# Copyright (c) 2014-2026 Maltrail developers (https://github.com/stamparm/maltrail/)
# See the file 'LICENSE' for copying permission

# Generic detection for compromised WordPress CMS

# Aliases: balada, baladainjector

# Reference: https://twitter.com/unmaskparasites/status/1355301566933213185

subl.net

# Reference: https://twitter.com/unmaskparasites/status/1367183133938831361

checklist.directory

# Reference: https://twitter.com/unmaskparasites/status/1369733061680586755
# Reference: https://twitter.com/unmaskparasites/status/1402047210343174146
# Reference: https://twitter.com/riper81/status/1404487096778170379

blameworthy.buzz
xn--80a1alg.xn--p1ai
xn--80a3afwhsk.xn--p1ai
xn--80aa4ce2a.xn--p1ai
xn--80ad2akx.xn--p1ai
xn--80adoej5a8h.xn--p1ai
xn--80ady8a.xn--p1ai
xn--80adzf.xn--p1ai
xn--80ae5bng4au.xn--p1ai
xn--80ahxth.xn--p1ai
xn--80aj4ae6d.xn--p1ai
xn--80aj6ah1a.xn--p1ai
xn--80amqk.xn--p1ai
xn--80azck0a.xn--p1ai
xn--90a7a4a.xn--p1ai
xn--90a8cf.xn--p1ai
xn--90achpp5d0c.xn--p1ai
xn--90aixnm.xn--p1ai
xn--b1axdhie3a.xn--p1ai
xn--b1ayb4b.xn--p1ai
xn--c1ab3awv.xn--p1ai
xn--c1ae0ahg.xn--p1ai
xn--c1aeyy.xn--p1ai
xn--c1alehkf5a3d.xn--p1ai
xn--c1anqe5e.xn--p1ai
xn--d1ad5e.xn--p1ai
xn--e1adtoj.xn--p1ai
xn--e1annge.xn--p1ai
xn--g1a1aom.xn--p1ai
xn--g1a2abr.xn--p1ai
xn--g1aehqp.xn--p1ai
xn--g1aey4a.xn--p1ai
xn--g1asqf.xn--p1ai
xn--h1aiml3a.xn--p1ai
xn--h1at3a.xn--p1ai
xn--i1abh6c.xn--p1ai
xn--i1aefi6c.xn--p1ai
xn--i1an6ab.xn--p1ai
xn--i1avf9a.xn--p1ai
xn--i1avu.xn--p1ai
xn--j1alm4a.xn--p1ai
xn--j1amtse.xn--p1ai
xn--k1akc5b.xn--p1ai
xn--k1aty.xn--p1ai
xn--o1aofd.xn--p1ai
xn--p1aldhp.xn--p1ai
xn--q1admt.xn--p1ai
xn--s1afb.xn--p1ai

# Reference: https://twitter.com/unmaskparasites/status/1370579966069383168

/SMILODON/index.php?view=

# Reference: https://twitter.com/unmaskparasites/status/1376690495477276674
# Reference: https://www.virustotal.com/gui/ip-address/194.61.25.77/relations

declarebusinessgroup.ga
dontkinhooot.tw
lovegreenpencils.ga
lowerthenskyactive.ga
strongcapitalads.ga
talkingaboutfirms.ga
travelfornamewalking.ga
travelinskydream.ga

# Reference: https://github.com/hardenedlinux/hardenedlinux-zeek-script/blob/master/scripts/frameworks/intel/OSINT/CYBERCRiME-03-03-19.txt

/SimplePie/Net/IPv5.php

# Reference: https://twitter.com/unmaskparasites/status/1394487078952398848

driverfortnigtly.ga

# Reference: https://twitter.com/unmaskparasites/status/1402346388617236481

digitalclimatestrike.net
assets.digitalclimatestrike.net

# Reference: https://www.wordfence.com/blog/2021/06/critical-0-day-in-fancy-product-designer-under-active-attack/
# Reference: https://otx.alienvault.com/pulse/60be1d277d109b2b37060c4c

http://46.53.253.152
http://69.12.71.82
http://92.53.124.123

# Reference: https://twitter.com/rootprivilege/status/1470821225542742016
# Reference: https://lukeleal.com/research/posts/trainresistor-cc-mass-injection/
# Reference: https://www.virustotal.com/gui/ip-address/45.9.150.64/relations

belonnanotservice.ga
piterreceiver.ga
trainresistor.cc

# Reference: https://twitter.com/unmaskparasites/status/1458970080797073413

blngblngs.rocks

# Reference: https://jetpack.com/2022/01/18/backdoor-found-in-themes-and-plugins-from-accesspress-themes/
# Reference: https://www.virustotal.com/gui/domain/wp-theme-connect.com/detection

wp-theme-connect.com

# Reference: https://twitter.com/unmaskparasites/status/1494462138298953736

cartoonmines.com

# Reference: https://twitter.com/unmaskparasites/status/1499593717845348354
# Reference: https://twitter.com/unmaskparasites/status/1506671930425823234
# Reference: https://twitter.com/unmaskparasites/status/1506728492016185348
# Reference: https://twitter.com/unmaskparasites/status/1507038308789936150
# Reference: https://twitter.com/unmaskparasites/status/1513575167674355712
# Reference: https://www.virustotal.com/gui/domain/turnedpro.xyz/relations
# Reference: https://www.virustotal.com/gui/ip-address/107.150.37.202/relations
# Reference: https://www.virustotal.com/gui/ip-address/142.54.189.218/relations
# Reference: https://www.virustotal.com/gui/ip-address/188.213.5.130/relations
# Reference: https://www.virustotal.com/gui/ip-address/188.213.5.197/relations
# Reference: https://www.virustotal.com/gui/ip-address/192.187.109.122/relations
# Reference: https://www.virustotal.com/gui/ip-address/198.204.252.154/relations
# Reference: https://www.virustotal.com/gui/ip-address/198.13.55.89/relations
# Reference: https://www.virustotal.com/gui/ip-address/45.67.230.136/relations
# Reference: https://www.virustotal.com/gui/ip-address/45.77.133.32/relations
# Reference: https://www.virustotal.com/gui/ip-address/5.134.119.42/relations
# Reference: https://www.virustotal.com/gui/ip-address/74.91.31.50/relations
# Reference: https://www.virustotal.com/gui/domain/firstok.xyz/relations
# Reference: https://www.virustotal.com/gui/domain/officialservicejp.com/relations
# Reference: https://www.virustotal.com/gui/domain/flyingfishes.online/relations
# Reference: https://www.virustotal.com/gui/domain/runpenguin.online/relations
# Reference: https://www.virustotal.com/gui/domain/tophead.online/relations
# Reference: https://www.virustotal.com/gui/domain/walkdolphin.online/relations
# Reference: https://qna.habr.com/q/1058482 (Russian)

alltee.buzz
anonymousfox.co
anonymousfox.io
anonymousfox.is
anonymousfox.mx
anonymousfox.to
bigercari.buzz
createseo.xyz
gloryplan.club
golang666.xyz
golangtools.live
ezreal333.icu
firstguide.xyz
firstok.xyz
gloryday.work
hahaha666.xyz
hellodolly666.xyz
hellodolly777.xyz
hellodolly888.xyz
hellodolly999.xyz
ok2345678.xyz
turnedpro.xyz
officialservicejp.com
flyingfishes.online
pinkpigs.online
runpenguin.online
tophead.online
walkdolphin.online
wtp9999999.xyz
api.firstguide.xyz
b1.gloryday.work
hello.firstguide.xyz
hello.hahaha666.xyz
hello.hellodolly666.xyz
hello.hellodolly777.xyz
hello.hellodolly888.xyz
hello.hellodolly999.xyz
hello.ok2345678.xyz
t.createseo.xyz
s.createseo.xyz
s.golangtools.live
s63.createseo.xyz
seo.createseo.xyz
seo.gloryday.work
seo1.createseo.xyz
seo3.createseo.xyz
seo1.doim.com
seo2.gloryday.work
seo23.firstok.xyz
seo30-1.firstok.xyz
seo30-2.firstok.xyz
seo32.firstok.xyz
seo35-1.firstok.xyz
seo35-2.firstok.xyz
seo50-1.firstok.xyz
seo50-2.firstok.xyz
seo50-3.firstok.xyz
seo601-1.firstok.xyz
seo601-2.firstok.xyz
seo801-1.firstok.xyz
seo802-1.firstok.xyz
seo803-1.firstok.xyz
seo804-2.firstok.xyz
seo805-1.firstok.xyz
seo806-2.firstok.xyz
seo808-1.firstok.xyz
seo809-1.firstok.xyz
seo810-1.firstok.xyz
seo811-1.firstok.xyz
seo82.firstok.xyz
seo92.firstok.xyz
a.turnedpro.xyz
api.turnedpro.xyz
hello.turnedpro.xyz
mn.turnedpro.xyz
p1.gloryplan.club
p2.gloryplan.club
p3.gloryplan.club
seo.gloryplan.club
seo1.turnedpro.xyz
seo10.turnedpro.xyz
seo2.turnedpro.xyz
seo3.turnedpro.xyz
seo4.turnedpro.xyz
seo5.turnedpro.xyz
seo6.turnedpro.xyz
seo7.turnedpro.xyz
seo8.turnedpro.xyz
seo9.turnedpro.xyz
track.turnedpro.xyz
seo45.officialservicejp.com
seo74.officialservicejp.com
seo802-8.officialservicejp.com
seo808-4.officialservicejp.com
seo824-2.officialservicejp.com
seo825-1.officialservicejp.com
seo826-1.officialservicejp.com
seo86.officialservicejp.com
seob215.officialservicejp.com
seoc226.officialservicejp.com
seo806-7.flyingfishes.online
seo812-8.flyingfishes.online
seo36.pinkpigs.online
seo804-6.pinkpigs.online
seo809-7.pinkpigs.online
seo810-6.pinkpigs.online
seo811-7.pinkpigs.online
seo814-7.pinkpigs.online
seo816-5.pinkpigs.online
seoa256.pinkpigs.online
seoc246.pinkpigs.online
seoc256.pinkpigs.online
seo104.runpenguin.online
seo35.runpenguin.online
seo54.runpenguin.online
seo602-3.runpenguin.online
seo801-4.runpenguin.online
seo801-5.runpenguin.online
seo802-2.runpenguin.online
seo802-3.runpenguin.online
seo804-4.runpenguin.online
seo806-4.runpenguin.online
seo808-3.runpenguin.online
seo809-4.runpenguin.online
seo810-2.runpenguin.online
seo810-5.runpenguin.online
seo811-3.runpenguin.online
seo812-5.runpenguin.online
seo815-3.runpenguin.online
seo815-4.runpenguin.online
seo817-2.runpenguin.online
seo818-2.runpenguin.online
seo819-2.runpenguin.online
seo819-3.runpenguin.online
seo820-2.runpenguin.online
seo821-1.runpenguin.online
seo821-3.runpenguin.online
seo822-1.runpenguin.online
seo824-1.runpenguin.online
seo824-3.runpenguin.online
seo84.runpenguin.online
seoa224.runpenguin.online
seob244.runpenguin.online
seob255.runpenguin.online
seoc215.runpenguin.online
seoc224.runpenguin.online
seoc244.runpenguin.online
seoc245.runpenguin.online
test.runpenguin.online
seo25.walkdolphin.online
seo11.tophead.online
seo51.tophead.online
seo81.tophead.online
seoa21.tophead.online
seoa212.tophead.online
seoa22.tophead.online
seoa221.tophead.online
seoa23.tophead.online
seoa232.tophead.online
seoa24.tophead.online
seoa241.tophead.online
seoa242.tophead.online
seoa243.tophead.online
seoa253.tophead.online
seob21.tophead.online
seob213.tophead.online
seob22.tophead.online
seob233.tophead.online
seob251.tophead.online
seob253.tophead.online
seoc21.tophead.online
seoc212.tophead.online
seoc22.tophead.online
seoc221.tophead.online
seoc23.tophead.online
seoc233.tophead.online
seoc24.tophead.online
seoc251.tophead.online
seoc253.tophead.online
seo805-4.walkdolphin.online
seo819-1.walkdolphin.online
seo820-1.walkdolphin.online
seo94.walkdolphin.online
/seeolkxa/

# Reference: https://www.virustotal.com/gui/ip-address/192.151.146.162/relations

site.gloryday.work

# Reference: https://twitter.com/unmaskparasites/status/1499536320896507906
# Reference: https://twitter.com/unmaskparasites/status/1511076575537557505
# Reference: https://twitter.com/unmaskparasites/status/1524843022952804352
# Reference: https://www.virustotal.com/gui/ip-address/111.90.143.157/relations

classicpartnerships.com
legendarytable.com
specialadves.com
storerightdesicion.com
ads.specialadves.com
click.specialadves.com
links.specialadves.com
refer.specialadves.com
blame.storerightdesicion.com
brr.storerightdesicion.com
chess.storerightdesicion.com
glove.storerightdesicion.com
lin.storerightdesicion.com
line.storerightdesicion.com
store.storerightdesicion.com
avasripts.classicpartnerships.com
comjavasripts.classicpartnerships.com
comwalk.classicpartnerships.com
event.classicpartnerships.com
events.classicpartnerships.com
javascript.classicpartnerships.com
javascripts.classicpartnerships.com
javasripts.classicpartnerships.com
open.classicpartnerships.com
scripts.classicpartnerships.com
simple.classicpartnerships.com
thisisatest.classicpartnerships.com
walk.classicpartnerships.com
white.classicpartnerships.com
34trick.legendarytable.com
clip.legendarytable.com
clipj.legendarytable.com
clipjs.legendarytable.com
comprint.legendarytable.com
comtrick.legendarytable.com
jack.legendarytable.com
print.legendarytable.com
trick.legendarytable.com

# Reference: https://twitter.com/unmaskparasites/status/1503550611756789760

32868.port0.org

# Reference: https://www.wordfence.com/blog/2022/03/increase-in-malware-sightings-on-godaddy-managed-hosting/

http://166.62.110.72
t-fish-ka.ru

# Reference: https://medium.com/@cirku17/wp-vcd-malware-analysis-7c5dbaad89c3
# Reference: https://github.com/CirKu17/wp-vcd-malware-sample
# Reference: https://twitter.com/BlackLotusLabs/status/1516415946587611137
# Reference: https://twitter.com/BlackLotusLabs/status/1516415948797976584
# Reference: https://twitter.com/BlackLotusLabs/status/1516415950396047380
# Reference: https://blog.prevailion.com/2020/02/phps-labyrinth-weaponized-wordpress.html
# Reference: http://web.archive.org/web/20200920003035/https:/blog.prevailion.com/2020/02/phps-labyrinth-weaponized-wordpress.html
# Reference: https://www.virustotal.com/gui/ip-address/94.156.175.170/relations
# Reference: https://otx.alienvault.com/pulse/596e1049fbe8a2174f3af765
# Reference: https://otx.alienvault.com/pulse/5e4d6c5790faacd62f7afed6
# Reference: https://www.virustotal.com/gui/file/cb8d693752fdcf84a77c486dfe04c3d53631cce4f97e5cccfc3c3486e5b10ebd/detection

24x7themes.top
aotson.com
arilns.com
batots.com
benos.cc
bomndo.com
bomndo.xyz
brilns.com
catots.pw
comndo.com
crilns.com
dacocs.com
darors.com
denom.cc
derna.cc
devata.icu
dlword.press
dolodos.top
dolsh.pw
domndo.com
download-freethemes.download
downloadfreenulled.download
downloadfreethemes.cc
downloadfreethemes.co
downloadfreethemes.download
downloadfreethemes.io
downloadfreethemes.pw
downloadfreethemes.space
downloadnulled.pw
drilns.pw
eatots.com
facocs.com
fapilo.com
farors.com
fatots.com
fomndo.com
fonjy.cc
freedownload.network
freenulled.top
freethemes.space
frilns.com
gacocs.com
gapilo.com
garors.com
gatots.com
gomnd.xyz
gomndo.com
gomndo.top
gomndo.xyz
grilns.com
hacocs.com
harors.com
hatots.com
hoxford.net
jarors.com
jatots.cc
jomndo.com
karors.com
katots.com
krilns.com
lanons.com
larors.com
latots.pw
linos.cc
lomndo.com
lomndo.top
lomndo.xyz
macocs.com
mapilo.net
marors.com
matots.com
medsource.top
merna.pw
mlimus.com
moxford.cc
mrilns.com
narors.com
natots.pw
null24.icu
null5.top
nulledzip.download
pacocs.com
panons.com
parors.com
patots.com
pervas.top
pharors.pw
phatots.com
piastas.gdn
piasuna.gdn
plimur.me
plimur.net
plimus.info
plimuz.me
poxford.com
premiumfreethemes.top
prilns.com
qarors.com
qatots.com
rarors.com
ratots.com
romndo.com
sarors.com
satots.com
semasa.icu
spekt.com
tanons.com
tarors.com
tdreg.icu
tdreg.top
themesdad.com
themesfreedownload.net
themesfreedownload.top
tomndo.com
tretas.top
trilns.com
uapilo.com
uarors.com
uatots.com
varors.com
vatots.com
vomndo.com
vosmas.icu
vrilns.com
vtoras.top
wacocs.com
warors.com
watots.com
womndo.com
wpfreedownload.press
wpmania.download
wrilns.com
wrilns.pw
xapilo.com
xarors.com
xatots.com
yapilo.pw
yarors.com
yatots.com
yomndo.com
zanons.com
zarors.com
zatots.com
zinos.cc
zomndo.com
zoxford.com
zrilns.com
zrilns.pw

# Reference: https://twitter.com/felixaime/status/1518527498929254401

ocamw.xyz
cdn.ocamw.xyz

# Reference: https://twitter.com/unmaskparasites/status/1524093794961960960

drakefollow.com
clocal.drakefollow.com
doggy.drakefollow.com
links.drakefollow.com
local.drakefollow.com
out.drakefollow.com
poll.drakefollow.com

# Reference: https://twitter.com/unmaskparasites/status/1526241349049077761

greengoplatform.com
creative.greengoplatform.com
column.greengoplatform.com
links.greengoplatform.com

# Reference: https://twitter.com/unmaskparasites/status/1530282235630235648

jj99.life

# Reference: https://twitter.com/unmaskparasites/status/1531307100709670912

brandonrestaurant.com

# Reference: https://twitter.com/unmaskparasites/status/1532112174411157504

transportgoline.com
back.transportgoline.com
front.transportgoline.com
track.transportgoline.com

# Reference: https://blog.sucuri.net/2022/06/analysis-massive-ndsw-ndsx-malware-campaign.html

/wp-content/plugins/wp-dumpme/click.php
/wp-content/plugins/wp-dumpme/clock.php
/wp-content/plugins/wp-dumpme/tasty.pot
/wp-content/plugins/wp-pimple/click.php
/wp-content/plugins/wp-pimple/clock.php
/wp-content/plugins/wp-sp/class.php
/wp-content/plugins/wp-sps/class.php
/wp-content/plugins/wp-sps/simple.php
/wp-content/plugins/wp-dumpme/
/wp-content/plugins/wp-pimple/
/wp-content/plugins/wp-sp/
/wp-content/plugins/wp-sps/

# Reference: https://twitter.com/momika233/status/1529694086193508353 (# CVE-2022-1609 WordPress Weblizar Backdoor)
# Reference: https://twitter.com/c3rb3ru5d3d53c/status/1536008762397544448

/wp-json/am-member/license

# Reference: https://twitter.com/unmaskparasites/status/1546896319037333504
# Reference: https://twitter.com/riper81/status/1559567645313142784
# Reference: https://www.virustotal.com/gui/ip-address/91.211.91.104/relations

bettershitecolumn.com
cofounderspecials.com
away.bettershitecolumn.com
beat.bettershitecolumn.com
best.bettershitecolumn.com
cdn.bettershitecolumn.com
click.bettershitecolumn.com
load.bettershitecolumn.com
loft.bettershitecolumn.com
scripts.bettershitecolumn.com
space.bettershitecolumn.com
wpz.cofounderspecials.com
fly.cofounderspecials.com
js.cofounderspecials.com
spectre.cofounderspecials.com

# Reference: https://www.virustotal.com/gui/ip-address/101.99.95.147/relations

brend.specialadves.com
call.greengoplatform.com
collect.greengoplatform.com
comcollect.greengoplatform.com
comtrack.greengoplatform.com
find.greengoplatform.com
flash.greengoplatform.com
front.greengoplatform.com
ftrack.greengoplatform.com
lnks.greengoplatform.com
local.specialadves.com
track.greengoplatform.com

# Reference: https://twitter.com/unmaskparasites/status/1615121524536795136
# Reference: https://www.virustotal.com/gui/ip-address/159.69.234.10/relations

specialblueitems.com
violetlovelines.com
cdn.violetlovelines.com
light.specialblueitems.com
track.violetlovelines.com
way.specialblueitems.com

# Reference: https://twitter.com/unmaskparasites/status/1552334638999228417

apigooglee.com

# Reference: https://twitter.com/tosscoinwitcher/status/1556698096813232129
# Reference: https://www.abuseipdb.com/check/51.142.175.104

http://20.254.121.118
http://51.142.175.104
51.142.175.104:52970
/a57bze8931.php
/savepng.php?location=a57bze8931.php

# Reference: https://blog.sucuri.net/2022/08/fake-ddos-pages-on-wordpress-lead-to-drive-by-downloads.html
# Reference: https://blog.sucuri.net/2022/09/new-malware-variants-serve-bogus-cloudflare-ddos-captcha.html
# Reference: https://www.virustotal.com/gui/ip-address/5.42.199.146/relations
# Reference: https://www.virustotal.com/gui/ip-address/5.42.199.148/relations
# Reference: https://www.virustotal.com/gui/file/7b72c022d506fc09a22d7721f6f50defd00297f52a89f1000b4f50b273d7f8ff/detection

adogeevent.com
colliderporn.at
confirmation.at
confirmation-process.at
gloogletag.com
luxury-limousine.com
skambio-porte.com
softlab-sport.com
trailerstrade.com
yaritsavodka.com
cheking.confirmation.at
gov.confirmation.at
irs.gov.confirmation.at
madeformade.confirmation.at
security-browser.colliderporn.at
verify.confirmation.at

# Reference: https://twitter.com/unmaskparasites/status/1254766052296122368
# Reference: https://www.virustotal.com/gui/domain/trackstatisticsss.com/relations
# Reference: https://www.joesandbox.com/analysis/399034/0/html
# Reference: https://www.wordfence.com/blog/2020/05/nearly-a-million-wp-sites-targeted-in-large-scale-attacks/

adsforbusines.com
stivenfernando.com
ps.stivenfernando.com
ws.stivenfernando.com
trackstatisticsss.com
adware.trackstatisticsss.com
count.trackstatisticsss.com
fox.trackstatisticsss.com
ount.trackstatisticsss.com
stat.trackstatisticsss.com
trstat.trackstatisticsss.com

