# Copyright (c) 2014-2026 Maltrail developers (https://github.com/stamparm/maltrail/)
# See the file 'LICENSE' for copying permission

# Reference: https://integralads.com/insider/ias-threat-lab-fraud-scheme-fake-android-apps/
# Reference: https://www.bitdefender.com/en-us/blog/labs/malicious-google-play-apps-bypassed-android-security
# Reference: https://raw.githubusercontent.com/bitdefender/malware-ioc/refs/heads/master/vapor_malware/urls.csv

afterthoughtthirsttime.cc
ansellaphotoeditor.com
applesqrcreator.cc
aquatrackergo.com
askoknook.com
auroralume.net
beautifuland.net
beebeatoplayer.com
behaviorwellnessscope.com
bikespdfvault.net
bloodpressuretrackerapp.net
bloodybuddyai.com
bmiloghealth.com
bnmbvdscc.com
bookanswers.net
bookbagpencilt.com
boysvitalflow.com
bpcardiocapture.com
bppulseprotector.com
browserzheng.com
btfdf.com
buildingtagreader.com
bysedr.com
cannonphysiqueprofiler.com
cardiapp.cc
cardpixelparser.cc
clearsoundvoice.com
clpclptrefinder.com
cobwebtorchup.com
covboe.com
cozybp.com
cupapplicationwhidperssips.com
cutewallpaper.link
defea.cc
degreejourneyquill.net
devainsulineer.com
dfcserwan.net
dilige.cc
dinnerlightbringer.cc
disate.com
dochecklistremarkthings.com
docuflowpdfinsight.com
docupdftext.com
drainlifelog.com
drfqopmnlight.com
drinkh2osphere.com
drinksmart.cc
drinkypalapp.com
drumbealu.com
eatrgrise.com
equinlight.com
erfedfvgf.com
everycountrecordexpenses.com
ewqewmokgfd.com
expensevisual.com
fairiescodecatcher.com
feelingshapetrack.cc
fesder.com
filebrowsereasytouser.com
fitcalcbmi.com
framefyphotoart.com
friendsparkdiary.com
fucyflash.com
fuyflash.om
gloveslim.cc
glucologhealth.com
grandfatherwaterwhiz.com
gulpminderdrink.com
h2owavelog.com
hairshydrovibe.com
healthpressurepilot.com
hornnitropdf.cc
hujkr.com
imageosis.com
industryperfectbmi.cc
inkpadnote.com
kittyechopages.net
ladybugsumatrapdf.cc
lancescanb.com
leadlifearkformyphone.com
livelynotelively.com
lokrrclk.com
magicdecloration.com
micefastpdf.net
monkeybodyguide.com
moontrackherbrowser.com
moreagent.net
needlepixform.cc
nimalcodek.com
nmyfun.com
noneedtowaitbrowser.com
notenimbus.com
notenookbook.com
oasisdrinktracker.com
oeredrt.com
overbitebender.com
pagepilotbox.com
pdfsaverfiledownload.com
pennycharge.net
pennyrecorder.com
petsquickscan.com
phmobi.net
photoah.com
photoyellowclolor.com
phrameselect.com
pondernotebook.com
pophnbn.com
powdershapesensei.com
powdrshapesnsei.com
presswatchbp.com
proseinksli.net
pulserecordbp.com
puredropdrink.com
puttqrhubnk.cc
qrfgsd.com
qrscanmachine.com
quarterpdfpro.com
qusadqueszh.com
rabbitglucosediary.com
raisetgb.com
redsaftrds.com
ringfindmyphone.com
robustdrink.net
sanitnote.com
saveallfbloader.com
scanblitz.net
scannertranslate.net
scribesphere.net
scubamnotes.com
servantpuresip.com
shockglowup.com
sigture.com
siphealth.cc
snailtracebrass.com
spectrumnote.com
spidersturbopdf.com
spritzy.cc
starcepulsemap.com
stickquenchlog.com
stridecounter.com
sugarscanmaster.com
suitabledownloader.com
supportcodeblitz.com
systolicscribebp.com
tartarmob.co
tartarmob.com
tastescanhub.cc
terdpo.com
textbkspird.com
texttreknotebook.com
thirstquesthealth.com
tkdodownloader.com
todaynote.net
todogalaxyapp.com
tomatoesqrafter.cc
toolsquikschetchwat.com
torchfalnesc.com
trandsz.com
trashbustercleanhyper.com
tretorchlight.com
trewreeew.com
truckxscan.com
turanantitheft.com
twinklenotestool.com
ufuopo.com
ulikerecoder.com
underwatybop.com
untangcardio.com
utfgop.com
vascularbpinspector.com
