{
  "aliases": [],
  "attack_id": null,
  "attack_name": null,
  "attack_url": null,
  "counts": {
    "domain": 519
  },
  "first_seen": {
    "domain": {
      "0ffice36o.com": "2018-12-11",
      "18-79-t.net": "2022-07-17",
      "1qhd6v.xyz": "2022-07-17",
      "4f-okdsvv.com": "2022-07-17",
      "5-9idk-gug7-k7.com": "2022-07-17",
      "52-ck29jr.com": "2022-07-17",
      "5z-hyq-g.net": "2022-07-17",
      "78p3-zgs-g-mc-u.com": "2022-07-17",
      "8f-mxh6-hupgd-dy.com": "2022-07-17",
      "8faf-rngtax.com": "2022-07-17",
      "a87-sun0r1w.com": "2022-07-17",
      "ac5e1f-fd2ph.com": "2022-07-17",
      "acyjob.tokyo": "2022-07-17",
      "adchum.tokyo": "2022-07-17",
      "adzwrq.tokyo": "2022-07-17",
      "akgxtu.tokyo": "2022-07-17",
      "aletko.tokyo": "2022-07-17",
      "am41-pm24ea.com": "2022-07-17",
      "amb29l1v3re.com": "2022-07-17",
      "ami10t-e37n.com": "2022-07-17",
      "an87-24pen1d.com": "2022-07-17",
      "and58-65kio.com": "2022-07-17",
      "apply33547.com": "2022-07-17",
      "ar5-chj-n-22d.com": "2022-07-17",
      "as93-attack1.com": "2022-07-17",
      "aso5fr-gre4.com": "2022-07-17",
      "au.imonju.net": "2022-07-17",
      "b5mjjc8s.com": "2022-07-17",
      "baebod.tokyo": "2022-07-17",
      "ban09-4w1as.com": "2022-07-17",
      "batdongsan.dcsvnqvmn.com": "2022-07-17",
      "baw2u-y6rsxf.com": "2022-07-17",
      "bed52-town1.com": "2022-07-17",
      "big429-7ten.com": "2022-07-17",
      "bing0017-s4e.com": "2022-07-17",
      "bing04-5ea1.com": "2022-07-17",
      "bm-8qkc8w.com": "2022-07-17",
      "bnv521-send4.com": "2022-07-17",
      "boat-19830214yh.com": "2022-07-17",
      "boceuz.tokyo": "2022-07-17",
      "boundhereafter.com": "2022-07-17",
      "bpugoc.tokyo": "2022-07-17",
      "bqufsuqj.com": "2022-07-17",
      "buffdrops.com": "2022-07-17",
      "bvnc5418-4s.com": "2022-07-17",
      "c02bf1r-kjre.com": "2022-07-17",
      "c7ykg-0sd5w.com": "2022-07-17",
      "cd-7rr-hgj.net": "2022-07-17",
      "cg58-6dr4wa.com": "2022-07-17",
      "chai58-mnew.com": "2022-07-17",
      "check.onedrvdn.co": "2022-07-17",
      "chi12-63in7m.com": "2022-07-17",
      "cm.appupdatemoremagic.com": "2022-07-17",
      "cont24-57hin.com": "2022-07-17",
      "crimeprocession.com": "2022-07-17",
      "crtfugrl.com": "2022-07-17",
      "cxevgfdy.com": "2022-07-17",
      "d-wl-kk.net": "2022-07-17",
      "d56gr-n2syp.xyz": "2022-07-17",
      "dalat.dalat.dulichovietnam.net": "2022-07-17",
      "dalat.dulichovietnam.net": "2022-07-17",
      "dan02-opl1h.com": "2022-07-17",
      "dan07oe0ch2f.com": "2022-07-17",
      "dan104.com": "2022-07-17",
      "dan32-ty65d.com": "2022-07-17",
      "dbfrqm.tokyo": "2022-07-17",
      "deliver-avenir.com": "2022-07-17",
      "den-85gh40ik.com": "2022-07-17",
      "developermisguided.email": "2022-07-17",
      "devzxm.tokyo": "2022-07-17",
      "dgywxfhuuy.com": "2022-07-17",
      "dhs4oms-plas.com": "2022-07-17",
      "dice-71ieoq.com": "2022-07-17",
      "dick06-a4e6o.com": "2022-07-17",
      "displayexploitation.com": "2022-07-17",
      "download.showprice.xyz": "2022-07-17",
      "dsykub.tokyo": "2022-07-17",
      "dwwkvf.tokyo": "2022-07-17",
      "e9dzrisph.com": "2022-07-17",
      "eden52-74ea.com": "2022-07-17",
      "edjkpz.tokyo": "2022-07-17",
      "edli501d-eaq.com": "2022-07-17",
      "eec-channel.com": "2022-07-17",
      "elcend.tokyo": "2022-07-17",
      "ell90-deep1w.com": "2022-07-17",
      "end09-r6s3x.com": "2022-07-17",
      "end87q.com": "2022-07-17",
      "eri05-63h4w.com": "2022-07-17",
      "eri25-d044g.com": "2022-07-17",
      "error.a87-sun0r1w.com": "2022-07-17",
      "error.amb29l1v3re.com": "2022-07-17",
      "error.bing0017-s4e.com": "2022-07-17",
      "error.boat-19830214yh.com": "2022-07-17",
      "error.chai58-mnew.com": "2022-07-17",
      "error.dan07oe0ch2f.com": "2022-07-17",
      "error.dan104.com": "2022-07-17",
      "error.dice-71ieoq.com": "2022-07-17",
      "error.eden52-74ea.com": "2022-07-17",
      "error.end87q.com": "2022-07-17",
      "error.get814sf1qz.com": "2022-07-17",
      "error.gine08-aw1a.com": "2022-07-17",
      "error.gp01-83-jind.com": "2022-07-17",
      "error.gu24dyen61v.com": "2022-07-17",
      "error.hanji1975-report.com": "2022-07-17",
      "error.hei032-4r4f.com": "2022-07-17",
      "error.hv-1d5f10ad.com": "2022-07-17",
      "error.ico65-e41dy.com": "2022-07-17",
      "error.iop045-jfh7.com": "2022-07-17",
      "error.jet02-59udc.com": "2022-07-17",
      "error.jin98-lme5a.com": "2022-07-17",
      "error.jun126japan4.com": "2022-07-17",
      "error.jun565.com": "2022-07-17",
      "error.jun98-rep-boat.com": "2022-07-17",
      "error.kaiketsu-250-md.com": "2022-07-17",
      "error.ken094l-14w.com": "2022-07-17",
      "error.kenji0903-boat.com": "2022-07-17",
      "error.key00nine7y.com": "2022-07-17",
      "error.key61sea03r.com": "2022-07-17",
      "error.key73plo54s.com": "2022-07-17",
      "error.key82ygo20w.com": "2022-07-17",
      "error.kif25vna1ed.com": "2022-07-17",
      "error.kin025-uma-boat.com": "2022-07-17",
      "error.kmv50-fs2eo.com": "2022-07-17",
      "error.knee39d.com": "2022-07-17",
      "error.lan57j-fd4s.com": "2022-07-17",
      "error.link053pin1e.com": "2022-07-17",
      "error.look01-d84w.com": "2022-07-17",
      "error.low05d14jsa.com": "2022-07-17",
      "error.may05-11pro.com": "2022-07-17",
      "error.men17f5h1sa.com": "2022-07-17",
      "error.mizuki2223-report.com": "2022-07-17",
      "error.mvp970a-e2a.com": "2022-07-17",
      "error.n04dvf-sd1r.com": "2022-07-17",
      "error.nec541-e41d.com": "2022-07-17",
      "error.net081f24jm.com": "2022-07-17",
      "error.new1f25ki2e.com": "2022-07-17",
      "error.nin24-412wa.com": "2022-07-17",
      "error.oim58hg2-sd.com": "2022-07-17",
      "error.on0555-keiba.com": "2022-07-17",
      "error.one04f2e4zy.com": "2022-07-17",
      "error.one63-8ui1d.com": "2022-07-17",
      "error.op-37repo39g.com": "2022-07-17",
      "error.op-42repo74g.com": "2022-07-17",
      "error.open21g.com": "2022-07-17",
      "error.pay518vsa0e.com": "2022-07-17",
      "error.pin023r-d1e.com": "2022-07-17",
      "error.pin520-uq6l.com": "2022-07-17",
      "error.pol35sby00ri.com": "2022-07-17",
      "error.pr204h7wall2.com": "2022-07-17",
      "error.pr732d1walk9.com": "2022-07-17",
      "error.qng9-dan21r.com": "2022-07-17",
      "error.quen58-po6w.com": "2022-07-17",
      "error.ren-0820-nanami.com": "2022-07-17",
      "error.rep-keibaboat20.com": "2022-07-17",
      "error.rep-keibaboat21.com": "2022-07-17",