# Reference: https://twitter.com/unmaskparasites/status/1235190676838633477

collectfasttracks.com
dest.collectfasttracks.com

# Reference: https://twitter.com/felixaime/status/1278600095538262017 (# WPScriptInjection)
# Reference: https://twitter.com/felixaime/status/1278602674401955846
# Reference: https://twitter.com/unmaskparasites/status/1280581176747601920
# Reference: https://www.virustotal.com/gui/ip-address/185.244.172.39/relations
# Reference: https://www.virustotal.com/gui/ip-address/45.9.148.49/relations

letsmakeparty3.ga
lobbydesires.com
tlcweb.ml
wpctrl.ga
wpctrl.gq
wpctrl.ml

# Reference: https://twitter.com/unmaskparasites/status/1289272342837895171
# Reference: https://twitter.com/unmaskparasites/status/1303792031693778947
# Reference: https://twitter.com/unmaskparasites/status/1303792922140254215
# Reference: https://twitter.com/unmaskparasites/status/1293570769545580545
# Reference: https://www.virustotal.com/gui/ip-address/45.9.148.126/relations

declarebusinessgroup.ga
developerstatss.ga
donatelloflowfirstly.ga
lowerbeforwarden.ml
trendopportunityfollow.ga
js.developerstatss.ga

# Reference: https://twitter.com/unmaskparasites/status/1329490824875282432
# Reference: https://www.virustotal.com/gui/ip-address/217.144.106.108/relations

lovegreenpencils.ga

# Reference: https://twitter.com/unmaskparasites/status/1291406328129298434
# Reference: https://blog.sucuri.net/2020/07/reverse-string-woocommerce-wordpress-credit-card-swiper.html

localhostnametable.com

# Reference: https://github.com/DoctorWebLtd/malware-iocs/tree/master/Linux.Backdoor.WordPressExploit.1

deliverygoodstrategies.com
gabriellalovecats.com
clon.collectfasttracks.com

# Reference: https://community.emergingthreats.net/t/ruleset-update-summary-2023-01-03-v10210/246
# Reference: https://www.virustotal.com/gui/ip-address/188.127.229.63/relations

tommyforgreendream.icu
transadforward.icu

# Reference: https://twitter.com/unmaskparasites/status/1577797497581613056
# Reference: https://www.virustotal.com/gui/file/dc39ec37839473ae1ad0dd7875205876ee84743609d28f2f4f55716c7659557a/detection

helpotus.com
/old_source/G1exHX0rYyv/
/wp-admin/EBxbU7MlIhOM/
/EBxbU7MlIhOM/
/G1exHX0rYyv/

# Reference: https://twitter.com/r3dbU7z/status/1586146279167361024
# Reference: https://blog.sucuri.net/2020/11/alfa-team-shell-v4-1-tesla-a-feature-update-analysis.html

http://87.238.210.44

# Reference: https://twitter.com/unmaskparasites/status/1496246505099108352

effectivecpmgate.com
trustedcpmrevenue.com

# Reference: https://blog.sucuri.net/2022/11/massive-ois-is-black-hat-redirect-malware-campaign.html

ois.is

# Reference: https://twitter.com/unmaskparasites/status/1593388212797382656
# Reference: https://www.virustotal.com/gui/ip-address/192.236.208.12/relations

i-io.io
i-s.is
t-o.to

# Reference: https://twitter.com/unmaskparasites/status/1600270751911014400

isn.is

# Reference: https://twitter.com/unmaskparasites/status/1600566768631967744

bitly.email

# Reference: https://twitter.com/unmaskparasites/status/1600578315659927552

cutlinks.pw

# Reference: https://twitter.com/unmaskparasites/status/1602374685278470144
# Reference: https://twitter.com/unmaskparasites/status/1603106867794022401
# Reference: https://twitter.com/unmaskparasites/status/1615091657858514944
# Reference: https://twitter.com/unmaskparasites/status/1618041405515132928
# Reference: https://www.virustotal.com/gui/ip-address/142.11.214.173/relations
# Reference: https://www.virustotal.com/gui/ip-address/172.96.189.69/relations
# Reference: https://www.virustotal.com/gui/ip-address/198.27.80.139/relations
# Reference: https://pastebin.com/raw/ffjAeK2L

012.bond
5pm.am
7la.la
b-i-t-l-y.co
b-i-t-l-y.net
bit-ly.mobi
bitly.gold
bitly.host
bitly.team
c-you.cyou
cc-z.cz
co-o.co
cr-7.cc
cutlinks.biz
cutlinks.ca
cutlinks.ch
cutlinks.mobi
cutlinks.org
cuturls.net
d-ev.dev
g-l.gl
g-y.gy
gob.co.il
gov-cn.cloud
h-air.hair
i-cu.icu
i-n-fo.info
ilc.lc
isx.sx
mvc.vc
obz.bz
oo-o.co
oo.coffee
qis.is
s-sh.sh
tiny-url.mobi
ufox.info
vms.ms
vv-vip.vip
w-me.me
w-ws.ws
wac.ac
wco.pw
webb-i-t-l-y.co
webb-i-t-l-y.net
webbit-ly.mobi
webbitly.email
webbitly.team
webcc-z.cz
webcutlinks.pw
webgov-cn.cloud
webufox.info
wst.st
b-i-t-l-y.co.b-i-t-l-y.net
bit-ly.mobi.b-i-t-l-y.net
bitly.eb-i-t-l-y.net
bitly.team.b-i-t-l-y.net
gov-cn.cloud.b-i-t-l-y.net

# Reference: https://blog.sucuri.net/2023/09/bogus-url-shorteners-go-mobile-only-in-adsense-fraud-campaign.html

a-a.asia
b-id.bid
c-h.tech
c-u.icu
i-me.link
m-e.cyou
o-n.one
p-c.pics
r-o.pro
t-e.site
u-u.today
w-a.wang
w-i.win
11g11.w-i.win
akhbarn.c-u.icu
crhalal.t-e.site
g16g.t-e.site
jmo.w-a.wang
jobsp.a-a.asia
kora.a-a.asia
l3b7.w-a.wang
maxkora.w-a.wang
toyori.a-a.asia
wallstfolly.t-e.site
yutrnd.w-a.wang

# Reference: https://twitter.com/unmaskparasites/status/1593690935959093248
# Reference: https://www.virustotal.com/gui/ip-address/89.22.228.250/relations

findtrustclicks.com
weatherplllatform.com
go.weatherplllatform.com
main.weatherplllatform.com
new.weatherplllatform.com
news.weatherplllatform.com
record.findtrustclicks.com
scripts.weatherplllatform.com
step.findtrustclicks.com
verify.weatherplllatform.com

# Reference: https://twitter.com/unmaskparasites/status/1595142301931941888
# Reference: https://urlscan.io/domain/watchvideo.pro
# Reference: https://www.virustotal.com/gui/ip-address/178.132.6.250/relations

adstracker.info
cleaner.computer
cleaner.digital
cleaner.support
date-now.org
datenow.date
virusscanner.to
watchvideo.cc
watchvideo.info
watchvideo.me
watchvideo.online
watchvideo.pro
winalert.computer
winalert.download
winalert.net
winalert.org
winalert.support
winalerts.computer
winalerts.download
winalerts.info
winalerts.live
winalerts.support
wincleaner.computer
wincleaner.digital
wincleaner.download
wincleaner.info
wincleaner.pro
wincleaner.support
yohoo.financial
yohoo.info
04qam.winalert.org
05imd.wincleaner.info
072gp.winalert.download
08evp.winalert.org
08geo.winalert.org
08nm7.watchvideo.pro
0airs.wincleaner.info
0am5g.winalert.net
0btrs.winalert.net
0dzgq.winalert.org
0f2w4.cleaner.computer
17quw.winalert.net
19800.winalert.net
1ce99.winalert.net
1gebm.winalert.net
1ggt3.winalert.net
1if2h.date-now.org
1oteb.winalert.net
1rvi3.date-now.org
1sg6d.winalert.net
1v2a4.winalert.net
26034.winalert.net
26z3b.winalert.net
27fdw.wincleaner.info
27gkd.winalert.net
286fv.winalert.org
2gqjs.winalerts.download
2kauk.wincleaner.info
2ltfx.watchvideo.cc
2lz8m.winalert.net
2m8a2.cleaner.computer
2quvq.winalert.net
2sl11.winalert.net
2v7wf.wincleaner.info
2wy27.wincleaner.info
32c6t.wincleaner.info
33jf4.watchvideo.cc
34t93.wincleaner.info
35k09.winalert.net
388n7.watchvideo.cc
3fqts.watchvideo.pro
3fw6n.wincleaner.info
3gn8r.watchvideo.online
3n2ou.winalert.org
3qmkf.wincleaner.info
3u7xr.winalert.net
3wc2l.winalert.org
3xuvx.winalert.net
3ypih.watchvideo.online
42zif.wincleaner.info
44lek.winalert.net
45lox.winalert.org
4b5nm.watchvideo.cc
4bq92.watchvideo.cc
4daxl.wincleaner.info
4en3r.winalert.org
4hb94.winalert.net
4iblu.wincleaner.info
4nug6.winalert.net
4p8p4.winalert.net
4rmys.cleaner.support
4sv9c.wincleaner.info
4u6f3.winalert.net
4w7f0.winalert.net
4z1s0.wincleaner.info
512qg.winalert.net
521j4.winalert.net
52v86.winalert.net
53uqc.wincleaner.info
5547e.winalert.net
57274.watchvideo.cc
5afea.cleaner.computer
5auky.watchvideo.online
5i8kr.winalert.net
5nzna.cleaner.support
5o9ft.winalert.net
5sw2r.date-now.org
5uydw.winalert.net
5z7f9.watchvideo.cc
67is8.watchvideo.cc
6b6a7.winalert.org
6cx6k.watchvideo.online
6faol.wincleaner.info
6he52.winalert.org
6kt6i.watchvideo.cc
6o7dv.watchvideo.cc
6r15a.wincleaner.info
6trfc.winalert.net
70n30.watchvideo.cc
7cdn6.winalert.net
7dulx.winalert.net
7ej61.winalert.net
7ibmf.wincleaner.info
7jgpt.watchvideo.cc
7pddp.wincleaner.info
7qfid.winalert.net
7sg7f.wincleaner.info
7u7ic.winalert.net
7udlx.wincleaner.info
7vr38.winalert.download
81ksn.wincleaner.info
8517k.watchvideo.cc
8bkdo.winalert.net
8fug9.cleaner.computer
8lbt2.winalert.net
8mtev.watchvideo.cc
8neih.wincleaner.info
8njbf.winalert.computer
8v7gk.wincleaner.info
90nxt.wincleaner.info
933j0.winalert.net
97caz.wincleaner.info
981t8.wincleaner.info
98xa8.winalert.org
9bty3.winalert.net
9fzjj.winalert.org
9h20w.winalert.net
9kja2.wincleaner.info
9mxe6.watchvideo.online
9ojn2.wincleaner.info
9pla9.winalert.net
9q97s.cleaner.computer
9ud06.winalert.org
9wjib.watchvideo.cc
9x9hg.cleaner.support
9y73y.watchvideo.pro
9zfqz.winalert.net
a266p.wincleaner.info
a29pj.wincleaner.info
a3afq.cleaner.computer
a612w.winalert.org
a8v9e.winalert.net
aabrr.watchvideo.online
ajeu5.winalert.org
ams4e.wincleaner.info
ar79g.watchvideo.cc
aympj.winalert.net
b0xrd.wincleaner.info
b4xam.watchvideo.cc
b5bgk.watchvideo.pro
bdme3.winalert.net
bff2u.winalert.net
bhscx.winalert.net
bi39h.wincleaner.info
bk23s.watchvideo.cc
bnw0p.winalert.org
bs07r.wincleaner.info
bskwp.winalert.net
bzhz2.wincleaner.info
bzszc.winalert.org
c0jmk.wincleaner.info
c2huq.cleaner.computer
ciwv4.wincleaner.info
ckpb5.winalert.net
crmv2.watchvideo.cc
ctbbg.winalert.org
cwh4x.watchvideo.cc
cxbbd.wincleaner.info
cxjh1.wincleaner.info
cxrja.watchvideo.cc
d2t3e.winalert.net
d5oru.winalert.net
d7htf.wincleaner.info
d7vke.cleaner.support
d8mo1.watchvideo.online
dcfs0.winalert.net
degh9.wincleaner.info
dfo6v.winalert.net
dg3ov.winalert.net
dobtj.winalert.net
e1bua.watchvideo.online
e26t3.winalert.net
e6je1.wincleaner.info
e6mrm.wincleaner.info
e8y40.winalert.net
eg74w.watchvideo.online
el46o.winalert.net
epfet.winalert.net
erus5.watchvideo.pro
esuse.wincleaner.info
eu7yd.watchvideo.online
exs5w.winalert.org
exwyd.watchvideo.pro
eyns6.winalert.net
f05t1.wincleaner.info
f481t.winalert.net
f7unt.wincleaner.info
fc380.cleaner.computer
fp3kr.watchvideo.cc
fpzck.winalert.download
frnpd.winalert.net
fu9ms.winalert.net
fuj9w.winalert.net
fv848.winalert.net
fzc0bj.watchvideo.online
g119g.winalert.net
g35kd.winalert.net
gblkg.wincleaner.info
ge380.winalert.net
gfwcc.winalert.net
gjvdr.watchvideo.cc
gt3jq.winalert.net
gtub6.winalert.org
gzyoi.watchvideo.cc
h2aw7.cleaner.support
h46ht.winalert.net
h4fkl.wincleaner.info
hadaz.winalerts.download
has5w.winalert.net
hidsz.winalert.org
hw4dx.winalert.net
i9r8e.wincleaner.info
icrkn.winalert.net
idbkb.wincleaner.info
ihgty.watchvideo.online
ik9c2.watchvideo.cc
ikdzc.wincleaner.info
it0ga.wincleaner.info
it3ea.wincleaner.info
its5j.winalert.computer
j3nou.date-now.org
j3pda.watchvideo.online
j7k9a.winalert.net
j7nir.watchvideo.cc
j7p2p.wincleaner.info
j7qdo.winalert.net
j88q4.wincleaner.info
jbkef.wincleaner.info
jerzw.winalert.net
jfjf1.winalert.net
jfupd.wincleaner.info
jp021.watchvideo.pro
jqq34.winalert.net
jrw1y.wincleaner.info
jsk7n.watchvideo.online
jszar.winalert.net
k7u6p.wincleaner.info
khxsc.wincleaner.info
kiph6.winalert.download
kk9rh.winalert.net
kkrqg.wincleaner.info
kp1ye.watchvideo.cc
kpz5j.watchvideo.online
ks45c.winalert.net
kwews.wincleaner.info
kzquq.watchvideo.cc
kzttt.winalert.net
l4zb2.watchvideo.pro
l5gux.wincleaner.info
l62wa.winalert.net
l9031.winalert.net
lcz95.winalert.org
le7oh.winalert.net
lhot3.winalert.net
lnfa8.wincleaner.info
lofxn.watchvideo.cc
lrg96.wincleaner.info
lxn3h.wincleaner.info
m0mx3.winalert.net
m4p2q.winalert.net
ma9aj.winalert.net
mabr1.cleaner.computer
mcft4.wincleaner.info
mev9h.winalert.net
mffye.winalert.org
mmq5y.winalert.org
mvnae.watchvideo.online
mzphe.cleaner.computer
n22ry.winalert.org
n34d9.watchvideo.pro
n73wf.cleaner.support
n8d6g.winalert.net
na7f7.cleaner.computer
nchm0.winalerts.download
njt8x.winalert.net
nk7c4.watchvideo.cc
nlox1.watchvideo.cc
npz55.winalert.net
nvnvm.watchvideo.pro
o54xw.watchvideo.cc
o9svp.winalert.org
o9z7f.winalert.net
ofpy5.cleaner.support
ol04k.watchvideo.cc
olkg9.wincleaner.info
osb35.winalert.net
otx8p.watchvideo.cc
ow4zk.winalert.net
p3p8k.watchvideo.cc
p4cyf.winalert.net
p5o9u.winalert.org
p8ujw.winalerts.download
peyj7.winalert.net
pndys.watchvideo.online
psfew.watchvideo.online
psn9f.winalert.net
pv6hx.wincleaner.info
pvd0h.wincleaner.info
py8rq.winalert.net
q1i35.wincleaner.info
qfz58.watchvideo.cc
qhjik.watchvideo.online
qi7gg.winalert.net
qm8h7.wincleaner.info
qprmq.winalert.net
qu1m0.winalert.net
quet7.winalert.net
qvrrq.cleaner.computer
qy7kb.watchvideo.cc
r0cyu.wincleaner.info
r1s20.winalert.net
r4zhb.cleaner.computer
r575z.cleaner.support
ratgh.wincleaner.info
rccih.winalert.org
rk9tk.wincleaner.info
rmeoc.wincleaner.info
rp49y.wincleaner.info
rry22.winalert.net
ru4lx.watchvideo.online
rw5ut.watchvideo.cc
rz7qn.winalert.net
s0bnk.cleaner.support
s308l.winalert.net
s3d0c.cleaner.computer
s63jf.winalert.org
s67de.winalert.net
s8bx6.watchvideo.online
s8h6e.winalert.net
sb4is.winalert.net
sh6dw.wincleaner.info
smywt.watchvideo.cc
ssewr.wincleaner.info
sszf0.winalert.org
sudns.winalert.net
sw9kh.watchvideo.cc
t0686.watchvideo.cc
t1v97.winalert.net
t5sc2.wincleaner.info
talej.cleaner.computer
tf2k3.winalert.net
tfthn.winalert.net
tfu6j.watchvideo.cc
thdra.winalert.net
tiwam.wincleaner.info
tjjkm.winalert.org
tq1cp.winalert.net
tzada.winalert.net
u58jr.winalert.net
u5wdz.wincleaner.info
u8v3r.wincleaner.info
ubj98.wincleaner.info
ufkh2.wincleaner.info
uhlk.winalert.net
ul27t.winalerts.download
uru8s.watchvideo.cc
uwpuy.watchvideo.cc
v3ynj.winalert.net
vd3vi.winalert.net
veeek.watchvideo.pro
vfjg4.winalert.net
vif5m.winalert.net
vkzig.winalert.org
vmwsm.winalert.org
vnagw.winalert.net
vo47j.watchvideo.cc
voaz2.winalert.org
vy79r.watchvideo.online
w2n7o.cleaner.computer
wc0jg.watchvideo.online
wcbsf.wincleaner.info
wcfl7.wincleaner.info
wm96e.winalert.net
wt177.cleaner.computer
wt8fy.winalert.net
wugrk.cleaner.support
ww1ig.winalert.org
wxifm.winalert.org
wykbp.winalert.net
x1r7i.winalert.net
x69js.watchvideo.cc
x8hob.winalert.net
xhvos.wincleaner.info
xlj5v.wincleaner.info
xnpv9.winalert.net
xp10k.watchvideo.cc
xqe15.winalert.net
xqhv7.wincleaner.info
xra4x.watchvideo.cc
xt3hf.watchvideo.online
xtj5c.wincleaner.info
xukbz.winalert.net
xvtqv.winalert.net
y1uc8.winalert.net
y3yex.wincleaner.info
y6rys.wincleaner.info
y8oo5.watchvideo.cc
y8qws.winalert.org
yag9m.watchvideo.cc
ybz2c.winalert.net
ygm57.winalert.org
yis3d.winalert.net
yl9ln.winalerts.download
ynckp.watchvideo.cc
ynv1c.watchvideo.cc
yohsx.winalert.net
ysxmsl.watchvideo.cc
ytcig.winalert.computer
yvgqe.date-now.org
yyirk.wincleaner.info
z2swm.wincleaner.info
z5wyt.winalert.net
zc0bj.watchvideo.online
zfrqo.winalert.org
zg7cg.winalerts.download
zgjnb.winalert.net
zgwq9.watchvideo.pro
zhecc.winalert.net
zj7h7.cleaner.computer
zju6f.wincleaner.info
zos6z.winalert.net
zr38i.winalert.net
zsg7s.winalert.net
zt7q6.winalert.net
ztk09.wincleaner.info
zumvv.winalert.net
zvddr.winalert.net
zw1ll.wincleaner.info
zzylv.winalert.net

# Reference: https://blog.sucuri.net/2023/01/massive-campaign-uses-hacked-wordpress-sites-as-platform-for-black-hat-ad-network.html

chestishugli.com
duhestyce.com
dusyguri.com
fujonusy.com
ginepija.com
heglosuty.com
hydothera.com
hyxumuta.com
interestmoments.com
jefashivy.com
kawunimy.com
ladyphapty.com
laluvygy.com
lebinaphy.com
psihimapto.com
similarwebline.com
thirawogla.com
tuleceti.com
vozastane.com
wholegrady.com
whujyfali.com
whychymithy.com
files.findtrustclicks.com
long.interestmoments.com
short.interestmoments.com
similar.similarwebline.com
template.interestmoments.com

# Reference: https://twitter.com/unmaskparasites/status/1620156750723973121

firstblackphase.com
dns.firstblackphase.com

# Reference: https://twitter.com/unmaskparasites/status/1623407097949077504

dofollowgreenline.com
sortyellowapples.com
back.firstblackphase.com
come.sortyellowapples.com
get.firstblackphase.com
get.sortyellowapples.com
goaway.dofollowgreenline.com
scripts.dofollowgreenline.com
shop.similarwebline.com
step.firstblackphase.com
store.firstblackphase.com
track.firstblackphase.com

# Reference: https://www.virustotal.com/gui/ip-address/194.135.30.40/relations

away.firstblackphase.com
away.similarwebline.com
final.similarwebline.com
first.interestmoments.com

# Reference: https://twitter.com/unmaskparasites/status/1628475618290700289
# Reference: https://www.virustotal.com/gui/ip-address/194.135.30.210/relations

statisticline.com
check.statisticline.com
for.firstblackphase.com
pista.violetlovelines.com
trac.violetlovelines.com

# Reference: https://twitter.com/unmaskparasites/status/1636765304062881792

wensbol.site
google-analytics.workers.dev
static.google-analytics.workers.dev

# Reference: https://blog.sucuri.net/2023/04/balada-injector-synopsis-of-a-massive-ongoing-wordpress-malware-campaign.html

accongestion.com
actraffic.com
admarketlocation.com
adsrequestbest.com
adtrafficjam.com
backrocklondon.com
balanceformoon.com
balanceforsun.com
balantfromsun.com
becausenightisbetter.com
becauseshineisbetter.com
beforwardplay.com
belaterbewasthere.com
belazyelephant.com
belighterservice.com
bluelabelmoscow.com
bullgoesdown.com
buyittraffic.com
carlbendergogo.com
cdn.statisticline.com
chatwithgreenbar.com
costsimpleplay.com
createrelativechanging.com
cuttraffic.com
dancewithlittleredpony.com
deliverblackjohn.com
denzzzelwashington.com
destinyfernandi.com
dexterfortune.com
donaldbackinsky.com
fast.destinyfernandi.com
followmyfirst1.com
generallocationgo.com
giantttraffic.com
globallyreinvation.com
gotosecond2.com
greenlabelfrancisco.com
greenrelaxfollow.com
importtraffic.com
jockersunface.com
letsmakesomechoice.com
lightversionhotel.com
littleandbiggreenballlon.com
main.travelfornamewalking.ga
makesomethird3.com
port.transandfiestas.ga
postertraffic.com
primarylocationgo.com
privacylocationforloc.com
puttraffic.com
redfunchicken.com
redlabellondon.com
redrelaxfollow.com
requestfor4.com
resolutiondestin.com
scripts.trasnaltemyrecords.com
slow.destinyfernandi.com
speakwithjohns.com
specialthankselsa.com
startrafficc.com
talktofranky.com
toupandgoforward.com
trafficlmedia.com
transandfiestas.ga
trasnaltemyrecords.com
traveltoscount.com
verybeatifulantony.com
wiilberedmodels.com
worldctraffic.com
yellowlabeltokyo.com
/wp-clearlineee/
/wp-resortpack/
/wp-resortpack/clock.php
/wp-resortpack/tasty.pot

