitter.com/VK_Intel/status/1115080282221293568

/supptech18i/suppid.php
/fdfd_iunub_hhert_ps.php

# Reference: https://twitter.com/Bank_Security/status/1115130011160383488
# Reference: https://pastebin.com/atN2w5SE
# Reference: https://github.com/blackorbird/APT_REPORT/blob/master/APT28/IOC/2019-04-05-ioc-mark.txt
# Reference: https://otx.alienvault.com/pulse/5cab3bf39e861d5e97554699

beatguitar.com
/agr-enum/progress-inform/cube.php
/local/s3/filters.php
/zx-system/core/main-config.php
/en_action_device/center_correct_customer/drivers-i7-x86.php
/db-module/version_1594/main.php
/Verifica-El-Lanzamiento/Ayuda-Del-Sistema/obtenerId.php
/action-center/centerforserviceandaction/service-and-action.php
/company-device-support/values/correlate-sec.php
/SupportA91i/syshelpA774i/viewsupp.php
/technet-support/library/online-service-description.php
/resource-store/stockroom-center-service/check.php
/technet-support/library/online-service-description.php
/advance/portable_version/service.php
/pkg/image/do.php

# Reference: https://blog.yoroi.company/research/apt28-and-upcoming-elections-possible-interference-signals/

functiondiscovery.net

# Reference: https://otx.alienvault.com/pulse/5ce65ec381f415c7dc794d41

/action-center/centerforserviceandaction/service-and-action.php

# Reference: https://www.virustotal.com/#/file/b40909ac0b70b7bd82465dfc7761a6b4e0df55b894dd42290e3f72cb4280fa44/community
# Reference: https://otx.alienvault.com/pulse/5cefdae12f7645afa995961e

experiencewithweakkid.com
maylaytravelgroup.com
reasonwithusefulpolicy.com
schooltillhungryprocess.com
streetunderrelevantpeople.com
systembeforeniceparent.com

# Reference: https://securelist.com/zebrocys-multilanguage-malware-salad/90680/

http://94.156.189.120
rammatica.com
raveston.com
/manual/current/symphony.php

# Reference: https://twitter.com/ClearskySec/status/1139160272755744774

fatherinfriendlyroad.com
guytillintelligentposition.com
networkcentrals.com
newstyleradio.net

# Reference: https://community.riskiq.com/projects/8b14d778-99be-d744-af06-36ffc0937b38

sportever.org

# Reference: https://community.riskiq.com/projects/47b45f6d-3b11-2082-0c04-dd8720fd3b67

bulgariaholidays.bg
escochartzone.com
thesocialstrategies.com
tripadvicecommunity.com
worldchanneltour.com

# Reference: https://community.riskiq.com/projects/6290b968-d907-d5fb-c31e-9b7bf830ec2c

golivecamp.net

# Reference: https://twitter.com/VK_Intel/status/1145270462559195137

 http://213.252.245.32/ControllerReset/view/register/comid/sid.php

# Reference: https://twitter.com/daphiel/status/1148128770014011392

onedrv-live.com
onedrive-sharedfile.com
microsoft-onthehub.com
my-sharepoints.com
my-sharefile.com

# Reference: https://www.vice.com/en_us/article/vvaxy8/evidence-linking-russian-hackers-fancy-bear-to-macron-phishing

accounts-office.fr
en-marche.co
mail-en-marche.fr
onedrive-en-marche.fr
portal-office.fr

# Reference: https://twitter.com/kyleehmke/status/1150834700069552130
# Reference: https://otx.alienvault.com/pulse/5d2db9cc8e1eb4d4d4be15e5

office365-osf.am
office365-osi.am
osfam.events
osfam.team
soros-my-sharepoint.com

# Reference: https://msrc-blog.microsoft.com/2019/08/05/corporate-iot-a-path-to-intrusion/

128.199.199.187:443
167.114.153.55:443
31.220.61.251:443
82.118.242.171:443
94.237.37.28:443

# Reference: https://medium.com/@rsatter/decoding-the-gru-indictment-bfb2c08fe362
# Reference: https://otx.alienvault.com/pulse/5d88c12375a272432c4cd9ec

cyb3rc.com
electionleaks.com
linuxkrnl.net

# Reference: https://twitter.com/pancak3lullz/status/1176856452780179456

http://185.221.202.35/software-protection/app.php

# Reference: https://threatconnect.com/blog/how-to-investigate-incidents-in-threatconnect/

office365-microsoft.com
syrianhrc.org
aljazeera-news.com
unian-news.info
mastconf.com
farele.co
mofa.farele.co
yandex-control.ru
pentestinglab.com
accountgooogle.com
accounts-gooogl.com
accountsgooglemail.com
afghanistanmfa.net
webmail.afghanistanmfa.net
akragames.net
pus.akragames.net
cloudmicrosoft365.com
cryptogo.net
#dcleaks.com
gooogle-login.com
gov-kw.com
mail.kuwaitarmy.gov-kw.com
live-settings.com
login-one.com
mail-hurriyet.com
mailtransferservice.com
newsweekadviser.com
posta-hurriyet.com
smtprelayhost.com
unrightswire.org
mx.unrightswire.org
mail.unrightswire.org
privacy-yandex.ru
emailyandex.ru
action-yandex.ru
report-yandex.ru
yandex-report.ru
service-yandex.ru
activity-yandex.ru
settinqs-yandex.ru
mail-service-yandex.ru
int-live.com
mailsettings-yandex.ru
yandex-report.ru
yandex-control.ru
e-mail-supports.com
team-google.com
accounts-qooqle.com
google-password.com
drive-google.ga
google-login.ml
google-password.ml
top-total.com
drive-auth.com
password-google.com
account.password-google.com
ftp.password-google.com
redirect.screenameaol.com
myaccountgoogle.ga
markburgston.com
service-yandex.ru
delivery-yandex.ru
settinqs-yandex.ru
yandex-site.com
pasport-yandex.com
gdforum.net
gdforum.info
google-passwd.com
hurriyet.org.uk

# Reference: https://twitter.com/kyleehmke/status/1186114823341400064

ovhsec.com

# Reference: https://meltx0r.github.io/tech/2019/10/24/apt28.html
# Reference: https://otx.alienvault.com/pulse/5db2cff18faf1f1d826cd074

pavlodar.news
/modules/Contact/Includes/1c.php
/modules/Contact/Includes/2c.php

# Reference: https://twitter.com/LastlineLabs/status/1022865021343330305

secao.com

# Reference: https://twitter.com/Vishnyak0v/status/1197129423830626318

http://37.120.140.215
http://79.142.70.106

# Reference: https://cdn.area1security.com/reports/Area-1-Security-PhishingBarismaHoldings.pdf
# Reference: https://otx.alienvault.com/pulse/5e1da5a3ca48088035ce6c5a
# Reference: https://twitter.com/kyleehmke/status/1207779048086286336
# Reference: https://twitter.com/kyleehmke/status/1216905172305227776

cubenergy-my-sharepoint.com
dpkshodnya-mysharepoint.com
hudsonorg-my-sharepoint.com
esco-plvnlch.com
kub-gas.com
kvatral95.com
minjust-gov-ua.com
my-ukr.net
soros-my-sharepoint.com

# Reference: https://twitter.com/ydklijnsma/status/1218599851669233666

184.95.51.172
liveserviceonedrive.com     # pDNS
78.142.19.114
photosyncdrive.com          # pDNS
80.255.3.116
gecurrenttime.com           # pDNS
193.70.80.214
aeroservicemax.com          # pDNS
185.141.63.103
scalingreserve.com          # pDNS
109.169.15.73
ovhsec.com                  # pDNS
178.32.251.98
placeuntilknownparent.com   # pDNS