      "error.report-deep-8857.com": "2022-07-17",
      "error.report-donna-1436.com": "2022-07-17",
      "error.report-fantastic-1996.com": "2022-07-17",
      "error.report-hearts-1096.com": "2022-07-17",
      "error.report-hearts-6170.com": "2022-07-17",
      "error.report-orfevre-5721.com": "2022-07-17",
      "error.report-ship-2012.com": "2022-07-17",
      "error.report-silence-7463.com": "2022-07-17",
      "error.report-vodka-8537.com": "2022-07-17",
      "error.ring-2341rd.com": "2022-07-17",
      "error.ring-888-uma.com": "2022-07-17",
      "error.ripo10make28.com": "2022-07-17",
      "error.ripo39fake47.com": "2022-07-17",
      "error.ripo52ball21.com": "2022-07-17",
      "error.ripo73talk95.com": "2022-07-17",
      "error.sou17-0taik2.com": "2022-07-17",
      "error.sou95-7taik6.com": "2022-07-17",
      "error.tap397.com": "2022-07-17",
      "error.ten043-ol5e.com": "2022-07-17",
      "error.ten047fsp9r.com": "2022-07-17",
      "error.ten0722-report.com": "2022-07-17",
      "error.th580621-uma.com": "2022-07-17",
      "error.tk15rep02mn.com": "2022-07-17",
      "error.uno073-g2pq.com": "2022-07-17",
      "error.vine57-s41l.com": "2022-07-17",
      "error.way89king01c.com": "2022-07-17",
      "error.wone61-s1ea.com": "2022-07-17",
      "error.xik054-junb.com": "2022-07-17",
      "error.xyz581dfa9po.com": "2022-07-17",
      "error.xyz62-pih6e.com": "2022-07-17",
      "error.yan052-r04t.com": "2022-07-17",
      "error.yen04-yj12w.com": "2022-07-17",
      "error.zexi7-lof2q.com": "2022-07-17",
      "extra49908.com": "2022-07-17",
      "face-hip.com": "2022-07-17",
      "fal05-06bing.com": "2022-07-17",
      "fan58-633rs.com": "2022-07-17",
      "favorite-mycosme.com": "2022-07-17",
      "fax021-eriq.com": "2022-07-17",
      "fax58-ikeyui.com": "2022-07-17",
      "fen14-25rol.com": "2022-07-17",
      "feqldn.tokyo": "2022-07-17",
      "fin04iu69wq.com": "2022-07-17",
      "fine-mo54wu.com": "2022-07-17",
      "fr-bxe-p6pe-cri.com": "2022-07-17",
      "fxpyfm.tokyo": "2022-07-17",
      "g0c-3w.net": "2022-07-17",
      "g8bp6ieju.com": "2022-07-17",
      "gam05-85t2w.com": "2022-07-17",
      "gan027-uyi7.com": "2022-07-17",
      "gan04r7es4b.com": "2022-07-17",
      "gan85-96ken0.com": "2022-07-17",
      "gang9-1r1dw.com": "2022-07-17",
      "get814sf1qz.com": "2022-07-17",
      "gg310-jmnw4a.com": "2022-07-17",
      "giehxn.tokyo": "2022-07-17",
      "gine08-aw1a.com": "2022-07-17",
      "gp01-83-jind.com": "2022-07-17",
      "gu24dyen61v.com": "2022-07-17",
      "ha7d1e-e12x.com": "2022-07-17",
      "hako-ren-sys.com": "2022-07-17",
      "han08-65ion8.com": "2022-07-17",
      "hanji1975-report.com": "2022-07-17",
      "hanoi.dalat.dulichovietnam.net": "2022-07-17",
      "harry-25.com": "2022-07-17",
      "hbudhzjx.space": "2022-07-17",
      "hei032-4r4f.com": "2022-07-17",
      "hell999-d05q.com": "2022-07-17",
      "helpful37987.com": "2022-07-17",
      "hide25-64koi.com": "2022-07-17",
      "hihjic.tokyo": "2022-07-17",
      "hikaku-gps.com": "2022-07-17",
      "hit84-62pim.com": "2022-07-17",
      "hkzgqt.tokyo": "2022-07-17",
      "htugcxmq.com": "2022-07-17",
      "hug48f4-rsd.com": "2022-07-17",
      "hv-1d5f10ad.com": "2022-07-17",
      "hwaax47yi.com": "2022-07-17",
      "ico65-e41dy.com": "2022-07-17",
      "ieprqoepirhjpqwijghoph.com": "2022-07-17",
      "igyhucqe.com": "2022-07-17",
      "ije-bwp5b.com": "2022-07-17",
      "in-45to24eav.com": "2022-07-17",
      "inc12r-slr56q.com": "2022-07-17",
      "io87-dex41e4.com": "2022-07-17",
      "ion062-41jne.com": "2022-07-17",
      "iop045-jfh7.com": "2022-07-17",
      "j7bu-s8tnk.com": "2022-07-17",
      "jascqr.tokyo": "2022-07-17",
      "jctymc.com": "2022-07-17",
      "jen98-265jin.com": "2022-07-17",
      "jet02-59udc.com": "2022-07-17",
      "jin42e-arai5.com": "2022-07-17",
      "jin77-0432rw.com": "2022-07-17",
      "jin98-lme5a.com": "2022-07-17",
      "jmqchk.tokyo": "2022-07-17",
      "js-net.tokyo": "2022-07-17",
      "jszpjq.tokyo": "2022-07-17",
      "judo-88-zzgu.com": "2022-07-17",
      "jun126japan4.com": "2022-07-17",
      "jun565.com": "2022-07-17",
      "jun98-rep-boat.com": "2022-07-17",
      "kaiketsu-250-md.com": "2022-07-17",
      "keiba-report.com": "2022-07-17",
      "keiba-report.jp": "2022-07-17",
      "keibareport.jp": "2022-07-17",
      "ken0438-g2jl.com": "2022-07-17",
      "ken094l-14w.com": "2022-07-17",
      "ken24-32yui.com": "2022-07-17",
      "kenji0903-boat.com": "2022-07-17",
      "key00nine7y.com": "2022-07-17",
      "key61sea03r.com": "2022-07-17",
      "key73plo54s.com": "2022-07-17",
      "key82ygo20w.com": "2022-07-17",
      "kid158-kids7.com": "2022-07-17",
      "kif25vna1ed.com": "2022-07-17",
      "kin025-uma-boat.com": "2022-07-17",
      "kin87-04rs3.com": "2022-07-17",
      "king42e-w4a1c.com": "2022-07-17",
      "kmv50-fs2eo.com": "2022-07-17",
      "knee39d.com": "2022-07-17",
      "koz-fo96m.com": "2022-07-17",
      "lan57j-fd4s.com": "2022-07-17",
      "let15-d12t1d.com": "2022-07-17",
      "let90-52len.com": "2022-07-17",
      "lex08-5light.com": "2022-07-17",
      "link053pin1e.com": "2022-07-17",
      "linx510-04rh.com": "2022-07-17",
      "lip03up645e.com": "2022-07-17",
      "list.bodologetee.com": "2022-07-17",
      "lmzayw.tokyo": "2022-07-17",
      "look01-d84w.com": "2022-07-17",
      "loop1-54hiu.com": "2022-07-17",
      "low05d14jsa.com": "2022-07-17",
      "lsbuidm.com": "2022-07-17",
      "lwueft.tokyo": "2022-07-17",
      "lzbzfd.tokyo": "2022-07-17",
      "mail.keiba-report.com": "2022-07-17",
      "mail.repo-bo-ke7.com": "2022-07-17",
      "mail.report-uma-boat.com": "2022-07-17",
      "matirsy.com": "2022-07-17",
      "may05-11pro.com": "2022-07-17",
      "meet7-55kin.com": "2022-07-17",
      "men17f5h1sa.com": "2022-07-17",
      "microsoft-update10v.amazonaws1.info": "2022-07-17",
      "min2r-2ray2d.com": "2022-07-17",
      "min40-3r4aq.com": "2022-07-17",
      "min54-teru51s.com": "2022-07-17",
      "mint98-825su.com": "2022-07-17",
      "mix-opr51f7p.com": "2022-07-17",
      "mix04-97rei.com": "2022-07-17",
      "mix55-77ten0.com": "2022-07-17",
      "mizuki2223-report.com": "2022-07-17",
      "mnc-15r3sdf.com": "2022-07-17",
      "mon98-12rui.com": "2022-07-17",
      "mszihe.tokyo": "2022-07-17",
      "mvp970a-e2a.com": "2022-07-17",
      "mwsda69e5.space": "2022-07-17",
      "n04dvf-sd1r.com": "2022-07-17",
      "n2-jhz-zq.net": "2022-07-17",
      "na7rei-0san3.com": "2022-07-17",
      "nec541-e41d.com": "2022-07-17",
      "net081f24jm.com": "2022-07-17",