# Reference: https://blog.malwarebytes.com/threat-analysis/2018/09/mass-wordpress-compromises-tech-support-scams/

drupalupdates.tk
ejyoklygase.tk
examhome.net
mp3menu.org
uustoughtonma.org
voipnewswire.net
ads.voipnewswire.net
cdn.allyouwant.online

# Reference: https://otx.alienvault.com/pulse/5d9cadcab8eefffbac23367a
# Reference: https://blog.sucuri.net/2017/05/fake-wordprssapi-stealing-cookies-and-hijacking-sessions.html
# Reference: https://www.scmagazineuk.com/cookie-monster-malware-steals-cookies-hijacks-wordpress-sessions/article/1474671

1.newor.net
12mlbe.com
2.api.viralheadlines.net
3.newor.net
a01.u-ad.info
abtrcking.com
adpoints.media
adrenalinecdn.com
adsvcs.com
affect.lt
affilizr.com
agrkings.com
airjss.com
andrewandjack.com
api.behavioralmailing.com
api.viralheadlines.net
avrti.xyz
b.nwcdn.xyz
baidustatic.pw
beatchucknorris.com
behavioralmailing.com
bh-cdn.com
blozoo.net
botthumb.com
bwinpoker24.com
c.radxcomm.com
caphyon-analytics.com
cdn.adpoints.media
cdn.avrti.xyz
cdn.echoenabled.com
cdn.inaudium.com
cdn.jquery.tools
cdn.muse-widgets.ru
cdn.owlcdn.com
cfs.u-ad.info
chat-client-js.firehoseapp.com
cleantds.in
clk-analytics.com
code.jguery.org
con1.sometimesfree.biz
connect.f1call.com
d0.histats.12mlbe.com
da.adsvcs.com
daljarrock.hurlinesswhitchurch.com
dancewithme.biz
dcts.pw
dezaula.com
dup.baidustatic.pw
e.e708.net
e708.net
earsham.pontypriddcrick.com
echoenabled.com
f1call.com
firehoseapp.com
flipdigital.ru
free-codes.org
frompariswithhate.org
gamescale.vio.rocks
getsocialbuttons.xyz
histats.12mlbe.com
hmailserver.in
hosted-oswa.org
hurlinesswhitchurch.com
i.omeljs.info
i.rfgdjs.info
i.selectionlinksjs.info
i3.putags.com
ijquery9.com
imaginaxs.com
inaudium.com
infinite-2.tcs3.co.uk
infinite-3.tcs3.co.uk
java.sometimesfree.biz
jguery.org
jquery.im
jquery.tools
js.nster.net
js.sn00.net
js.trafficanalytics.online
js2.sn00.net
kanpianjs.top
keit.kristofer.ga
kristofer.ga
kuru2jam.com
lb.wa-track.com
livestats.us
log.widgetstat.net
m.free-codes.org
m.xfanclub.ru
mediros.ru
muse-widgets.ru
narnia.tcs3.co.uk
newor.net
nstracking.com
nwcdn.xyz
oasagm82wioi.org
omeljs.info
omnitor.ru
onlinemarketplace.top
orange81safe.com
ournet-analytics.com
owlcdn.com
parts.kuru2jam.com
pipardot.com
pontypriddcrick.com
putags.com
radxcomm.com
rarstats.com
rfgdjs.info
rolledwil.biz
s.orange81safe.com
s1.omnitor.ru
sbdtds.com
script.affilizr.com
sdb.dancewithme.biz
segpress.io
selectionlinksjs.info
seo101.net
sn00.net
sometimesfree.biz
spartan-ntv.com
src.dancewithme.biz
srv1.clk-analytics.com
st.segpress.io
st.stadsvc.com
stablemoney.ru
stadsvc.com
stat.botthumb.com
stat.rolledwil.biz
static.bh-cdn.com
tag.imaginaxs.com
takoashi.net
tcs3.co.uk
themes.affect.lt
trafficanalytics.online
trafficapi.nl
traffictrade.life
tsometimesfree.biz
u-ad.info
upgraderservices.cf
upskirt-jp.net
viralheadlines.net
w5983.lb.wa-track.com
wa-track.com
webstats.xcellenzy.com
widgets.wowzio.net
widgetstat.net
wowzio.net
xcellenzy.com
xfanclub.ru
yourmsrp.com
yys1982.com
zirve100.com

# Reference: https://wordpress.org/support/topic/website-hacked-index-php-totally-changed/
# Reference: https://www.virustotal.com/gui/domain/bingstyle.com/relations

bingstyle.com
saleforyou.org

# Reference: https://twitter.com/unmaskparasites/status/1650944399969513472
# Reference: https://twitter.com/unmaskparasites/status/1653124417596329985
# Reference: https://twitter.com/unmaskparasites/status/1656024953249218560
# Reference: https://www.virustotal.com/gui/ip-address/194.135.30.210/relations
# Reference: https://www.virustotal.com/gui/ip-address/2.59.222.113/relations
# Reference: https://www.virustotal.com/gui/ip-address/45.9.148.27/relations

beatylines.com
descriptionscripts.com
dofollowgreenline.com
firstblackphase.com
sortyellowapples.com
specialblueitems.com
statisticline.com
trackersline.com
violetlovelines.com
weatherplllatform.com
22news.weatherplllatform.com
ack.firstblackphase.com
away.firstblackphase.com
ay.specialblueitems.com
back.firstblackphase.com
block.descriptionscripts.com
cdn.statisticline.com
cdn.violetlovelines.com
check.statisticline.com
comcdn.statisticline.com
come.sortyellowapples.com
comtrack.violetlovelines.com
cripts.dofollowgreenline.com
dns.firstblackphase.com
e.sortyellowapples.com
far.statisticline.com
fire.descriptionscripts.com
for.firstblackphase.com
for.sortyellowapples.com
get.firstblackphase.com
get.sortyellowapples.com
goaway.dofollowgreenline.com
light.specialblueitems.com
line.beatylines.com
main.weatherplllatform.com
pista.violetlovelines.com
rack.violetlovelines.com
reway.specialblueitems.com
script.dofollowgreenline.com
scripts.dofollowgreenline.com
select.sortyellowapples.com
shop.similarwebline.com
stat.descriptionscripts.com
stats.statisticline.com
stay.trackersline.com
step.descriptionscripts.com
step.firstblackphase.com
stock.statisticline.com
store.firstblackphase.com
trac.violetlovelines.com
track.firstblackphase.com
track.violetlovelines.com
way.specialblueitems.com
statisticline.comcdn.statisticline.com
violetlovelines.comtrack.violetlovelines.com
cdn.statisticline.comcdn.statisticline.com
track.violetlovelines.comtrack.violetlovelines.com

# Reference: https://twitter.com/daniel_sloof/status/1658109542108917761
# Reference: https://www.virustotal.com/gui/ip-address/194.135.30.210/relations
# Reference: https://www.virustotal.com/gui/ip-address/2.59.222.113/relations
# Reference: https://www.virustotal.com/gui/ip-address/2.59.222.122/relations
# Reference: https://app.validin.com/axon?type=dom&limit=100&find=*.scriptsplatform.com

scriptsplatform.com
away.scriptsplatform.com
cdn.scriptsplatform.com
come.scriptsplatform.com
get.scriptsplatform.com
statistic.scriptsplatform.com
statistics.scriptsplatform.com
top.scriptsplatform.com

# Reference: https://twitter.com/unmaskparasites/status/1660440128207327233
# Reference: https://www.virustotal.com/gui/ip-address/194.135.30.210/relations

clickandanalytics.com
cdn.clickandanalytics.com
click.clickandanalytics.com
come.clickandanalytics.com
get.clickandanalytics.com
put.clickandanalytics.com

# Reference: https://www.virustotal.com/gui/ip-address/91.238.104.193/relations
# Reference: https://www.virustotal.com/gui/ip-address/2.59.222.119/relations
# Reference: https://www.virustotal.com/gui/ip-address/2.59.222.121/relations
# Reference: https://www.virustotal.com/gui/ip-address/2.59.222.122/relations
# Reference: https://www.virustotal.com/gui/ip-address/88.151.192.253/relations
# Reference: https://www.virustotal.com/gui/ip-address/89.23.103.32/relations
# Reference: https://www.virustotal.com/gui/file/d9035339d29363e7ae7191b493a6b0c14e6584995f51b4fc3df73b6bf4beedba/detection

linestoget.com
specialnewspaper.com
specialtaskevents.com
stablelightway.com
stratosbody.com
apis.stratosbody.com
away.linestoget.com
away.specialnewspaper.com
away.stratosbody.com
away.trackersline.com
cdn.specialtaskevents.com
cdn.weatherplllatform.com
collect.clickandanalytics.com
fly.stratosbody.com
get.interestmoments.com
get.linestoget.com
go.linestoget.com
go.specialnewspaper.com
goto.stablelightway.com
lists.clickandanalytics.com
needgo.trackersline.com
rate.specialtaskevents.com
sleep.stratosbody.com
spot.scriptsplatform.com
stay.linestoget.com
stay.stratosbody.com
step.linestoget.com
take.specialtaskevents.com
trace.stratosbody.com
trend.stablelightway.com
way.trackersline.com
stoomawy.stay.linestoget.com

# Reference: https://twitter.com/unmaskparasites/status/1704961690880913816
# Reference: https://www.virustotal.com/gui/ip-address/88.151.192.254/relations
# Reference: https://app.validin.com/axon?find=88.151.192.254

getmygateway.com
collect.getmygateway.com
gate.getmygateway.com
send.getmygateway.com
space.getmygateway.com
spot.getmygateway.com

# Reference: https://twitter.com/unmaskparasites/status/1704952839729267087
# Reference: https://www.virustotal.com/gui/ip-address/111.90.141.193/relations
# Reference: https://www.virustotal.com/gui/ip-address/88.151.192.253/relations

decentralappps.com
cdn.decentralappps.com
cell.decentralappps.com
maliciousstay.decentralappps.com
stay.decentralappps.com
stock.decentralappps.com
thestay.decentralappps.com
tostock.decentralappps.com
way.decentralappps.com
withstock.decentralappps.com

# Reference: https://www.virustotal.com/gui/ip-address/111.90.141.192/relations
# Reference: https://www.virustotal.com/gui/ip-address/185.177.94.180/relations
# Reference: https://app.validin.com/axon?source=DNS&type=ip&find=111.90.141.192

allowww.com
blacklinetosplit.com
getfailfilm.com
whitelinetosplit.com
0.allowww.com
1.allowww.com
2.allowww.com
3.allowww.com
4.allowww.com
5.allowww.com
6.allowww.com
7.allowww.com
8.allowww.com
9.allowww.com
10.allowww.com
0.blacklinetosplit.com
1.blacklinetosplit.com
2.blacklinetosplit.com
0.getfailfilm.com
1.getfailfilm.com
2.getfailfilm.com
3.getfailfilm.com
4.getfailfilm.com
5.getfailfilm.com
6.getfailfilm.com
7.getfailfilm.com
8.getfailfilm.com
9.getfailfilm.com
10.getfailfilm.com
0.whitelinetosplit.com
2.whitelinetosplit.com
from.whitelinetosplit.com
goto.whitelinetosplit.com
select.blacklinetosplit.com

# Reference: https://www.virustotal.com/gui/ip-address/185.177.94.194/relations

gadgetnews.one
gomajorlink.com
m-video.shop
major-video.click
majoriklink.com
majorikmedia.com
majorilink.com
majorius.com
majorlink.club
majorlinker.biz
majorlinker.com
majormedialink.com
majorpush.shop
majorsmi.com
majortoplink.com
n1major.com
n2major.com
n3major.com
notrobot.top

# Reference: https://www.virustotal.com/gui/ip-address/80.66.79.252/relations
# Reference: https://www.virustotal.com/gui/ip-address/80.66.79.253/relations

bridgelinering.com
colorschemeas.com
findbestresultss.com
lightsteper.com
promsmotion.com
210net.promsmotion.com
211.210net.promsmotion.com
232.211.210net.promsmotion.com
2fservice.specialcraftbox.com
46.232.211.210net.promsmotion.com
all.colorschemeas.com
call.colorschemeas.com
et.promsmotion.com
fecall.colorschemeas.com
gate.promsmotion.com
generic.service.specialcraftbox.com
get.lightsteper.com
get.promsmotion.com
getl.promsmotion.com
go.bridgelinering.com
net.promsmotion.com
page.specialnewspaper.com
s.specialcraftbox.com
show.bridgelinering.com
stay.findbestresultss.com
tracker.findbestresultss.com

# Reference: https://www.virustotal.com/gui/ip-address/2.59.222.157/relations

base2.getmygateway.com
cdn.lightsteper.com
comgate.getmygateway.com
get.getmygateway.com
haishirokuma.comgate.getmygateway.com

# Reference: https://blog.sucuri.net/2023/10/balada-injector-targets-unpatched-tagdiv-plugin-newspaper-theme-wordpress-admins.html
# Reference: https://www.virustotal.com/gui/ip-address/185.39.206.158/relations
# Reference: https://www.virustotal.com/gui/ip-address/185.39.206.159/relations
# Reference: https://www.virustotal.com/gui/ip-address/185.39.206.160/relations
# Reference: https://www.virustotal.com/gui/ip-address/185.39.206.161/relations
# Reference: https://www.virustotal.com/gui/ip-address/185.39.206.162/relations

dataofpages.com
listwithstats.com
statisticscripts.com
0cdn.dataofpages.com
age.listwithstats.com
asset.statisticscripts.com
assets.statisticscripts.com
call.dataofpages.com
cassets.statisticscripts.com
cdn.dataofpages.com
cnd.dataofpages.com
cdn.statisticscripts.com
compage.listwithstats.com
compost.listwithstats.com
css.statisticscripts.com
dn.dataofpages.com
dn.statisticscripts.com
first.dataofpages.com
img.statisticscripts.com
inassets.statisticscripts.com
irst.dataofpages.com
ja.statisticscripts.com
js.statisticscripts.com
new.listwithstats.com
news.listwithstats.com
one.dataofpages.com
ost.listwithstats.com
page.listwithstats.com
post.listwithstats.com
riseup.cdn.dataofpages.com
slash.dataofpages.com
splash.dataofpages.com
ssets.statisticscripts.com
xyz.dataofpages.com
calgarytoyshow.compost.listwithstats.com
listwithstats.compage.listwithstats.com
page.listwithstats.compage.listwithstats.com

# Reference: https://threatfox.abuse.ch/browse/tag/balada/
# Reference: https://www.virustotal.com/gui/ip-address/80.66.79.247/relations

getsmallcount.com
gybritanalytsesystem.com
playerofsunshine.com
selectofmychoices.com
startperfectsolutions.com
bee.selectofmychoices.com
best.playerofsunshine.com
call.getsmallcount.com
come.statisticplatform.com
comsecond.gybritanalytsesystem.com
debest.playerofsunshine.com
econd.gybritanalytsesystem.com
emv1.selectofmychoices.com
excelent.playerofsunshine.com
excellent.playerofsunshine.com
exelent.playerofsunshine.com
fifth.gybritanalytsesystem.com
first.gybritanalytsesystem.com
five.startperfectsolutions.com
for.getsmallcount.com
four.startperfectsolutions.com
fourth.gybritanalytsesystem.com
get.statisticplatform.com
good.playerofsunshine.com
got.statisticplatform.com
great.playerofsunshine.com
here.selectofmychoices.com
meilleur.playerofsunshine.com
mejor.playerofsunshine.com
normal.playerofsunshine.com
one.startperfectsolutions.com
prueba.selectofmychoices.com
qwer.gybritanalytsesystem.com
root.selectofmychoices.com
second.gybritanalytsesystem.com
third.gybritanalytsesystem.com
three.startperfectsolutions.com
trry.selectofmychoices.com
try.selectofmychoices.com
two.startperfectsolutions.com
was.selectofmychoices.com
where.selectofmychoices.com
browsermine.comsecond.gybritanalytsesystem.com
test20102023.debest.playerofsunshine.com

# Reference: https://blog.sucuri.net/2024/01/thousands-of-sites-with-popup-builder-compromised-by-balada-injector.html
# Reference: https://infosec.exchange/@rmceoin/111665788958104483
# Reference: https://www.virustotal.com/gui/ip-address/80.66.79.248/relations
# Reference: https://app.validin.com/axon?find=80.66.79.248/30&type=ip4

bestdarkbars.com
bestlightbars.com
bestselllerservice.com
betradingway.com
blueperfectballon.com
bluesmallbutterfly.com
clearblueline.com
cleargreenline.com
clearlinesprice.com
creativemanagercircle.com
creativemanagerline.com
darkspecialbars.com
daynitroglass.com
goldflowerservice.com
greenfastline.com
greensmallbutterfly.com
lightgreenstep.com
lightredstep.com
lightspecialbars.com
lineferaline.com
nightnitroglass.com
openspecificdark.com
openspecificwhite.com
redperfectballon.com
selectchoise.com
solohostering.com
somenewforyou.com
specialcraftbox.com
statisticplatform.com
stoneblacksort.com
stonewhitesort.com
sunshineblackcolor.com
sunshinewhitecolor.com
topgiftsforusers.com
trackspecialdomain.com
workandbestservice.com
workandgoodservice.com
cget.specialcraftbox.com
domain-service.specialcraftbox.com
fine.greenfastline.com
get.specialcraftbox.com
give.selectchoise.com
goaway.betradingway.com
got.selectchoise.com
goto.betradingway.com
goto.lineferaline.com
namesoft.specialcraftbox.com
north.statisticplatform.com
oaway.betradingway.com
rest.greenfastline.com
service.specialcraftbox.com
soft.specialcraftbox.com
sofx.specialcraftbox.com
startup.betradingway.com
stone.betradingway.com
store.bestselllerservice.com
west.statisticplatform.com

# Reference: https://www.virustotal.com/gui/ip-address/80.66.79.249/relations

beatifulllhistory.com
special.beatifulllhistory.com

# Reference: https://www.virustotal.com/gui/ip-address/80.66.79.251/relations

cdntoswitchspirit.com
forwardstarlight.com
2frest.greenfastline.com
comcss.cdntoswitchspirit.com
cpjs.cdntoswitchspirit.com
css.cdntoswitchspirit.com
dominiorest.greenfastline.com
est.cdntoswitchspirit.com
fine.lineferaline.com
follow.forwardstarlight.com
from.forwardstarlight.com
from.lineferaline.com
goto.greenfastline.com
js.cdntoswitchspirit.com
malware-iconchest.cdntoswitchspirit.com
rest.cdntoswitchspirit.com
rest.lineferaline.com
reste.greenfastline.com
s.cdntoswitchspirit.com
stay.forwardstarlight.com
step.greenfastline.com

# Reference: https://twitter.com/banthisguy9349/status/1744397694443848035

statisticsplatform.com
comwest.statisticsplatform.com
done.forwardstarlight.com
east.statisticsplatform.com
finish.selectchoise.com
north.statisticsplatform.com
page.bridgelinering.com
shop.bridgelinering.com
start.selectchoise.com
west.statisticsplatform.com

# Reference: https://twitter.com/unmaskparasites/status/1719152791875420655

cdzanalytics.com
ga.cdzanalytics.com

# Reference: https://twitter.com/unmaskparasites/status/1749877909450633616

plastformspecial.com
get.plastformspecial.com
post.plastformspecial.com

# Reference: https://www.virustotal.com/gui/file/eedb020cff479ebcb511376b902825a0e35e5549346462548c0bca8d6ecd7ac3/detection

111.90.148.245:3503
/LIboibne3ru6sighe6urpcsgo/checkquit
/LIboibne3ru6sighe6urpcsgo/get
/LIboibne3ru6sighe6urpcsgo/set
/LIboibne3ru6sighe6urpcsgo/

# Reference: https://www.virustotal.com/gui/file/21bfc6439c7c750846a8e6a337621f49843dea714e4ce5f9dc72908f09f513c0/detection

111.90.148.245:3319

# Reference: https://www.virustotal.com/gui/file/c3afe8bee1512205bbd01ea486679de547ff61c697f13220c833d3b0f5117e75/detection

111.90.148.245:3411

# Reference: https://www.virustotal.com/gui/file/b0588dd8bba4a3e098176834f98cb9ecfd447614a06e56b34eba144674c66f7d/detection

111.90.148.245:3491

# Reference: https://www.virustotal.com/gui/file/998622fd0e64534704c699b7a91639e036623af28ad6f37b4abe4af0523ada7d/detection

111.90.148.245:3457

# Reference: https://www.virustotal.com/gui/file/66733ed1a4eb310f3f3026170a240d952b7464505ff8bbff394122f16b3bf81b/detection

111.90.148.245:3467

# Reference: https://www.virustotal.com/gui/file/5f9d59f33f5fe45de008c134585f682261f2498ce298fa082d047ed5c5d6638e/detection

111.90.148.245:3431

# Reference: https://www.virustotal.com/gui/file/51233d54c17ee49323bbc50a230a2904d91241e54f1ddd036c3bae1fd47990ff/detection

111.90.148.245:3429

# Reference: https://www.virustotal.com/gui/file/fb379e1327170f00c456a5f9061bd9ebb4c765d036a3208a4594fb5120f1a303/detection

111.90.148.245:5034

# Reference: https://blog.sucuri.net/2023/02/bogus-url-shorteners-redirect-thousands-of-hacked-sites-in-adsense-fraud-campaign.html

filestack.live
0-4.top
77w.pw
99pw.pw
9ge.ge
b-d.bond
b-ly.link
b-y.by
bit-ly.is
bitly.best
bitly.network
c-lick.click
fco.to
fmo.fm
gov.co.ve
icx.cx
ii-ii.ru
j-e.je
l-o.loan
l-ol.lol
lbz.bz
m-n.mn
n-g.ng
n-z.nz
psu.su
s-b.sb
s-k.sk
sy-s.systems
u-mu.mu
uxe.luxe
vvg.vg
w-tw.tw
wci.ci
xx-yz.xyz

# Reference: https://blog.sucuri.net/2023/08/from-google-dns-to-tech-support-scam-sites-unmasking-the-malware-trail.html
# Reference: https://www.virustotal.com/gui/ip-address/185.155.184.208/relations

attractbonuses.life
big-bonus.life
bonus-premium.life
bonusbounty.life
bonusesmaster.life
bonuspremium.life
camshere-hot.life
camshot.life
camsonlinehot.life
camsprohot.life
datingdudes.life
gametopadult.life
gaygather.life
greatbonusspot.life
hitjackpot.life
hugebonuswinner.life
keepbonusforwin.life
keeprewards.life
magnetbestprofit.life
magnetmerchandise.life
male-power.life
malepower.life
manmatch.life
match-finder.life
my-game-4adult.life
mygaygather.life
mypremiumwin.life
myprizeforall.life
mysweetsbonus.life
premiumwin.life
prize-sense.life
prizeforall.life
profitmagnet.life
spotspecialist.life
super-game-4adult.life
supergame4adult.life
sweet-big-win.life
sweets-bonus.life
sweetsbonus.life
thecamshot.life
themalepower.life
theythourbonusgain.life
topgame-4adult.life
yourbonusgain.life
yourwin.life
tracker-cloud.com