# Reference: https://twitter.com/kyleehmke/status/1286779311626870791
# Reference: https://twitter.com/kyleehmke/status/1286779313384312834

revampme.net

# Reference: https://www.proofpoint.com/us/threat-insight/post/apt28-racing-exploit-cve-2017-11292-flash-vulnerability-patches-are-deployed
# Reference: https://blog.angelalonso.es/2017/10/hunting-apt28-cve-2017-11292-flash.html?m=0
# Reference: https://www.virustotal.com/gui/file/362a8297a0ff603553e992626a8e28c0aa19d038557da82fe6f4526988601be7/behavior/Tencent%20HABO

blackpartshare.com
mountainsgide.com
contentdeliverysrv.net
space-delivery.com

# Reference: https://doc.emergingthreats.net/bin/view/Main/2023662

gpufps.com

# Reference: https://www.trendmicro.com/vinfo/us/security/news/cyber-attacks/probing-pawn-storm-cyberespionage-campaign-through-scanning-credential-phishing-and-more
# Reference: https://otx.alienvault.com/pulse/5e736669fcc47a29220ce3f0

0x4fc271.tk
0xf4a5.tk
0xf4a54cf56.tk
546874.tk
change-password.ml
id24556.tk
id451295.com
id6589.com
yahoo-change-password.com

# Reference: http://www.hexcapes.com/sofacy-in-poland/

picturecrawling.com
popdancestream.com
webchartzone.com

# Reference: https://www.vkremez.com/2018/12/lets-learn-dissecting-apt28sofacy.html

http://89.37.226.123/advance/portable_version/service.php

# Reference: https://documents.trendmicro.com/assets/appendix_looking-into-a-cyber-attack-facilitator-in-the-netherlands.pdf
# Reference: https://vxcube.com/recent-threats-ioc/5c74c73ca39bb5786f9664d3/detail

aijazeera.org
blu172maillive.com
catholicsinaliance.org
cc-yahoo-inc.org
defensenews.org
edit-mail-yahoo.com
e-post.byegm.web.tr
eservicesystems.net
euroreport24.com
help-yahoo-service.com
int-live.com
iraqinews.info
itunes-helper.net
live-settings.com
loqin-yandex.ru
mail.byegm.web.tr
mail.g0v.me
mailhost.university-tartu.info
mailhost-ut.ee
mail-hurriyet.com
mail-justus.com.ua
mail.kuwaitarmy.gov-kw.com
mailmil.ae
mail.mofa.g0v.qa
mail-navy.ro
mail.rsaf.qov.sa.com
mail.teiecomitalia.it
mfagreece.com
military-info.eu
mobile-sanoma.net
mycloud-mail.ru
nato-news.com
options-mail.ru
osce-info.com
osce-press.com
pasport-yandex.ru
poczta.mon-gov.pl
posta-hurriyet.com
privacy-facebook.me
privacy-yahooservice.com
redirect2app.cf
reuters-press.com
rn-mail.ru
service-ukr.net
service-yahoo.com
setting-mail.ru
tbmm.qov.web.tr
unbulletin.com
webmail-gov.me
webmail-mil.gr
webmail.mofa.qov.ae
worldpoliticsreviews.com
wsjworld.com
yahoo.securepassword.info

# Reference: https://www.vkremez.com/2019/01/lets-learn-progression-of-apt28-autoit.html
# Reference: https://www.virustotal.com/gui/ip-address/145.249.106.198/relations
# Reference: https://www.virustotal.com/gui/ip-address/185.236.203.53/relations
# Reference: https://www.virustotal.com/gui/file/5b52bc196bfc207d43eedfe585df96fcfabbdead087ff79fcdcdd4d08c7806db/detection
# Reference: https://www.virustotal.com/gui/file/384c9a19dd6f0f73bee575e54801f9608883ae31db1b399a28b8cc5f7aa9a26c/detection

http://80.255.6.5
http://185.236.203.53
http://194.187.249.126
http://220.158.216.127
145.249.106.198:443
185.236.203.53:443

# Reference: https://twitter.com/ShadowChasing1/status/1251164774982795266

bohack51.ddns.net

# Reference: https://twitter.com/dewan202/status/1255582744110862345
# Reference: https://www.virustotal.com/gui/file/7edacdf35900e722b798dbc891159cf1ede9f6d671a86b0f01f9ef802202aa73/detection
# Reference: https://www.virustotal.com/gui/ip-address/185.77.129.152/relations
# Reference: https://www.virustotal.com/gui/ip-address/93.115.38.132/relations

http://185.77.129.152
http://93.115.38.132
/wwpydsmrulkdp/arpz/

# Reference: https://twitter.com/Vishnyak0v/status/1257606954085646337

http://185.221.202.36
/overstock/brand.php

# Reference: https://www.virustotal.com/gui/ip-address/23.227.196.215/relations

http://23.227.196.215

# Reference: https://twitter.com/Vishnyak0v/status/1269651391980736513

http://185.234.52.168
/categories/buildings.php

# Reference: https://app.any.run/tasks/0f0eb583-abcf-4e0f-a803-2b1d3bfdfe47/

http://89.37.226.148

# Reference: https://twitter.com/ShadowChasing1/status/1291931828723408896
# Reference: https://www.virustotal.com/gui/file/aac3b1221366cf7e4421bdd555d0bc33d4b92d6f65fa58c1bb4d8474db883fec/detection
# Reference: https://quointelligence.eu/2020/09/apt28-zebrocy-malware-campaign-nato-theme/
# Reference: https://otx.alienvault.com/pulse/5f6a13f6bd6ff146fa3967de

http://194.32.78.245
/protect/get-upd-id.php

# Reference: https://media.defense.gov/2020/Aug/13/2002476465/-1/-1/0/CSA_DROVORUB_RUSSIAN_GRU_MALWARE_AUG_2020.PDF
# Reference: https://otx.alienvault.com/pulse/5f3581cc4138be1d82c183b8

http://185.86.149.125

# Reference: https://www.virustotal.com/gui/file/02de72e43d578c45d9d6359299cb2d47771081617ff01363b736414eb831deea/detection

http://69.90.132.215

# Reference: https://www.virustotal.com/gui/file/76f8f159637c9201e98ed1aab5e0359ea983c5cce8ced832bae13dffab0f73a8/detection

bl4kj2.zapto.org

# Reference: https://twitter.com/Vishnyak0v/status/1310861022954225664
# Reference: https://www.virustotal.com/gui/file/7f698295230f59c7ca8193322eb48d71cd203f3675139f2da99e326589bfdad3/detection
# Reference: https://www.virustotal.com/gui/file/e23b7a912f6bd16d634a1acce41922f277242ec8ab9c354754b5e97a0bab85d0/detection