      "new1f25ki2e.com": "2022-07-17",
      "nex047-in3e.com": "2022-07-17",
      "ni2r0-izu2a.com": "2022-07-17",
      "nic205e-s7w.com": "2022-07-17",
      "nin24-412wa.com": "2022-07-17",
      "nin58-7uy6s.com": "2022-07-17",
      "nix04-ioke0w.com": "2022-07-17",
      "ns1.0ffice36o.com": "2022-07-17",
      "ns2.0ffice36o.com": "2022-07-17",
      "ns8-02dr9.com": "2022-07-17",
      "nude00-99poi.com": "2022-07-17",
      "oftpjrdv.com": "2022-07-17",
      "og-hgh-gx0.net": "2022-07-17",
      "oihpyq.tokyo": "2022-07-17",
      "oim58hg2-sd.com": "2022-07-17",
      "ojrxef.tokyo": "2022-07-17",
      "on0555-keiba.com": "2022-07-17",
      "ond04-632hit.com": "2022-07-17",
      "one04f2e4zy.com": "2022-07-17",
      "one63-8ui1d.com": "2022-07-17",
      "oo78-rx78gun.com": "2022-07-17",
      "op-07repo63g.com": "2022-07-17",
      "op-15repo02g.com": "2022-07-17",
      "op-37repo39g.com": "2022-07-17",
      "op-42repo74g.com": "2022-07-17",
      "op28-land7ae.com": "2022-07-17",
      "open21g.com": "2022-07-17",
      "opposemuffin.email": "2022-07-17",
      "oqyfxl.tokyo": "2022-07-17",
      "p-ur1-2z.net": "2022-07-17",
      "pan478rdt1s.com": "2022-07-17",
      "parent35991.tokyo": "2022-07-17",
      "pay518vsa0e.com": "2022-07-17",
      "pd3-4q21a.com": "2022-07-17",
      "pfwjjs.tokyo": "2022-07-17",
      "picsec.tokyo": "2022-07-17",
      "pim109-s2r4.com": "2022-07-17",
      "pin023r-d1e.com": "2022-07-17",
      "pin059-pet12.com": "2022-07-17",
      "pin520-uq6l.com": "2022-07-17",
      "pink79-plq4r.com": "2022-07-17",
      "pistolmarshal.com": "2022-07-17",
      "pocket-80are.com": "2022-07-17",
      "point56-s42.com": "2022-07-17",
      "pol35sby00ri.com": "2022-07-17",
      "portstake.com": "2022-07-17",
      "pr204h7wall2.com": "2022-07-17",
      "pr732d1walk9.com": "2022-07-17",
      "purposes10859.tokyo": "2022-07-17",
      "pwdgkmaohakaiunpaokndsjgiuqh.com": "2022-07-17",
      "qa5f1r1ws-ir.com": "2022-07-17",
      "qan05-ion70.com": "2022-07-17",
      "qehf15fr-f0w.com": "2022-07-17",
      "qng9-dan21r.com": "2022-07-17",
      "qsjdfopiahfptjaprjypqh.com": "2022-07-17",
      "quen58-po6w.com": "2022-07-17",
      "quiz03-875in.com": "2022-07-17",
      "quiz59dyu-4gr.com": "2022-07-17",
      "qutonium.com": "2022-07-17",
      "qvzhyv.tokyo": "2022-07-17",
      "qw25-hill37s.com": "2022-07-17",
      "qxvwrsn.tokyo": "2022-07-17",
      "r3udxa-b26e.xyz": "2022-07-17",
      "r56w7-r24iq.xyz": "2022-07-17",
      "rae8od.xyz": "2022-07-17",
      "rap95-uc1-gu.com": "2022-07-17",
      "rate-system.com": "2022-07-17",
      "rei03-kin14w.com": "2022-07-17",
      "rei42-9getlu.com": "2022-07-17",
      "reid1r-b45e.com": "2022-07-17",
      "ren-0820-nanami.com": "2022-07-17",
      "rep28pin62q.com": "2022-07-17",
      "repo-bo-ke7.com": "2022-07-17",
      "report-deep-8857.com": "2022-07-17",
      "report-donna-1436.com": "2022-07-17",
      "report-fantastic-1996.com": "2022-07-17",
      "report-gold-1997.com": "2022-07-17",
      "report-groove-5739.com": "2022-07-17",
      "report-hearts-1096.com": "2022-07-17",
      "report-hearts-6170.com": "2022-07-17",
      "report-lord-4126.com": "2022-07-17",
      "report-northern-0219.com": "2022-07-17",
      "report-orfevre-5721.com": "2022-07-17",
      "report-ship-2012.com": "2022-07-17",
      "report-silence-7463.com": "2022-07-17",
      "report-silk-9247.com": "2022-07-17",
      "report-uma-boat.com": "2022-07-17",
      "report-vega-0907.com": "2022-07-17",
      "report-vodka-8537.com": "2022-07-17",
      "report84yen.com": "2022-07-17",
      "report98han.com": "2022-07-17",
      "rewuiren.com": "2022-07-17",
      "rine4-52arq.com": "2022-07-17",
      "ring-2341rd.com": "2022-07-17",
      "ring-888-uma.com": "2022-07-17",
      "ripo10make28.com": "2022-07-17",
      "ripo39fake47.com": "2022-07-17",
      "ripo52ball21.com": "2022-07-17",
      "ripo73talk95.com": "2022-07-17",
      "rit521-f4rs.com": "2022-07-17",
      "rmsayxh.tokyo": "2022-07-17",
      "rui94-23s1f.com": "2022-07-17",
      "rwd52-d14g1w.com": "2022-07-17",
      "ryiunuh.com": "2022-07-17",
      "s10jr-h4yopa.com": "2022-07-17",
      "sain007-sd1.com": "2022-07-17",
      "san-1r24eday.com": "2022-07-17",
      "sen98-r41ew.com": "2022-07-17",
      "sgngnshdf1nbd.com": "2022-07-17",
      "si4-2ico0wa.com": "2022-07-17",
      "sin685-min4e.com": "2022-07-17",
      "six666-45en.com": "2022-07-17",
      "sky258-d4ts1.com": "2022-07-17",
      "slmcda.tokyo": "2022-07-17",
      "sou17-0taik2.com": "2022-07-17",
      "sou95-7taik6.com": "2022-07-17",
      "springstriker.com": "2022-07-17",
      "spyy2xbxj5s8fhr.xyz": "2022-07-17",
      "ssnftc.tokyo": "2022-07-17",
      "stop04-o6eg.com": "2022-07-17",
      "support.gdrvcheck.co": "2022-07-17",
      "swcgztsjyy.com": "2022-07-17",
      "tap397.com": "2022-07-17",
      "tel085-652ck.com": "2022-07-17",
      "tel25-plq1h.com": "2022-07-17",
      "tel78-0dt4a.com": "2022-07-17",
      "ten043-ol5e.com": "2022-07-17",
      "ten047fsp9r.com": "2022-07-17",
      "ten0722-report.com": "2022-07-17",
      "ten10-min4ws.com": "2022-07-17",
      "ten10-one1aa.com": "2022-07-17",
      "ten52-d584t.com": "2022-07-17",
      "teru777-boat.com": "2022-07-17",
      "th580621-uma.com": "2022-07-17",
      "thpflk.tokyo": "2022-07-17",
      "tk15rep02mn.com": "2022-07-17",
      "tk37repo-kk.com": "2022-07-17",
      "trading16694.com": "2022-07-17",
      "ts-47-r9-rgy-m6rzi.com": "2022-07-17",
      "tsnjrm.tokyo": "2022-07-17",
      "tu-2-i.net": "2022-07-17",
      "twjvnekr.com": "2022-07-17",
      "uc120-gunf91.com": "2022-07-17",
      "ugrbnfhj.com": "2022-07-17",
      "uk.imonju.net": "2022-07-17",
      "uma-kouta0624.com": "2022-07-17",
      "und05-rep79u.com": "2022-07-17",
      "uno073-g2pq.com": "2022-07-17",
      "uorloy.tokyo": "2022-07-17",
      "uq005-15eg5o.com": "2022-07-17",
      "uq25-d4r3eg.com": "2022-07-17",
      "us-cpqr0w.com": "2022-07-17",
      "us.imonju.net": "2022-07-17",
      "vai58-9lan0r.com": "2022-07-17",
      "vamsfogokusendnaoserjhgaosdfvh.com": "2022-07-17",
      "van29-fe4ac.com": "2022-07-17",
      "van51e.com": "2022-07-17",
      "vfjupg.tokyo": "2022-07-17",
      "vin20-d1r7aq.com": "2022-07-17",
      "vine57-s41l.com": "2022-07-17",
      "vio521-f4wes.com": "2022-07-17",
      "vix98-74ope.com": "2022-07-17",
      "vmt8bmkxj4dpd.life": "2022-07-17",
      "voidplask.com": "2022-07-17",
      "vpn065-yu4w.com": "2022-07-17",
      "vyen58c386kg1.life": "2022-07-17",
      "w5fg1-mweplq.com": "2022-07-17",