# Reference: https://app.validin.com/detail?find=185.155.184.85&type=ip4&ref_id=679d57ae16b#tab=resolutions

adultfantasyplay.life
adultgaming.life
adultgaming.one
adultplay-fantasy.xyz
adultplay.life
amourarbor.life
attractbonus.life
attractdating.life
awardwinning.life
best-big-bonus.life
best-camshot.top
best-casualflirt.life
best-partner.life
best-prize.life
bestbestdates.life
bestbestdates.top
bestbonuszone.life
bestbonuszone.top
bestcamsprohot.life
bestcamsprohot.top
bestcasualdating.life
bestcasualdating.top
bestcasualmeet.life
bestdate-forhookup.life
bestdates.life
bestdatingado.life
bestdatingfind-girl.life
bestdatingfinder.life
besthookupromanceonline.top
besthotcamspro.top
besthubmatch.xyz
bestlovematches.life
bestmeetlove.life
bestpleasuredates.one
bestprizerhere.life
bestprofitmagnet.life
bestromanceradar.life
bestscasualflirt.life
bestscasualflirt.top
bestsearchlove.life
bestspotbestbonus.life
bestspotbestbonus.top
beststhedatingjourney.top
betterdatecasual.life
betterdatecasual.top
big-casualdating.xyz
bigbonusbenefit.life
bigbonusleader.life
bigbonusleader.top
bigbonuszone.life
bigcasualdating.life
bigdatingcasual.top
biggame4adult.life
bigprofit.life
bonus-winprofit.life
bonusaward.life
bonusboostzone.life
bonusgift.life
bonusmagnethub.life
bonuspremiumpower.life
bonuspulsefortune.life
bonuspulsefortune.top
bonusreward.life
bonusscore.life
cams-lineonline.xyz
camslineonline.life
camslineonline.top
camsplayshub.life
casual-datepartner.top
casualaffectiongirls.life
casualbigdating.xyz
casualconnection.life
casualdate-partner.life
casualdatejoy.life
casualdatepure.top
casualdatingforall.life
casualdatinggirls.life
casualdatinghub.life
casualdatingplace.life
casualdatingvip.life
casualgirls.top
casualheartmate.life
casualloveconnection.life
casuallovecrazy.life
casuallovecrazy.top
casuallovemeet.life
casuallovepartner.life
casuallovesync.life
casualmajorsite.life
casualmeetforyou.life
casualromancesite.life
casualsparkromance.life
casualvibedates.life
cherishdating.life
connectsweetdate.life
contactclub.life
contactflirtfinders.top
contactwithgirls.life
coolmagnetprofit.life
cozylovemeet.life
crazy-love.life
crazybestlovelady.life
crazycasuallove.life
crazycasuallove.top
crazydatelove.life
crazyloveconnection.click
crazylovelady.life
crazylovemeet.life
cutegirls.life
dailydating.life
dailydatings.life
dailyflirt.life
dat24.top
date-bestgirl.life
date-casualpartner.life
date-like-sweet.life
date-lovetime.top
dateanddate.life
datecasualgirls.life
datecasualpartner.life
datecasualpartner.top
datedesire.life
datedreamweaver.life
dateforyou.life
datelove.life
datetop-flirt.life
datewave.life
dating-experts.life
dating-finder.life
dating-galaxy.life
dating-girls.life
dating-more.life
datingado.life
datingaza.life
datingboard-4u.life
datingcasualpartner.life
datingconnecthub.life
datingdelightful.life
datingdestination.life
datingdirect.life
datingfind-girl.life
datingfind.top
datingfindcasual.top
datinggo.life
datingjoyjunction.top
datingmagic.life
datingmaniahub.top
datingmanner.life
datingmymasters.top
datingpassiondestination.life
datingpassiondestination.top
datingpleasure.top
datings-again.life
datings-fun.life
datingsearch-girl.life
datingsgourmet.life
datingsoulmates.life
datingspicyher.life
delightdating.life
delightdatings.life
delightfuldates.life
desiredatings.life
discoverdating.life
dreamydatenight.life
dyskretne-spotkania.xyz
dyskretny.podryw.xyz
e5gpmrd.meethoneyplace.top
e6cp8rv.the-flirtoceans.one
e9122r2.contactflirtfinders.top
easygoingdatelove.top
easymeetsoulmate.life
easyprizegain.life
elitesmatcheshaven.top
enjoycasualdating.life
eternalromancebliss.life
faithdating.life
fast-hookupolalahub.life
find-hubmatch.xyz
find-partner-now.life
find-prizes.life
find-simplylove.life
findcasualromance.life
findecasualpartners.life
findlovepartner.life
findmanlover.life
findmanlover.top
findpartners.life
findpartnersnow.life
findpartnersnow.top
findpassionlove.life
findpassionlove.top
findsoulmate.life
findsweetheart.life
findyourromance.life
flirt-fiesta.life
flirt-partner.life
flirtandfiesta.life
flirtfiesta.top
flirtfusion.life
flirtocean.life
flirtpartners.life
flirtrealm.life
flirts-zone.life
flirtyfuturesdating.life
fonddating.life
foreverbeloved.life
free-dating.life
fresh-dating.life
g1k2mrm.beststhedatingjourney.top
gainhugeprize.life
gainhugeprize.top
gainprizeshunters.life
gainprizeshunters.top
game-passionadult.top
gamepassionadult.life
gamepassionadult.top
gay-passiongather.top
gaydatingdudes.life
gaydatingdudes.top
gaypassiongather.life
get-bigbonus-here.life
giftaward.life
giftbonus.life
giftgainreward.life
giftgainreward.top
giftjackpot.life
girl-datingfind.life
girldatingfind.life
girls-mania.life
girls-time.life
girlsdate.life
girlsflirthere.life
girlsflutter.life
girlsgalore.life
girlsgleam.life
girlshoneyreal.top
girlsluxcontact.life
girlssymbol.life
girlstaste.life
girlstime.life
girlstrue.life
girlswanderlust.life
goodlovemeet.life
goodpassionmeet.online
greatprizes.life
growngaming.life
grownplay-time.one
grownplaytime.life
grownplaytime.top
gwhpmr6.beststhedatingjourney.top
gwhpmr6.starpartnersspots.top
here-gain-quick.life
herepremiumwin.life
hitbonuswin.life
hithugejackpot.life
hitthejackpot.life
honeyedromance.life
honeygirlhere.life
hookup-index.life
hookupromanceonline.top
hootdatings.life
hot-casualdating.life
hot-dateflirt.top
hot-likesmeet.life
hot-lovemeet.top
hotcasualdates.life
hotdate-girl.life
hotdateflirt.life
hotdateforyou.life
hotdatehublinks.life
hotdatelink.life
hotdating-girl.life
hotdatinghub.life
hotdatinghub.one
hotdesiredates.life
hothoneydates.life
hotpartners.life
hotpasiondates.life
hotrandomdating.life
hotrandomdating.top
hotties-datings-hub.life
hotties-from-your.life
hotties-hub-dating.life
hottop-flirt.life
hugebonuses.life
hugebonusfinder.life
hugebonusfinder.top
hugesclubrushs.life
incredibledating.life
infinitelovelinks.life
itmalepower.life
jackpotscore.life
jackpotwinning.life
joythedating.life
k8cpmrd.bestprizerhere.life
k8cpmrd.reachreward.life
k8cpmrdeu.linehugeprize.life
k8cpmrdvi2.reachreward.life
keep-rewards.life
keepbonus.life
keepreward.life
ladiesdating.top
ladieselitedating.top
ladiesmania.life
ladiesmeetnow.top
ladylovefinder.life
ladyloveseeker.life
linehugeprize.life
lolsearchnew-girls.life
love-mixer.life
loveabode.life
lovecontactfind.life
lovecontactzone.life
lovecraze.life
lovehaven.life
lovelanedating.life
lovelounge.life
lovematches.life
lovematcheszone.life
loverfinder.life
lovestoryconnect.life
lovevoyagehub.life
lovewavehub.life
lovewomanmeetup.top
lovida.top
madecasualdating.life
mail.findsoulmate.life
makecasualdating.life
makecasualromances.life
maleherepower.life
maleherepower.top
malepower-method.life
manbig-match.xyz
manbigmatch.life
manbigmatch.top
manmatchbig.online
manyhoneygirl.life
matchesmade.life
meet-girls.life
meet-hubmatch.top
meetcasualgirls.life
meetcasualgirls.top
meetcasuallove.life
meetcasualpartner.life
meetcasualsoulmate.life
meetcontactreals.top
meetgirlcasual.top
meetheartmate.life
meethoneyplace.top
meethotgirls.life
meethubdating.life
meethubmatch.life
meethubmatch.top
meetlovehere.life
meetmatch.life
meetmyhubmatch.top
meetmysoulmate.life
meetsoulmates.life
meetspartnersreal.top
meetyourhoney.life
mega-flirt.life
mega-flirthub.life
membermingle.life
membertest.life
moredatings.life
my-bonusforwin.life
my-datinggirl.top
my22hry.flirtfiesta.top
myadultfantasyplays.life
myadultfantasyplays.top
myadultplay-fantasys.xyz
mybigprofit.top
mybountybonus.life
mybountybonus.top
mycasual-datepartner.top
mycasualaffectiongirls.life
mycasualdating.life
mycasuallovecrazy.top
mycupid-dating.life
mycupidhookups.life
mycupidhookups.top
mydailyflirt.life
mydatecasualgirls.life
mydateforyou.life
mydatingado.life
mydatingaza.life
mydatingcasual.top
mydatingfinder.life
mydatingforyou.life
myfancydating.life
myfindpartners.life
myflirtfinder.life
mygreatbonushere.life
mygreatprize.life
myhotties-dating.life
myhublovelines.life
myhublovelines.top
myirlsflirting.life
myirlsflirting.top
mylady-now.life
mylovelines.life
myloveseekers.life
myloveseekers.top
mymeetcasualgirls.top
mymeetpretties2nite.top
mymembermingle.life
mynewmember.life
mypassioncasualmeet.life
mypassioncasualmeet.top
myprizeserv.life
myprizespaces.life
myprofitmagnetzone.top
mypurecasualdating.life
mysweetromancelink.life
mythehotties-hoo.top
mytop-bonusmaster.life
myvipd4ailydates.life
myxxldating.life
myyoursweetflirt.life
nby2hrt.girlshoneyreal.top
new-camshot.top
newkeeprewards.life
newladiesmania.life
newmember.life
newprizezone.life
newprizezone.top
ohmydateforyou.life
ohmyeasyflirtnow.life
ohmylovematcheszone.life
ohmysunnygirldate.life
ohnydelightfuldates.life
ohspotlightonprofit.life
ohspotlightonprofit.top
olalayourromance.life
olalayourromance.top
onlinecams.xyz
partnerperfect.life
partners-place.life
partners-space.life
passionatematchup.life
passioncasualdate.life
passioncasualmeet.life
passiongameadult.life
passiongameadult.top
passionlovemeet.life
passionmatch.life
passionromancelink.life
playfulheartmeet.life
playlovemeet.life
podryw.xyz
prizeaward.life
prizefast.life
prizegain.life
prizerush.life
prizesenses.life
prizesure.life
prizewinsmart.life
profitmagnetzone.life
pure-casualdate.one
purecasualdate.life
purecasualdate.top
purecasualdating.life
reachreward.life
realgift.life
rewardgains.life
rewardradiant.life
rewardreach.life
rfdprr7.meethoneyplace.top
romancearound.life
romancepartner.life
romancepartners.life
romanceradar.life
romancesite.life
rv22mrd.meethubmatch.top
scorereward.life
searchman-lover.xyz
searchnew-girl.life
serenesoulmates.life
simplecasualdates.life
simpleprize.life
simplewin.life
simply-love.life
simplymeetlove.life
sinfuldating.life
soulmatepartner.life
sparkcasualdate.life
sparkcasualromance.life
spotbestbonus.life
spotlightonprofit.life
spotlightonprofit.top
starpartnersspots.top
store.ladiesmeetnow.top
sunnygirldate.life
super-sweet-lady.life
superhot-datings.life
sweetconnect.life
sweetflirting.life
sweetheartseekers.life
sweethotromance.life
sweetromancedates.life
sweetromancehub.life
sweetromancelink.life
taketheprizes.life
tenderheartmeet.life
the-dates-heaven.life
the-flirtoceans.one
thebest-prize.life
thebest-trynicedating.life
thebestdating.life
thebestflirtflourish.top
thebestprizes.life
thebigbonusleader.xyz
thebigprofit.life
thebonusreward.life
thebountybonus.life
thecasualbigdating.xyz
thecoolmagnetprofit.life
thecoolmagnetprofit.top
thecupid-dating-hub.life
thecupidhookups.life
thedateanddesire.life
thedatecasual.life
thedating-hookup.life
thedatingboard4u.xyz
thedatingdirect.life
thedatinghookuphub.life
thedatinghouse.life
thedatingmasters.life
thedatingsearch-girls.life
thedatingwave.life
thedelightfuldates.life
theeasy-dateportal.life
theflirtoceans.life
theflirtoceans.top
theflirtpartners.life
thegirlssuns.life
thegoodlovefind.life
thegoodlovemeet.life
thegoodpassionmeet.life
thegreatbonusspot.life
thegreatbonusspot.top
thehitjackpot.life
thehoneywomenflirt.life
thelovestoryconnect.life
themadecasualdatings.life
themembermingle.life
thepartnerperfect.life
thepassionlovefind.life
theplaylovemeet.life
thepleasuredates.life
thepremiumwin.life
thepurecasualdate.top
thespotlightonprofit.life
thesweetgirlsparadise.life
thesweetloveplace.life
thetrybestdating.life
thetrynicedating.life
thevipcasualgirls.top
theyourromance.life
theyoursweetflirt.life
top-bonusmaster.life
topbonusgain.life
topcasualdating.life
trdphry.contactflirtfinders.top
truedating.life
trueloveencounter.life
trybestdating.life
ueq26b7.the-flirtoceans.one
un22pry.bigbonusleader.life
uwv2brk.hotdatinghub.life
v1.casualmeetforyou.life
vipbonusgain.life
vipbonusgain.top
vipcasualfind.life
vipcasualfind.top
vipcasualgirls.life
vipcasualgirls.top
vipcasualmeet.life
vipd4ailydates.life
vipladysflirtings.top
vipmeetsoulmate.life
w2w2mre.datingfindcasual.top
win-bonus.life
win-bonuses.life
win-prize-now.life
win-prize.life
win-touch.life
wincorporate.life
winearth.life
winexpert.life
wingiftnow.life
winmore.life
winprizehere.life
winpulse.life
winregistry.life
winsimply.life
wintarget.life
womandatefind.life
womanwise.life
wonderdates.life
xwcpmrp.starpartnersspots.top
xxl-girls-time.life
xxldating.life
youkeeprewards.life
yourbest-partner.life
yourbestpartner.life
yourbonusforwin.life
yourbonusforwin.top
yourextraflirt.life
yourhoneydate.life
yourhotromance.life
yourmeetpretties2nite.top
yourmeetzone.top
yourpassionromance.life
yourperfectdating.life
yoursweetsbonus.life
yoursweetsbonus.top
zingydating.life
zingydatings.life
zingyflirt.life
zonedate.life
zoneofdate.life

# Reference: https://twitter.com/unmaskparasites/status/1727470416388874683

gcdnanalytics.com
metricaga.com
metricastats.com
quickcontentnetwork.com
cdn.metricastats.com
fast.quickcontentnetwork.com
gll.metricaga.com
syndication.gcdnanalytics.com

# Reference: https://www.virustotal.com/gui/ip-address/87.107.124.35/relations

metrica.ir
metricastats.ir
metryeka.ir
stadata.ir

# Reference: https://www.virustotal.com/gui/ip-address/45.140.146.101/relations

away.greenfastline.com
cdn.bestselllerservice.com
cgate.getmygateway.com
estancia.decentralappps.com
estancia.stratosbody.com
finish.lineferaline.com
ns1.getmygateway.com
set.lineferaline.com
stray.stratosbody.com
vendingbackstage.comgate.getmygateway.com
xn--stay-p96a.decentralappps.com

# Reference: https://twitter.com/unmaskparasites/status/1747690203941396671
# Reference: https://www.virustotal.com/gui/ip-address/172.67.185.17/relations

flyspecialline.com
165.225.208.34near.flyspecialline.com
208.34near.flyspecialline.com
225.208.34near.flyspecialline.com
34near.flyspecialline.com
746near.flyspecialline.com
cdn.flyspecialline.com
cnd.flyspecialline.com
comnear.flyspecialline.com
ear.flyspecialline.com
near.flyspecialline.com
nearly.flyspecialline.com
flyspecialline.comnear.flyspecialline.com
me.near.flyspecialline.com
near.flyspecialline.comnear.flyspecialline.com

# Reference: https://twitter.com/karol_paciorek/status/1747886529370841512

platformspecial.com
get.platformspecial.com
post.platformspecial.com

# Reference: https://www.wordfence.com/blog/2023/12/psa-fake-cve-2023-45124-phishing-scam-tricks-users-into-installing-backdoor-plugin/
# Reference: https://blog.sucuri.net/2023/12/analysis-of-the-fake-wordpress-cve-2023-46182-patch-plugin-phishing-campaign.html
# Reference: https://otx.alienvault.com/pulse/656f2ee901a8cdd523b08cb8
# Reference: https://www.virustotal.com/gui/ip-address/193.32.162.240/relations

en-ca-wordpress.org
en-gb-wordpress.org
en-us-wordpress.org
secureplatform.org
securityplugins.org
wordpress.secureplatform.org
wordpress.securityplugins.org
wpgate.zip
wpops.zip
wpsrv.zip
wpsys.zip

# Reference: https://thehackernews.com/2024/01/balada-injector-infects-over-7100.html
# Reference: https://www.secureblink.com/cyber-security-news/6-200-word-press-sites-with-popup-builder-plugin-infected-by-new-balada-1
# Reference: https://www.malcare.com/blog/wp-vcd-php-malware-removal/

/wp-felody/wp-felody.php
/wp-includes/wp-vcd.php
/wp-felody.php
/wp-vcd.php

# Reference: https://twitter.com/unmaskparasites/status/1752794370435420635
# Reference: https://www.virustotal.com/gui/file/0b3ce8bad28e3da1377244c102c67f62828d1c7c93b50a78e4c135321a579467/detection

extentaccreditedinsensitive.com
exemptrequest.com
highcpmrevenuegate.com
professionalswebcheck.com

# Reference: https://twitter.com/DavidTy03461965/status/1753098841749069895
# Reference: https://www.virustotal.com/gui/domain/statisticsong.com/relations

statisticsong.com
ak.statisticsong.com
api.statisticsong.com
c1.statisticsong.com
dr.statisticsong.com
emv1.statisticsong.com
find.statisticsong.com
panal.statisticsong.com
panel.statisticsong.com
widget.statisticsong.com
wiki.statisticsong.com
zdm.statisticsong.com
antimalware.api.statisticsong.com

# Reference: https://x.com/unmaskparasites/status/1744851979392950312
# Reference: https://patchstack.com/articles/fake-security-vulnerability-phishing-campaign-targets-woocommerce-users/
# Reference: https://app.validin.com/detail?find=ec798f07ee6774932f2beadd1b9ad5b9&type=hash&ref_id=202b58f8a9e#tab=host_pairs
# Reference: https://app.validin.com/detail?find=%2Fplugins%2Fhuman-verification-challenge%2Finvalid&type=raw&ref_id=2c81fb14284#tab=host_pairs (# 2025-05-02)

alerts-wordpress.org
app-wordpress.org
assistance-wordpress.org
ca.en-wordpress.org
ch-wordpress.org
contact-wordpress.org
db-wordpress.org
de-wordpress.org
de-2-wordpress.org
de.de-2-wordpress.org
dev-wordpress.org
dk-wordpress.org
dk.dk-wordpress.org
en-us.db-wordpress.org
en-us.host-wordpress.org
en-us.tech-wordpress.org
en-us.web-wordpress.org
en-wordpress.org
en.ca-wordpress.org
en.uk-wordpress.org
en.us-wordpress.org
es-wordpress.org
es-2-wordpress.org
fr-2-wordpress.org
fr-wordpress.org
fr.fr-wordpress.org
gb.en-wordpress.org
guardadefense.com
jp.app-wordpress.org
helpline-wordpress.org
host-wordpress.org
info-wordpress.org
inquiries-wordpress.org
it-wordpress.org
it-2-wordpress.org
nl-wordpress.org
nl-2-wordpress.org
notices-wordpress.org
notify-wordpress.org
pl-wordpress.org
pl.pl-wordpress.org
protcve.com
reports-wordpress.org
se-wordpress.org
sg.dev-wordpress.org
tech-wordpress.org
uk-wordpress.org
updates-wordpress.org
us-wordpress.org
us-en-wordpress.org
us.en-wordpress.org
viacve.com
web-wordpress.org
wpappdevelopment.org
wpcloudservices.org
wpdevnetwork.org
wptechsolutions.org

# Reference: https://securityonline.info/urgent-warning-balada-injector-malware-targets-popular-wordpress-plugin/
# Reference: https://www.virustotal.com/gui/ip-address/104.21.94.69/relations

cloudsonicwave.com
traveltraffic.cc
host.cloudsonicwave.com
ttincoming.traveltraffic.cc

# Reference: https://threatfox.abuse.ch/browse/tag/balada/
# Reference: https://www.virustotal.com/gui/ip-address/193.163.7.113/relations
# Reference: https://www.virustotal.com/gui/ip-address/45.150.67.235/relations
# Reference: https://www.virustotal.com/gui/file/f9138500fc81b33e46ad7a5c16936b5aa570afbbd3662b4725b09465cb087751/detection
# Reference: https://www.virustotal.com/gui/file/07963e46fd55defa8336e4a53ca6ecd48dc6f0a7b51f8231219bcb217d35af8c/detection

apistatexperience.com
bestresulttostart.com
startservicefounds.com
0start.apistatexperience.com
10start.apistatexperience.com
1api.startservicefounds.com
api.bestresulttostart.com
api.startservicefounds.com
bind.bestresulttostart.com
coolapi.startservicefounds.com
csdata3.startservicefounds.com
dns.startservicefounds.com
find.bestresulttostart.com
follow.bestresulttostart.com
get.startservicefounds.com
papers.coolapi.startservicefounds.com
point.bestresulttostart.com
rest.startservicefounds.com
right.bestresulttostart.com
scripts.bestresulttostart.com
start.apistatexperience.com
tart.apistatexperience.com
startservicefounds.comapi.startservicefounds.com