http://31.7.62.103

# Reference: https://www.welivesecurity.com/2018/04/24/sednit-update-analysis-zebrocy/

http://185.25.50.93
http://185.25.51.114
http://185.25.51.164
http://185.25.51.198
http://185.77.129.152
http://188.241.68.121
http://194.187.249.126
http://213.103.67.193
http://213.252.244.219
http://213.252.245.132
http://220.158.216.127
http://222.15.23.121
http://46.102.152.127
http://46.183.223.227
http://80.255.6.5
http://86.105.18.106
http://86.105.18.111
http://86.106.131.177
http://89.249.65.166
http://89.249.65.234
http://89.40.181.126
http://89.45.67.153
http://93.113.131.117
http://93.113.131.155
http://93.115.38.132
/test-update-16-8852418/temp727612430/checkUpdate89732468.php
/test-update-17-8752417/temp827612480/checkUpdate79832467.php
/syshelp/kd8812u/protocol.php
/syshelp/kd8812u/
/tech99-04/litelib1/setwsdv4.php
/tech99-04/litelib1/
/setwsdv4.php
/techicalBS391-two/supptech18i/suppid.php
/get-help-software/get-app-c/error-code-lookup.php
/srv_upd_dest_two/destBB/en.php
/stream-upd-service-two/definition/event.php
/wWpYdSMRulkdp/arpz/MsKZrpUfe.php
/update/dB-Release/NewBaseCheck.php
/database-update-centre/check-system-version/id=18862.php
/security-services-DMHA-group/info-update-version/id77820082.php
/ghflYvz/vmwWIdx/realui.php
/client-update-info/version-id/version333.php
/cumulative-security-update/Summary/details.php
/search-release/Search-Version/crmclients.php
/setting-the-os-release/Support-OS-release/ApiMap.php
/search-sys-update-release/base-sync/db7749sc.php
/db7749sc.php
/gft_piyes/ndhfkuryhs09/fdfd_iunb_hhert_ps.php
/ndhfkuryhs09/
/fdfd_iunb_hhert_ps.php
/services-check-update/security-certificate-11-554/CheckNow864.php
/CheckNow864.php
/daily-update-certifaicates52735462534234/update-15.dat/
/LoG-statistic8397420934809/date-update9048353094c/StaticIpUpdateLog23741033.php
/StaticIpUpdateLog23741033.php
/apps.update/DetailsID/clientPID-118253.php
/data-extract/timermodule/update-client.php
/debug-info/pluginId/CLISD1934.php
/ram-data/managerId/REM1234.php
/versionID/Plugin0899/debug-release01119
/UpdateCertificate33-33725cnm^BB/CheckerNow-saMbA-99-36^11/CheckerSerface^8830-11.php
/srvSettings/conf4421i/
/srvSettings/conf4421i/support.php
/SupportA91i/syshelpA774i/
/SupportA91i/syshelpA774i/viewsupp.php
/clientid-and-uniqued-r2/the-differenceU/Events76.php
/int-release/check-user/userid.php
/guard-service/Servers-ip4/upd-release
/verification-online/service.911-19/check-verification-88291.php
/grenadLibS44-two/fIndToClose12t3/sol41.php
/supportfsys/t863321i/func112SerErr.php
/func112SerErr.php
/KB7735-9927/security-serv/opt.php
/Verifica-El-Lanzamiento/Ayuda-Del-Sistema/obtenerId.php
/wWpYdSMRulkdp/arpz/MsKZrpUfe.php
/wWpYdSMRulkdp/arpz/
/wWpYdSMRulkdp/
/MsKZrpUfe.php

# Reference: https://us-cert.cisa.gov/ncas/analysis-reports/ar20-303b
# Reference: https://otx.alienvault.com/pulse/5f9b0ac2ac1088826c07eb3b
# Reference: https://www.virustotal.com/gui/file/2631f95e9a46c821a701269a76b15bb065764cc15a0b268a4d1eac045975c9b8/detection
# Reference: https://www.virustotal.com/gui/file/0be114fe30ef5042890c17033b63d7c9e0363972fcc15a61433c598dd33f49d1/detection

23.200.147.10:80

# Reference: https://www.intezer.com/blog/research/russian-apt-uses-covid-19-lures-to-deliver-zebrocy/
# Reference: https://otx.alienvault.com/pulse/5fd10cde3563e4121cbab5c7

support-cloud.life
/managment/cb-secure/technology.php
/technet-support/library/online-service-description.php

# Reference: https://twitter.com/Arkbird_SOLG/status/1336834398784786432

http://185.77.131.110
http://46.183.218.34
http://80.255.12.252
http://92.114.92.128
drive365us.com

# Reference: https://s3.amazonaws.com/snort-org/www/rules/community/community-rules.tar.gz
# Reference: https://snort-org-site.s3.amazonaws.com/production/release_files/files/000/012/156/original/snort3-community-rules.tar.gz

baltichost.org

# Reference: https://twitter.com/RedDrip7/status/1362343352759250946
# Reference: https://otx.alienvault.com/pulse/602fe96189be26708dfafe17/
# Reference: https://www.virustotal.com/gui/file/1dd03c4ea4d630a59f73e053d705185e27e2e2545dd9caedb26a824ac5d11466/detection
# Reference: https://www.virustotal.com/gui/file/3b548a851fb889d3cc84243eb8ce9cbf8a857c7d725a24408934c0d8342d5811/detection

c4csa.org/includes/sources/felims.php
xbhp.com/dominargreatasianodyssey/wp-content/plugins/akismet/style.php

# Reference: https://twitter.com/cluster25_io/status/1400467624912318470
# Reference: https://cluster25.io/wp-content/uploads/2021/05/2021-05_FancyBear.pdf (# SkinnyBoy)
# Reference: https://www.virustotal.com/gui/ip-address/194.33.40.72/relations
# Reference: https://www.virustotal.com/gui/ip-address/5.149.253.45/relations

getstatpro.com
updaterweb.com

# Reference: https://www.intezer.com/blog/malware-analysis/targeted-phishing-attack-against-ukrainian-government-expands-to-georgia/
# Reference: https://otx.alienvault.com/pulse/60eff240c7c9cb4f24907049
# Reference: http://report.threatbook.cn/ST.pdf

000000027.xyz
1000018.xyz
1000020.xyz
1221.site
15052021.space
1681683130.website
16868138130.space
1833.site
2055.site
2215.site
2f9348243249382479234343284324023432748892349702394023.xyz
32689657.xyz
32689658.xyz
33655990.cyou
29572459487545-4543543-543534255-454-35432524-5243523-234543.xyz
4895458025-4545445-222435-9635794543-3242314342-234123423728.space
512521525-5245451515-985978774-2341235146436.xyz
9348243249382479234343284324023432748892349702394023.xyz
9832473219412342343423243242364-34939246823743287468793247237.site
99kg.site
coronavirus5g.site
name1d.site
name4050.com

# Reference: https://www.virustotal.com/gui/ip-address/45.146.164.37/relations
# Reference: https://www.virustotal.com/gui/file/b72188ba545ad865eb34954afbbdf2c9e8ebc465a87c5122cebb711f41005939/detection

150520212.space
150520213.space
32689659.xyz
99996665550.fun
getvps.site

# Reference: https://twitter.com/billyleonard/status/1446226367008313344

service-reset-password-moderate-digital.rf.gd
reset-service-identity-mail.42web.io
digital-email-software.great-site.net

# Reference: https://github.com/ti-research-io/ti/blob/main/ioc_extender/ET_APT28.json

cdn-nrdata.live
checklogin.in
ciscosupports.com
dancemusicstream.com
doorbehindentirerelationship.com
familynearbysuitablenumber.com
groupsincevisibleend.com
hostapp.link
hourduringstrictsense.com
memcached.in
msrole.com
nationalzonehouse.com
outlook-update.live
powerfromfamousbank.com
systembetweendifficultquality.com
utmserver.com

# Reference: https://twitter.com/billyleonard/status/1482034733072752640

consumerpanel.eu3.biz
consumerpanel.eu3.org
consumerspanelsrv.eu3.org
protectpanel.eu3.biz
updateservicecenter.blogspot.com