      "wa28t-yell7u.com": "2022-07-17",
      "walk36p-w8a.com": "2022-07-17",
      "wang10-po5r.com": "2022-07-17",
      "wang58d-r4s.com": "2022-07-17",
      "way89king01c.com": "2022-07-17",
      "web.adobephotostage.com": "2021-01-27",
      "wg7q-utyfp.biz": "2022-07-17",
      "winserverform.com": "2022-07-17",
      "wolaoy.tokyo": "2022-07-17",
      "wone61-s1ea.com": "2022-07-17",
      "x58-nmrte25s.com": "2022-07-17",
      "xen41-6day0e.com": "2022-07-17",
      "xik054-junb.com": "2022-07-17",
      "xin04f-re5s.com": "2022-07-17",
      "xqkyegvb.com": "2022-07-17",
      "xukmmx.tokyo": "2022-07-17",
      "xyz581dfa9po.com": "2022-07-17",
      "xyz62-pih6e.com": "2022-07-17",
      "y-sx1-dl.net": "2022-07-17",
      "yan052-r04t.com": "2022-07-17",
      "yell-11ey01o.com": "2022-07-17",
      "yen04-yj12w.com": "2022-07-17",
      "yen05-04s1rq.com": "2022-07-17",
      "yen87-opkid.com": "2022-07-17",
      "yourls.kari-domain.com": "2022-07-17",
      "z777-rend0y.com": "2022-07-17",
      "z87-kami08po.com": "2022-07-17",
      "zdf5f2r-ir8l.com": "2022-07-17",
      "zen29-have5s.com": "2022-07-17",
      "zen41-65yus.com": "2022-07-17",
      "zet92-63r4s.com": "2022-07-17",
      "zexi21f-gt5h.com": "2022-07-17",
      "zexi7-lof2q.com": "2022-07-17",
      "zzon185-4sd.com": "2022-07-17"
    }
  },
  "first_seen_precision": {
    "domain": {}
  },
  "first_seen_range": {
    "earliest": "2018-12-11",
    "latest": "2022-07-17"
  },
  "generated_at": "2026-08-08T03:26:30+00:00",
  "indicators": {
    "domain": [
      "0ffice36o.com",
      "18-79-t.net",
      "1qhd6v.xyz",
      "4f-okdsvv.com",
      "5-9idk-gug7-k7.com",
      "52-ck29jr.com",
      "5z-hyq-g.net",
      "78p3-zgs-g-mc-u.com",
      "8f-mxh6-hupgd-dy.com",
      "8faf-rngtax.com",
      "a87-sun0r1w.com",
      "ac5e1f-fd2ph.com",
      "acyjob.tokyo",
      "adchum.tokyo",
      "adzwrq.tokyo",
      "akgxtu.tokyo",
      "aletko.tokyo",
      "am41-pm24ea.com",
      "amb29l1v3re.com",
      "ami10t-e37n.com",
      "an87-24pen1d.com",
      "and58-65kio.com",
      "apply33547.com",
      "ar5-chj-n-22d.com",
      "as93-attack1.com",
      "aso5fr-gre4.com",
      "au.imonju.net",
      "b5mjjc8s.com",
      "baebod.tokyo",
      "ban09-4w1as.com",
      "batdongsan.dcsvnqvmn.com",
      "baw2u-y6rsxf.com",
      "bed52-town1.com",
      "big429-7ten.com",
      "bing0017-s4e.com",
      "bing04-5ea1.com",
      "bm-8qkc8w.com",
      "bnv521-send4.com",
      "boat-19830214yh.com",
      "boceuz.tokyo",
      "boundhereafter.com",
      "bpugoc.tokyo",
      "bqufsuqj.com",
      "buffdrops.com",
      "bvnc5418-4s.com",
      "c02bf1r-kjre.com",
      "c7ykg-0sd5w.com",
      "cd-7rr-hgj.net",
      "cg58-6dr4wa.com",
      "chai58-mnew.com",
      "check.onedrvdn.co",
      "chi12-63in7m.com",
      "cm.appupdatemoremagic.com",
      "cont24-57hin.com",
      "crimeprocession.com",
      "crtfugrl.com",
      "cxevgfdy.com",
      "d-wl-kk.net",
      "d56gr-n2syp.xyz",
      "dalat.dalat.dulichovietnam.net",
      "dalat.dulichovietnam.net",
      "dan02-opl1h.com",
      "dan07oe0ch2f.com",
      "dan104.com",
      "dan32-ty65d.com",
      "dbfrqm.tokyo",
      "deliver-avenir.com",
      "den-85gh40ik.com",
      "developermisguided.email",
      "devzxm.tokyo",
      "dgywxfhuuy.com",
      "dhs4oms-plas.com",
      "dice-71ieoq.com",
      "dick06-a4e6o.com",
      "displayexploitation.com",
      "download.showprice.xyz",
      "dsykub.tokyo",
      "dwwkvf.tokyo",
      "e9dzrisph.com",
      "eden52-74ea.com",
      "edjkpz.tokyo",
      "edli501d-eaq.com",
      "eec-channel.com",
      "elcend.tokyo",
      "ell90-deep1w.com",
      "end09-r6s3x.com",
      "end87q.com",
      "eri05-63h4w.com",
      "eri25-d044g.com",
      "error.a87-sun0r1w.com",
      "error.amb29l1v3re.com",
      "error.bing0017-s4e.com",
      "error.boat-19830214yh.com",
      "error.chai58-mnew.com",
      "error.dan07oe0ch2f.com",
      "error.dan104.com",
      "error.dice-71ieoq.com",
      "error.eden52-74ea.com",
      "error.end87q.com",
      "error.get814sf1qz.com",
      "error.gine08-aw1a.com",
      "error.gp01-83-jind.com",
      "error.gu24dyen61v.com",
      "error.hanji1975-report.com",
      "error.hei032-4r4f.com",
      "error.hv-1d5f10ad.com",
      "error.ico65-e41dy.com",
      "error.iop045-jfh7.com",
      "error.jet02-59udc.com",
      "error.jin98-lme5a.com",
      "error.jun126japan4.com",
      "error.jun565.com",
      "error.jun98-rep-boat.com",
      "error.kaiketsu-250-md.com",
      "error.ken094l-14w.com",
      "error.kenji0903-boat.com",
      "error.key00nine7y.com",
      "error.key61sea03r.com",
      "error.key73plo54s.com",
      "error.key82ygo20w.com",
      "error.kif25vna1ed.com",
      "error.kin025-uma-boat.com",
      "error.kmv50-fs2eo.com",
      "error.knee39d.com",
      "error.lan57j-fd4s.com",
      "error.link053pin1e.com",
      "error.look01-d84w.com",
      "error.low05d14jsa.com",
      "error.may05-11pro.com",
      "error.men17f5h1sa.com",
      "error.mizuki2223-report.com",
      "error.mvp970a-e2a.com",
      "error.n04dvf-sd1r.com",
      "error.nec541-e41d.com",
      "error.net081f24jm.com",
      "error.new1f25ki2e.com",
      "error.nin24-412wa.com",
      "error.oim58hg2-sd.com",
      "error.on0555-keiba.com",
      "error.one04f2e4zy.com",
      "error.one63-8ui1d.com",
      "error.op-37repo39g.com",
      "error.op-42repo74g.com",
      "error.open21g.com",
      "error.pay518vsa0e.com",
      "error.pin023r-d1e.com",
      "error.pin520-uq6l.com",
      "error.pol35sby00ri.com",
      "error.pr204h7wall2.com",
      "error.pr732d1walk9.com",
      "error.qng9-dan21r.com",
      "error.quen58-po6w.com",
      "error.ren-0820-nanami.com",
      "error.rep-keibaboat20.com",
      "error.rep-keibaboat21.com",
      "error.report-deep-8857.com",
      "error.report-donna-1436.com",
      "error.report-fantastic-1996.com",
      "error.report-hearts-1096.com",
      "error.report-hearts-6170.com",
      "error.report-orfevre-5721.com",
      "error.report-ship-2012.com",
      "error.report-silence-7463.com",
      "error.report-vodka-8537.com",
      "error.ring-2341rd.com",
      "error.ring-888-uma.com",
      "error.ripo10make28.com",
      "error.ripo39fake47.com",
      "error.ripo52ball21.com",
      "error.ripo73talk95.com",
      "error.sou17-0taik2.com",
      "error.sou95-7taik6.com",
      "error.tap397.com",
      "error.ten043-ol5e.com",
      "error.ten047fsp9r.com",
      "error.ten0722-report.com",
      "error.th580621-uma.com",