# Reference: https://x.com/unmaskparasites/status/1820517755785003231
# Reference: https://www.virustotal.com/gui/ip-address/101.99.75.138/relations
# Reference: https://www.virustotal.com/gui/ip-address/190.123.45.228/relations
# Reference: https://blog.sucuri.net/2024/05/mal-metrica-redirects-users-to-scam-sites.html
# Reference: https://www.virustotal.com/gui/file/e50f6b96447d64dda24187c651586247c69d004708f75cb744245c7471398f6b/detection
# Reference: https://www.virustotal.com/gui/file/fb01066660beb228116f341e25ae5d637d79af2817c7a87d74fb5e8d604c1785/detection

bestonlinesupplies.com
cloudswiftcdn.com
edgecdnc.com
edgerapidcdn.com
gdcstatic.com
globalultracdn.com
gocloudmaps.com
gorapidcdn.com
gsslcloud.com
rapidglobalorbit.com
streamfastcdn.com
syndcloud.com
tnewstraffic.com
vvordpress.org
cache.cloudswiftcdn.com
cloud.edgerapidcdn.com
cloud.tnewstraffic.com
content.gorapidcdn.com
content.streamfastcdn.com
go.syndcloud.com
host.gsslcloud.com
mail.bestonlinesupplies.com
metrics.gocloudmaps.com
secure.gdcstatic.com
secure.globalultracdn.com
server.bestonlinesupplies.com
static.rapidglobalorbit.com
synd.edgecdnc.com

# Reference: https://blog.sucuri.net/2024/03/sign1-malware-analysis-campaign-history-indicators-of-compromise.html
# Reference: https://www.virustotal.com/gui/ip-address/162.0.228.112/relations
# Reference: https://www.virustotal.com/gui/file/774780f037cb02997b7a262385feb3ef5e9f76a75587cde7af15b415ceb21e3c/detection
# Reference: https://www.virustotal.com/gui/file/77844112f883cf2cf9b9e4fe49ca7d737705969ef538ad736fd8e19bb2c362d8/detection

24supportkit.com
365analytics.xyz
abc-cdn.online
counter247.live
js-assets.cloud
js-min.site
jsdevlvr.info
jsonmediapacks.com
localadswidget.com
opttracker.online
schema-forms.org
stickloader.info
watchasync.com
webstaticcdn.com
wt-api.top
api.localadswidget.com
assets.watchasync.com
cdn.jsdevlvr.info
cdn.wt-api.top
js.abc-cdn.online
js.opttracker.online
js.schema-forms.org
l.js-assets.cloud
load.365analytics.xyz
page.24supportkit.com
spf.js-min.site
stat.counter247.live
streaming.jsonmediapacks.com
stylesheet.webstaticcdn.com
tags.stickloader.info

# Reference: https://blog.sucuri.net/2024/04/javascript-malware-switches-to-server-side-redirects-dns-txt-records-tds.html

ads-promo.com
host-stats.io
web-hosts.io

# Reference: https://www.virustotal.com/gui/ip-address/104.21.64.161/relations

startfinishthis.com
back.startfinishthis.com
board.startfinishthis.com
finish.startfinishthis.com
from.startfinishthis.com
isit.startfinishthis.com
visit.startfinishthis.com

# Reference: https://www.virustotal.com/gui/ip-address/45.142.212.163/relations

0first.dataofpages.com
114.96.0first.dataofpages.com
142.21four.startperfectsolutions.com
188.114.96.0first.dataofpages.com
21four.startperfectsolutions.com
445.142.21four.startperfectsolutions.com
96.0first.dataofpages.com
g.four.startperfectsolutions.com
repost.statisticsplatform.com
sf.four.startperfectsolutions.com
xn--three-hw3b.startperfectsolutions.com

# Reference: https://x.com/unmaskparasites/status/1797695543948513313
# Reference: https://www.virustotal.com/gui/ip-address/45.9.149.210/relations

rdntocdns.com
assets.rdntocdns.com
cdn.rdntocdns.com
css.rdntocdns.com
rest1.rdntocdns.com
rest2.rdntocdns.com
tmpl.rdntocdns.com
wave.rdntocdns.com

# Reference: https://x.com/_cr0n_/status/1811022304651993435
# Reference: https://www.virustotal.com/gui/ip-address/185.155.186.25/relations
# Reference: https://www.virustotal.com/gui/file/44aaf1549534fce645fd7c990f4c4a159b693674af1853886d0b8dfab2ddd909/detection
# Reference: https://www.virustotal.com/gui/file/aa5e281149fcf674dd21ed4dd470bf36ceafc2d5a4f7ce3b94decc0b9d955e4f/detection