# Reference: https://www.trellix.com/en-us/about/newsroom/stories/threat-labs/prime-ministers-office-compromised.html
# Reference: https://www.virustotal.com/gui/file/1ee602e9b6e4e58dfff0fb8606a41336723169f8d6b4b1b433372bf6573baf40/detection

jimbeam.live
wordkeyvpload.net
wordkeyvpload.org

# Reference: https://blog.bushidotoken.net/2022/01/tracking-renewable-energy-intelligence.html
# Reference: https://otx.alienvault.com/pulse/61e6de4edebb498761384f2a

alphabitconsulting.com
armaghanteb.com
centralinsumos.com.bo
cercoselectricos.cl
englishlessons-houston.com
flammaautomoveis.com.br
primage.com.br
pwametalurgica.com.br
quadteximagery.com
saleswarriorinc.com
saojoaodaurtigars.com.br

# Reference: https://blog.google/threat-analysis-group/update-threat-landscape-ukraine/

consumerspanel.frge.io
hatdfg-rhgreh684.frge.io
id-unconfirmeduser.frge.io
ua-consumerpanel.frge.io

# Reference: https://cert.gov.ua/article/40102 (Ukrainian)

eo2mxtqmeqzafqi.m.pipedream.net

# Reference: https://blog.malwarebytes.com/threat-intelligence/2022/06/russias-apt28-uses-fear-of-nuclear-war-to-spread-follina-docs-in-ukraine/
# Reference: https://cert.gov.ua/article/341128 (# Ukrainian)
# Reference: https://www.virustotal.com/gui/file/daaa271cee97853bf4e235b55cb34c1f03ea6f8d3c958f86728d41f418b0bf01/detection

kitten-268.frge.io
kompartpomiar.pl/grafika/

# Reference: https://twitter.com/teamcymru_S2/status/1540390953516765185

caribou-forge-server.new.c66.me
monkey-129.getforge.site

# Reference: https://blog.cluster25.duskrise.com/2022/09/23/in-the-footsteps-of-the-fancy-bear-powerpoint-graphite/

9b5uja.am.files.1drv.com
kdmzlw.am.files.1drv.com

# Reference: https://www.virustotal.com/gui/file/87f363afc9778efc78dd3e0ced112d8d66a09a8924091f0927ed02a7b64850d2/detection

http://109.248.148.42

# Reference: https://twitter.com/angel11VR/status/1636474327926206470
# Reference: https://pastebin.com/FJDa0MA8

http://85.195.206.7
85.195.206.7:445

# Reference: https://twitter.com/RedDrip7/status/1640342052327108609
# Reference: https://www.virustotal.com/gui/file/ece085c17ac5e822b78c533366e725bc845e215dcda78c0502ebd7f33ccb06ed/detection

http://5.199.162.132
5.199.162.132:445

# Reference: https://unit42.paloaltonetworks.com/threat-brief-cve-2023-23397/
# Reference: https://unit42.paloaltonetworks.com/russian-apt-fighting-ursa-exploits-cve-2023-233397/

http://101.255.119.42
http://113.160.234.229
http://168.205.200.55
http://181.209.99.204
http://185.132.17.160
http://213.32.252.221
http://24.142.165.2
http://42.98.5.225
http://61.14.68.33
http://69.162.253.21
http://69.51.2.106
http://82.196.113.102
101.255.119.42:445
113.160.234.229:445
168.205.200.55:445
181.209.99.204:445
185.132.17.160:445
213.32.252.221:445
24.142.165.2:445
42.98.5.225:445
61.14.68.33:445
69.162.253.21:445
69.51.2.106:445
82.196.113.102:445

# Reference: https://twitter.com/StopMalvertisin/status/1653441365496459270
# Reference: https://cert.gov.ua/article/4492467 (Ukrainian)

mockbin.org/bin/4aa17a07-7635-4ee0-9f3a-449fcd91f342
mockbin.org/bin/b8427b58-7497-46cd-a5b2-6ff6a40b4592
mockbin.org/bin/e8bfd045-2b14-4afc-9372-b723f7d76918
run.mocky.io/v3/1e88179a-3105-4a5c-9eb3-aebea36e9c21
run.mocky.io/v3/3b44f33d-b6e5-4ec6-b120-99b6ac52f74b
run.mocky.io/v3/a261411d-b869-4877-86f5-307e32ed6afa
run.mocky.io/v3/a4b6625c-226e-4dbc-baec-1dbd854b8015
run.mocky.io/v3/acea62da-ca05-46d1-bb80-0b036af7467c
run.mocky.io/v3/ef206b51-4cf4-4c93-90bf-1e66673315b0
run.mocky.io/v3/ef4c7798-fc09-42cd-8431-91a22d5728d9

# Reference: https://twitter.com/cyber__sloth/status/1677068498625867777
# Reference: https://twitter.com/Cyber0verload/status/1677361473427841029
# Reference: https://www.virustotal.com/gui/file/4df72b051d8e3b97640ea3819da75ffb34df75aeb40403edb3e8482a8465dfab/detection

62.4.36.126:8880

# Reference: https://blog.sekoia.io/apt28-leverages-multiple-phishing-techniques-to-target-ukrainian-civil-society/
# Reference: https://otx.alienvault.com/pulse/64676e2dffb6057207af2037

config-panel.frge.io
packinstall.kozow.com
panelunregistertle-348.frge.io
setnewcred.ukr.net.frge.io
settings-panel.frge.io
smtp-relay.frge.io
ukrprivacysite.frge.io

# Reference: https://cert.gov.ua/article/5105791 (Ukrainian)

37.191.122.186:3578
eopkne8kapj01xi.m.pipedream.net
eos93vb2cwsu3xf.m.pipedream.net
mail-gov-ua.frge.io
setnewcred.ukr.net.frge.io

# Reference: https://cert.gov.ua/article/39253 (Ukrainian, #UAC-0094)
# Reference: https://blog.google/threat-analysis-group/ukraine-remains-russias-biggest-cyber-focus-in-2023/
# Reference: https://otx.alienvault.com/pulse/64403596d7a47d80451657c3
# Reference: https://www.virustotal.com/gui/ip-address/193.106.191.202/relations
# Reference: https://www.virustotal.com/gui/ip-address/45.150.67.87/relations

ohsxy.com
telsec.org
org.ohsxy.com
security.ohsxy.com
telegram.org.ohsxy.com
org.security.ohsxy.com
security-check.telegram.org.ohsxy.com
telegram.org.security.ohsxy.com
chatgpt4beta.com
cpcpipe.com
cpcpipe.org
masterofdigital.org
robot-876.frge.io
setnewcreds.ukr.net.frge.io
telegram.org.4234e8234ad0f.24o1.com
ukroboronprom.com.ukr.pm
ukrprivatesite.frge.io

# Reference: https://cert.gov.ua/article/4905829 (Ukrainian)

aneria.net
armpress.net
ceriossl.info
fountainrate.com
global-news-world.com
global-world-news.net
lonejade.com
modeselling.com
oncetrips.com
vtxhospital.com
ns1.fountainrate.com
ns1.lonejade.com
ns1.modeselling.com
ns1.oncetrips.com
ns1.vtxhospital.com
ns2.fountainrate.com
ns2.modeselling.com
ns2.oncetrips.com
ns2.vtxhospital.com