      "error.tk15rep02mn.com",
      "error.uno073-g2pq.com",
      "error.vine57-s41l.com",
      "error.way89king01c.com",
      "error.wone61-s1ea.com",
      "error.xik054-junb.com",
      "error.xyz581dfa9po.com",
      "error.xyz62-pih6e.com",
      "error.yan052-r04t.com",
      "error.yen04-yj12w.com",
      "error.zexi7-lof2q.com",
      "extra49908.com",
      "face-hip.com",
      "fal05-06bing.com",
      "fan58-633rs.com",
      "favorite-mycosme.com",
      "fax021-eriq.com",
      "fax58-ikeyui.com",
      "fen14-25rol.com",
      "feqldn.tokyo",
      "fin04iu69wq.com",
      "fine-mo54wu.com",
      "fr-bxe-p6pe-cri.com",
      "fxpyfm.tokyo",
      "g0c-3w.net",
      "g8bp6ieju.com",
      "gam05-85t2w.com",
      "gan027-uyi7.com",
      "gan04r7es4b.com",
      "gan85-96ken0.com",
      "gang9-1r1dw.com",
      "get814sf1qz.com",
      "gg310-jmnw4a.com",
      "giehxn.tokyo",
      "gine08-aw1a.com",
      "gp01-83-jind.com",
      "gu24dyen61v.com",
      "ha7d1e-e12x.com",
      "hako-ren-sys.com",
      "han08-65ion8.com",
      "hanji1975-report.com",
      "hanoi.dalat.dulichovietnam.net",
      "harry-25.com",
      "hbudhzjx.space",
      "hei032-4r4f.com",
      "hell999-d05q.com",
      "helpful37987.com",
      "hide25-64koi.com",
      "hihjic.tokyo",
      "hikaku-gps.com",
      "hit84-62pim.com",
      "hkzgqt.tokyo",
      "htugcxmq.com",
      "hug48f4-rsd.com",
      "hv-1d5f10ad.com",
      "hwaax47yi.com",
      "ico65-e41dy.com",
      "ieprqoepirhjpqwijghoph.com",
      "igyhucqe.com",
      "ije-bwp5b.com",
      "in-45to24eav.com",
      "inc12r-slr56q.com",
      "io87-dex41e4.com",
      "ion062-41jne.com",
      "iop045-jfh7.com",
      "j7bu-s8tnk.com",
      "jascqr.tokyo",
      "jctymc.com",
      "jen98-265jin.com",
      "jet02-59udc.com",
      "jin42e-arai5.com",
      "jin77-0432rw.com",
      "jin98-lme5a.com",
      "jmqchk.tokyo",
      "js-net.tokyo",
      "jszpjq.tokyo",
      "judo-88-zzgu.com",
      "jun126japan4.com",
      "jun565.com",
      "jun98-rep-boat.com",
      "kaiketsu-250-md.com",
      "keiba-report.com",
      "keiba-report.jp",
      "keibareport.jp",
      "ken0438-g2jl.com",
      "ken094l-14w.com",
      "ken24-32yui.com",
      "kenji0903-boat.com",
      "key00nine7y.com",
      "key61sea03r.com",
      "key73plo54s.com",
      "key82ygo20w.com",
      "kid158-kids7.com",
      "kif25vna1ed.com",
      "kin025-uma-boat.com",
      "kin87-04rs3.com",
      "king42e-w4a1c.com",
      "kmv50-fs2eo.com",
      "knee39d.com",
      "koz-fo96m.com",
      "lan57j-fd4s.com",
      "let15-d12t1d.com",
      "let90-52len.com",
      "lex08-5light.com",
      "link053pin1e.com",
      "linx510-04rh.com",
      "lip03up645e.com",
      "list.bodologetee.com",
      "lmzayw.tokyo",
      "look01-d84w.com",
      "loop1-54hiu.com",
      "low05d14jsa.com",
      "lsbuidm.com",
      "lwueft.tokyo",
      "lzbzfd.tokyo",
      "mail.keiba-report.com",
      "mail.repo-bo-ke7.com",
      "mail.report-uma-boat.com",
      "matirsy.com",
      "may05-11pro.com",
      "meet7-55kin.com",
      "men17f5h1sa.com",
      "microsoft-update10v.amazonaws1.info",
      "min2r-2ray2d.com",
      "min40-3r4aq.com",
      "min54-teru51s.com",
      "mint98-825su.com",
      "mix-opr51f7p.com",
      "mix04-97rei.com",
      "mix55-77ten0.com",
      "mizuki2223-report.com",
      "mnc-15r3sdf.com",
      "mon98-12rui.com",
      "mszihe.tokyo",
      "mvp970a-e2a.com",
      "mwsda69e5.space",
      "n04dvf-sd1r.com",
      "n2-jhz-zq.net",
      "na7rei-0san3.com",
      "nec541-e41d.com",
      "net081f24jm.com",
      "new1f25ki2e.com",
      "nex047-in3e.com",
      "ni2r0-izu2a.com",
      "nic205e-s7w.com",
      "nin24-412wa.com",
      "nin58-7uy6s.com",
      "nix04-ioke0w.com",
      "ns1.0ffice36o.com",
      "ns2.0ffice36o.com",
      "ns8-02dr9.com",
      "nude00-99poi.com",
      "oftpjrdv.com",
      "og-hgh-gx0.net",
      "oihpyq.tokyo",
      "oim58hg2-sd.com",
      "ojrxef.tokyo",
      "on0555-keiba.com",
      "ond04-632hit.com",
      "one04f2e4zy.com",
      "one63-8ui1d.com",
      "oo78-rx78gun.com",
      "op-07repo63g.com",
      "op-15repo02g.com",
      "op-37repo39g.com",
      "op-42repo74g.com",
      "op28-land7ae.com",
      "open21g.com",
      "opposemuffin.email",
      "oqyfxl.tokyo",
      "p-ur1-2z.net",
      "pan478rdt1s.com",
      "parent35991.tokyo",
      "pay518vsa0e.com",
      "pd3-4q21a.com",
      "pfwjjs.tokyo",
      "picsec.tokyo",
      "pim109-s2r4.com",
      "pin023r-d1e.com",
      "pin059-pet12.com",
      "pin520-uq6l.com",
      "pink79-plq4r.com",
      "pistolmarshal.com",
      "pocket-80are.com",
      "point56-s42.com",
      "pol35sby00ri.com",
      "portstake.com",
      "pr204h7wall2.com",
      "pr732d1walk9.com",
      "purposes10859.tokyo",
      "pwdgkmaohakaiunpaokndsjgiuqh.com",
      "qa5f1r1ws-ir.com",
      "qan05-ion70.com",
      "qehf15fr-f0w.com",
      "qng9-dan21r.com",
      "qsjdfopiahfptjaprjypqh.com",
      "quen58-po6w.com",
      "quiz03-875in.com",
      "quiz59dyu-4gr.com",
      "qutonium.com",
      "qvzhyv.tokyo",
      "qw25-hill37s.com",
      "qxvwrsn.tokyo",
      "r3udxa-b26e.xyz",
      "r56w7-r24iq.xyz",
      "rae8od.xyz",
      "rap95-uc1-gu.com",
      "rate-system.com",
      "rei03-kin14w.com",
      "rei42-9getlu.com",
      "reid1r-b45e.com",
      "ren-0820-nanami.com",
      "rep28pin62q.com",
      "repo-bo-ke7.com",
      "report-deep-8857.com",
      "report-donna-1436.com",
      "report-fantastic-1996.com",
      "report-gold-1997.com",
      "report-groove-5739.com",
      "report-hearts-1096.com",
      "report-hearts-6170.com",
      "report-lord-4126.com",
      "report-northern-0219.com",
      "report-orfevre-5721.com",
      "report-ship-2012.com",
      "report-silence-7463.com",
      "report-silk-9247.com",
      "report-uma-boat.com",
      "report-vega-0907.com",
      "report-vodka-8537.com",
      "report84yen.com",
      "report98han.com",
      "rewuiren.com",
      "rine4-52arq.com",
      "ring-2341rd.com",
      "ring-888-uma.com",
      "ripo10make28.com",
      "ripo39fake47.com",
      "ripo52ball21.com",
      "ripo73talk95.com",
      "rit521-f4rs.com",
      "rmsayxh.tokyo",
      "rui94-23s1f.com",
      "rwd52-d14g1w.com",
      "ryiunuh.com",
      "s10jr-h4yopa.com",
      "sain007-sd1.com",
      "san-1r24eday.com",
      "sen98-r41ew.com",
      "sgngnshdf1nbd.com",
      "si4-2ico0wa.com",
      "sin685-min4e.com",
      "six666-45en.com",
      "sky258-d4ts1.com",
      "slmcda.tokyo",
      "sou17-0taik2.com",
      "sou95-7taik6.com",