aaappsub.live
aabowlsun.live
abagoalti.live
abalucksuit.live
abamuchfew.live
abaruemeat.live
abcookfay.live
abgagnu.live
ablejoinbis.live
ablemovefact.live
ablepetfund.live
abmovecore.live
abpascum.live
abselflu.live
abshowbe.live
absstoptale.live
abtaskyo.live
acebodysol.live
acidsafegold.live
actbarfour.live
actiflog.live
adddefdis.live
admotduty.live
adocarecase.live
adoeyeour.live
adosinhurt.live
adplaypast.live
aelagwest.live
aelineinn.live
aeqifish.live
aftatewore.live
aftmustlaid.live
aftrisksip.live
agebetwho.live
agedlinkown.live
agedwaxdebt.live
agemarcad.live
agouserfig.live
agyenlad.live
ahatoemu.live
ahshipfry.live
aidarkaim.live
aidarmyduty.live
aidaysake.live
aidmenuto.live
aimjoehog.live
aimrockgem.live
aimwhomzip.live
aimwishwish.live
airnaywill.live
airroekit.live
airseemsic.live
airsenae.live
alamodmark.live
alamugfee.live
alanilrad.live
aldugcup.live
alebaadis.live
alebitterm.live
aledimli.live
aledrewass.live
aleerfall.live
aleertwo.live
alepannip.live
aleparfilm.live
allkneework.live
allmibee.live
allshipgee.live
alonghome.site
alpipsip.live
alsofirmhub.live
alsomolhurt.live
alsototnick.live
altcarela.live
altitssame.live
alzerohis.live
amacebest.live
ambudlist.live
amdatamen.live
ampcobkit.live
ampnaydrug.live
analongfor.live
anapawform.live
anaskijane.live
anastepword.live
anatonetold.live
anbarcor.live
annickraj.live
anrestas.live
ansendmeal.live
antbudpat.live
antvastacid.live
antvowda.live
anybirddoe.live
anycoldcod.live
anypegvet.live
apeaamy.live
apeawseed.live
apepicktest.live
apesiccop.live
appahonce.live
appbondthy.live
appgeepage.live
apthemtool.live
aptneckheat.live
aptowcat.live
aptparwow.live
aptpinto.live
aptripjoy.live
arcintogone.live
arcsameaw.live
arctoldok.live
arearestmom.live
aredearmile.live
arkfadinn.live
arkmenuye.live
arkwifeweb.live
armarwhom.live
armflatwine.live
armsotin.live
armyforrely.live
armysolsag.live
armywedai.live
arsolefeel.live
artpenpalm.live
askdealbaa.live
askdewseat.live
askeslift.live
aslosete.live
aspmodgig.live
assdebtag.live
assifom.live
atedebthand.live
ateenddrew.live
ategulfwant.live
atehughat.live
atejumpaxe.live
atelaybone.live
atelealeg.live
atetypete.live
atstopag.live
avecopynear.live
avegigbeat.live
averajband.live
awaybobmom.live
awaypushet.live
awaywrybeer.live
awcobmeat.live
awecoopo.live
awehesign.live
awesakelead.live
awetaleoil.live
aweweakgate.live
aweweakmust.live
awlivedose.live
axbedza.live
axeparvote.live
axetextsuit.live
axnapchi.live
axspotbis.live
axwelltalk.live
aybadrice.live
aycanrem.live
ayeladrush.live
ayraybelt.live
aysupooh.live
baafesub.live
babyayemine.live
babydyehut.live
babyedew.live
bacargrow.live
backelfblow.live
backletfen.live
backseatfax.live
badsagview.live
balldewward.live
ballfalljoin.live
ballholdtat.live
balllordre.live
ballmoondin.live
balloddrest.live
ballsandsuit.live
balltatpeak.live
ballwereflow.live
bandtownsup.live
bandwhatlose.live
bankdarkearn.live
barbanmoon.live
barfeam.live
barfillvie.live
barheadfill.live
baryardport.live
basejoynot.live
basenutbuy.live
basepuplose.live
basetoldface.live
bathdaysdial.live
bathpacmilk.live
batmedsand.live
bayalhey.live
bayednip.live
bayneedlap.live
baysignmiss.live
bearbuntoll.live
beardoclake.live
bearxisix.live
beathallup.live
beatridhi.live
beatshopopen.live
bedigglife.live
bedpincome.live
beedipis.live
beencoreet.live
beenhmrich.live
beenhostmass.live
beenmenfell.live
beenpainbe.live
beepaceage.live
begetfuel.live
bekeenlog.live
belbiddisc.live
beleftar.live
belidham.live
bellhomebob.live
bellthatcut.live
belstaryou.live
beltarklate.live
beltmuchring.live
beltnaysole.live
bendoes.live
benkeptease.live
benkiby.live
benorbdab.live
besicknews.live
bestsentcum.live
betelfles.live
betheadburn.live
betmopits.live
betnickmilk.live
betshybiz.live
betsitemake.live
beweekvice.live
bichipgave.live
bicorelord.live
bidinkah.live
bidmenupop.live
bidrowdef.live
bidsetbell.live
bidzipwork.live
bieyewalk.live
bigfarnose.live
bijogknee.live
billdaysfact.live
billevendebt.live
billfindfin.live
binaleseem.live
binblowsip.live
binmodfeel.live
bioearnpark.live
biofixus.live
biogirlsec.live
biomarep.live
birdashtype.live
birdkiside.live
bisaybuy.live
bismacmed.live
bissignfear.live
bisthygal.live
bitcardfail.live
bitrestsue.live
bittagwon.live
bizjaneoff.live
blowbuyhow.live
blowfootmen.live
blowharmmil.live
blowmaxwant.live
blowsoultap.live
blowwedboom.live
bluebeltable.live
blueboymeat.live
boblesswed.live
bobshowbe.live
bobtypebook.live
bobwearnext.live
bodyarcam.live
bodycowvast.live
bodytownpaid.live
bogallbum.live
bogcellai.live
bogclubwalk.live
boglowmeg.live
bombchipan.live
bombrooflie.live
bondlesmust.live
bonecodecall.live
bonelaidted.live
bonelogate.live
bonerootfar.live
bonetookjean.live
bonewisesame.live
bonosesole.live
bookranshy.live
bookwageflat.live
boomattlist.live
boomdalboom.live
boomsadwind.live
boomtipink.live
bornasbaby.live
borniontext.live
bornloanfact.live
bossraredose.live
bosstambut.live
bossyepbad.live
bothdooron.live
bowjethat.live
bowldotaim.live
bowlgetfarm.live
bowljoykey.live
boxfulltat.live
boyarmytool.live
boylowdal.live
boyokayta.live
bragearsow.live
braraildye.live
budfenduke.live
bugmoodseek.live
bugplansoft.live
bumdietpink.live
bumlabhurt.live
bumwitfun.live
burnnilhell.live
burnsirleft.live
bushastake.live
busjetname.live
busorhunt.live
bustimeage.live
busypaceis.live
butgoldbet.live
buthadla.live
butpubtor.live
butroomtold.live
butuhwill.live
buyfineborn.live
buyrosebin.live
byefellcob.live
byeosdan.live
bynicefilm.live
cabballdal.live
cabfillski.live
cabnubody.live
cabpesow.live
caderoi.live
cadeyedial.live
callwanimp.live
callwildgone.live
calmanddisk.live
calmcowfad.live
calmhiremere.live
calmoddbin.live
calmrosedeal.live
camecrewmil.live
camjoelose.live
campmainfish.live
campnextyear.live
canemusick.live
canfilebye.live
cangincat.live
canhaholy.live
cansalttony.live
capbeenart.live
capneedkeep.live
caposmilk.live
caproadeach.live
capvowblue.live
carbesthire.live
carbusfly.live
cardbejet.live
cardfensign.live
careabyen.live
carhumgas.live
carnebhall.live
carnonedef.live
carspycut.live
cashaimgo.live
cashcardoc.live
cashhelppure.live
cashsaferose.live
cashseadrop.live
castbeatpath.live
castmedpot.live
castreflist.live
catcopewave.live
catnextdisc.live
cellbicook.live
celldabwhom.live
celldownebb.live
celleastnun.live
celllapdel.live
chatpushboo.live
chiacttom.live
chidonebell.live
chiearfoe.live
chiourwin.live
chioyspy.live
chipashlet.live
chipfafor.live
cityhandbest.live
cityhourtake.live
cityinkfirm.live
citymarkpie.live
cityoldso.live
cluboffthe.live
coaldataaid.live
coaldialiron.live
coaltanit.live
coatpubwit.live
cobitlog.live
cobmonchip.live
cobsoonbog.live
codebenmike.live
codelookthat.live
codeorbride.live
coderegben.live
codinacid.live
colcoatlake.live
coldotden.live
colmodmade.live
colnebyet.live
colraceop.live
coluserdon.live
comeinpo.live
comezoneonce.live
conaskrush.live
confixseem.live
consalewit.live
coobeertot.live
coocoltoll.live
cookbatwis.live
cookdanfoot.live
cookmoltab.live
cooksolseen.live
coolburnrev.live
coolhampam.live
coolsatlose.live
coolwisegg.live
copefadmi.live
copelealady.live
copemorethem.live
copesoilbiz.live
copjaypool.live
coppainfox.live
copsisair.live
copybiho.live
copyfirmroof.live
copyflatfate.live
copymolweb.live
corabaas.live
coredeemum.live
corefitvery.live
coreimpden.live
cortiborn.live
cossolfell.live
costblowho.live
cotpullfrom.live
cotvowis.live
cowrushspy.live
cowwantwait.live
coxedgedon.live
coxmainsub.live
coyantmeg.live
crewbizcow.live
crewboxcope.live
crewtonsuch.live
cropgijury.live
cubdrawbody.live
cubfundhire.live
cubrueacid.live
cuenavyspa.live
cuenuntie.live
cuepapvery.live
cumaddne.live
cumcobmod.live
cumneglay.live
cumrolelane.live
cupbeenbaa.live
cupfighog.live
cupovermi.live
cuptoldill.live
dabslipzoo.live
dadcuboil.live
daddewget.live
dadfellago.live
dadlogonext.live
dadpubfrom.live
dadsalead.live
dalaltwave.live
dalnipass.live
dalrollmon.live
damfedodd.live
damoakmail.live
danlipnab.live
danpamjoy.live
darkwearlaid.live
darkwhenwife.live
datafreehuge.live
datalagtook.live
dataopfund.live
datarimbun.live
datarugala.live
datelandthat.live
dawnmadenine.live
dawnsenre.live
daylitsec.live
dayscoxget.live
daysdeepsaw.live
dayssipicy.live
daywetpea.live
deadmactrue.live
dealetahop.live
dealgodsafe.live
dealgoldvia.live
dealnicklogo.live
dealpalpep.live
deankentdust.live
deanunzero.live
deanwifediet.live
dearkitdata.live
dearwingnan.live
debttugla.live
deebluetub.live
deecamthin.live
deepibuy.live
dehemwee.live
delandado.live
delchipwo.live
delelmglad.live
delpegdim.live
demegweb.live
densecwild.live
denycoolsag.live
denydisgulf.live
denyladlee.live
desakenun.live
deskbeeawe.live
deskcoldrose.live
deskmayglad.live
desktooklive.live
desolead.live
dewdoeaa.live
dewtakesim.live
dewtwosun.live
dickcaseland.live
dickonesoy.live
dicktookcrew.live
diewastank.live
diewestcum.live
digsheonly.live
digslipnavy.live
digwidesite.live
dinwoodash.live
dipantop.live
dipdoenos.live
dipjohnbee.live
dippurehost.live
discwaitbaa.live
diskjamage.live
diskmiledate.live
disratedye.live
doballfan.live
doclongpass.live
docolvie.live
docplancam.live
docwearwage.live
docwerebeg.live
doejunuh.live
doeyeartad.live
dogawayye.live
dogcoxpair.live
dogdawnzero.live
doggelsoon.live
doggoldcard.live
dogkidonce.live
dogplayfar.live
donbushdel.live
donebemain.live
donepainnot.live
donepastna.live
doneraddef.live
donespyhot.live
donlotmud.live
donpathmere.live
dontatspa.live
dontikill.live
doorfeedark.live
doorhugdisk.live
dosebosspep.live
doseflutwin.live
dospabay.live
dotdigrice.live
dotloour.live
dotoosat.live
dotpastduty.live
dowirereal.live
downjuneat.live
downlidore.live
downoftray.live
downpanarea.live
downtalesand.live
drawdayslike.live
drewbelive.live
drewhitcon.live
drewtomtwin.live
drewwaysvice.live
dropbaawin.live
dropcowsag.live
dropgatesew.live
drugcublib.live
drugiflake.live
drugmereart.live
drugtatat.live
drugwetbum.live
dryadoem.live
drygrowal.live
dualfaam.live
duallabdry.live
dualladmob.live
dualwillrye.live
duboutdew.live
dubtextsong.live
dubtiha.live
duebilltax.live
dueetahang.live
dugbadmed.live
dugdinwas.live
dugfinepick.live
dugomebb.live
dukecoyrun.live
dukedadsame.live
dunagring.live
dunbonebond.live
dunbosspen.live
dustdoelong.live
dustrobpage.live
dyekneetry.live
eachfilmbel.live
eachoxtask.live
eachtowngod.live
eachuhgolf.live
earnnilarmy.live
earnribhip.live
earntoolad.live
eastaptcos.live
eastboydub.live
easyervote.live
easygivedisc.live
easyhenan.live
easyrottank.live
eatdogbulk.live
eatfaycos.live
eatowor.live
ebbpopsow.live
ebbrateaim.live
ecuhaycall.live
edantnil.live
eddamcode.live
edgelitwine.live
edrealreal.live
edtesnow.live
eftadde.live
eggcrysin.live
eggfearbest.live
eggfishneck.live
egglanelead.live
eggtodfoe.live
egobarhalf.live
egocoattell.live
egohumamp.live
egonoseran.live
ehhipwind.live
ehmetcoat.live
ehmmala.live
ehyearkey.live
elfsellbell.live
elfshottom.live
elroemeal.live
elruesub.live
elseadpap.live
elsecopydig.live
elseoohdry.live
elseremonce.live
elseuhward.live
elseyeyet.live
eltadpat.live
emfesh.live
emubeeboy.live
emubothmil.live
emucryhem.live
emuhallcore.live
emuitstop.live
emuoohfee.live
emzated.live
enbowlegg.live
encoxyear.live
endhatefast.live
endhillacid.live
enhelpfair.live
enintobra.live
enringhuge.live
enwildalso.live
eramalefeet.live
eranyvie.live
eraworevary.live
erbigpath.live
erformwood.live
ersaidspa.live
esconoft.live
esfeltaba.live
eshandwin.live
essalethe.live
etadisckick.live
etjeanjoe.live
etwagelead.live
evefatefile.live
evehaywise.live
evenbeghour.live
evenmassare.live
everaidtan.live
everdealbeg.live
everoneroe.live
evezakit.live
evilalship.live
evilimpgive.live
evilninedisc.live
exdiehim.live
exitbushgray.live
exitdugjam.live
exputhair.live
exsoonlife.live
eyeavefind.live
eyehagod.live
eyesoftpac.live
fabcoxeta.live
fabdubbid.live
fabrestho.live
fabtheyhat.live
facevanpart.live
factsowpoor.live
fadelhop.live
fadgladgive.live
fadhatot.live
fadledwon.live
fadofffarm.live
fadradmust.live
fadwasdear.live
fahered.live
failfishyeah.live
failkidtap.live
fairbusyboy.live
fairgiside.live
fairsacwis.live
fallcosyep.live
fallgreysell.live
falllossgot.live
fallmimom.live
fallnupie.live
fallsumlaw.live
fallzipneg.live
fanagdip.live
fanjambase.live
fanseeddark.live
fapeakkent.live
farfairpass.live
farmrapbug.live
farmsabhim.live
farwhous.live
fastbothbid.live
fastherehang.live
fastloadglad.live
fastmustlay.live
fastnabcup.live
fatebasedot.live
fatecryfay.live
fatedrugoi.live
fateiftop.live
fateodddie.live
fatharmchi.live
fatinchpick.live
fatsummass.live
faxgoeseve.live
faxleftre.live
faxplywed.live
faxpopkay.live
faxtiegrew.live
faxzaod.live
faybutable.live
faycoatboth.live
faydewise.live
faydickbaby.live
faykitturn.live
faylogace.live
faytoespot.live
feardoescot.live
fearmarkbone.live
fearseeecu.live
feartapfig.live
feartreeby.live
fedewood.live
fedfatgame.live
fedmoveyep.live
feebbwye.live
feelpasap.live
feelwhomfine.live
feetfamas.live
feetryedeny.live
feeyardapp.live
fehimsort.live
fellwebarmy.live
felthavebath.live
fenmovecop.live
fenoleboth.live
fenrawrye.live
feregnick.live
feunitmiss.live
fewishhope.live
figexoff.live
figloseape.live
figtellzone.live
filedropspot.live
filegulfjun.live
filemadedata.live
filepsidry.live
fillaimcry.live
fillmmlate.live
fillsowtape.live
filmcropcare.live
filmdadjug.live
filmfellcut.live
filmwootext.live
findgotla.live
findpinkpac.live
findpubdue.live
fineankept.live
finelikespot.live
finhogneb.live
finpamroof.live
fireitdose.live
firelamwore.live
firemenshow.live
firetreeivy.live
firgirlat.live
firmhogring.live
firmindnip.live
firmmattwest.live
firmparthon.live
fishcodeale.live
fishconhuge.live
fishcuetee.live
fishemlake.live
fishladyhate.live
fishsexhid.live
fitbillspy.live
fitnowpac.live
fitwardaa.live
fivebudmet.live
fivehiphead.live
fixfigcub.live
fixokayknow.live
flatbusyfate.live
flatisyou.live
flatweeksue.live
flowdutyebb.live
flowmetcrop.live
flowpetrip.live
flowsayclub.live
flowteamgirl.live
flowtwinrear.live
flujohold.live
flypafir.live
flysinawe.live
fogtrippo.live
foodboorum.live
foodsunmere.live
footcamphip.live
footcropbusy.live
footeyeshut.live
footleadtip.live
footpaylist.live
forasmum.live
fordjanerace.live
fordphimob.live
formdinsee.live
formdrawsold.live
formlabapt.live
formlogmo.live
formoxsay.live
forsolecue.live
fortkeepgot.live
fortpluslose.live
fortsoilmu.live
forvotemag.live
fourflurest.live
fourtinrat.live
fourtookpro.live
foxcoladd.live
foxhairham.live
foxkenthair.live
foxreaddam.live
foxsicksow.live
foxslownose.live
freeringhall.live
frombookwall.live
fromchiphim.live
fromenjoin.live
fromfearmi.live
fromlandsee.live
fromtinyold.live
frydoorseat.live
fueltakejam.live
fullbellsuit.live
fullsoonte.live
funaddfort.live
funbiodrop.live
fundnilcoy.live
funuponhuge.live
furwerecox.live
gagarcoh.live
gagdigcrew.live
gagrootalt.live
gagsalepub.live
gainbyfear.live
gaincodale.live
gaincotbulk.live
gainlackcop.live
gainmeatrun.live
galbugoy.live
galomarc.live
galwigsim.live
gamehonpot.live
gapaelag.live
gapaltan.live
gapevilun.live
gaphandoral.live
gasfencol.live
gasgiftram.live
gasgotways.live
gatelagrear.live
gatemmseed.live
gatepeavie.live
gatesizeha.live
gaveselfado.live
gayareaarc.live
gaylastpack.live
gaynanrid.live
geedyesin.live
gelarreal.live
gelfewsuit.live
gelinnoh.live
gemappjust.live
gemcashecu.live
gempitelf.live
gemtollmet.live
genewayroot.live
getfastfarm.live
getgoddoor.live
getrestda.live
getsunan.live
giftbathrest.live
giftdarkpast.live
gifthuntarmy.live
giftnewsmix.live
ginfalldisc.live
gingigwine.live
girlaidcoy.live
girlbeme.live
girlcoxsoft.live
girlgibow.live
girlnotair.live
girluslam.live
giveablesuit.live
givearejun.live
givenaynear.live
giveperearn.live
gladbulkmix.live
goalbaapipe.live
goalsafefor.live
goatetrip.live
goesahamob.live
goesrootbaby.live
goestonname.live
goldmegwide.live
goldnewslong.live
goldpigcue.live
goldsamesly.live
goldwebwe.live
goldwereopen.live
golfballjew.live
golfgulfpig.live
golfspotsat.live
goneahrep.live
goneluckmi.live
gonemartook.live
gonesecarmy.live
goodcomegal.live
gooddofile.live
goodoralgi.live
goodpageless.live
gotmidlaw.live
gotookbusy.live
grayfatedick.live
graynonehey.live
graypairfall.live
grayrateplan.live
grayrealhas.live
grayskyfine.live
graysongaxe.live
grewladynun.live
grewtetalk.live
greyaskhog.live
greyoftlake.live
growminebond.live
growyepsame.live
gumablegirl.live
gumdatalike.live
gumgreygolf.live
gumitelf.live
gunagodeny.live
gunhairspot.live
gunodhen.live
gunpippoor.live
gutfigcar.live
guttoldnos.live
guttoolski.live
guydaymag.live
guyevecum.live
guyflatcame.live
guyjumplift.live
guypaloral.live
hadladyhas.live
hadleddon.live
hadpetlive.live
hairmacfull.live
hairwiresend.live
halfhamfur.live
halfhategame.live
halfmostoak.live
halfsadred.live
hallhugwife.live
hallsidepair.live
hamchiring.live
hamdabloss.live
handdoeeft.live
handhipbig.live
handmadbay.live
handremmale.live
handribgain.live
hangarebo.live
hangtadmat.live
hardcityteam.live
harmeastsic.live
harmjobi.live
harmmileage.live
harmseekrace.live
harmyalot.live
hasacetot.live
hashotgear.live
haskapeak.live
haslaygrow.live
hasmaave.live
hasproking.live
hasrichhis.live
hatematell.live
hatemissfree.live
haterotblow.live
hatetedef.live
hatfastpe.live
hatsubmen.live
haveasrun.live
havemararea.live
havesignthan.live
hawifethan.live
hayverywalk.live
headthefuel.live
headwardwave.live
hearboglack.live
hearfundhome.live
hearnanhon.live
heatmustonly.live
heatnaygag.live
heatpacsuit.live
heattimebay.live
heldhandban.live
heldofcore.live
heldpiefad.live
heldteeby.live
hellallmean.live
hellbeatpot.live
helletashop.live
hellkitgoal.live
hellplugthan.live
hellsixfirm.live
helltoplaw.live
hemelkeen.live
hemgolfsol.live
hemplugjar.live
hemsooncum.live
henabwind.live
henguysad.live
heparsame.live
hersicsoon.live
hertakeass.live
heviewlogo.live
heyanythe.live
heymailai.live
heymissdiet.live
heynure.live
hidwildmere.live
highgulfgod.live
highmotiron.live
highrunpac.live
highsaylane.live
hilloldmeat.live
himgreywave.live
himradgoal.live
himwryawe.live
hipbudsave.live
hipliphm.live
hirekepthid.live
hirelifteven.live
hisoychat.live
histinyget.live
hitbaagas.live
hitseeksoon.live
hityearsap.live
hoggumana.live
hogthenlead.live
holetoldut.live
holysunjoin.live
homefootwax.live
homeoigee.live
homeoldwife.live
homeratsnow.live
homestepold.live
hometajun.live
homeyessay.live
honkidelse.live
honoehow.live
hopacgig.live
hopbathback.live
hopcubbeat.live
hopebargut.live
hopedanho.live
hopedebtdrop.live
hopefatmid.live
hoperugmove.live
hopeselldog.live
hopewildmeg.live
hostanpro.live
hostsafeless.live
hostyardnose.live
hotlayvery.live
hoursonbun.live
howsacboth.live
howsimeet.live
hubetasag.live
hubfullhost.live
hublinkde.live
hubpieaxe.live
huefreeso.live
hueideaion.live
hugcotrue.live
hugdeeparmy.live
hugemonef.live
hugpathsuit.live
hugunblue.live
huhcookdeep.live
huheasepace.live
huhgaydin.live
humthusza.live
hungampole.live
hungbombfish.live
hungnavyab.live
hungshopruth.live
huntdukesize.live
hunthetea.live
huntkamust.live
huntredead.live
huntwefilm.live
huntyohome.live
hurtgiggo.live
hutcoalpap.live
hutdoesdeal.live
hutwhatsum.live
icechipheld.live
icewasnone.live
icykayplay.live
ideamupick.live
idearelysuit.live
idremdust.live
idroesoon.live
idwhoguy.live
ifapttree.live
ifcumeven.live
ifdryid.live
iggcardjoy.live
illdogye.live
illhilleh.live
impfehut.live
imppitdown.live
impsongfor.live
inbetebb.live
inchdrewjaw.live
inchhelpmod.live
inchthemar.live
indeliveri.tech
inkgiveknew.live
innaltnab.live
innpostsad.live
innryeper.live
intobanhon.live
intomanleft.live
inwearonce.live
ionrareta.live
isdubgain.live
isfarmjust.live
isletpea.live
islowgrow.live
itaddrye.live
itemlosthole.live
itempalage.live
itemwaxfile.live
itermove.live
itscargem.live
itsfaddig.live
itstamhair.live
ivypartid.live
jackhopebad.live
jamcoolbusy.live
jamemused.live
jamrigdoes.live
jamwitrem.live
janeontomag.live
janewhyask.live
jarheab.live
jarseemhome.live
jarteaused.live
jawcoxmet.live
jawdunfox.live
jayiggtrip.live
jayinkfact.live
jaystarpi.live
jaytextbiz.live
jeanjoeacid.live
jeannebsaid.live
jethastoy.live
jetleglo.live
jetvastaw.live
jewmegphi.live
jobjogash.live
joblogun.live
joboncan.live
jobraceera.live
jobtellten.live
jodueduty.live
jofeardrew.live
jogdognan.live
jogrankbond.live
jogsuethat.live
jogvetill.live
johnawaydata.live
johncelldot.live
johncityfew.live
johnwaittone.live
joingrowore.live
joyinchwax.live
jugfitweek.live
jugflatwild.live
jugholyward.live
jugkidbut.live
jumpdipsell.live
jumpholymed.live
jumpwislee.live
junisban.live
juryfurarm.live
justaledis.live
justgulfwon.live
justoxtop.live
kaflylaw.live
kaformxi.live
kagigkid.live
kayevesept.live
keenbellwage.live
keenhotseed.live
keenmattgray.live
keenperex.live
keepbatkind.live
keepjaycamp.live
keepsuetax.live
kenbaasis.live
kenedrum.live
kenesrich.live
kennodlog.live
kentmettie.live
kentpasmop.live
keptbumluck.live
keptyencard.live
keypadfun.live
keypodget.live
keywasana.live
kickmassjane.live
kidantook.live
kidgrowago.live
kidhangba.live
kidhowpart.live
kihisee.live
kimilwood.live
kincarenun.live
kindgumtoy.live
kindisgive.live
kindneguy.live
kindpipetat.live
kindyardon.live
kingfeetnear.live
kinghugdead.live
kinhopepup.live
kinkneeplan.live
kitdiscjun.live
kneeaddod.live
kneegaypo.live
kneewinrice.live
kneewishooh.live
knowaxedual.live
knowexitcot.live
knowgoem.live
knowmaxeta.live
knowpacenine.live
labfallan.live
labirdford.live
lacwelllab.live
ladpalidea.live
ladsatrate.live
ladyclubphi.live
ladyninefarm.live
ladytintrip.live
laeatcat.live
lageastten.live
lagkingpick.live
lagpopsent.live
laidcorewash.live
laidrarekey.live
lakeanydrug.live
lakebobup.live
lakepubcoo.live
laketinyyet.live
laketoldbiz.live
lamdosenab.live
landstayrev.live
lanearktool.live
lanedancell.live
lanegaverat.live
lanekeepdad.live
lastaceka.live
lastgrowpub.live
lastwayking.live
lastyeahtape.live
latepastdam.live
lawalfund.live
lawpewrank.live
laxlookmain.live
layesjane.live
laytaskemu.live
leaddrughope.live
leadnameput.live
leapatox.live
ledwebtill.live
leedeskdip.live
leefoursip.live
leegreycox.live
leerareyeah.live
leftpodmilk.live
legawewho.live
legkinmas.live
lessemujust.live
lessokbar.live
lestypenice.live
letagthe.live
letrotsoul.live
liblogsame.live
libtitwo.live
libyewin.live
lidaysslip.live
lidfelthurt.live
lidmagvan.live
lidtestsub.live
liegemnote.live
liegrowcoo.live
liehlet.live
lieladme.live
liepetsic.live
lieroselot.live
liesawgee.live
lifeflattoy.live
lifehamwave.live
lifehopecut.live
lifeowper.live
lifesellcopy.live
lifetelid.live
lifewarride.live
liftslyonly.live
likerarean.live
likeveryset.live
linecropten.live
linemarkspa.live
lineviewdad.live
linkcoybird.live
linkflowcon.live
linkwisplay.live
lipbodyfrom.live
lipsaywow.live
listpoolonto.live
listwellbook.live
litdeetar.live
litregmine.live
loadaemood.live
loandukecard.live
lockbandjust.live
lockdebthow.live
lockfirwash.live
lockmitom.live
lodrewpsi.live
logbankbone.live
logearbag.live
loggamecam.live
longladyball.live
loninebig.live
lookatetill.live
lookthinhope.live
lookumnut.live
lordhipcob.live
lordlakeof.live
lordlossowl.live
lossgoalpew.live
losshumsab.live
losspubmon.live
lossrevhire.live
lossteemany.live
losstoecamp.live
losterhome.live
losthighod.live
lostridesoon.live
lotcellplan.live
lotenfail.live
lothutash.live
lotmerebut.live
lottellwore.live
lovebagpen.live
lovebayhue.live
loveroomtab.live
lovetownpaw.live
lowfullvie.live
luckarmyvan.live
luckbabyfuel.live
luckbluepub.live
luckwisgum.live
mabiebb.live
maccolbag.live
madefluhear.live
madehugeai.live
madformsap.live
madthengoal.live
magaeonto.live
mailoptword.live
mailskisite.live
mainfellash.live
mainpegset.live
makedonbut.live
makefedzip.live
makejugash.live
makepathply.live
malebradun.live
malejaycar.live
malesongself.live
manheygym.live
manmagruth.live
manydeadthus.live
manysortpage.live
maoptlea.live
mapalmdue.live
mappiput.live
maptruenear.live
marevervan.live
markageski.live
markkitboy.live
marniplib.live
marwalkview.live
mascamphow.live
mascoolte.live
mashidsly.live
massdehand.live
masshuntloss.live
massmenuthey.live
matdeskinch.live
matlivetoll.live
mattlacbig.live
mattmodela.live
mattneedslow.live
mattruleen.live
maxbudlam.live
maxhamdose.live
maxpadkeep.live
maxparktell.live
maxtoyjew.live
maxvastneb.live
maylatour.live
meanlabsap.live
meanlogala.live
meantarpol.live
measbis.live
meatbandteam.live
meathairpay.live
meatnosbaby.live
meatviagut.live
meatwoodcoal.live
medkajam.live
medlaplate.live
medtaoak.live
meetlaxwire.live
megfastdam.live
megrepdid.live
megsapaxe.live
megsinom.live
mencobapp.live
menuhumhm.live
menuknowrid.live
menulastduo.live
menusatjet.live
menutheyfee.live
merekatap.live
meretododd.live
mesortera.live
metaxsaid.live
metminekit.live
metrichplay.live
metwanttub.live
mibiotan.live
midbookwet.live
midgayelf.live
midlaxnap.live
mikemenuthy.live
mikenovat.live
milefillpsi.live
miletat.live
miletworem.live
milezagold.live
milkaddhey.live
milkdelwe.live
milkgelher.live
milkgemdisk.live
milkniljay.live
milkratesend.live
millcostfarm.live
millfacekeen.live
milstarcore.live
mindarkhon.live
mindguysoon.live
mindsendmiss.live
minekeynu.live
missbaacrop.live
misspartmine.live
misstheana.live
mixillword.live
mixpapsun.live
mmgoallike.live
mmmetjo.live
mmpadles.live
mmseptvat.live
mmsubapp.live
mobgotzone.live
modedatalax.live
modediswore.live
modeherodie.live
modejobhat.live
modelivepet.live
modjuntool.live
modloangin.live
modmanroom.live
modtreeas.live
molhopepip.live
molrajme.live
momaltpip.live
momilold.live
mommanwig.live
momsongrim.live
monbackpi.live
mongemtat.live
montoood.live
moodpacub.live
moodsongrisk.live
moodtooore.live
moonwoodown.live
mopdammom.live
mopfeltits.live
moplaydeep.live
mopwoodref.live
morehatbeer.live
moreyearpas.live
mosortlot.live
mostkaits.live
mostopfay.live
motimpelf.live
motleftbox.live
motplanvow.live
motpullonce.live
movebugbill.live
moveconpit.live
moveletlad.live
movelidhm.live
movepeasick.live
moveusedsuit.live
muavedad.live
muchhourplug.live
muchleftwhom.live
mucubfire.live
mudantted.live
mudrodsuit.live
mudsatmol.live
mugdyehave.live
mugsubsort.live
mugyetmet.live
mummcome.live
mumpurefilm.live
mustendcad.live
mustlaraw.live
mustnuband.live
myjohnam.live
nabnuslip.live
nagofast.live
nandonear.live
naniggcam.live
natollhem.live
navygaveboo.live
navyoyrue.live
navysitmust.live
nawagebid.live
neadholy.live
nearagowon.live
neargelwill.live
nearoneken.live
nearperoak.live
nebarbiz.live
nebgumtiny.live
neblibcub.live
nebnahbaby.live
nebpopkent.live
nebsoldtug.live
neckbeensin.live
neckhendrew.live
neckloveham.live
needusfe.live
negsowyo.live
nepewtoll.live
nerodsi.live
neroomdan.live
nettoddab.live
newjanewere.live
newpeakom.live
newsarksix.live
newscutpot.live
newsicyfour.live
newsplotacid.live
nextbacad.live
nextpoolsub.live
nextwordrum.live
niceashub.live
nicewildmean.live
nickfineluck.live
nickgoneat.live
nickhangmatt.live
nickherarmy.live
nickslipmod.live
nilkicknu.live
niltamhit.live
ninegrowchat.live
nineryehid.live
ninesaverue.live
nipchicut.live
nipgoldkent.live
nobetgem.live
nodfeetzone.live
nonefactever.live
nonetheonly.live
nonewaveneb.live
nopisad.live
nosecanruth.live
nosedubgay.live
noseeverdean.live
nosehidgate.live
nosewasmind.live
nosfencup.live
noteendshe.live
notepackoe.live
noteyamine.live
notmakeaxe.live
notpairshy.live
nowcoatrat.live
nowdadwig.live
nowpewfir.live
nowsiscrew.live
nubusever.live
nuherboy.live
nunfaxthey.live
nunyardtold.live
nutbornyour.live
nutcoptoo.live
nutpephuge.live
nutsueen.live
nutverylife.live
nutwireone.live
oakoutbye.live
oaksoonte.live
oaktilit.live
odayyear.live
odcameem.live
oddboathalf.live
oddpoprice.live
oddrarealso.live
oddtadsol.live
odhirejury.live
odletkit.live
oeonlyship.live
oeowesoft.live
oepipekin.live
offbayup.live
offpipebo.live
offteamgrey.live
ofhungtea.live
ofjoinus.live
ofloststop.live
ofrestate.live
ofslipgay.live
oftfatespy.live
oftsameyes.live
ohowread.live
oilcookcook.live
oilcoshand.live
oilseedhall.live
oiltaleany.live
oiplotion.live
oldatvote.live
oldbadee.live
oldsoftgold.live
olecopsue.live
oleontoya.live
olewhyform.live
omexitship.live
omrevya.live
omsentmay.live
oncemanboy.live
oncerimrock.live
onceyoukay.live
oncotho.live
ondenrye.live
onebossbit.live
onejanezip.live
onlyfogcame.live
onlyledmilk.live
onpotef.live
onrentwry.live
onsolesand.live
ontoironfive.live
ontorughug.live
ontosolecold.live
onwellboss.live
oohpicmuch.live
oohwearwood.live
openlachat.live
openphiole.live
opentatdab.live
optchatcell.live
optcodbow.live
opteatfort.live
optugmail.live
oralmargirl.live
orbaxfive.live
orbrugabs.live
ordinleft.live
orkanot.live
oshiresag.live
oshoppas.live
ospatad.live
outcamptoy.live
outhuelike.live
outrefti.live
overdidmol.live
overfillthy.live
overhugfree.live
overmadhour.live
owlsawjoy.live
owlunhem.live
ownaidcue.live
ownratedebt.live
ownwanpie.live
oxbusydye.live
oyjurytour.live
oynayboom.live
oypastrob.live
oytanwho.live
paablehub.live
paceawsi.live
pacebitthus.live
paceddog.live
pacegrowloss.live
pacfinddid.live
pacgraylay.live
packbinhog.live
packcutlax.live
padheldband.live
padshetext.live
padthinmol.live
pafailfilm.live
pagedualxi.live
paidblowtold.live
paidduotony.live
paidmmoak.live
painpainpit.live
pairbombof.live
palcobrob.live
palmhalldean.live
palmmeancot.live
palmtodnet.live
palmviahas.live
pamlordda.live
pampincast.live
pamwrymm.live
pamxufab.live
papcorerush.live
paptellpure.live
parkanttalk.live
parklosefly.live
parthandsup.live
parttowrock.live
pasbedelse.live
pasearntank.live
passcupya.live
pastflyfed.live
pastgulfnay.live
pastleeat.live
pastroadwind.live
pathapprat.live
patheattwo.live
pathonceher.live
pathsoonper.live
patmovekey.live
paworram.live
paynosand.live
paysellrare.live
paywholot.live
peabaaroot.live
peahoglab.live
peakringlet.live
pealhead.live
peboytor.live
pedownmen.live
pegalroof.live
pegbioid.live
pegfortrule.live
pegfourmere.live
pegslipdue.live
pegtajog.live
penfaxowl.live
pennosand.live
peroohinch.live
petburnwent.live
petpinoft.live
pewcropgave.live
pewwinkid.live
phirefmob.live
picdayart.live
pichatpark.live
pickligod.live
pickshopinch.live
pickstartown.live
picsatdue.live
piecostpack.live
pieivypro.live
pigayesoy.live
pigdeanfit.live
pigladyvary.live
pigwaveduo.live
pinkbugroe.live
pinkfordmeg.live
pinwestknew.live
pipeleesure.live
pitcapet.live
pitnodays.live
piwonhero.live
planblowcold.live
planearnlink.live
playshowfill.live
plotlaywye.live
plottarain.live
plugsicbit.live
plusseentam.live
plustodlock.live
plyanyheld.live
plybowmot.live
plyevilcor.live
poboybo.live
podinchxu.live
podtaskup.live
polbelnot.live
poldunlid.live
polfanfor.live
polhighfit.live
polldefwork.live
pollhardrest.live
pollnecknice.live
pollnetho.live
polowrare.live
poolpupsort.live
poorbaour.live
popnonetwo.live
poprunhope.live
portheatwire.live
portlaxcoal.live
portloanfin.live
postopenuse.live
potweakpure.live
povetbo.live
promodepipe.live
pronavydry.live
psihascost.live
psioillake.live
pubfadin.live
pubhalllaw.live
pubpuptool.live
pullalaera.live
pullesnick.live
pupmeatsoy.live
pupoohwis.live
pupsawvia.live
puregagbo.live
pushbiopart.live
pushdonrem.live
pushhotcare.live
pushnutivy.live
pushrednow.live
pushspotgoal.live
putfootskin.live
putkintiny.live
qidaysdoes.live
qifoejump.live
qioddsh.live
qiyepnap.live
racegearfell.live
raceintous.live
racepollwarm.live
racepushnose.live
racethineast.live
radcopesab.live
radlabhair.live
radmakeamp.live
ragevennu.live
ragremaway.live
ragsaiddate.live
ragtinypast.live
railryesure.live
rainbeeyen.live
rainlapace.live
rainmealslow.live
rainmoverum.live
rainpaidmark.live
rajdustoy.live
rajgenetee.live
rajiggshe.live
rajlamyep.live
rajsawfoot.live
ramvoteseat.live
randustgem.live
ranklafee.live
rankspotlord.live
ransandaway.live
ranwhatan.live
raplegtag.live
rarecellmop.live
raresaidbeat.live
ratecotjug.live
raterobwhom.live
rattendraw.live
rawcamno.live
rawgraywine.live
rawlowheat.live
rawqinine.live
rawribmode.live
rayerafive.live
rayesnun.live
raymegdog.live
readlastton.live
realcookark.live
reallastseed.live
reallocklow.live
realroadbet.live
reantmove.live
rearbinet.live
rearfadebb.live
rearviaload.live
redpayhis.live
redpipsew.live
refbombbeer.live
refnueta.live
refrominn.live
regphitime.live
relyaxefast.live
relywiregive.live
remcophand.live
remgiveed.live
remumwee.live
renthandjack.live
rentpuredub.live
rentseatopt.live
renunus.live
reppulllife.live
restgasspy.live
revshetip.live
revtellcue.live
revtowcrop.live
ribdogtune.live
ribdoorbo.live
ricemineits.live
ricesinose.live
richeviland.live
richmaleorb.live
ridapeana.live
ridboxlift.live
ridmilkmeal.live
ridneten.live
ridrippull.live
ridsenfog.live
rigivyer.live
rimtankship.live
ringsigncow.live
ringtypesite.live
ringvanholy.live
ripaftwhat.live
ripagoel.live
rippastplot.live
risealsea.live
risebenlap.live
risecostlead.live
riskfoodfeet.live
riskweaklogo.live
roadheldki.live
roadxubus.live
robgoddry.live
robmumfed.live
robohjew.live
robspyrig.live
rockarmyten.live
rockdueoff.live
rockpalmover.live
rodhelltad.live
rodmmmiss.live
rodsunneb.live
roeitemrat.live
roenebalso.live
roeplanload.live
roewalleta.live
rolekidsue.live
rolepalboo.live
roleworkpipe.live
rollabtoo.live
rolllatesome.live
rooffarvie.live
roofthenmeal.live
roomgamefire.live
roomifhad.live
roomtamdog.live
rootcityshy.live
rootkingka.live
rootwerelid.live
rootyeprely.live
rosebeholy.live
rosefrynavy.live
roseheadfear.live
rosehopethen.live
rosemengee.live
rotlidrock.live
rotnoseark.live
rotseptsick.live
rottimekind.live
rowgulfaxe.live
rowripplan.live
rubagewild.live
rubcastroot.live
rubknewpage.live
ruboilmiss.live
rueyesroe.live
rugaveheat.live
rughirap.live
rugoxsalt.live
rulecopetrue.live
rulewentcat.live
rumantduty.live
rumgoodfig.live
rumnosview.live
runeninn.live
runnegart.live
rushpeturn.live
ruthelraw.live
ruthfuelsen.live
ruthpoorfry.live
ryefacecell.live
ryeyenass.live
sabcaselive.live
sabrushduo.live
saccoowhy.live
sachimade.live
sadpostsex.live
saefoxfin.live
saetechsell.live
saewagetall.live
safegetbook.live
saggreyshot.live
saidbayfit.live
saidgutkin.live
saidsiteholy.live
saidwideask.live
sakeaifile.live
sakefendie.live
sakeitpast.live
sakejaneban.live
saketamgum.live
salbandcode.live
salbobbeen.live
salchinor.live
salenesuit.live
saleoverfan.live
salfordwash.live
salmarkmuch.live
salpackfelt.live
salpotwave.live
salseemred.live
saltgivetab.live
saltrainflat.live
samenutdeny.live
sandyourace.live
saplidarmy.live
saptreebird.live
satclubfan.live
satdietcost.live
satlovexi.live
savebitboo.live
savehitgay.live
saveseekem.live
sawwaxnew.live
sayaceevil.live
saybuyfrom.live
saypiemi.live
saysendshut.live
seacoynor.live
sealiprub.live
sechmturn.live
seecopdose.live
seedjarcash.live
seedkepthay.live
seedlaneball.live
seekairoi.live
seemhanggoes.live
seenbedold.live
seenmasfile.live
seennewdel.live
selfwestnos.live
sellasprip.live
sellfilmfit.live
selltendsip.live
senagedaha.live
sensumjoe.live
sentbowlboat.live
sentledthis.live
septbahear.live
sewfoxice.live
sewrisebowl.live
sexkeepgolf.live
sexrepdie.live
sexsawwye.live
sheshyshot.live
shesuboff.live
shetantot.live
sheyomike.live
shopantwood.live
shopearngoes.live
shoprawboo.live
shopsoftfox.live
shotahride.live
shottheycoal.live
shownotfed.live
shricenil.live
shydutyvan.live
shylaphit.live
shysungame.live
sickasopt.live
sickdimtool.live
sickinchdrop.live
sickmanyken.live
sickmolhen.live
sicyephung.live
sideabsaged.live
sidepaidmany.live
sidepaptom.live
signpicknor.live
signpodtoll.live
signsaeexit.live
siheatgod.live
sikidlac.live
simbedself.live
simhemsip.live
simlakestar.live
simrodget.live
simugun.live
simwavemol.live
sinbombwig.live
sipagovary.live
sirfairpic.live
siruleyou.live
sisfedspot.live
sisifbet.live
sisironsun.live
sisofupon.live
sistatsoil.live
sitbellslow.live
sitecab.live
sitecotborn.live
sitemidink.live
siteseentree.live
sitewinheld.live
sitrankwin.live
sitwetrig.live
sixmugold.live
skinallmil.live
skinflatpup.live
skinsoilmap.live
skinsuitpie.live
skinunvery.live
skinwedcell.live
skitaketall.live
skyfindterm.live
skyhurtso.live
skysiptod.live
slipaimdiet.live
slipbondte.live
slowbellsew.live
slowpairdeny.live
slyginsae.live
slyjoyhour.live
snowlorddin.live
snowsoleitem.live
snowsureem.live
snowwiremeg.live
sobegowe.live
socastgem.live
sodappmoon.live
soddeskfine.live
sodnelong.live
sodrewear.live
softantoo.live
softbirdyour.live
softnordye.live
softovergel.live
softwaitsup.live
soilgayvat.live
soilpetfat.live
solbackbet.live
soldboxshe.live
soldcapho.live
solddownvow.live
soldoddave.live
soldringtoll.live
soleitmay.live
solelowcoat.live
somehighvery.live
somelagpad.live
soncodesoon.live
soneatoff.live
songbumwill.live
songsuchnil.live
sonoseyen.live
sonpupben.live
sonwarmwent.live
soonchatfund.live
soongettrip.live
soonjetsup.live
soonnickvery.live
sortnegseem.live
soruebeen.live
sosoulball.live
sotedad.live
soultypegrow.live
souluthug.live
soulwaygolf.live
sowbillbed.live
sowfacthuge.live
sowitemplus.live
sowslipwig.live
soyspyrole.live
spaasthem.live
spabombbell.live
spahandever.live
spasiill.live
spotawetech.live
spotjoemi.live
spysalyes.live
staymomzip.live
stayrunsole.live
stayshysim.live
staysisdee.live
staytaxtiny.live
stepmilcold.live
stepregsaw.live
stopfaytune.live
stopmabear.live
subcapgym.live
subdrawtin.live
suchbusrot.live
suchfirmum.live
suchnegrug.live
suebisegg.live
suekentneb.live
sueryerisk.live
sueweakeven.live
suewhomgod.live
suitaltcame.live
suitfirmloss.live
suitpinkjew.live
suitqioi.live
sumfayna.live
sumlosefine.live
sumutelm.live
sunfueldip.live
sunrareend.live
sunsundun.live
supdualhog.live
supryeaa.live
sureanycity.live
suresentwage.live
tabgagla.live
tabtuneword.live
tadsewgirl.live
tagbuthat.live
tagdayslead.live
tagdealfox.live
taglistcoat.live
tagofget.live
tagsandtee.live
tagstaypick.live
takehiscar.live
takepewcox.live
talecampford.live
talevicerub.live
talklossill.live
talktunedata.live
tankbellpar.live
tanklosoil.live
tankmadrum.live
tankpanmix.live
tankpathtip.live
tanyetlam.live
tapbugcome.live
taplegwow.live
taracegay.live
tarealcop.live
taryeahcopy.live
taseagame.live
taskiup.live
tasklateyard.live
taskracehas.live
tatfilmmeg.live
tathavewit.live
tatopthang.live
tatprogive.live
taxhitbath.live
teaflyimp.live
teagisame.live
teaiceorb.live
teampipnan.live
teamtestli.live
teamuchwave.live
teapasslag.live
teasandit.live
teatoneact.live
techfactnews.live
techmilklad.live
techmoodpink.live
techvastfeed.live
tedjohnnext.live
tedpothost.live
tefego.live
tellyepso.live
temeangold.live
tendfateside.live
tendskidick.live
tenedgebra.live
tenwhyer.live
terawimp.live
termdeadpack.live
termsatborn.live
testfabcare.live
testnoraa.live
textamsit.live
thanbisic.live
thanbunthy.live
thanhisbusy.live
thatilldate.live
thatjoyka.live
thatlitroof.live
thehadwash.live
themeatcow.live
themkaymale.live
themupwash.live
theycorenew.live
theydayssay.live
theyinchonto.live
theypeaone.live
theywantna.live
thinacerace.live
thinbefear.live
thinkickply.live
thishateill.live
thisinnbone.live
thisjayfly.live
thissurearm.live
thusbadab.live
thusbeerlaw.live
thuspegwo.live
thydoneact.live
thysuegame.live
ticodeloss.live
tiegainsold.live
tietoowage.live
tieumka.live
tigrowcow.live
tilloytask.live
timebaypig.live
timeweregap.live
tinjanemere.live
tinoddtie.live
tinyantgym.live
tipacidmilk.live
tipfairsal.live
tipgoof.live
todtimecold.live
toebagsis.live
toeelsesat.live
toerayphi.live
toerueexit.live
tojodebt.live
tollbossera.live
tollfaxles.live
tomhalfcode.live
tomoleharm.live
tomparrye.live
tonehelpglad.live
toneoneheld.live
tonesonfund.live
tonorneck.live
tontaxroad.live
tonwisthan.live
tonyboatrate.live
tonyraysac.live
tooeasywise.live
tookdiskbusy.live
toolfeetlose.live
topbellea.live
topjanecor.live
torabssal.live
torhattie.live
toroxbox.live
torpostbaby.live
torremyard.live
totnorka.live
totremneb.live
totwentfen.live
totzonelong.live
tourbodyden.live
tourthinsay.live
towatnod.live
townrugkent.live
towntollyear.live
towpepfee.live
towragapp.live
toyagame.live
treeaptwent.live
treeawegray.live
tripseatedge.live
truefaxpoll.live
trueheroall.live
truetechhard.live
tryclubdab.live
trysimore.live
tubdewal.live
tubgetused.live
tubholystay.live
tubtimeamp.live
tugbearthan.live
tugdesktime.live
tuggearpass.live
tugheatabs.live
tugtoldoak.live
tunecolran.live
tunerapeh.live
turnavedraw.live
turncardcup.live
turnfourlaid.live
twodeadoft.live
twodidrib.live
twokittoe.live
typebabysat.live
uhtermlost.live
uhtoolook.live
uhzavary.live
umjoyrag.live
umoddmud.live
umsawheld.live
unitosput.live
unitpiprod.live
unwanbond.live
uplaggave.live
uponalldays.live
uponlandjew.live
upontadseat.live
upspalad.live
useasname.live
usedbusease.live
usedhisan.live
usedwingbad.live
userdunpark.live
usergoldvice.live
userkindear.live
useseeton.live
utaveblow.live
utlistfeet.live
utwelltree.live
vancabdin.live
vanryehay.live
vantoesic.live
vanumhunt.live
vanusercow.live
varyagedsort.live
varynaydo.live
vastfairjog.live
vastmailcall.live
vasttwincamp.live
vastwaxeven.live
vatcadold.live
vatlordsen.live
vatslipwhat.live
veryenduty.live
verysomebe.live
vetjumprush.live
vetrestcar.live
viadigaba.live
viaourole.live
vicebabypi.live
viceusedhen.live
vieneedbet.live
viewhostonce.live
viewisbush.live
viewpasssign.live
viewverypol.live
vowbasetall.live
vowbiztool.live
vowcotpan.live
vowdoneby.live
vowpairmax.live
wageableno.live
wagehmnu.live
wagemisstoll.live
wageseekrun.live
waiticyado.live
waitsaptub.live
waityetsoon.live
wakebulkfire.live
wakeosnine.live
walkkeyset.live
walklawwed.live
walksaidah.live
walkworebat.live
wancueneg.live
wanillday.live
wanpuppipe.live
wantalegin.live
wanttoopat.live
wantvowski.live
warasbra.live
wardpawall.live
warmdoorof.live
warmthusla.live
warsomebill.live
wasfromcos.live
washhayrob.live
wasroomrue.live
waxmoontown.live
waycopemuch.live
wayharmsap.live
waysmodecool.live
weakcryrock.live
weaknowhub.live
weakpipboth.live
weakxihelp.live
wearexiteta.live
wearinivy.live
wearruleinch.live
weballspot.live
webbillmid.live
webecufear.live
weberadue.live
webjogsaw.live
webrekill.live
wedcoseft.live
wedeachmoon.live
wedeftsend.live
wedisklife.live
wedmikeyard.live
wedriserest.live
wedshotrag.live
weduseash.live
wedwideis.live
weeapelack.live
weekahasale.live
weekfairboth.live
wellbeernow.live
welledthey.live
wellfactluck.live
wellrappad.live
wellwanad.live
wentcrewford.live
wentmyyen.live
wentsalread.live
werebusbud.live
wereostom.live
westdaysbox.live
westdogtool.live
westlikeof.live
westmeetbad.live
wetasksoil.live
wetendbid.live
wetgagem.live
wetnearbad.live
wettooldoor.live
weyardfear.live
wezaen.live
whenmeretour.live
whenyoudip.live
whoevervote.live
whomdrawfund.live
whompickdue.live
whyhatuser.live
whymuchhome.live
widenegray.live
widewellecu.live
wifeahahip.live
wigetasend.live
wigiggbus.live
wildjuryaft.live
wildmumreg.live
willwillarc.live
winalasafe.live
winbumpair.live
windheroyes.live
windnaylane.live
windwebslip.live
winebanfix.live
winemorepe.live
winevieward.live
wingcowrain.live
winisgoes.live
wirefisheft.live
wirepacgot.live
wiretadit.live
wisdebtknew.live
wisedatacard.live
wishgalhold.live
wishnahact.live
wispodtown.live
witcongem.live
withcaretend.live
withdabdig.live
withwidedam.live
withyenfig.live
witlackbone.live
witmudopt.live
witvaryta.live
witvotegot.live
wonadosnow.live
wonbodytool.live
woncamepush.live
wondebtjog.live
wongonere.live
wonmaillook.live
wonvarybet.live
wooagodug.live
woodpashope.live
woodwetoo.live
wooetalift.live
wooposttook.live
woowavete.live
wordhavespa.live
wordpainsup.live
wordturncoal.live
worefireupon.live
woremacsalt.live
woreokmed.live
woretadhug.live
woreunfish.live
workreflet.live
workshowhome.live
wowagosign.live
wowcooknavy.live
wowhavetype.live
wowtipward.live
wrybabymm.live
wrydateale.live
xidietrip.live
xiroofown.live
xisodstay.live
xiwalksup.live
xiwanpush.live
xiwhobo.live
xuoldlaw.live
xuowltwo.live
yajoeand.live
yardfourbig.live
yardkittrue.live
yardpushtad.live
yardutlab.live
yaworeran.live
yeahhubwar.live
yeahlidbowl.live
yeahtextfur.live
yeahtoodam.live
yearanadot.live
yearyourbo.live
yedietlook.live
yepexlaid.live
yepviceseek.live
yepwisedrop.live
yesaltest.live
yesgunrap.live
yesniprely.live
yetorboo.live
yetskion.live
yogavemike.live
yohavemix.live
yougigdear.live
youlongpsi.live
yourdamfur.live
youskinxu.live
youyeduke.live
zabitzero.live
zapitkept.live
zerolandwill.live
zipeftonce.live
zipevereve.live
zipiddone.live
zippubhid.live
zonebusykill.live
zonefouryard.live
zoohavia.live
zooohcod.live
bluefiretobind.com
followstepcherry.com
greenstepcherry.com
0.bluefiretobind.com
0.greenstepcherry.com
1.bluefiretobind.com
1.greenstepcherry.com
2815.metminekit.live
74.theydayssay.live
t06pgwq.altitssame.live

