# Copyright (c) 2014-2026 Maltrail developers (https://github.com/stamparm/maltrail/)
# See the file 'LICENSE' for copying permission

# Aliases: phantomremote, phantomcore, phantomocx, phantomc2, phantomproxylite, cargotalon, eaglet implant, ung0901, headmare

# Reference: https://bi.zone/expertise/blog/rainbow-hyena-snova-atakuet-novyy-bekdor-i-smena-taktik/
# Reference: https://www.virustotal.com/gui/file/4c78d6bba282aaff0eab749cfa8a28e432f7cbf9c61dec8de8f4800fd27e0314/detection
# Reference: https://www.virustotal.com/gui/file/d9bb370d87c09f23fff2fb4a32afd9d89c002e2ed9bfffdd85ce7883bc27aecc/detection
# Reference: https://www.virustotal.com/gui/file/ed9b24a77a74cd34c96b30f8de794fe85eb1d9f188f516bd7d6020cc81a86728/detection
# Reference: https://www.virustotal.com/gui/file/01f12bb3f4359fae1138a194237914f4fcdbf9e472804e428a765ad820f399be/detection
# Reference: https://www.virustotal.com/gui/file/0f1dcdc414afca59f97800a2d108089bf9f9a0cb3f7fbf0522dc10e8f7449046/detection

http://185.225.17.104
http://188.127.254.44
http://91.239.148.21

# Reference: https://x.com/malwrhunterteam/status/2013319279332999200
# Reference: https://www.virustotal.com/gui/file/a464cfd80810c6f5357b4e738317e900baef9a45fbbc59f5c51475f69b053e5e/detection

http://217.60.1.46
spareline.ru/wp-includes/pomo/entry.html
spareline.ru/wp-includes/post-template.html

# Reference: https://x.com/PrakkiSathwik/status/2013579955876118852
# Reference: https://www.virustotal.com/gui/file/bd149347be4141752dc206f833c6410ef065bfa9353cb370c543fa58dfc27f60/detection

http://185.54.0.148
http://217.60.5.249
http://217.60.60.18
act-print.ru/wp-includes/pomo/entry.html
act-print.ru/wp-includes/post-template.html
ast-automation.ru/wp-includes/pomo/entry.html
ast-automation.ru/wp-includes/post-template.html
ink-master.ru/wp-includes/pomo/entry.html
ink-master.ru/wp-includes/post-template.html
metelkova.ru/wp-includes/pomo/entry.html
metelkova.ru/wp-includes/post-template.html
shibargan.ru/wp-includes/pomo/entry.html
shibargan.ru/wp-includes/post-template.html

# Reference: https://securelist.com/head-mare-hacktivists/113555/
# Reference: https://www.virustotal.com/gui/file/063a8cad2115f6021532fa5093b33ec322b052c936659ec5cb42aa53a8207e59/detection
# Reference: https://www.virustotal.com/gui/file/4a65b7a0f940a55ab308595844ec2df205487d8b291162fb11d066ac3765074d/detection
# Reference: https://www.virustotal.com/gui/file/5d924a9ab2774120c4d45a386272287997fd7e6708be47fb93a4cad271f32a03/detection
# Reference: https://www.virustotal.com/gui/file/7e9d6a70a13c589622f47b2b984a9952c6498e8564df9e0e3fd86a7ac0088bf4/detection
# Reference: https://www.virustotal.com/gui/file/a048c920cf17b9ab4060e67dcd7d94b03aabb6636f895ede59d63b35c1145024/detection
# Reference: https://www.virustotal.com/gui/file/b45c9d797e7338e8a73cb86ba28e7c7638db9ccf901bb84a188cca274de6d4ad/detection
# Reference: https://www.virustotal.com/gui/file/bac3c4607a051f8b157882ce36b35b328dcf8f5662a18a09be0d3b08b233497b/detection
# Reference: https://www.virustotal.com/gui/file/dc3e4a549e3b95614dee580f73a63d75272d0fba8ca1ad6e93d99e44b9f95caa/detection
# Reference: https://www.virustotal.com/gui/file/e9e62b5a6059772d98ab95637dd020cc4beb5deb22d38ebc0a6f1d5714fbbc0e/detection

http://185.80.91.107
http://188.127.227.201
http://194.87.210.134
http://45.11.27.232
http://45.156.21.178
http://5.252.176.47
http://94.131.113.79
185.80.91.107:443
45.11.27.232:443
45.87.245.30:7000
45.87.246.169:6443
5.252.176.77:45098
5.252.176.77:8888
interoperaebility.world
jaudyoyh.ru