      "springstriker.com",
      "spyy2xbxj5s8fhr.xyz",
      "ssnftc.tokyo",
      "stop04-o6eg.com",
      "support.gdrvcheck.co",
      "swcgztsjyy.com",
      "tap397.com",
      "tel085-652ck.com",
      "tel25-plq1h.com",
      "tel78-0dt4a.com",
      "ten043-ol5e.com",
      "ten047fsp9r.com",
      "ten0722-report.com",
      "ten10-min4ws.com",
      "ten10-one1aa.com",
      "ten52-d584t.com",
      "teru777-boat.com",
      "th580621-uma.com",
      "thpflk.tokyo",
      "tk15rep02mn.com",
      "tk37repo-kk.com",
      "trading16694.com",
      "ts-47-r9-rgy-m6rzi.com",
      "tsnjrm.tokyo",
      "tu-2-i.net",
      "twjvnekr.com",
      "uc120-gunf91.com",
      "ugrbnfhj.com",
      "uk.imonju.net",
      "uma-kouta0624.com",
      "und05-rep79u.com",
      "uno073-g2pq.com",
      "uorloy.tokyo",
      "uq005-15eg5o.com",
      "uq25-d4r3eg.com",
      "us-cpqr0w.com",
      "us.imonju.net",
      "vai58-9lan0r.com",
      "vamsfogokusendnaoserjhgaosdfvh.com",
      "van29-fe4ac.com",
      "van51e.com",
      "vfjupg.tokyo",
      "vin20-d1r7aq.com",
      "vine57-s41l.com",
      "vio521-f4wes.com",
      "vix98-74ope.com",
      "vmt8bmkxj4dpd.life",
      "voidplask.com",
      "vpn065-yu4w.com",
      "vyen58c386kg1.life",
      "w5fg1-mweplq.com",
      "wa28t-yell7u.com",
      "walk36p-w8a.com",
      "wang10-po5r.com",
      "wang58d-r4s.com",
      "way89king01c.com",
      "web.adobephotostage.com",
      "wg7q-utyfp.biz",
      "winserverform.com",
      "wolaoy.tokyo",
      "wone61-s1ea.com",
      "x58-nmrte25s.com",
      "xen41-6day0e.com",
      "xik054-junb.com",
      "xin04f-re5s.com",
      "xqkyegvb.com",
      "xukmmx.tokyo",
      "xyz581dfa9po.com",
      "xyz62-pih6e.com",
      "y-sx1-dl.net",
      "yan052-r04t.com",
      "yell-11ey01o.com",
      "yen04-yj12w.com",
      "yen05-04s1rq.com",
      "yen87-opkid.com",
      "yourls.kari-domain.com",
      "z777-rend0y.com",
      "z87-kami08po.com",
      "zdf5f2r-ir8l.com",
      "zen29-have5s.com",
      "zen41-65yus.com",
      "zet92-63r4s.com",
      "zexi21f-gt5h.com",
      "zexi7-lof2q.com",
      "zzon185-4sd.com"
    ]
  },
  "last_modified": "2026-01-02T23:10:15+00:00",
  "maltrail_groups": [
    "DNSPIONAGE"
  ],
  "references": [
    "https://blog.talosintelligence.com/2018/11/dnspionage-campaign-targets-middle-east.html",
    "https://github.com/ti-research-io/ti/blob/main/ioc_extender/ET_DNS_Query_for_DNSpionage.json",
    "https://www.virustotal.com/gui/ip-address/74.63.204.32/relations",
    "https://www.virustotal.com/gui/ip-address/74.63.204.99/relations"
  ],
  "related": [
    {
      "evidence": [
        {
          "detail": "1 shared indicator",
          "kind": "infrastructure",
          "weight": 1.0
        }
      ],
      "slug": "G0087"
    }
  ],
  "slug": "DNSPIONAGE",
  "timeline": [
    {
      "counts": {
        "domain": 517
      },
      "first_seen": "2022-07-17",
      "indicators": {
        "domain": [
          "18-79-t.net",
          "1qhd6v.xyz",
          "4f-okdsvv.com",
          "5-9idk-gug7-k7.com",
          "52-ck29jr.com",
          "5z-hyq-g.net",
          "78p3-zgs-g-mc-u.com",
          "8f-mxh6-hupgd-dy.com",
          "8faf-rngtax.com",
          "a87-sun0r1w.com",
          "ac5e1f-fd2ph.com",
          "acyjob.tokyo",
          "adchum.tokyo",
          "adzwrq.tokyo",
          "akgxtu.tokyo",
          "aletko.tokyo",
          "am41-pm24ea.com",
          "amb29l1v3re.com",
          "ami10t-e37n.com",
          "an87-24pen1d.com",
          "and58-65kio.com",
          "apply33547.com",
          "ar5-chj-n-22d.com",
          "as93-attack1.com",
          "aso5fr-gre4.com",
          "au.imonju.net",
          "b5mjjc8s.com",
          "baebod.tokyo",
          "ban09-4w1as.com",
          "batdongsan.dcsvnqvmn.com",
          "baw2u-y6rsxf.com",
          "bed52-town1.com",
          "big429-7ten.com",
          "bing0017-s4e.com",
          "bing04-5ea1.com",
          "bm-8qkc8w.com",
          "bnv521-send4.com",
          "boat-19830214yh.com",
          "boceuz.tokyo",
          "boundhereafter.com",
          "bpugoc.tokyo",
          "bqufsuqj.com",
          "buffdrops.com",
          "bvnc5418-4s.com",
          "c02bf1r-kjre.com",
          "c7ykg-0sd5w.com",
          "cd-7rr-hgj.net",
          "cg58-6dr4wa.com",
          "chai58-mnew.com",
          "check.onedrvdn.co",
          "chi12-63in7m.com",
          "cm.appupdatemoremagic.com",
          "cont24-57hin.com",
          "crimeprocession.com",
          "crtfugrl.com",
          "cxevgfdy.com",
          "d-wl-kk.net",
          "d56gr-n2syp.xyz",
          "dalat.dalat.dulichovietnam.net",
          "dalat.dulichovietnam.net",
          "dan02-opl1h.com",
          "dan07oe0ch2f.com",
          "dan104.com",
          "dan32-ty65d.com",
          "dbfrqm.tokyo",
          "deliver-avenir.com",
          "den-85gh40ik.com",
          "developermisguided.email",
          "devzxm.tokyo",
          "dgywxfhuuy.com",
          "dhs4oms-plas.com",
          "dice-71ieoq.com",
          "dick06-a4e6o.com",
          "displayexploitation.com",
          "download.showprice.xyz",
          "dsykub.tokyo",
          "dwwkvf.tokyo",
          "e9dzrisph.com",
          "eden52-74ea.com",
          "edjkpz.tokyo",
          "edli501d-eaq.com",
          "eec-channel.com",
          "elcend.tokyo",
          "ell90-deep1w.com",
          "end09-r6s3x.com",
          "end87q.com",
          "eri05-63h4w.com",
          "eri25-d044g.com",
          "error.a87-sun0r1w.com",
          "error.amb29l1v3re.com",
          "error.bing0017-s4e.com",
          "error.boat-19830214yh.com",
          "error.chai58-mnew.com",
          "error.dan07oe0ch2f.com",
          "error.dan104.com",
          "error.dice-71ieoq.com",
          "error.eden52-74ea.com",
          "error.end87q.com",
          "error.get814sf1qz.com",
          "error.gine08-aw1a.com",
          "error.gp01-83-jind.com",
          "error.gu24dyen61v.com",
          "error.hanji1975-report.com",
          "error.hei032-4r4f.com",
          "error.hv-1d5f10ad.com",
          "error.ico65-e41dy.com",
          "error.iop045-jfh7.com",
          "error.jet02-59udc.com",
          "error.jin98-lme5a.com",
          "error.jun126japan4.com",
          "error.jun565.com",
          "error.jun98-rep-boat.com",
          "error.kaiketsu-250-md.com",
          "error.ken094l-14w.com",
          "error.kenji0903-boat.com",
          "error.key00nine7y.com",
          "error.key61sea03r.com",
          "error.key73plo54s.com",
          "error.key82ygo20w.com",