# Reference: https://blog.sucuri.net/2024/06/caesar-cipher-skimmer.html
# Reference: https://app.validin.com/detail?find=NOTHING%20TO%20SEE%20HERE%20(%3A&type=raw&ref_id=038b91e70eb#tab=host_pairs_v2

1api.club
1api.club.sports-app.xyz
api-data.xyz
api-data.xyz.sports-app.xyz
api-service.one
api-service.one.sports-app.xyz
apinetwork.club
apinetwork.club.sports-app.xyz
apisports.one
apisports.one.sports-app.xyz
autoconfig.node6257.myfcloud.com
autodiscover.node6257.myfcloud.com
backendsports.bovadasport.app
backendsports.xyz
blogway.xyz
bovadasport.app
bovadasport.bovadasport.app
bovadasport.club
go-play.xyz
gomobi.xyz
ipv6.node6257.myfcloud.com
mobile2tools.xyz
node6257.myfcloud.com
ns1.node6257.myfcloud.com
ns2.node6257.myfcloud.com
sports-app.xyz
sports-data.club
sports-data.club.sports-app.xyz
sports-data.xyz
sports-data.xyz.sports-app.xyz
sports2app.xyz
sports2app.xyz.mobile2tools.xyz
sports2go.xyz
sports2goxyz.bovadasport.app
sportsapi.club
sportsdata.xyz
sportsdata.xyz.sports-app.xyz
sportsdev.bovadasport.app
sportsdev.xyz
sportsmobile.xyz
sportsmobile.xyz.mobile2tools.xyz
trafficapp.xyz
trafficdelivery.xyz
trafficfilter.xyz
brightaems.com/wp-content/themes/educator-education/css/css.php
flyfishinguide.co.nz/css/css.php
ilegkenya.org/acs/css.php
patilcomputers.com/wp-content/themes/shopic-child/css.php
shop.care.pistoia.it/wp-content/languages/css.php
thepioneerbank.com/wp-content/themes/twentytwentytwo/css.php

# Reference: https://www.linkedin.com/posts/aaronmeese_linkedin-is-allowing-some-very-sktetchy-stuff-activity-7304884331821359105-fwtL
# Reference: https://app.validin.com/detail?find=91.204.209.201&type=ip4&ref_id=46f254742b1#tab=resolutions
# Reference: https://www.virustotal.com/gui/file/3b0474d63633b76cbdcd6e53eac5e87bca46c736e3e94b2d6221b7a662ea97ac/detection
# Reference: https://www.virustotal.com/gui/file/4fc89c5a2d28d6c02ed9ce131ed78586744723c8a9144ba3b601029b510d25d9/detection
# Reference: https://www.virustotal.com/gui/file/6eeaed83e4f490be631b435cd8a34b33996f562ce7cf874821c5c8a51500948b/detection
# Reference: https://www.virustotal.com/gui/file/aae9dbe9005be632a2e2a95e13a83652155946c95f66e7c00e24641023845956/detection
# Reference: https://www.virustotal.com/gui/file/d5868c7d17c071f8e3f9b1fcc6d349c6c7d2b9c9b71a53f8a8a34bbdb4ca66e6/detection
# Reference: https://www.virustotal.com/gui/file/f13b5c7d4c6882f41eea64c5738aeaa7b5d9e61421c9c3727c0a04a969886115/detection

activeejobs.xyz
activejobs.xyz
ahadjobs.us
apply-career.us
apply-sourcingsquare.us
apply-usjobz.xyz
apply-workwave.xyz
applycareer.us
applyjobus.us
bestactivejobs.us
bestjobs4u.site
bestjobshere.xyz
bestjobz.xyz
career.ahadjobs.us
career.applyjobus.us
career.enoovia.us
career.findusjobs.us
career.indeeo.us
career.jobdewa.site
career.jobnotify.us
career.jobsigma.site
career.mycareers.us
career.open2work.site
career-usjobs.xyz
career2guru.site
careeractive.xyz
careeractives.xyz
careeradvisory.site
careerguru.us
careers.jobmarketing.site
careersigma.site
careersstart.site
desirejobs.xyz
engjobs.xyz
findajobs.us
findopenwork.site
findusjobs.us
fromusjobs.us
hello1jobs.xyz
hellomyjob.us
hellomyjob.xyz
indeedcareer.site
indeedjobz.us
itactivejobs.xyz
itjobz.xyz
job.careerguru.us
job.opencareer.us
jobadvisory.us
jobapplyhere.site
jobbulider.us
jobcareerss.us
jobdewa.site
jobmarketing.site
jobmaster.site
jobnotify.us
jobs.applycareer.us
jobs.career2guru.site
jobs.careeradvisory.site
jobs.careersigma.site
jobs.findopenwork.site
jobs.indeedcareer.site
jobs.jobmaster.site
jobs.nationaljob.us
jobs.opencareer.site
jobs.prwisha.us
jobs.rozee.site
jobs-applyhere.xyz
jobs-best.xyz
jobs4you.site
jobshere1.xyz
jobseekers.site
jobshub.us
jobsigma.site
jobsmood.xyz
lensajobs.us
mybestjob.xyz
mycareers.us
myfirsttjob.xyz
nationaljob.us
newcompanyjobs.us
newyearjobs.us
open2work.site
open2work.us
opencareer.site
opencareer.us
openforjob.us
openforjob.xyz
papularjobs.xyz
us-jobs.us
uscareers0.xyz
usjobcenter.us
usjobs2.xyz
usprivatejobs.site
workfornew.xyz
workfromhouse.xyz

# Reference: https://www.wordfence.com/blog/2024/06/supply-chain-attack-on-wordpress-org-plugins-leads-to-5-maliciously-compromised-wordpress-plugins/
# Reference: https://www.virustotal.com/gui/file/6c5ee295cec9a1f4518d2f9c12d53251c7b53a1cff3e9d3bd2d01ad03b99df81/detection
# Reference: https://www.virustotal.com/gui/file/28e145ad13289cbd819ce730f673b27c8b9d49c5488a3796de24eb0f775353c6/detection

http://94.156.79.8
94.156.79.8:443
94.156.79.8:999

# Reference: https://twitter.com/unmaskparasites/status/1765144260729618782
# Reference: https://x.com/raghav127001/status/1826530849178972189
# Reference: https://blog.sucuri.net/2024/02/web3-crypto-malware-angel-drainer.html
# Reference: https://blog.sucuri.net/2024/03/from-web3-drainer-to-distributed-wordpress-brute-force-attack.html
# Reference: https://www.virustotal.com/gui/file/ee4c04a80af6f7e2c2fb2016248bcdf8fcdf0c04552fa60fcb4bd879f8783e9f/detection

4378uehdkf.com
65a044a0023ca.com
87634rh4r4r3rfekj.com
billionalr.com
billlionair.app
browsersjsfiles.com
calzoom.com
cdn-npmjs.com
cdnjs-storage.com
chain-connect-api.com
cloudcdnjs.com
cloudflare-eth.org
cloudweb3-api.com
coingecko-priceapi.com
dynamic-flows.com
dynamic-linx.com
dynamiclinks.cfd
dynamiclink.lol
flashbots-builder.com
getblocks.org
giftbeyondwealth.com
hostpdf.co
infura-api.com
io-walletconnect.com
melstroy.by
monkey-ads.digital
nextcdnjs.com
newsoutlets.net
nftfastapi.com
opensmarketplace.net
paulmulleracademico.com
posiit.com
rpc-ankr.net
tobaccosoldiers.com
tradinglabs.app
unpkgaa.com
web3-cloudfront.com
web3modal-api.com
eth.flashbots-builder.com
eth.rpc-ankr.net
highaf.tobaccosoldiers.com
jscdnweb.pages.dev
rpc.4378uehdkf.com
rpc.65a044a0023ca.com
rpc.87634rh4r4r3rfekj.com
rpc.chain-connect-api.com
rpc.cloudweb3-api.com
rpc.coingecko-priceapi.com
rpc.getblocks.org
rpc.infura-api.com
rpc.io-walletconnect.com
rpc.web3modal-api.com
api.nftfastapi.com
rpc.nftfastapi.com