# Reference: https://www.proofpoint.com/us/blog/threat-insight/ta422s-dedicated-exploitation-loop-same-week-after-week
# Reference: https://securityintelligence.com/x-force/itg05-ops-leverage-israel-hamas-conflict-lures-to-deliver-headlace-malware/
# Reference: https://twitter.com/Jane_0sint/status/1698702459739255016
# Reference: https://twitter.com/drb_ra/status/1696958416516759956
# Reference: https://twitter.com/Joseliyo_Jstnk/status/1730631107899437490
# Reference: https://twitter.com/Joseliyo_Jstnk/status/1730631116564951437
# Reference: https://twitter.com/Joseliyo_Jstnk/status/1730631107899437490
# Reference: https://twitter.com/Joseliyo_Jstnk/status/1730631116564951437
# Reference: https://otx.alienvault.com/pulse/6579b53c00375a2dcfaaf952
# Reference: https://app.any.run/tasks/aa73504a-563a-4dd7-8724-3afe54de02f2/
# Reference: https://www.virustotal.com/gui/file/2ac6735e8e0b23b222161690adf172aec668894d170299e9ff2c54a4ec25b1f4/detection
# Reference: https://www.virustotal.com/gui/file/d37779e16a92da7bd05eae50c64b36e2e2022eb441382be686fda4dbd1800e90/detection
# Reference: https://www.virustotal.com/gui/file/2ac6735e8e0b23b222161690adf172aec668894d170299e9ff2c54a4ec25b1f4/detection
# Reference: https://www.virustotal.com/gui/file/d37779e16a92da7bd05eae50c64b36e2e2022eb441382be686fda4dbd1800e90/detection

http://50.173.136.70
50.173.136.70:445
89.96.196.150:8080
document-c.infinityfreeapp.com
downloaddoc.infinityfreeapp.com
downloadfile.infinityfreeapp.com
downloadingdoc.infinityfreeapp.com
downloadingf.infinityfreeapp.com
opendoc.infinityfreeapp.com
opendocument.infinityfreeapp.com
/execdwn.php
/filedwn.php
/execdwn.php?id=
/filedwn.php?id=

# Reference: https://twitter.com/BushidoToken/status/1740431013397078407
# Reference: https://twitter.com/k3yp0d/status/1752285465284170186
# Reference: https://cert.gov.ua/article/6276894
# Reference: https://harfanglab.io/en/insidethelab/compromised-routers-infrastructure-target-europe-caucasus/
# Reference: https://otx.alienvault.com/pulse/65bcd6e5cc24f8906b1a212a

http://194.126.178.8
http://23.24.68.109
http://88.209.251.6
194.126.178.8:445
23.24.68.109:443
cn5n8a92vtc00004a0t0gks3tbcyyyyyd.oast.fun
czyrqdnvpujmmjkfhhvs2x9oyfsn6gd7t.oast.fun
czyrqdnvpujmmjkfhhvs4knf1av02demj.oast.fun
czyrqdnvpujmmjkfhhvs9647ioh30wxvd.oast.fun
czyrqdnvpujmmjkfhhvsclx05sfi23bfr.oast.fun
czyrqdnvpujmmjkfhhvseabz1q5olrum5.oast.fun
czyrqdnvpujmmjkfhhvsgapqr3hclnhhj.oast.fun
czyrqdnvpujmmjkfhhvsqfxkqz68qzjcd.oast.fun
czyrqdnvpujmmjkfhhvsqslblw0mawilr.oast.fun
czyrqdnvpujmmjkfhhvsvlaax17vd5r6v.oast.fun
e-nas.firstcloudit.com
e-wody.firstcloudit.com
gcsd.firstcloudit.com
nas-files.firstcloudit.com
presidencia-docs.firstcloudit.com
sgg-gov.firstcloudit.com
ua-calendar.firstcloudit.com

# Reference: https://twitter.com/h2jazi/status/1749489799184937094
# Reference: https://www.virustotal.com/gui/file/8d6a24eac7a90860edaf6721856ff11ce0cff9dd3dc9c2b546a3fdf9d15be4ed/detection
# Reference: https://www.virustotal.com/gui/file/a5418213e34f81913726f19cdeefa8d9e3d425a8786eda086e56faacea1372ae/detection

202.55.80.225:35770

# Reference: https://twitter.com/felixaime/status/1760750756699812296
# Reference: https://www.virustotal.com/gui/ip-address/86.123.151.53/relations

86.123.151.53:4430
xfgjgjkuykykgihguifdt.mywire.org

# Reference: https://twitter.com/MavericksInt/status/1765783346519425331
# Reference: https://www.virustotal.com/gui/file/ca5dd056e948b1d25bda3a96a0bc6001e20ef20c9516c86718e41817943400fa/detection
# Reference: https://www.virustotal.com/gui/file/aef94d2451e1eb943d2b1ee5ed48d923ffff4baeb0d26ebe4450d6e151bf28c8/detection
# Reference: https://www.virustotal.com/gui/file/7bed81cbbc5d368beb4531a373bad5a38aef7947f565048ad4ba597a821897c6/detection

163.172.67.233:5000
webhook.site/92a1c89c-c371-4b93-a91c-cb0d61b3432d

# Reference: https://twitter.com/Joseliyo_Jstnk/status/1769699442045657261
# Reference: https://x.com/Joseliyo_Jstnk/status/1826879652960346411
# Reference: https://securityintelligence.com/x-force/itg05-leverages-malware-arsenal/
# Reference: https://www.virustotal.com/gui/file/18f891a3737bb53cd1ab451e2140654a376a43b2d75f6695f3133d47a41952b6/detection
# Reference: https://www.virustotal.com/gui/file/40a7fd89b9e51b0a515ac2355036d203357be90a2200b9c506b95c12db54c7aa/detection
# Reference: https://www.virustotal.com/gui/file/451f3d427ac21632f38619ef96dece25798918866d44fe82ff1ed30996f998dc/detection
# Reference: https://www.virustotal.com/gui/file/64b0037dde987c78edf807a1bd7f09cdfac072ec2a59954cc4918828b7e608a3/behavior

148.252.42.42:54467
172.114.170.18:55155
194.126.178.8:55555
calendar-ua.firstcloudit.com
calendarua.firstcloudit.com
dls-gov.firstcloudit.com
e-gov-am.firstcloudit.com
e-gov.firstcloudit.com
e-military.firstcloudit.com
e-mod.firstcloudit.com
e-presidencia.firstcloudit.com
eecomission.firstcloudit.com
eecommission-drive.firstcloudit.com
eecommission.firstcloudit.com
emod.firstcloudit.com
files-presidencia.firstcloudit.com
info-mod.firstcloudit.com
kzgw-wody.firstcloudit.com
mfa-files.firstcloudit.com
militarysupport.firstcloudit.com
presidencia-files.firstcloudit.com
presidencia-gob.firstcloudit.com
presidencia-gov.firstcloudit.com
rada-zakon.firstcloudit.com
sgg-files.firstcloudit.com
wody-info-files.firstcloudit.com
webhook.site/e2831741-d8c8-4971-9464-e52d34f9d611

# Reference: https://twitter.com/Joseliyo_Jstnk/status/1776248416210702679

http://24.88.87.29
24.88.87.29:445
euspa-vacancy.firstcloudit.com
taizfbuhgowpawhafyuq23nb2v9kq0rmg.oast.fun