          "error.kif25vna1ed.com",
          "error.kin025-uma-boat.com",
          "error.kmv50-fs2eo.com",
          "error.knee39d.com",
          "error.lan57j-fd4s.com",
          "error.link053pin1e.com",
          "error.look01-d84w.com",
          "error.low05d14jsa.com",
          "error.may05-11pro.com",
          "error.men17f5h1sa.com",
          "error.mizuki2223-report.com",
          "error.mvp970a-e2a.com",
          "error.n04dvf-sd1r.com",
          "error.nec541-e41d.com",
          "error.net081f24jm.com",
          "error.new1f25ki2e.com",
          "error.nin24-412wa.com",
          "error.oim58hg2-sd.com",
          "error.on0555-keiba.com",
          "error.one04f2e4zy.com",
          "error.one63-8ui1d.com",
          "error.op-37repo39g.com",
          "error.op-42repo74g.com",
          "error.open21g.com",
          "error.pay518vsa0e.com",
          "error.pin023r-d1e.com",
          "error.pin520-uq6l.com",
          "error.pol35sby00ri.com",
          "error.pr204h7wall2.com",
          "error.pr732d1walk9.com",
          "error.qng9-dan21r.com",
          "error.quen58-po6w.com",
          "error.ren-0820-nanami.com",
          "error.rep-keibaboat20.com",
          "error.rep-keibaboat21.com",
          "error.report-deep-8857.com",
          "error.report-donna-1436.com",
          "error.report-fantastic-1996.com",
          "error.report-hearts-1096.com",
          "error.report-hearts-6170.com",
          "error.report-orfevre-5721.com",
          "error.report-ship-2012.com",
          "error.report-silence-7463.com",
          "error.report-vodka-8537.com",
          "error.ring-2341rd.com",
          "error.ring-888-uma.com",
          "error.ripo10make28.com",
          "error.ripo39fake47.com",
          "error.ripo52ball21.com",
          "error.ripo73talk95.com",
          "error.sou17-0taik2.com",
          "error.sou95-7taik6.com",
          "error.tap397.com",
          "error.ten043-ol5e.com",
          "error.ten047fsp9r.com",
          "error.ten0722-report.com",
          "error.th580621-uma.com",
          "error.tk15rep02mn.com",
          "error.uno073-g2pq.com",
          "error.vine57-s41l.com",
          "error.way89king01c.com",
          "error.wone61-s1ea.com",
          "error.xik054-junb.com",
          "error.xyz581dfa9po.com",
          "error.xyz62-pih6e.com",
          "error.yan052-r04t.com",
          "error.yen04-yj12w.com",
          "error.zexi7-lof2q.com",
          "extra49908.com",
          "face-hip.com",
          "fal05-06bing.com",
          "fan58-633rs.com",
          "favorite-mycosme.com",
          "fax021-eriq.com",
          "fax58-ikeyui.com",
          "fen14-25rol.com",
          "feqldn.tokyo",
          "fin04iu69wq.com",
          "fine-mo54wu.com",
          "fr-bxe-p6pe-cri.com",
          "fxpyfm.tokyo",
          "g0c-3w.net",
          "g8bp6ieju.com",
          "gam05-85t2w.com",
          "gan027-uyi7.com",
          "gan04r7es4b.com",
          "gan85-96ken0.com",
          "gang9-1r1dw.com",
          "get814sf1qz.com",
          "gg310-jmnw4a.com",
          "giehxn.tokyo",
          "gine08-aw1a.com",
          "gp01-83-jind.com",
          "gu24dyen61v.com",
          "ha7d1e-e12x.com",
          "hako-ren-sys.com",
          "han08-65ion8.com",
          "hanji1975-report.com",
          "hanoi.dalat.dulichovietnam.net",
          "harry-25.com",
          "hbudhzjx.space",
          "hei032-4r4f.com",
          "hell999-d05q.com",
          "helpful37987.com",
          "hide25-64koi.com",
          "hihjic.tokyo",
          "hikaku-gps.com",
          "hit84-62pim.com",
          "hkzgqt.tokyo",
          "htugcxmq.com",
          "hug48f4-rsd.com",
          "hv-1d5f10ad.com",
          "hwaax47yi.com",
          "ico65-e41dy.com",
          "ieprqoepirhjpqwijghoph.com",
          "igyhucqe.com",
          "ije-bwp5b.com",
          "in-45to24eav.com",
          "inc12r-slr56q.com",
          "io87-dex41e4.com",
          "ion062-41jne.com",
          "iop045-jfh7.com",
          "j7bu-s8tnk.com",
          "jascqr.tokyo",
          "jctymc.com",
          "jen98-265jin.com",
          "jet02-59udc.com",
          "jin42e-arai5.com",
          "jin77-0432rw.com",
          "jin98-lme5a.com",
          "jmqchk.tokyo",
          "js-net.tokyo",
          "jszpjq.tokyo",
          "judo-88-zzgu.com",
          "jun126japan4.com",
          "jun565.com",
          "jun98-rep-boat.com",
          "kaiketsu-250-md.com",
          "keiba-report.com",
          "keiba-report.jp",
          "keibareport.jp",
          "ken0438-g2jl.com",
          "ken094l-14w.com",
          "ken24-32yui.com",
          "kenji0903-boat.com",
          "key00nine7y.com",
          "key61sea03r.com",
          "key73plo54s.com",
          "key82ygo20w.com",
          "kid158-kids7.com",
          "kif25vna1ed.com",
          "kin025-uma-boat.com",
          "kin87-04rs3.com",
          "king42e-w4a1c.com",
          "kmv50-fs2eo.com",
          "knee39d.com",
          "koz-fo96m.com",
          "lan57j-fd4s.com",
          "let15-d12t1d.com",
          "let90-52len.com",
          "lex08-5light.com",
          "link053pin1e.com",
          "linx510-04rh.com",
          "lip03up645e.com",
          "list.bodologetee.com",
          "lmzayw.tokyo",
          "look01-d84w.com",
          "loop1-54hiu.com",
          "low05d14jsa.com",
          "lsbuidm.com",
          "lwueft.tokyo",
          "lzbzfd.tokyo",
          "mail.keiba-report.com",
          "mail.repo-bo-ke7.com",
          "mail.report-uma-boat.com",
          "matirsy.com",
          "may05-11pro.com",
          "meet7-55kin.com",
          "men17f5h1sa.com",
          "microsoft-update10v.amazonaws1.info",
          "min2r-2ray2d.com",
          "min40-3r4aq.com",
          "min54-teru51s.com",
          "mint98-825su.com",
          "mix-opr51f7p.com",
          "mix04-97rei.com",
          "mix55-77ten0.com",
          "mizuki2223-report.com",
          "mnc-15r3sdf.com",
          "mon98-12rui.com",
          "mszihe.tokyo",
          "mvp970a-e2a.com",
          "mwsda69e5.space",
          "n04dvf-sd1r.com",
          "n2-jhz-zq.net",
          "na7rei-0san3.com",
          "nec541-e41d.com",
          "net081f24jm.com",
          "new1f25ki2e.com",
          "nex047-in3e.com",
          "ni2r0-izu2a.com",
          "nic205e-s7w.com",
          "nin24-412wa.com",
          "nin58-7uy6s.com",
          "nix04-ioke0w.com",
          "ns1.0ffice36o.com",
          "ns2.0ffice36o.com",
          "ns8-02dr9.com",
          "nude00-99poi.com",
          "oftpjrdv.com",