# Reference: https://securelist.ru/head-mare-phantomheart-and-phantomproxylite/114753/
# BANNER_0_HASH-HOST=83bb5d0645d7942d7de46da41ad64469
# BANNER_0_HASH-HOST=a31ad4ae7c4d3a5bb76a2990c5ad7f80
# BANNER_0_HASH-HOST=0740ed75c00bd2bb54bfa06c03ed6e77
# BANNER_0_HASH-HOST=ff81be3802c687bd8d32dc6146280a88
# BANNER_0_HASH-HOST=f08e68d88bf7528f5b9605a274a23c66
# BANNER_0_HASH-HOST=ecb3a7b9edc6f66a43dc11f2d7220156
# BANNER_0_HASH-HOST=eb574548f540cb76da7b3293a7afce56
# BANNER_0_HASH-HOST=e0fff251ce7ca9e69f40d9edac96c0be
# BANNER_0_HASH-HOST=b37572aef15567c03971a9f2f13ab8c4
# BANNER_0_HASH-HOST=af9982df17686fa7ffeb9872f05abaa3
# BANNER_0_HASH-HOST=a482559315866a07a30e668e43fa19ce
# BANNER_0_HASH-HOST=944d5cc1c18c7e12e76df5c52acbaca1
# BANNER_0_HASH-HOST=91a89671fbfaf62f4c70fbd0bd35fe85
# BANNER_0_HASH-HOST=8054af1aa1473dcfd88c4c3638ffcbb3
# BANNER_0_HASH-HOST=7a565ab06dd066481317d1940e76ceb4
# BANNER_0_HASH-HOST=6b7d3f3d89b025111ba5480b3a9955b2
# BANNER_0_HASH-HOST=686d17e4ac8328272f4ba00c611959a0
# BANNER_0_HASH-HOST=53b6fc9535171551efe5c7bfbe2c8ac9
# BANNER_0_HASH-HOST=509bdf187fd4960d1b80cf6bb2266cda
# BANNER_0_HASH-HOST=40952a7a5736eaef3b889486ac9393df
# BANNER_0_HASH-HOST=3f503edb8523d8d9f54da31385facd2a
# BANNER_0_HASH-HOST=3031e80d03231667e5743ac7e754f69f
# BANNER_0_HASH-HOST=20238b3fadbf4264cc411dd321de49b6
# BANNER_0_HASH-HOST=18ef01f7fdea23f4c6d130d69f24693e
# BANNER_0_HASH-HOST=189ff88e078317d496cb22269fc05cfb
# BANNER_0_HASH-HOST=df592a37a6dd95c2e6584954bf0454a6