# Reference: https://www.virustotal.com/gui/file/673a1a3a262b9b174733ee39810725286368a364ea9ef3f1f3c16ba71ac1f759/detection

developmyredflag.top
css.developmyredflag.top

# Reference: https://www.virustotal.com/gui/file/096368e99f15b67b136214f4859de989e8f18b86ef563518f543762240ce8e38/detection

kissedthetrain.com

# Reference: https://www.virustotal.com/gui/file/6aca4460bbc5180a3b9c8c56f15e614f09a1d65875dc7449548f19eff4989b04/detection
# Reference: https://www.virustotal.com/gui/file/c7633415ebd4afc9b49359b6c979770fde32d0f36a883bacd4ddc8a1bf292539/detection

letmeplayformoney.com
cdn.letmeplayformoney.com
pr.letmeplayformoney.com
scr.letmeplayformoney.com
tmp.letmeplayformoney.com
vcdn.letmeplayformoney.com

# Reference: https://www.virustotal.com/gui/ip-address/185.155.184.36/relations

recordsbluemountain.com
bre.recordsbluemountain.com
dre.recordsbluemountain.com
flow.recordsbluemountain.com
get.recordsbluemountain.com
go.recordsbluemountain.com
gogo.recordsbluemountain.com
page.recordsbluemountain.com
re.recordsbluemountain.com
set.recordsbluemountain.com

# Reference: https://www.virustotal.com/gui/file/c33bcd9c3492b71c6ac78eccffa26b6d059274536298cca3436e106c12193e26/detection

restartyourchoices.com
done.restartyourchoices.com
iojquery.restartyourchoices.com
jquery.restartyourchoices.com
query.restartyourchoices.com

# Reference: https://community.emergingthreats.net/t/ruleset-update-summary-2024-08-21-v10671/1910
# Reference: https://www.virustotal.com/gui/file/d1536b0cad619b8da779f6be4ea5e50ec3eef59d99d37ce1321083feefc7aa70/detection

blueselectorpage.com
taskscompletedlists.com
0.blueselectorpage.com
1.blueselectorpage.com
away.taskscompletedlists.com
come.taskscompletedlists.com
from.taskscompletedlists.com
to.taskscompletedlists.com

# Reference: https://www.virustotal.com/gui/file/46093c52adf2b499d112e5cec24179fa2af54a9f890572c31487cf2d2b29f1e9/detection

broworker9s.com
siteforyou3d.com
0.siteforyou3d.com
1.siteforyou3d.com
2.siteforyou3d.com
4.siteforyou3d.com
5.siteforyou3d.com
6.siteforyou3d.com
7.siteforyou3d.com
8.siteforyou3d.com
9.siteforyou3d.com

# Reference: https://www.virustotal.com/gui/file/75aa742410ecbdc3700fc1ff3520952de52f1960426690844c52fc705e819c97/detection

kntsv.nl

# Reference: https://x.com/unmaskparasites/status/1846975894415724807
# Reference: https://www.godaddy.com/resources/news/threat-actors-push-clickfix-fake-browser-updates-using-stolen-credentials

/wp-content/plugins/admin-bar-customizer/abc-script.js 
/wp-content/plugins/advanced-user-manager/aum-script.js
/wp-content/plugins/advanced-widget-manage/awm-script.js
/wp-content/plugins/content-blocker/cb-script.js
/wp-content/plugins/custom-css-injector/cci-script.js
/wp-content/plugins/custom-footer-generator/cfg-script.js
/wp-content/plugins/custom-login-styler/cls-script.js
/wp-content/plugins/dynamic-sidebar-manager/dsm-script.js
/wp-content/plugins/easy-themes-manager/script.js
/wp-content/plugins/form-builder-pro/fbp-script.js
/wp-content/plugins/quick-cache-cleaner/qcc-script.js
/wp-content/plugins/responsive-menu-builder/rmb-script.js
/wp-content/plugins/seo-optimizer-pro/sop-script.js
/wp-content/plugins/simple-post-enhancer/spe-script.js
/wp-content/plugins/social-media-integrator/smi-script.js
/wp-content/plugins/custom-css-injector/
/custom-css-injector/

# Reference: https://x.com/9823f_/status/1851257589046071574

/wp-includes/css/dist/niil.php

# Reference: https://www.virustotal.com/gui/file/378ea9be097e794b597dc4345043ffdc97276adb46615cf873073c73f5d1aa17/detection

background.apistatexperience.com
broworker10s.com
finish.linetowaystrue.com
linetoslice.com
linetowaystrue.com
opdomaines.space
png.linetoslice.com
rain.recordsbluemountain.com
redselectorpage.com
render.linetowaystrue.com
start.linetowaystrue.com
where.linetowaystrue.com

# Reference: https://www.virustotal.com/gui/ip-address/185.80.234.230/relations
# Reference: https://www.virustotal.com/gui/file/44cded46f5a371c71db5223abe616dd5800d2b6516bdbddbfff3cb682d2190b5/detection

ckinohoot1.shop
ckinohoot2.shop
ckinohoot3.shop
ckinohoot4.shop
ckinohoot5.shop
ckinohoot6.shop
ckinohoot7.shop
ckinohoot8.shop
cvideoi9hd.shop
cvideoihd1.shop
cwideoihd5.shop
etkpoxh.ckinohoot1.shop
ezzston.kinoihootd8.shop
hdvideor8.shop
hdvideor9.shop
iwideoi7hd.shop
jwideohd.hair
kinohoot22.shop
kinoihootd1.shop
kinoihootd2.shop
kinoihootd3.shop
kinoihootd4.shop
kinoihootd5.shop
kinoihootd6.shop
kinoihootd7.shop
kinoihootd8.shop
kinoihootd9.shop
kinoihooter8.shop
kinouyhootf1.shop
kinouyhootf2.shop
kinouyhootf3.shop
kinouyhootf4.shop
kinouyhootf5.shop
kinouyhootf6.shop
kinouyhootf7.shop
kinouyhootf8.shop
kinouyhootf9.shop
kwideohd.hair
maxkonvert.pw
maxkv.pw
maxkv.shop
mjsccb.videochd1.shop
muvideohd.shop
mvideiohd.sbs
mvideohd1.shop
mvideohd10.shop
mvideohd2.shop
mvideohd3.shop
mvideohd4.shop
mvideohd5.shop
mvideohd6.shop
mvideohd7.shop
mvideohd8.shop
mvideohd9.shop
mwideoihd5.shop
nkinohoot3.shop
nkinohoot4.shop
nkinohoot5.shop
nkinohoot6.shop
nkinohoot7.shop
nplayer.shop
nplayyer5.shop
nvideohd3.shop
nvideohd4.shop
nvideohd5.shop
nvideohd6.shop
nvideohd7.shop
nvideoi1hd.shop
playerrs.shop
uavideo2.website
videochd1.shop
videochd2.shop
videochd3.shop
videochd4.shop
videochd5.shop
videochd6.shop
videochd7.shop

# Reference: https://www.virustotal.com/gui/file/10083b45547ab7dce90c18376be277b72571fd8c1ce1fee64bb225b73e571626/detection

perfectlinestarter.com
get.perfectlinestarter.com
go.perfectlinestarter.com
ready.perfectlinestarter.com
records.perfectlinestarter.com

# Reference: https://www.virustotal.com/gui/file/3156e9e14ae1a295d101549b584dee643ac50872f7cc6b216aa78363185f65e5/detection

opendomains.space

# Reference: https://www.virustotal.com/gui/domain/readytocheckline.com/relations

readytocheckline.com
fr1.readytocheckline.com
fr2.readytocheckline.com
genericpoint.readytocheckline.com
get.readytocheckline.com
pepoint.readytocheckline.com
point.readytocheckline.com
rt1.readytocheckline.com
set.readytocheckline.com
sources.readytocheckline.com
start.readytocheckline.com
starts.readytocheckline.com
steper.readytocheckline.com

# Reference: https://www.virustotal.com/gui/file/a8866e50386b6fcf4314cdb0a826106d020f4117907cd3ffdee6b00157270ff7/detection

infosystemsllc.com
participates.cfd
ulstery.space
binari.participates.cfd
dalopt.participates.cfd
delopt.participates.cfd
frimok.participates.cfd
noqcal.participates.cfd
noqkal.participates.cfd
takres.participates.cfd
tavux.participates.cfd
vezopa.participates.cfd
my.ulstery.space
smart.ulstery.space
unity.ulstery.space

# Reference: https://www.virustotal.com/gui/file/bbb3fe6bdd4f8cf00414b77cffc782113ba42e6d7addcee00905de74b1d2eb77/detection

cashmachines.biz

# Reference: https://www.virustotal.com/gui/file/139b83dc15a0679b6b42c559ae3c7463fcbd5a4e3a07ab5bf239fe1c459d42fa/detection

tuggest.space
crypt.tuggest.space
like.tuggest.space
tuto.tuggest.space

# Reference: https://x.com/g0njxa/status/1869006978976301540
# Reference: https://app.validin.com/detail?find=57e79ecb3411edc5e929bf8cda104bde&type=hash&ref_id=ca11cd099d6#tab=host_pairs (# 2024-12-17)

authmycookie.com
cverifier.top

# Reference: https://community.emergingthreats.net/t/ruleset-update-summary-2024-10-24-v10727/2074
# Reference: https://www.virustotal.com/gui/ip-address/134.209.139.16/relations

brodirect10s.com
brodirect4s.site
brodirect5s.site
brodirect8s.com
brodownload4s.site
brodownload5s.site
brodownloads5s.site
brogetcode10s.cc
brogetcode8s.cc
brolink4s.site
brolink5s.site
broluckycode4s.site
broluckycode5s.site
bromusic5s.site
broredir4s.site
broredir5s.site
brovideos4s.site
brovideos5s.site
broweb4s.site
broweb5s.site
topwebsites3d.com
videoforyou3d.com
yourbestbro3s.site
yourbestbro4s.site
yourbestbro5s.site
yourbrolink3d.com
yourbrolink4d.com

# Reference: https://raw.githubusercontent.com/Gi7w0rm/MalwareConfigLists/refs/heads/main/BaladaInjector/balada_all.txt

browork2er.cc
browork3er.cc
broworker1s.com
broworker4s.com
broworker5s.com
broworker6s.com
broworker7.com
broworker8s.com
broworkers5s.com

# Reference: https://cside.dev/blog/over-5k-wordpress-sites-caught-in-wp3xyz-malware-attack
# Reference: https://www.virustotal.com/gui/file/6cdb4f3e5285e2bad3b82893e600167ed178514a81d7db84e266c59a6666ae9b/detection

wp3.xyz

# Reference: https://x.com/cyberfeeddigest/status/1893923236225687947

/wp-admin/0.txt

# Reference: https://blog.sucuri.net/2025/02/fake-wordpress-plugin-impacts-seo-by-injecting-casino-spam.html

jsscript.top

# Reference: https://cside.dev/blog/thousands-of-websites-hit-by-four-backdoors-in-3rd-party-javascript-attack
# Reference: https://app.validin.com/detail?find=ebac4decceffd560ddf0c48c1e45534c&type=hash&ref_id=5eba2f6f756#tab=host_pairs (# 2025-03-06)

cloudsyndication.bz
cloudsyndication.cc
cloudsyndication.club
cloudsyndication.dev
cloudsyndication.me
cloudsyndication.org
cloudsyndication.to
cloudsyndication.xyz
csyndication.com
dke.me
incdn.me
protocolcdn.com
sonicloud.org
syndication.bz
ak.dke.me
aka.cloudsyndication.dev
api.incdn.me
cdn.csyndication.com
cloud.syndication.bz
information.cloudsyndication.dev
information.cloudsyndication.org
pagead2.csyndication.com
tx.dke.me

# Reference: https://app.validin.com/detail?find=e58f78e85f2e3af9350dd7d1c909a95f&type=hash&ref_id=6ccab8d90f1#tab=host_pairs (# 2025-03-06)

instantcontentflow.com
gll.instantcontentflow.com

# Reference: https://www.virustotal.com/gui/file/8b589439b8514759aa6fb9936ab698ca7e7acbbf56c88b160c8d5c949b78e78f/detection

swiftstreamhub.com
cloud.swiftstreamhub.com

# Reference: https://x.com/unmaskparasites/status/1899528917519884550
# Reference: https://www.virustotal.com/gui/ip-address/154.62.226.44/relations
# Reference: https://www.virustotal.com/gui/ip-address/159.100.6.41/relations
# Reference: https://www.virustotal.com/gui/file/02737ffc9a2c33741945a5e5fc832913d14c2f418925da298f2a7df03092a98d/detection

api-cdn.icu
apipanel1x.xyz
iogamesl.xyz
jquery.bond
schemapi.com
w3l.icu
wp-cdn.top
cdn.schemapi.com
mail.apipanel1x.xyz
mail.w3l.icu
mail.wp-cdn.top

# Reference: https://www.virustotal.com/gui/file/0d0feed4ce01f8f94624cd4f02e8871468a54a22de83fc8d448978a5c3e2e67f/detection
# Reference: https://www.virustotal.com/gui/file/c45eafcd560a0351e53b1cfcacc2dd8680d886082b7b637090e49149c7ee7197/detection

spelldeterrent.com

# Reference: https://x.com/malwrhunterteam/status/1898285268647444952
# Reference: https://www.virustotal.com/gui/file/d2469fa3615ca83da082ccc41da9ff7a4913257af5f977e78e3f27154559c45f/detection
# ReferencE: https://www.virustotal.com/gui/file/c59fb533002f7a7db4c4cde96d7debc5c9d96fd55881d333a12f6b7ea39683e5/detection
# Reference: https://www.virustotal.com/gui/file/ab2d99b8086c52141025dc1430d06337e754e0fa9a9989e7f24b7cfd0be52561/detection
# Reference: https://www.virustotal.com/gui/file/a10dc6149fa3610bd4a78e0db784e918e428c37b8d10dcce21523cdb6bfb9810/detection
# Reference: https://www.virustotal.com/gui/file/a09721158214a0fc57471a78fe1606bf095a683d2c6c124f01be10e64e568297/detection
# Reference: https://www.virustotal.com/gui/file/6e7ba7c9f76bbdc9a4babf68bb41d2375b19c5f01f456b381b8974ad07311bd1/detection
# Reference: https://www.virustotal.com/gui/file/2c4d09e941105fff3bdbde7cf6f72be55a881a14bc5e0a3efcd3efeee92e17af/detection
# Reference: https://www.virustotal.com/gui/file/1339a8867e8f04e12cc7543c548a33ac7b94dcba591e2da8b9ae2df24687c99e/detection

107.189.29.12:60001

# Reference: https://www.virustotal.com/gui/domain/profitablecpmratenetwork.com/detection

profitablecpmratenetwork.com

# Reference: https://www.virustotal.com/gui/domain/profitablecpmrate.com/detection

profitablecpmrate.com

# Reference: https://www.virustotal.com/gui/domain/highperformanceformat.com/relations

highperformanceformat.com

# Reference: https://www.godaddy.com/resources/news/dollyway-world-domination
# Reference: https://www.virustotal.com/gui/file/118a9b810110712beb8ccaf88619fd5971f95fd37d0d920e2db6163bc57438c2/detection

blackentertainments.com
blueeyeswebsite.com
cdnwebsiteforyou.biz
deliverygoodstrategy.com
dontstopthismusics.com
2fdrop.dontstopthismusics.com
analytics.cdnwebsiteforyou.biz
comdrop.dontstopthismusics.com
cyoudrop.dontstopthismusics.com
drop.blackentertainments.com
drop.dontstopthismusics.com
for.dontstopthismusics.com
m.blackentertainments.com
survey.blackentertainments.com

# Reference: https://www.virustotal.com/gui/file/46809acf183bde3b94d3d2fc9e86c2848e68b4626f2c233920e673de041aed39/detection
# Reference: https://www.virustotal.com/gui/file/53f9aaa6f757a90d56032f29e2a300922fd3f28911f8c18da087f8b7989eb0d3/detection
# Reference: https://www.virustotal.com/gui/file/19b7dd9117c51bc7d2998e3b37daa0d411e083c4345f5a052e59c75bd692b5df/detection

deliverynotforme.best
developfirstline.com
developfirstlinex.com
togetherforwine.com
0.deliverynotforme.best
0.togetherforwine.com
1.deliverynotforme.best
2.deliverynotforme.best
3.deliverynotforme.best
8.togetherforwine.com
load.developfirstline.com
track.developfirstline.com
track.developfirstlinex.com

# Reference: https://www.virustotal.com/gui/domain/a11ybar.com/relations
# Reference: https://www.virustotal.com/gui/domain/ian029dkl3osl930sian.club/relations
# Reference: https://app.any.run/tasks/f37643ac-aa48-480e-b320-d94a13ff0fc3

a11ybar.com
ian029dkl3osl930sian.club
api.ian029dkl3osl930sian.club
media.ian029dkl3osl930sian.club
sdk.ian029dkl3osl930sian.club
a11ybar.a11ybar.com
admin.a11ybar.com
api.a11ybar.com
app.a11ybar.com
auth.a11ybar.com
secure-prod.a11ybar.com
secure.a11ybar.com
url9476.a11ybar.com

# Reference: https://www.godaddy.com/resources/news/dollyway-malware-history

http://176.113.115.10
777traffget.site
co34.space
compensationsa.xyz
diathophyltetigid.ga
sikopersimoasho.ml

# Reference: https://www.wordfence.com/blog/2025/04/interesting-wordpress-malware-disguised-as-legitimate-anti-malware-plugin/

45.61.136.85:5555

# Reference: https://www.wordfence.com/blog/2025/06/a-deep-dive-into-a-modular-malware-family/

api-service-188910982.website
blastergallery.com
chaolingtech.com
contentsdeliverystat.com
deliveryrange.pro
emojiselect.info
graphiccloudcontent.com
imageresizefix.com
imagifytext.com
internetmemoryservice.com
staticdelivery.net
staticimagedelivery.com
vectorimagefabric.com
vectorizegraphic.com
api.staticdelivery.net

# Reference: https://cert.orange.pl/aktualnosci/zainfekuj-sie-sam-kampania-clickfix/

/wp-assets-optimizer.html

# Reference: https://patchstack.com/articles/critical-malware-found-in-gravityforms-official-plugin-site
# Reference: https://www.virustotal.com/gui/ip-address/185.193.89.19/relations
# Reference: https://www.virustotal.com/gui/ip-address/185.243.113.108/relations
# Reference: https://app.validin.com/lookalikes?lookback=90&depth=2&find=gravityapi (# 2025-07-14)

gravityapi.ai
gravityapi.co
gravityapi.dev
gravityapi.io
gravityapi.net
gravityapi.org

# Reference: https://blog.sucuri.net/2025/07/stealthy-php-malware-uses-zip-archive-to-redirect-wordpress-visitors.html
# Reference: https://www.virustotal.com/gui/ip-address/142.54.171.253/relations
# Reference: https://www.virustotal.com/gui/ip-address/174.128.225.188/relations

enturbioaj.xyz
enwipesk.xyz
fachakademie.xyz
icercanokt.xyz
offoward.top
raygun.top
slponentq.xyz
asanythe.slponentq.xyz
bkseventysixug.raygun.top
bzbasketjh.offoward.top
cbcollarbz.offoward.top
gaeightythreeix.raygun.top
hcsteamge.enwipesk.xyz
hxeightyfivepd.raygun.top
inbakezt.offoward.top
irplumada.enturbioaj.xyz
kbninetytwoxg.raygun.top
khfraganbv.enturbioaj.xyz
kphutqu.offoward.top
lkremedwz.offoward.top
mxmousede.offoward.top
nesevenonehr.fachakademie.xyz
nlvoyagehb.offoward.top
oqmetrix.icercanokt.xyz
orduckea.offoward.top
tkwidthkd.icercanokt.xyz
ufeightyonehp.raygun.top
wditemqy.enturbioaj.xyz
yzsurfar.icercanokt.xyz
zpcoarseyf.enturbioaj.xyz

# Reference: https://blog.sucuri.net/2025/07/uncovering-a-stealthy-wordpress-backdoor-in-mu-plugins.html
# Reference: https://app.validin.com/detail?find=eef34d90564665e86104e93143e22052&type=hash&ref_id=7c5e7091d6f#tab=host_pairs (# 2025-07-23)
# Reference: https://app.validin.com/detail?find=W%2F%2233-Mt3XSbigbnhsci059eWiXwA6mWo%22&type=raw&ref_id=7c5e7091d6f#tab=host_pairs (# 2025-07-23)

1870y4rr4y3d1k757673q.xyz
arderphon.org
asyabahisgiris.vip
babychecker.xyz
seka-amp5.com
sekabetgiris.click
sekabetgirislink.com

# Reference: https://www.virustotal.com/gui/domain/125700.shop/detection

125700.shop
cdn.125700.shop

# Reference: https://www.virustotal.com/gui/ip-address/93.152.230.52/relations
# Reference: https://www.virustotal.com/gui/file/0e11d61eea17f99d19f5a5854c0c8defd83c74953443147eac8bbb1506a63200/detection

advertipros.com
naverogo.com

# Reference: https://www.virustotal.com/gui/ip-address/67.212.173.77/relations

agitted.shop
sundard.shop
contrar.agitted.shop
denough.sundard.shop

# Reference: https://blog.sucuri.net/2025/12/wordpress-auto-login-backdoor-disguised-as-javascript-data-file.html

/wp-admin/js/mr_skk/data.php
/wp-admin/js/mr_skk/

# Reference: https://x.com/unmaskparasites/status/2045229462921343473
# BANNER_0_HASH-HOST=a7f06614f807c9e83072da9bfcb37d1c
# HEADER_HASH-HOST=e4e0287b9b7088491c28

cms-manager.net
eightiesvintagestyle.com
fivesecondoutfit.com
fourseasonwardrobe.com
fraudlabspro.net
nineyarddress.com
onestyleshop.com
sevensizesclothing.com
sixpocketjeans.com
threehoodiesbrand.com
twotrousersstore.com
wpengine-cdn.com
zerowastefashion.net
assets.fraudlabspro.net
cdn.fraudlabspro.net
sec.fraudlabspro.net
security.fraudlabspro.net

# Reference: https://x.com/JustWantToQ1/status/2044568080735498573
# Reference: https://x.com/BreakGlassIntel/status/2045290715987472437
# Reference: https://intel.breakglass.tech/post/netscan-wpmagic-caas-xssnew-unmasked

86.109.75.167:443
86.109.75.167:8080
netscan.info
wpmagic.net

# Reference: https://x.com/unmaskparasites/status/2036905912552874158

first-node.rocks
api.first-node.rocks
check.first-node.rocks

# Reference: https://www.virustotal.com/gui/file/8c94b15da07794ca8ab86f694f0d7bd8ce6400cbb9f02ee632b700e074584d6e/detection
# Reference: https://gist.github.com/danslo/870dc7ec698f121e8fbf304d13e300c9

fontscanvas.com

# Reference: https://www.virustotal.com/gui/ip-address/15.197.172.60/relations

anyexists.com

# Reference: https://www.virustotal.com/gui/file/4eb550063b3316d21b076f38e25f2ac0a015a54759507f08481179c6c289601f/detection

3lichat.us

# Reference: https://www.virustotal.com/gui/ip-address/217.196.54.129/relations

cdnpixelnetworks.com

# Reference: https://www.virustotal.com/gui/ip-address/18.167.19.159/relations

bootcdn.pro

# Reference: https://www.virustotal.com/gui/ip-address/217.160.0.139/relations

tracking-pilot.com
app.tracking-pilot.com