vcdfcx.net
vdafqr.com
verifyartical.com
videovideoeditor.link
volleyballsipsmart.cc
vughgnnfg.com
vuotarg.com
vvkdio.com
wallpapersave.com
waterwinkxy.com
wavewatcherhealth.com
whisperedtruthapp.com
wildernesshydr8.com
wisdomoflifebook.com
wishwoodenfish.com
wrdup.net
writerdrinkup.cc
writerdripdropduo.com
wrterdrinkup.cc
wsesas.com
xxdffvc.com
ynastyqrique.net
zoofv.com
abed.bloodybuddyai.com
adult.writerdrinkup.cc
agile.dfcserwan.net
agleam.trewreeew.com
aid.ewqewmokgfd.com
allemand.leadlifearkformyphone.com
amend.sugarscanmaster.com
amoco.moontrackherbrowser.com
amperage.lancescanb.com
api.askoknook.com
api.beebeatoplayer.com
api.bnmbvdscc.com
api.bookanswers.net
api.bookbagpencilt.com
api.btfdf.com
api.bysedr.com
api.clpclptrefinder.com
api.dfcserwan.net
api.disate.com
api.drfqopmnlight.com
api.eatrgrise.com
api.erfedfvgf.com
api.fesder.com
api.fucyflash.com
api.fuyflash.om
api.hujkr.com
api.lokrrclk.com
api.nmyfun.com
api.oeredrt.com
api.pennyrecorder.com
api.phmobi.net
api.pophnbn.com
api.qrfgsd.com
api.qusadqueszh.com
api.raisetgb.com
api.redsaftrds.com
api.sigture.com
api.spritzy.cc
api.terdpo.com
api.textbkspird.com
api.todaynote.net
api.trandsz.com
api.tretorchlight.com
api.trewreeew.com
api.turanantitheft.com
api.ufuopo.com
api.ulikerecoder.com
api.underwatybop.com
api.utfgop.com
api.vcdfcx.net
api.vdafqr.com
api.vughgnnfg.com
api.vuotarg.com
api.vvkdio.com
api.wrdup.net
api.xxdffvc.com
api.zoofv.com
aquatrackergo.com
argonaut.overbitebender.com
arroyo.glucologhealth.com
arttest.framefyphotoart.com
athwart.bppulseprotector.com
ault.writerdrinkup.cc
autumn.quarterpdfpro.com
autumnal.proseinksli.net
baboon.monkeybodyguide.com
backwood.tomatoesqrafter.cc
bankrupt.drinkh2osphere.com
barn.torchfalnesc.com
barton.saveallfbloader.com
battelle.defea.cc
battery.proseinksli.net
beat.bookanswers.net
beau.wallpapersave.com
beloit.drinkypalapp.com
bergamot.lancescanb.com
bide.friendsparkdiary.com
bite.untangcardio.com
bloodpressuretrackerapp.net
bloodybuddyai.com
bmiloghealth.com
boastful.gloveslim.cc
bombast.volleyballsipsmart.cc
bose.kittyechopages.net
bpcardiocapture.com
bppulseprotector.com
brass.snailtracebrass.com
brazen.qusadqueszh.com
breathe.terdpo.com
brick.tomatoesqrafter.cc
brighton.fesder.com
brot.noneedtowaitbrowser.com
budget.glucologhealth.com
bug.whisperedtruthapp.com
bun.cardiapp.cc
bury.snailtracebrass.com
buste.trashbustercleanhyper.com
calais.scanblitz.net
carlin.drinksmart.cc
carriage.nimalcodek.com
caustic.cutewallpaper.link
caustic.fucyflash.com
cern.boysvitalflow.com
chairman.fairiescodecatcher.com
checksum.ringfindmyphone.com
chemise.ynastyqrique.net
chlorate.untangcardio.com
clatter.btfdf.com
clean0903.minigame.vip
clolor.photoyellowclolor.com
closeup.tastescanhub.cc
codicil.vcdfcx.net
collar.lancescanb.com
comb.puttqrhubnk.cc
concrete.beebeatoplayer.com
control.spidersturbopdf.com
copper.buildingtagreader.com
corduroy.clpclptrefinder.com
cork.proseinksli.net
corn.writerdripdropduo.com
corset.tkdodownloader.com
counter.stridecounter.com
counttre.everycountrecordexpenses.com
crime.hornnitropdf.cc
critter.qrfgsd.com
croupier.twinklenotestool.com
cuddly.wrterdrinkup.cc
cumin.truckxscan.com
cupapplicationwhidperssips.com
cut.redsaftrds.com
cutset.robustdrink.net
cygnus.thirstquesthealth.com
cz.toolsquikschetchwat.com
danish.nmyfun.com
demote.auroralume.net
devotee.pennyrecorder.com
diabetes.hujkr.com
diehard.bloodybuddyai.com
dint.underwatybop.com
direction.monkeybodyguide.com