http://176.98.189.101
http://178.255.127.65
http://188.127.227.46
http://188.127.254.233
http://193.176.153.162
http://195.133.32.213
http://213.232.204.111
http://31.56.227.100
http://31.56.227.61
http://31.56.48.178
http://31.58.137.197
http://80.66.81.13
http://94.183.188.166
178.255.127.65:8888
193.176.153.162:8090
193.176.153.162:8808
195.133.32.213:8000
213.232.204.111:55555
213.232.204.111:8080
31.56.227.100:3000
31.56.227.100:4000
31.56.227.100:8000
31.56.227.61:1000
31.56.227.61:1224
31.56.227.61:1244
31.56.227.61:14000
31.56.227.61:2000
31.56.227.61:8001
31.56.227.61:8080
31.56.227.61:9000
31.56.48.178:9000
31.58.137.197:5000
31.58.137.197:5173
31.58.137.197:8080
80.66.81.13:3000
80.66.81.13:8081
94.183.188.166:10000
94.183.188.166:1224
94.183.188.166:8443
146.190.234.multiversitetet.no
193.37.71.221.sslip.io
1be.pro
1to30.shop
3hito.tech
50forwardspodcast.co.uk
7evenfoundation.org
92108.sbs
aainfo.online
abhinayafoodrecipes.com
abstractcorner.com
account.win-shares.com
acquisizione.net
activehealth01.online
admirationhq.com
aegissecurity.online
affilipost.com
affordablecarsonline.com
agelessbonds.com
aifix.space
ainghain.com
aiupworkpro.com
alliedambitions.com
allin1livetv.xyz
allretail.shop
allstaramerican.com
almaxhura.com
alquilerdecuatrimotosmedellin.com
alsawsanaalsawdaa.com
alugueseusite.net
alvarezgabriel.com
alyseikari.com
ama30anos.online
amaatucachorro.com
americancrepes.co
amritsariyadhaba.com
analytisec.space
andrescardenas.uno
anishpitale.com
antenasbet.online
anthonychukwu.net
aonemy.com
app.shieldify.online
appeasy.ai
appulse.info
areamarket.online
arkadcorretora.online
artmateriali.com
arya-anggara.xyz
ashariyya.online
astralmetaverse.com
ataevisinop.com
atelier-bever.com
atendimentohumanasaude.online
atomms.cloud
aura-entdecken.com
bbcars.shop
beezai.fun
bellebindi.com
bestanews.com
bignewsblog.com
billionairejewels.shop
bindrehab.org
binramdoun.com
bloomvaults.com
bluecollarseoexperts.com
bodyandenergy.shop
borboletacriativarecursos.online
botiicario.com
brandiqueindonesia.com
bravebrandcircle.com
brightshield.space
brokerclash.com
brookhvrst.com
buildaround.org
bundlemeister.com
bxmarmiton.com
cafefiladelfia.com
callbucdial.store
camilasobrino.com
cartaopg.bet
casasantosltda.shop
castlecyberskull.fun
ccis-progeco.com
ceostorymagazine.com
chandrikaproperties4you.co.uk
charlsmontero.com
charmingfrenchhouse.com
chickengrill.store
childpsychologyai.com
cifzap.online
cityscaperent.com
clareadordemanchas.store
clickmoney.online
clientsatisfy.com
cloudinor.com
cloudtips.shop
coinova.online
collagenjelly.store
comcast-technology.com
compliances-team.info
condatorpersonal.com
cone.ledahost.com
consultadlicenciamento.site
correspondhq.org
correspondlocal.org
covidoll.com
cpanel.todo-anime.com
cpulsdom.cloud
crenecrap.shop
crickingkols.com
cristinadapena.com
cruisestoursandtickets.com
cryptara.online
cscjankari.shop
csdt.network
cuerposaludable.shop
curatioproperty.com
curiouscoder.fun
cursosbaratosseguros.com
cursosonlinesuperate.net
cyberposi.space
cyvantis.online
daitawise.com
damansara-asia.com
dare2shineacademy.com
defentry.online
deficore.tech
delicatedesign.org
demo.niges.pro
dentisto.org
desipresent.shop
dexticket.com
digital-c.ir
digitalarbre.online
digitalmarketingworld.store
digitaltwin.pet
dino-dealer.net
diplomatrix.org
diversidademinas.org
dmmforex.com
dmsconstructions.com
doc-audit.com
docment.info
doeparaarenacorinthians.site
dreamjobma.com
dropnu.com
drppin.com
dsbglobaltech.online
dubaiscustomimport.com
dubibazar.com
duplicatescreenshots.com
duygutuna.com
dwine.pro
dwtsol.fun
earthmetaticket.uno
eco4d.site
ecoeconsultores.com
ecrplomktee.art
eezilly.com
egyeng.online
ekkw.co.uk
elegantmagasin.shop
elevatorsjeddah.click
elideli.shop
elitepaintersmelbs.com
elkseekerbows.com
ensinoonlinecomdesconto.site
entrepriseshield.org
ephtur.online
escuelademusicaretama.com
euromart.site
evenbetter.shop
evoluafitness.site
exoticpetforsale.com
exposurestate.online
fairyfinesse.org