# Reference: https://twitter.com/k3yp0d/status/1780888686025961824
# Reference: https://www.virustotal.com/gui/file/6954b6930afed2602e15400e38408883d2b94a2c643ff3070ccd7f87b043061d/detection

http://172.114.170.18
172.114.170.18:445
postfix-mail.firstcloudit.com

# Reference: https://twitter.com/dimitribest/status/1780815421983109459
# Reference: https://www.linkedin.com/pulse/xagent-spyware-targeting-ios-devices-western-europe-dmitry-bestuzhev-xunle/
# Reference: https://www.joesandbox.com/analysis/828645?idtype=analysisid#iocs
# Reference: https://www.virustotal.com/gui/file/a665cd40efaca89e9257d083328e13446428281d133895f984e847d93634e736/detection

http://198.27.64.218

# Reference: https://cert.pl/posts/2024/05/apt28-kampania/
# Reference: https://otx.alienvault.com/pulse/663b9c27bdf8af853c0e1e03

webhook.site/0d2dc90e-2d5e-49f8-8249-d7ab955c387a
webhook.site/0ef0dcf7-f258-4d02-b274-cbf62a2000cf
webhook.site/127df518-52be-46c5-bbb2-0479f4b9693b
webhook.site/1658772a-4de8-4368-a604-980c90b0a1ed
webhook.site/2d07e34c-3dd3-45e8-865c-3888a65ab885
webhook.site/3f396db1-2016-4b69-9ec3-ffc417d5f3aa
webhook.site/4ba464d9-0675-4a7a-9966-8f84e93290ba
webhook.site/4fe5885c-f2f6-4905-8bc7-aef1a046a134
webhook.site/508da0df-7ec9-420e-b1fe-958fbbe699d1
webhook.site/5100fcc0-f6be-4b09-8c58-5a8a6706ec4f
webhook.site/577b82c3-7249-44e9-9353-5eab106fead6
webhook.site/5a8758c6-5702-4fea-9d5e-4fbdb6dd795f
webhook.site/5e4c7949-30a2-4477-9e9b-e8828fc76a1b
webhook.site/66ea3bbc-29dc-4ece-b804-71c6ec7b77b6
webhook.site/7674f06b-e435-4470-a594-6d59578c552d
webhook.site/90fea98f-fbdb-4847-be03-409d02a43caf
webhook.site/9a9cdaf8-120c-4de9-b17a-d6d8e2796a3b
webhook.site/9c87649c-220d-425d-8331-ffc8d9b94a38
webhook.site/b10bd697-1a9f-4ec7-aa2f-1fa84ad916a1
webhook.site/bc349b93-b047-42f8-a421-d45e3ec94dc5
webhook.site/bec23763-b8d9-4191-99ba-04a4a163b4de
webhook.site/c1112bb3-0e6e-4ba4-abe7-fb31388b47ad
webhook.site/c618ea32-2923-4c12-8151-8d0002b56af0
webhook.site/dee016bf-21a2-45dd-86b4-6099747794c4
webhook.site/e13d23aa-b6f8-4491-9adc-71f7f8c438df
webhook.site/efb79108-a2b5-4cba-844d-6352bb8fad8c
webhook.site/f97bcee0-0d91-4503-a30c-027f1b34820f

# Reference: https://go.recordedfuture.com/hubfs/reports/CTA-RU-2024-0530.pdf

174.53.242.108:8080
68.76.150.97:8080
73.80.9.137:35780
calc-dwn.infinityfreeapp.com
clouddrive.infinityfreeapp.com
consumerpanel0x254a2.frge.io
consumerpanelapp.42web.io
delivery-ukrinmash-service.infinityfreeapp.com
document-d.infinityfreeapp.com
documents-cloud.infinityfreeapp.com
downloadable.infinityfreeapp.com
downloadc.infinityfreeapp.com
downloadinge.infinityfreeapp.com
downloadingq.infinityfreeapp.com
downloadingw.infinityfreeapp.com
downloadx.infinityfreeapp.com
downloadz.infinityfreeapp.com
eo1ws2wgj75rdfd.m.pipedream.net
eo6kgbwpysq0laa.m.pipedream.net
eogo85tybrrn2r.m.pipedream.net
eomhv6vdu4v5qyt.m.pipedream.net
eottxji4yk4vg5x.m.pipedream.net
eoy6vrzslpn9vu.m.pipedream.net
eoytfd39hbrspa3.m.pipedream.net
fdsagdfg.rf.gd
file-download.infinityfreeapp.com
filedwn.infinityfreeapp.com
filehosting.infinityfreeapp.com
filihosting.infinityfreeapp.com
microsoft-files.infinityfreeapp.com
online-download.infinityfreeapp.com
online-drive.infinityfreeapp.com
opendocuments.infinityfreeapp.com
run.mocky.io/v3/4e14d583-bbf5-4af3-9a86-4c0938a7802a
turbify-biz-cesdaz.rf.gd
xgfdstu6k.frge.io
xzdgsdfhfgtjdfj.wuaze.com
webhook.site/d466f7a7-63a1-4c04-8347-fe2d0a96081f
webhook.site/e7f39f18-bcb3-40e3-9e82-8cf7f807cc80
webhook.site/f5eace0b-062b-402f-a006-63b97e4950c3

# Reference: https://unit42.paloaltonetworks.com/fighting-ursa-car-for-sale-phishing-lure/

webhook.site/66d5b9f9-a5eb-48e6-9476-9b6142b0c3ae
webhook.site/d290377c-82b5-4765-acb8-454edf6425dd

# Reference: https://x.com/Tac_Mangusta/status/1828077900475580901
# Reference: https://www.virustotal.com/gui/file/aaa20b39bcf056f42509069dc3faccefd70cd69a3972560fe7c3745c9c40e1f7/detection

http://83.147.243.18

# Reference: https://x.com/Cyber0verload/status/1829953345009672433
# Reference: https://x.com/StrikeReadyLabs/status/1826585308734931266
# Reference: https://x.com/StrikeReadyLabs/status/1826950349384495489
# Reference: https://www.virustotal.com/gui/file/c194f619d1ed73c0f0721d818564aa8238aceba94d1e721942c5cb67cbba68ff/detection
# Reference: https://www.virustotal.com/gui/file/2431578b5ba5a8569a689807bdb827e3d445a16cc013ed8eba7b7bfea661d76a/detection

73ce1aae8a9ba738b91040232524f51a.serveo.net
92ace7e653e9c32d2af9700592cc96ea.serveo.net

# Reference: https://x.com/Cyber0verload/status/1829953345009672433
# Reference: https://x.com/StrikeReadyLabs/status/1829562262253617411
# Reference: https://www.virustotal.com/gui/file/98a97978f84a2ca6f2c05a4e15e60e9ab7ea3a77b36b26a83ae8562f58b6749d/detection
# Reference: https://www.virustotal.com/gui/file/654a19f0773bbba1e63b0fee936b261fe14ca0222fba71150d688fbb9f3dac60/detection

6c7aa72bd5f1d30203b80596f926b2b7.serveo.net
78cc700b31dcd7c7f25fd7b0372259e3.serveo.net

# Reference: https://x.com/RakeshKrish12/status/1830493704911728980

cluz.someguydelivery.com
dryf.shneez.com
igfcw.torresemello.com
jzit.wocircuitfitness.com
majc.healthfloww.com
swvfy.noreplay-fca.com
urjaa.nitrocreditfix.com
uttlh.peterswaysales.com
zxrgh.viouni.com

# Reference: https://x.com/StrikeReadyLabs/status/1830933284248776936
# Reference: https://www.virustotal.com/gui/file/f112876e875d43791da675e1187254eb2c839b7051d465ae83568274412d644a/detection
# Reference: https://www.virustotal.com/gui/file/64b26a92652bfb67cbe18217b6508fce460eff859526b2e256d3f1b9eab338b0/detection

18.157.68.73:15254
18.192.93.86:11962
kfghjerrlknsm.line.pm

# Reference: https://x.com/StrikeReadyLabs/status/1834217191060779174
# Reference: https://x.com/Cyber0verload/status/1834259021060014302

run.mocky.io/v3/47d78e98-8d12-452a-922b-bae56450a393

# Reference: https://x.com/StrikeReadyLabs/status/1837316398760022252
# Reference: https://www.virustotal.com/gui/file/8b77e8199c61c0d97b7a40e35feedf21a168a62696b18bbb4d49766332c2c8a8/detection

fgjgjuyfkuuyk.blogspot.com
47e811dbe2ed0ea8d506af94c1bb7d4c.serveo.net
run.mocky.io/v3/6c446a45-05aa-4198-9a81-d4472d7e81cb