discuss.stickquenchlog.com
dog.gloveslim.cc
dominate.covboe.com
dow.nmyfun.com
dr.applesqrcreator.cc
drinkh2osphere.com
drinkypalapp.com
duodenum.notenimbus.com
dupont.dilige.cc
editor.videovideoeditor.link
efface.cardiapp.cc
eleazar.oasisdrinktracker.com
elliot.gulpminderdrink.com
emily.bookbagpencilt.com
eng.browserzheng.com
eng.disate.com
european.healthpressurepilot.com
evince.supportcodeblitz.com
exalt.aquatrackergo.com
fact.hairshydrovibe.com
faustus.pulserecordbp.com
fete.suitabledownloader.com
feudal.monkeybodyguide.com
filedapi.pdfsaverfiledownload.com
firm.imageosis.com
fitcalcbmi.com
five.drinkypalapp.com
floral.ynastyqrique.net
floruit.drinkh2osphere.com
folio.hornnitropdf.cc
folio.twinklenotestool.com
formal.clpclptrefinder.com
formal.drfqopmnlight.com
formal.nmyfun.com
formal.terdpo.com
formic.raisetgb.com
freddy.ufuopo.com
furrier.supportcodeblitz.com
gape.spectrumnote.com
gauzy.photoyellowclolor.com
getet.pennycharge.net
glossary.fitcalcbmi.com
glucologhealth.com
gneiss.bnmbvdscc.com
got.robustdrink.net
grade.fairiescodecatcher.com
griev.fairiescodecatcher.com
grieve.fairiescodecatcher.com
gulpminderdrink.com
h2owavelog.com
hampton.applesqrcreator.cc
hanover.devainsulineer.com
harelip.wildernesshydr8.com
hazy.petsquickscan.com
healthpressurepilot.com
hearten.tretorchlight.com
heine.bloodpressuretrackerapp.net
henchmen.photoah.com
her.moontrackherbrowser.com
hodge.robustdrink.net
hologram.waterwinkxy.com
hop.beautifuland.net
horse.tomatoesqrafter.cc
hotrod.degreejourneyquill.net
houdini.scubamnotes.com
humpback.micefastpdf.net
icicle.grandfatherwaterwhiz.com
imbrue.livelynotelively.com
implicit.h2owavelog.com
inflame.shockglowup.com
inflater.notenimbus.com
inflme.shockglowup.com
inhibit.qrscanmachine.com
inkpadnote.com
innovate.gulpminderdrink.com
insure.phrameselect.com
into.ulikerecoder.com
isolate.wishwoodenfish.com
jag.cupapplicationwhidperssips.com
jean.cardpixelparser.cc
jerky.filebrowsereasytouser.com
johannes.wsesas.com
jurassic.clearsoundvoice.com
kelsey.torchfalnesc.com
ketch.wavewatcherhealth.com
keynes.oeredrt.com
klaxon.trandsz.com
lachesis.scannertranslate.net
lad.saveallfbloader.com
lake.supportcodeblitz.com
leadlifearkformyphone.com
leather.sanitnote.com
lend.wildernesshydr8.com
lip.tastescanhub.cc
longish.zoofv.com
loquat.healthpressurepilot.com
lowry.notenookbook.com
lumber.degreejourneyquill.net
lush.verifyartical.com
mac.qrscanmachine.com
machine.boysvitalflow.com
madmen.ansellaphotoeditor.com
marshal.expensevisual.com
mccauley.cannonphysiqueprofiler.com
medicate.wavewatcherhealth.com
membrane.tartarmob.com
merrill.drfqopmnlight.com
metonymy.cobwebtorchup.com
mettle.feelingshapetrack.cc
millie.magicdecloration.com
missy.lokrrclk.com
moon.afterthoughtthirsttime.cc
mort.clpclptrefinder.com
mundane.textbkspird.com
mutandis.ladybugsumatrapdf.cc
neo.utfgop.com
newport.moreagent.net
nex.docuflowpdfinsight.com
nicholas.docuflowpdfinsight.com
nil.wisdomoflifebook.com
noise.wildernesshydr8.com
nominal.gloveslim.cc
notenimbus.com
notenookbook.com
oaf.pophnbn.com
oasisdrinktracker.com
octant.pulserecordbp.com
oil.quarterpdfpro.com
okinawa.afterthoughtthirsttime.cc
paddle.wisdomoflifebook.com
pagepilotbox.com
password.livelynotelively.com
paul.oasisdrinktracker.com
pens.expensevisual.com
pest.needlepixform.cc
petrel.volleyballsipsmart.cc
phoneme.puredropdrink.com
pit.puttqrhubnk.cc
placemat.devainsulineer.com
platelet.pondernotebook.com
plot.writerdrinkup.cc
plow.docupdftext.com