falaiguaba.com
fedlankilicaslan.info
feelingratio.com
femshift.com
ferreiraempreiteira.com
festivaldabaleia.com.br
fflutter.com
findlock.site
finlandlatinfestival.fi
finsure.site
fjscaneye-system.tech
flavorlink.org
flope.fun
flyworld.app
fortisec.online
fortniteaccounts.fun
fortpravoce.online
foxglx.com
freelancerseba.com.computerlearningschool.com
fresca-art.com
freshfactstoday.com
friendlygroup.org
frogmouse.fun
ftp.healthwelldata.org
ftp.odobryaka.ru
fukue.org
functionmentors.com
gabrielfsantos.shop
gandoulf.fun
geclass.fun
gestoriavehicular.uno
getitfast.help
ghamidko.com
gievents.site
glitchy.store
globeexim.com
globrecon.com
goldmanwear.com
gpplt.com
greenautorepair.shop
growtrends.store
gryzzly.cloud
guidehiking.xyz
gynoshakti.online
h2ohydrobike.fun
hargharjob.com
haxsecurityinc.com
hdgdsdh.com
hdkm.org
healingrishi.com
healthinsurancekaka.com
healthwelldata.org
heelhire.com
hema-store.xyz
heng246.xyz
henrik-andersen.com
historiaphotos.com
homesecuritysystem.store
homewoodhs.org
hospetpro.com
hostinfo-service.info
hotcontent.co.uk
hotdao.icu
houseakcros.com
housecallheroes.net
hygienes.blog
hypehaus.io
iceincusa.com
ideavault.org
iibat.net
imphi.network
index-search.online
infooportunidad.site
infoseon.online
inglesviajando.com
inimamente.shop
inmueblesenperu.com
inori.app
insuranceusa17.shop
invistamovel.site
ionechatbot.com
iovielat.xyz
iqviaworldreview.com
ittefaqcartravel.xyz
iwgassessoria.shop
jagrukplus.com
japaneselfe.com
jazthespazlife.com
jbblog.shop
jestwise.org
jigwinner.com
jinxstu.shop
jurnalist.online
jusmaster.com
kagorx.com
kaiquebrito.com
kaitee.nl
kaluigar.com
kangkeker.com
keto-oman.online
kezira.online
kingstechschool.online
kitber.xyz
klevergardens.com
kolatruco.trucosdigitalff.com
konglehund.com
kouturebrand.online
kusekhaya.net
lakehealthservices.com
lapanpizzaria.com.br
laserimar.com
legalviagens.com
lillebaby.id
litrato.org
liveboq.com
liveinfilms.com
livrariathechosen.online
lookacar.online
loveyourinnerguru.co.uk
lucidgatherings.com
lukygo.com
magatuniversity.pro
mail.leykiner.ru
mail.odobryaka.ru
mail.salsastatic.ru
mailinviare.com
maisondescristaux.com
mandistar.com
manualimpression.org
mapasdrones.com
markkethubb.online
maxsetka.space
maxx11.com
mayornow.org
mccictservices.com
melhorcomprabr.shop
meqrew.com
midtownmodernsg.com
mildmarket.org
ming-yin.com
mobileayoub.online
mogontop.co.uk
moldenhauer-baudienstleister.de
monier-maitenance.tech
morayatrend.com
moscowbks.com
moscowshield.com
mostan.store
mostesrealestate.com
movie.world-wide.blog
mrhustle.online
mrklyga.com
mscfutma.shop
msnetsec.space
multipletimesbetter.net
mundoemmovimento.info
mustmuslimstreetwear.shop
mx2.sgs.cx
myboxing.shop
mydivinedecor.com
nadinsartpromo.com
najornadadoingles.com
narutousumaki.shop
nerve-alive.shop
netrix.space
netvion.online
newgenius.org
newlogic.site
newreliefmovers.com
newsviral.blog
newversion-homedesign.online
nexaguard.space
nexblooms.com
nexusmedicalwoundcaresolutions.com
nikmok.net
nina.ledahost.com
nkwsllc.com
nlssports.com.br
nodasa.net
norsemenandsafety.com
northbengalrisingsportsfoundation.com
notesharing.online
nourix.shop
novateksolar.org
nrisre.com
ns1.bindrehab.org
ns1.cloudinor.com
ns1.correspondhq.org
ns1.correspondlocal.org
ns1.delicatedesign.org
ns1.diplomatrix.org
ns1.flavorlink.org
ns1.heelhire.com
ns1.ideavault.org
ns1.jestwise.org
ns1.litrato.org
ns1.manualimpression.org
ns1.mayornow.org
ns1.mildmarket.org
ns1.moscowbks.com
ns1.moscowshield.com
ns1.newgenius.org
ns1.onmth.com
ns1.perfumalia.org
ns1.pleasantlynest.org
ns1.policyset.com
ns1.positionpeak.org
ns1.rallybuilders.com
ns1.ratiorulers.org
ns1.realitydriven.org
ns1.safespotgrub.com
ns1.secureru.com
ns1.skillcurator.org
ns1.techhub10.online
ns1.traditionhq.org
ns1.trafficempire.org
ns1.unlikeu.org
ns1.viewvanguard.org
ns1.widenscience.com
ns2.techhub10.online
odobryaka.ru
ofertagta6.store
okvgallery.com
olifaa.com
omarjelwan.com
onmth.com
openwealthapp.com
opsfl.net
optivault.space
oqqes.xyz