# Reference: https://x.com/StrikeReadyLabs/status/1841288172950499624
# Reference: https://www.virustotal.com/gui/file/1bcc09d482a1c84a06c4f1da85ba90b33ec269b873b51d153de4ef8e19cb1592/detection
# Reference: https://www.virustotal.com/gui/file/3d165a9bd4738fd3c1922643bd45204ff91bc37f2c5aa3f47d97523f7fd9e8ed/detection

18.197.239.109:10176
jkcfgjgfcjty.fast-page.org
jkbfgkjdffghh.linkpc.net
run.mocky.io/v3/6ba09505-fa73-4d92-b209-641bfc51b6e2

# Reference: https://x.com/Cyber0verload/status/1841924570351018233

vgjkifguotgi.talebco.ir
run.mocky.io/v3/df8e33e0-4c17-4564-917f-9fbff17f4571
run.mocky.io/v3/8dbd585e-805d-4b14-8485-c6da4c3ef5a7

# Reference: https://x.com/StrikeReadyLabs/status/1849084042966094183
# Reference: https://www.virustotal.com/gui/file/a097400e060edf1190002a30c64506da0f72f92f96ed526b01cb4c00d5df2f0c/detection

3.67.15.169:1746
ukraine.html-5.me

# Reference: https://www.virustotal.com/gui/file/86a9ca34790e219ddc371fa154c51a9a2930e2afdebf4fc0889d2ba94d6acfc1/detection

fghjdfhdzggjjdfd.rf.gd

# Reference: https://cert.gov.ua/article/6281123 (# UAC-0001)
# Reference: https://hunt.io/blog/operation-roundish-apt28-roundcube-exploitation
# BANNER_0_HASH-HOST/IP=bf5865bc7941820087c20bfd16e3d648
# CLASS_0_HASH-HOST/IP=a07771c2613edd925347a78d5ff62b03

http://93.170.72.54
203.161.50.145:22
203.161.50.145:5000
203.161.50.145:6211
203.161.50.145:8080
203.161.50.145:8443
203.161.50.145:8889
45.61.169.221:445
petdiary.net
zhblz.com
a.zhblz.com
mail.zhblz.com
doc.gmail.com.gyehddhrggdii323sdhnshiswh2udhqjwdhhfjcjeuejcj.zhblz.com
docs.google.com.spreadsheets.d.1ip6eeakdebmwteh36vana4hu-glaeksstsht-boujdk.zhblz.com
ns1.petdiary.net
ns2.petdiary.net

# Reference: https://x.com/StrikeReadyLabs/status/1851266545793617938
# Reference: https://www.virustotal.com/gui/file/fa8a4d544ffb3ca9d51448772f478f303602023e0cd70af4b9f85d3b72b4cd27/detection

ukrainesafeurl.talebco.ir

# Reference: https://x.com/StrikeReadyLabs/status/1852167112367689933

ukrainesafe.is-great.org

# Reference: https://strikeready.com/blog/finding-the-unknown-unknowns-part-1/

kjghfkfgfdytku.infinityfreeapp.com
run.mocky.io/v3/da384ab3-f749-42d5-a076-40c248dece9b

# Reference: https://x.com/StrikeReadyLabs/status/1853769628696113337
# Reference: https://www.virustotal.com/gui/file/be3cccc2c62c0033aebcf91a6587eb815a1994cf268c42cf92ed856b6cf556aa/detection

chujdrtuityui.mydiscussion.net

# Reference: https://x.com/StrikeReadyLabs/status/1857059598072455426
# Reference: https://www.virustotal.com/gui/file/44935484933a13fb6632e8db92229cf1c5777333fa5a3c0a374b37428add69fb/detection

tuyt8erti867i.synergize.co

# Reference: https://community.emergingthreats.net/t/ruleset-update-summary-2024-11-21-v10747/2154

errorreporting.net
experience-improvement.com
game-wins.com
internalsecurity.us
lanmangraphics.com
retaildemo.info
shared-rss.info
telemetry-network.com
tieringservice.com

# Reference: https://x.com/StrikeReadyLabs/status/1878779709590565064
# Reference: https://www.virustotal.com/gui/file/53142380d75e3f54490f2896b58f308e6b91bec841d09b4e88985cb5b7812031/detection

doads.org
linkcuts.com
run.mocky.io/v3/22a2a2d8-84b9-4619-b8ba-359beb386cf9

# Reference: https://cert.gov.ua/article/6284730 (# lamehug)
# Reference: https://app.any.run/tasks/5bd56fb0-573e-471c-8503-6fe1a7f86b01
# Reference: https://www.virustotal.com/gui/file/d6af1c9f5ce407e53ec73c8e7187ed804fb4f80cf8dbd6722fc69e15e135db2e/detection
# Reference: https://www.virustotal.com/gui/file/bdb33bbb4ea11884b15f67e5c974136e6294aa87459cdc276ac2eea85b1deaa3/detection

144.126.202.227:22
stayathomeclasses.com/slpw/up.php

# Reference: https://www.kroll.com/en/publications/cyber/fancy-bear-gonepostal-espionage-tool-backdoor-access-microsoft-outlook

webhook.site/8bf50371-5f9f-4d45-9320-922b068ebc2e

# Reference: https://x.com/HaifeiLi/status/2018353377965723761
# Reference: https://x.com/_CERT_UA/status/2018240505218314369
# Reference: https://pub.expmon.com/analysis/311631/
# Reference: https://www.zscaler.com/blogs/security-research/apt28-leverages-cve-2026-21509-operation-neusploit
# Reference: https://www.virustotal.com/gui/file/1ed863a32372160b3a25549aad25d48d5352d9b4f58d4339408c4eea69807f50/detection
# Reference: https://www.virustotal.com/gui/file/b2ba51b4491da8604ff9410d6e004971e3cd9a321390d0258e294ac42010b546/detection
# Reference: https://www.virustotal.com/gui/file/fed537aade989abe4eb76a7a27756e66861fe92322c4b359feca8e01b85b438b/detection
# Reference: https://www.virustotal.com/gui/file/5a17cfaea0cc3a82242fdd11b53140c0b56256d769b07c33757d61e0a0a6ec02/detection
# Reference: https://www.virustotal.com/gui/file/c91183175ce77360006f964841eb4048cf37cb82103f2573e262927be4c7607f/detection
# Reference: https://www.virustotal.com/gui/file/969d2776df0674a1cca0f74c2fccbc43802b4f2b62ecccecc26ed538e9565eae/detection
# Reference: https://www.virustotal.com/gui/file/c9b3ef44640e0fe297d76e770454ee2597e474f5d0cb406e376da8d504db0117/detection
# Reference: https://www.virustotal.com/gui/file/fd3f13db41cd5b442fa26ba8bc0e9703ed243b3516374e3ef89be71cbf07436b/detection

freefoodaid.com
wellnesscaremed.com
wellnessmedcare.org

# Reference: https://x.com/smica83/status/2018659460261318958
# Reference: https://www.virustotal.com/gui/file/be859b4f4576ec09b69a2ef2d119939f7eb31de121aa01d38e1f0b2290f5a15e/detection

longsauce.com

# Reference: https://x.com/smica83/status/2020539423285203102
# Reference: https://www.virustotal.com/gui/file/506e7512c897514e9d312a1532d2e2949ec8ebd73f6ca52740fb5e3306f08843/detection