plow.industryperfectbmi.cc
polonium.pagepilotbox.com
pondernotebook.com
position.waterwinkxy.com
presswatchbp.com
previous.petsquickscan.com
pristine.beebeatoplayer.com
procyon.vdafqr.com
prod.beebeatoplayer.com
prod.bmiloghealth.com
prod.clpclptrefinder.com
prod.covboe.com
prod.cozybp.com
prod.dfcserwan.net
prod.drfqopmnlight.com
prod.eatrgrise.com
prod.ewqewmokgfd.com
prod.hujkr.com
prod.moreagent.net
prod.nmyfun.com
prod.ringfindmyphone.com
prod.systolicscribebp.com
prod.terdpo.com
prod.turanantitheft.com
prod.ufuopo.com
prod.ulikerecoder.com
prod.utfgop.com
prod.vvkdio.com
prod.waterwinkxy.com
prod.wrdup.net
prod.wsesas.com
prod.zoofv.com
proton.vascularbpinspector.com
pulserecordbp.com
puredropdrink.com
quilt.cobwebtorchup.com
ransack.sugarscanmaster.com
receipt.industryperfectbmi.cc
record.powdershapesensei.com
record.powdrshapesnsei.com
recovery.siphealth.cc
revisal.cupapplicationwhidperssips.com
revoke.texttreknotebook.com
rhizome.todogalaxyapp.com
rilly.snailtracebrass.com
ringfindmyphone.com
rings.drumbealu.com
roil.behaviorwellnessscope.com
rope.vvkdio.com
sabina.degreejourneyquill.net
salad.dilige.cc
saratoga.inkpadnote.com
sawyer.spectrumnote.com
scala.tartarmob.co
scanty.stridecounter.com
schubert.docupdftext.com
scout.pondernotebook.com
sea.micefastpdf.net
seen.inkpadnote.com
seething.turanantitheft.com
select.phrameselect.com
sensor.framefyphotoart.com
serenade.erfedfvgf.com
sesame.sigture.com
shame.drainlifelog.com
sheathe.askoknook.com
shine.cardpixelparser.cc
shoshone.needlepixform.cc
shrike.bikespdfvault.net
sibling.starcepulsemap.com
sidecar.presswatchbp.com
sierra.scubamnotes.com
sire.pdfsaverfiledownload.com
skiddy.bpcardiocapture.com
skylight.browserzheng.com
smes.imageosis.com
soap.equinlight.com
sojourn.auroralume.net
son.scribesphere.net
son.texttreknotebook.com
southern.drinksmart.cc
spaniard.vuotarg.com
spectra.thirstquesthealth.com
spectrumnote.com
spica.bloodpressuretrackerapp.net
spurious.drfqopmnlight.com
steel.servantpuresip.com
strem.dochecklistremarkthings.com
succinct.truckxscan.com
suit.behaviorwellnessscope.com
supple.terdpo.com
swidden.wallpapersave.com
systolicscribebp.com
tackle.starcepulsemap.com
taint.defea.cc
tangent.wrdup.net
taverna.bikespdfvault.net
tedo.tkdodownloader.com
teen.wishwoodenfish.com
tenant.todogalaxyapp.com
tenant.vascularbpinspector.com
texttreknotebook.com
thing.dinnerlightbringer.cc
thirstquesthealth.com
threat.puttqrhubnk.cc
thrill.notenookbook.com
thymine.untangcardio.com
tin.bikespdfvault.net
toach.photoah.com
todogalaxyapp.com
tour.servantpuresip.com
tree.scubamnotes.com
tremolo.shockglowup.com
tribal.pagepilotbox.com
trophic.bppulseprotector.com
twinklenotestool.com
uganda.ladybugsumatrapdf.cc
upturn.bysedr.com
urge.todaynote.net
usa.fitcalcbmi.com
userapi.filebrowsereasytouser.com
v.verifyartical.com
vacuole.vughgnnfg.com
vasquez.xxdffvc.com
vaudois.h2owavelog.com
verna.bpcardiocapture.com
vial.industryperfectbmi.cc
visitor.truckxscan.com
vocal.eatrgrise.com
voiapi.clearsoundvoice.com
wadi.aquatrackergo.com
walledit.ansellaphotoeditor.com
waltz.rabbitglucosediary.com
wand.presswatchbp.com
ware.videovideoeditor.link
warll.cutewallpaper.link
warrior.whisperedtruthapp.com
waste.overbitebender.com
waterwinkxy.com
wavewatcherhealth.com
wheller.kittyechopages.net
whisperedtruthapp.com
wilful.micefastpdf.net
wine.scanblitz.net
wire.devainsulineer.com
wiry.feelingshapetrack.cc
wishwoodenfish.com
wrasse.quarterpdfpro.com
zenith.puredropdrink.com