ornan-ies.com
overviewweb.org
ozenfit-original.shop
pakspinpanel.com
panamabez.org
pandorabet.click
patelgallerie.com
pawdash.shop
peelgoodvibes.com
pennyftx.pro
pepespie.fun
perfumalia.org
petit-bac.online
phenowave.com
pierpress.org
planetastro.co.uk
plarnrnis.com
plateformeartisanat.com
pleasantlynest.org
plotsunlocked.com
policyset.com
politofarm.com
pop.odobryaka.ru
portalessencial.shop
portallppva24.site
portaltrucker.com.br
positionpeak.org
potensilahanpertanian.online
pravoslavnie.com
precisetechnomark.com
preconstructionestimation.net
premierkwt.com
pretznut.com
procasservices.com
procureesaiba.shop
prodiel-us.com
projetafacil.com
prospotsuae.com
protipw.com
pusdiklatpassus.site
qvpropertymanagement.com
raisest.online
rallybuilders.com
rapormtspnrantobaek.my.id
rarrymanpccl.online
ratiorulers.org
readhub.site
realidadcurso.com
realitydriven.org
recentnews.blog
redappletoken.com
redtailcruises.com
regularizacaodetaxa.site
regularizar-pendencias.shop
relacionamentocombo.online
rendaimobiliaria.com
rendapocket.shop
rendevalores.shop
rentscale.in
revoballot.com
riocasaimoveis.com
riyaddah.net
rmphysiowellness.online
robabdigital.com
rosesangre.online
rotterdam.wtf
rrassociates.agency
rrbetsport.online
rtp-spin68.site
ru.linsorata.xyz
sadilopo.site
safebloom.space
safespotgrub.com
saledigitals.com
salon-products.com
salsastatic.ru
samrassure.com
sancyllc.com
sandiegonftartgallery.com
sansplo.pro
sanxgroups.com
sapolopabsulcar.online
sarakerbazarwomenscollege.com
satio.xyz
savvyshppers.website
sawlaji.org
searchretrieval.tech
secureru.com
securetechno.shop
segurocomprasempre.shop
seocompany.tech
seofordentalcare.com
service-sopport.com
servont.com
setpa.shop
sgbeautycastle13.com
shieldify.online
shreeconsultancy.online
simonautoglass.shop
simpliwealthcreations.com
sionacademy.online
siopa420.com
skillcurator.org
skydrone.site
slimanedesigner.com
smartclass.site
smfgrup.com
smtp.odobryaka.ru
smtp3202.de
socksverse.wtf
softneek.com
solittleshop.com
solostudiosvq.com
spaceevents.space
sparkzdigitalmedia.com
specialretard.com
sportshistorynews.com
sss.v2ryng01.ru
standingappart.net
startglobal.online
stay24hotels.in
stickpacksolutions.com
storyspectroscopy.net
stroitelnye-cheki.com
studioline-mb.co.uk
styleclon.shop
suduang.fun
suiwukong.com
survei-spi-kpk.org
syncio.xyz
tahaali.co.uk
tambolaparty.in
tanj.cloud
tastehub.online
tband.shop
teamslc.info
tech-infosec.store
techcruxs.com
techhub10.online
techtrendline.com
tecnusmundo.com
tekbenk.net
temcredito.tech
tepekofficial.com
testando-dominio.shop
tfybrecho.com.br
thebeautyfans.com
thecreatist.net
thedepressionexperiment.com
theeyug.com
thehandleatherco.com
thelightgathering.com
themillionaireuniversity.org
theselfdiscoverylab.com
thewhisperingpinesretreat.com
thewnyholidays.com
thresholdtrends.com
timnasnews.com
tokoatapbesibaja.com
tokyapiproje.com
tomidaglossindoindah.com
tottibanotti.com
tpconstructions.in
tr0137733.fun
traditionhq.org
trafficempire.org
tramites.icu
treetrimguys.com
trilinkx.store
trippyfunart.com
truelivingproperties.com
ubagent.com.br
ubreats.store
unbindfast.com
unicaeg.com
universeofbeing.com
unlikeu.org
unrestinc.com
updatedoffers.shop
urtech.space
vaarom.com
vabliss.tech
valida-hoje.shop
verao-pg.com
verdana-village.net
vglrk.com
vh-startup.online
vibeprogramming.in
vibham.com
vidgrowthexperts.com
viewvanguard.org
vinarium.online
vinecrew.online
vitalock.space
vitalsaudepro.shop
vksportsclub.com
voluntize.org
vortextechfit.com
vpn01.l-d.tech
w3win.online
webapp-guruku.urtech.space
welllnessocietygeneva.fr
widenscience.com
win-shares.com
wishindinner.blog
wishmore.store
work-folio.com
worldofstatues.com
wpsuperlinks.store
wuachopi.com
wvidonasi.damansara-asia.com
xbanka.net
xn--kaganzademandra-klc.com
xn--relgio-dxa.online
xn--rtptoppus88-ucb6c.site
xn--seslikse-s4a.com
xn--ssalgadoscom-0hb.site
xntra-group.com
xpccs.com
yallooficial.com
youtradebase.com
zapbotinteligente.shop
zaybr.com
zieloushop.com

# Generic

/2000×2000.php