          "og-hgh-gx0.net",
          "oihpyq.tokyo",
          "oim58hg2-sd.com",
          "ojrxef.tokyo",
          "on0555-keiba.com",
          "ond04-632hit.com",
          "one04f2e4zy.com",
          "one63-8ui1d.com",
          "oo78-rx78gun.com",
          "op-07repo63g.com",
          "op-15repo02g.com",
          "op-37repo39g.com",
          "op-42repo74g.com",
          "op28-land7ae.com",
          "open21g.com",
          "opposemuffin.email",
          "oqyfxl.tokyo",
          "p-ur1-2z.net",
          "pan478rdt1s.com",
          "parent35991.tokyo",
          "pay518vsa0e.com",
          "pd3-4q21a.com",
          "pfwjjs.tokyo",
          "picsec.tokyo",
          "pim109-s2r4.com",
          "pin023r-d1e.com",
          "pin059-pet12.com",
          "pin520-uq6l.com",
          "pink79-plq4r.com",
          "pistolmarshal.com",
          "pocket-80are.com",
          "point56-s42.com",
          "pol35sby00ri.com",
          "portstake.com",
          "pr204h7wall2.com",
          "pr732d1walk9.com",
          "purposes10859.tokyo",
          "pwdgkmaohakaiunpaokndsjgiuqh.com",
          "qa5f1r1ws-ir.com",
          "qan05-ion70.com",
          "qehf15fr-f0w.com",
          "qng9-dan21r.com",
          "qsjdfopiahfptjaprjypqh.com",
          "quen58-po6w.com",
          "quiz03-875in.com",
          "quiz59dyu-4gr.com",
          "qutonium.com",
          "qvzhyv.tokyo",
          "qw25-hill37s.com",
          "qxvwrsn.tokyo",
          "r3udxa-b26e.xyz",
          "r56w7-r24iq.xyz",
          "rae8od.xyz",
          "rap95-uc1-gu.com",
          "rate-system.com",
          "rei03-kin14w.com",
          "rei42-9getlu.com",
          "reid1r-b45e.com",
          "ren-0820-nanami.com",
          "rep28pin62q.com",
          "repo-bo-ke7.com",
          "report-deep-8857.com",
          "report-donna-1436.com",
          "report-fantastic-1996.com",
          "report-gold-1997.com",
          "report-groove-5739.com",
          "report-hearts-1096.com",
          "report-hearts-6170.com",
          "report-lord-4126.com",
          "report-northern-0219.com",
          "report-orfevre-5721.com",
          "report-ship-2012.com",
          "report-silence-7463.com",
          "report-silk-9247.com",
          "report-uma-boat.com",
          "report-vega-0907.com",
          "report-vodka-8537.com",
          "report84yen.com",
          "report98han.com",
          "rewuiren.com",
          "rine4-52arq.com",
          "ring-2341rd.com",
          "ring-888-uma.com",
          "ripo10make28.com",
          "ripo39fake47.com",
          "ripo52ball21.com",
          "ripo73talk95.com",
          "rit521-f4rs.com",
          "rmsayxh.tokyo",
          "rui94-23s1f.com",
          "rwd52-d14g1w.com",
          "ryiunuh.com",
          "s10jr-h4yopa.com",
          "sain007-sd1.com",
          "san-1r24eday.com",
          "sen98-r41ew.com",
          "sgngnshdf1nbd.com",
          "si4-2ico0wa.com",
          "sin685-min4e.com",
          "six666-45en.com",
          "sky258-d4ts1.com",
          "slmcda.tokyo",
          "sou17-0taik2.com",
          "sou95-7taik6.com",
          "springstriker.com",
          "spyy2xbxj5s8fhr.xyz",
          "ssnftc.tokyo",
          "stop04-o6eg.com",
          "support.gdrvcheck.co",
          "swcgztsjyy.com",
          "tap397.com",
          "tel085-652ck.com",
          "tel25-plq1h.com",
          "tel78-0dt4a.com",
          "ten043-ol5e.com",
          "ten047fsp9r.com",
          "ten0722-report.com",
          "ten10-min4ws.com",
          "ten10-one1aa.com",
          "ten52-d584t.com",
          "teru777-boat.com",
          "th580621-uma.com",
          "thpflk.tokyo",
          "tk15rep02mn.com",
          "tk37repo-kk.com",
          "trading16694.com",
          "ts-47-r9-rgy-m6rzi.com",
          "tsnjrm.tokyo",
          "tu-2-i.net",
          "twjvnekr.com",
          "uc120-gunf91.com",
          "ugrbnfhj.com",
          "uk.imonju.net",
          "uma-kouta0624.com",
          "und05-rep79u.com",
          "uno073-g2pq.com",
          "uorloy.tokyo",
          "uq005-15eg5o.com",
          "uq25-d4r3eg.com",
          "us-cpqr0w.com",
          "us.imonju.net",
          "vai58-9lan0r.com",
          "vamsfogokusendnaoserjhgaosdfvh.com",
          "van29-fe4ac.com",
          "van51e.com",
          "vfjupg.tokyo",
          "vin20-d1r7aq.com",
          "vine57-s41l.com",
          "vio521-f4wes.com",
          "vix98-74ope.com",
          "vmt8bmkxj4dpd.life",
          "voidplask.com",
          "vpn065-yu4w.com",
          "vyen58c386kg1.life",
          "w5fg1-mweplq.com",
          "wa28t-yell7u.com",
          "walk36p-w8a.com",
          "wang10-po5r.com",
          "wang58d-r4s.com",
          "way89king01c.com",
          "wg7q-utyfp.biz",
          "winserverform.com",
          "wolaoy.tokyo",
          "wone61-s1ea.com",
          "x58-nmrte25s.com",
          "xen41-6day0e.com",
          "xik054-junb.com",
          "xin04f-re5s.com",
          "xqkyegvb.com",
          "xukmmx.tokyo",
          "xyz581dfa9po.com",
          "xyz62-pih6e.com",
          "y-sx1-dl.net",
          "yan052-r04t.com",
          "yell-11ey01o.com",
          "yen04-yj12w.com",
          "yen05-04s1rq.com",
          "yen87-opkid.com",
          "yourls.kari-domain.com",
          "z777-rend0y.com",
          "z87-kami08po.com",
          "zdf5f2r-ir8l.com",
          "zen29-have5s.com",
          "zen41-65yus.com",
          "zet92-63r4s.com",
          "zexi21f-gt5h.com",
          "zexi7-lof2q.com",
          "zzon185-4sd.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://github.com/ti-research-io/ti/blob/main/ioc_extender/ET_DNS_Query_for_DNSpionage.json",
        "https://www.virustotal.com/gui/ip-address/74.63.204.32/relations",
        "https://www.virustotal.com/gui/ip-address/74.63.204.99/relations"
      ],
      "total": 517
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2021-01-27",
      "indicators": {
        "domain": [
          "web.adobephotostage.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://github.com/ti-research-io/ti/blob/main/ioc_extender/ET_DNS_Query_for_DNSpionage.json",
        "https://www.virustotal.com/gui/ip-address/74.63.204.32/relations",
        "https://www.virustotal.com/gui/ip-address/74.63.204.99/relations"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2018-12-11",
      "indicators": {
        "domain": [
          "0ffice36o.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://blog.talosintelligence.com/2018/11/dnspionage-campaign-targets-middle-east.html"
      ],
      "total": 1
    }
  ]
}