48d83469-d0c6-4ade-8f82-e383fff094b8.webhook.site

# Reference: https://x.com/LAB52io/status/2022281566513180933
# Reference: https://www.virustotal.com/gui/file/9097d9cf5e6659e869bf2edf766741b687e3d8570036d853c0ca59ae72f9e9fc/detection

webhook.site/4e6cf717-e4d6-4f40-9f2d-134196fa5e7d/
webhook.site/5744c020-a8d9-4755-abfb-cde6ccd450af/
webhook.site/5dbed3be-f1c9-41e5-b5d5-e961d08b5fba/
webhook.site/62114596-33f5-47fb-9012-0223529e5a13/
webhook.site/68d68fc7-aa94-4f2d-a727-d18fb40b0d69/
webhook.site/a3f4e990-0b2a-4f6a-a02e-c573005de3ee/
webhook.site/a72d8905-b15f-4e95-9a8f-5e4bb7dc9b3d/
webhook.site/c29905ab-e5fa-446c-8958-4eab15d8fb80/
webhook.site/c2e1be16-401b-4f60-8a0f-276b30417fda/
webhook.site/d63049e3-1cbe-474b-9005-237517af53a7/

# Reference: https://ctrlaltintel.com/threat%20research/FancyBear/

vppdr.com
gov.vppdr.com

# Reference: https://x.com/TeamDreier/status/2035301205031719170
# Reference: https://www.seqrite.com/blog/operation-ghostmail-zimbra-xss-russian-apt-ukraine/

analyticemailmeter.com
emailanalytics.com.ua
fraispei.com
istc-cloud.com
mailnalysis.com
synacorzimbra.nl
zimbra-metadata.com
zimbrasoft.com.ua
zimbrastat.com
zmailanalytics.com
ftp.fraispei.com
i.analyticemailmeter.com
i.emailanalytics.com.ua
i.mailnalysis.com
i.zimbra-metadata.com
i.zimbrasoft.com.ua
i.zimbrastat.com
i.zmailanalytics.com
pro.fraispei.com
test.fraispei.com

# Reference: https://www.trendmicro.com/en_us/research/26/c/pawn-storm-targets-govt-infra.html
# Reference: https://documents.trendmicro.com/assets/txt/Pawn%20Storm%20Deploys%20PRISMA%20IOCs-xQ48S7H.txt

910cf351-a05d-4f67-ab8e-6f62cfa8e26d.dnshook.site
dbca10b5-63e0-42ec-ad10-de13be96dc42.dnshook.site

# Reference: https://x.com/smica83/status/2037477379530953027
# Reference: https://www.virustotal.com/gui/file/479fd5e5bd5566a0252acd4ec29c5abc0dac501d0d6e9f316612b52aa48a3587/detection

webhook.site/c2dceeb0-d40d-41a2-8622-118fa974649c/

# Reference: https://www.ncsc.gov.uk/news/apt28-exploit-routers-to-enable-dns-hijacking-operations

103.140.186.148:53
103.140.186.149:53
103.140.186.155:53
185.117.88.22:53
185.117.88.28:53
185.117.88.29:53
185.117.88.30:53
185.117.88.31:53
185.117.88.50:53
185.117.88.60:53
185.117.88.61:53
185.117.88.62:53
185.117.89.32:53
185.117.89.46:53
185.117.89.47:53
185.234.73.58:53
185.234.73.61:53
185.234.73.62:53
185.237.166.224:53
185.237.166.225:53
185.237.166.226:53
185.237.166.227:53
185.237.166.228:53
185.237.166.229:53
185.237.166.230:53
185.237.166.231:53
185.237.166.232:53
185.237.166.233:53
185.237.166.234:53
185.237.166.235:53
185.237.166.236:53
185.237.166.237:53
185.237.166.238:53
185.237.166.239:53
185.237.166.240:53
185.237.166.241:53
185.237.166.242:53
185.237.166.243:53
185.237.166.244:53
185.237.166.245:53
185.237.166.246:53
185.237.166.247:53
185.237.166.248:53
185.237.166.249:53
185.237.166.55:53
185.237.166.56:53
185.237.166.57:53
185.237.166.58:53
185.237.166.59:53
185.237.166.60:53
185.237.166.61:53
185.237.166.62:53
185.237.166.63:53
185.237.166.64:53
185.237.166.65:53
185.237.166.66:53
185.237.166.67:53
185.237.166.68:53
185.237.166.69:53
185.237.166.70:53
185.237.166.71:53
185.237.166.72:53
185.237.166.73:53
185.237.166.74:53
185.237.166.75:53
23.106.120.119:53
37.221.64.101:53
37.221.64.116:53
37.221.64.131:53
37.221.64.148:53
37.221.64.149:53
37.221.64.150:53
37.221.64.151:53
37.221.64.163:53
37.221.64.173:53
37.221.64.199:53
37.221.64.208:53
37.221.64.224:53
37.221.64.254:53
37.221.64.77:53
37.221.64.78:53
37.221.64.93:53
5.226.137.151:53
5.226.137.230:53
5.226.137.231:53
5.226.137.232:53
5.226.137.234:53
5.226.137.235:53
5.226.137.242:53
5.226.137.243:53
5.226.137.244:53
5.226.137.245:53
64.120.31.100:53
64.120.31.96:53
64.120.31.97:53
64.120.31.98:53
64.120.31.99:53
64.44.154.227:53
64.44.154.237:53
64.44.154.238:53
64.44.154.239:53
64.44.154.240:53
77.83.197.37:53
77.83.197.38:53
77.83.197.39:53
77.83.197.40:53
77.83.197.41:53
77.83.197.42:53
77.83.197.43:53
77.83.197.44:53
77.83.197.45:53
77.83.197.46:53
77.83.197.47:53
77.83.197.48:53
77.83.197.49:53
77.83.197.50:53
77.83.197.51:53
77.83.197.52:53
77.83.197.53:53
77.83.197.54:53
77.83.197.55:53
77.83.197.56:53
77.83.197.57:53
77.83.197.58:53
77.83.197.59:53
77.83.197.60:53
77.83.198.39:53
79.141.160.78:53
79.141.161.66:53
79.141.161.67:53
79.141.161.68:53
79.141.161.69:53
79.141.161.70:53
79.141.161.71:53
79.141.161.72:53
79.141.161.73:53
79.141.161.74:53
79.141.161.75:53
79.141.161.76:53
79.141.161.77:53
79.141.161.78:53
79.141.161.79:53
79.141.161.80:53
79.141.161.81:53
79.141.161.82:53
79.141.161.83:53
79.141.161.84:53
79.141.161.85:53
79.141.173.103:53
79.141.173.119:53
79.141.173.120:53
79.141.173.121:53
79.141.173.122:53
79.141.173.123:53
79.141.173.200:53
79.141.173.210:53
79.141.173.211:53
79.141.173.231:53
79.141.173.232:53
79.141.173.233:53
79.141.173.246:53
79.141.173.247:53
79.141.173.248:53
79.141.173.249:53
79.141.173.250:53
79.141.173.251:53
79.141.173.252:53
79.141.173.253:53
79.141.173.254:53
79.141.173.70:53
79.141.173.96:53
79.141.173.97:53
79.141.173.98:53
79.143.87.229:53
79.143.87.232:53
79.143.87.240:53
79.143.87.243:53
79.143.87.249:53
88.80.148.49:53
88.80.148.53:53
89.150.40.43:53
89.150.40.86:53
