{ "aliases": [ "KTA007", "SNAKEMACKEREL", "STRONTIUM", "TG-4127", "UAC-0001", "UAC-0028", "ZimReaper", "apt-c-20", "apt28", "beardshell", "fancy bear", "gonepostal", "group 74", "lamehug", "pawn storm", "sednit", "sofacy", "ta422", "ta426", "threat troup-4127", "tsar team", "zebrocy" ], "attack_id": "G0007", "attack_name": "APT28", "attack_url": "https://attack.mitre.org/groups/G0007/", "counts": { "domain": 1431, "ipv4": 240, "url": 144, "url_path": 79 }, "first_seen": { "domain": { "000000027.xyz": "2021-07-17", "0x4fc271.tk": "2020-03-19", "0xf4a5.tk": "2020-03-19", "0xf4a54cf56.tk": "2020-03-19", "1000018.xyz": "2021-04-29", "1000020.xyz": "2021-04-28", "100plusapps.com": "2018-09-18", "1221.site": "2021-07-13", "15052021.space": "2021-07-17", "150520212.space": "2021-08-07", "150520213.space": "2021-08-07", "1681683130.website": "2021-07-13", "16868138130.space": "2021-07-13", "1833.site": "2021-07-13", "1oo7.net": "2018-09-05", "200200.duckdns.org": "2017-11-07", "2055.site": "2021-04-12", "2215.site": "2021-07-13", "29572459487545-4543543-543534255-454-35432524-5243523-234543.xyz": "2021-12-17", "2f9348243249382479234343284324023432748892349702394023.xyz": "2021-07-17", "32689657.xyz": "2021-07-17", "32689658.xyz": "2021-07-17", "32689659.xyz": "2021-08-07", "33655990.cyou": "2021-07-13", "34564414564.com": "2018-08-30", "357.duckdns.org": "2017-11-07", "365msoffice.com": "2017-02-27", "47e811dbe2ed0ea8d506af94c1bb7d4c.serveo.net": "2024-09-21", "4895458025-4545445-222435-9635794543-3242314342-234123423728.space": "2021-07-17", "48d83469-d0c6-4ade-8f82-e383fff094b8.webhook.site": "2026-02-09", "512521525-5245451515-985978774-2341235146436.xyz": "2021-12-17", "546874.tk": "2020-03-19", "5thelementq8.com": "2019-03-13", "645547657668787.com": "2018-08-30", "6c7aa72bd5f1d30203b80596f926b2b7.serveo.net": "2024-08-31", "73ce1aae8a9ba738b91040232524f51a.serveo.net": "2024-08-23", "78cc700b31dcd7c7f25fd7b0372259e3.serveo.net": "2024-08-31", "7daysinabudhabi.org": "2018-09-18", "90update.com": "2019-03-13", "910cf351-a05d-4f67-ab8e-6f62cfa8e26d.dnshook.site": "2026-03-26", "92ace7e653e9c32d2af9700592cc96ea.serveo.net": "2024-08-22", "9348243249382479234343284324023432748892349702394023.xyz": "2021-07-13", "9832473219412342343423243242364-34939246823743287468793247237.site": "2021-07-13", "99996665550.fun": "2021-08-07", "99kg.site": "2021-07-17", "9b5uja.am.files.1drv.com": "2022-09-23", "a.zhblz.com": "2026-03-11", "aa.69.mu": "2018-09-18", "aadexpo2014.co.za": "2018-09-18", "abbott-export.com": "2018-09-18", "academl.com": "2018-09-18", "acccountverify.com": "2017-02-27", "accesd-de-desjardins.com": "2018-09-18", "access-apple-login-account.gq": "2017-11-10", "access-google.com": "2018-08-30", "accgmail.com": "2017-02-27", "account-activity-verification-login.ga": "2017-11-10", "account-close-status.com": "2017-02-27", "account-flickr.com": "2018-09-18", "account-microsoftonline.com": "2018-08-30", "account-office365.com": "2018-08-30", "account-verify-comfirmation-info-login.ga": "2017-11-10", "account-verify-comfirmation-info-login.gq": "2017-11-10", "account.password-google.com": "2019-10-07", "accountgooogle.com": "2019-10-07", "accountlogin-inc.ga": "2017-11-10", "accounts-googlc.com": "2017-03-30", "accounts-gooogl.com": "2019-10-07", "accounts-office.fr": "2019-07-08", "accounts-qooqle.com": "2019-10-07", "accounts-updated.com": "2017-02-27", "accounts.rsshotmail.com": "2018-08-30", "accountsgooglemail.com": "2019-10-07", "accountsteam-en.com": "2017-02-27", "accountverify-disableinfo-login.gq": "2017-11-10", "accountverify.com": "2017-02-27", "accountverify.info": "2017-02-27", "acledit.com": "2018-08-30", "acrobatportable.com": "2018-08-30", "actblues.com": "2018-08-30", "action-yandex.ru": "2019-10-07", "activity-yandex.ru": "2019-10-07", "adawareblock.com": "2015-03-18", "adfs-senate.email": "2018-08-28", "adfs-senate.services": "2018-08-28", "adfs.senate.group": "2018-10-29", "adfs.senate.qov.info": "2018-08-30", "adobe-flash-updates.org": "2017-02-27", "adobeincorp.com": "2015-03-18", "adobemainsecurity.com": "2017-02-27", "adobeproduct.com": "2017-11-07", "adobestatistic.com": "2018-08-30", "adobestatistic.org": "2018-08-30", "adobeupdater.org": "2017-03-30", "adobeupdatetechnology.com": "2018-08-30", "adobeupgradeflash.com": "2017-04-10", "advpdxapi.com": "2018-08-30", "aerospacesystem.us.com": "2018-09-18", "afghanistanmfa.net": "2019-10-07", "ahr0cdovlzkyljiymi4ymdkundkvywn0a.0.d.255.adobeproduct.com": "2017-11-07", "aijazeera.org": "2020-04-06", "akadns.info": "2017-02-27", "akamaicachecdn.com": "2017-04-14", "akamaichecker.com": "2017-02-27", "akamaisoft.com": "2018-09-05", "akamaisoftupdate.com": "2017-04-10", "akamaitechnologysupport.com": "2018-08-30", "akamaitechupdate.com": "2018-08-30", "akragames.net": "2019-10-07", "al-wayi.com": "2018-09-18", "alert-new-login-com.ga": "2017-11-10", "aljazeera-news.com": "2018-09-05", "allcashin.com": "2018-09-18", "alphabitconsulting.com": "2022-01-29", "ambcomission.com": "2019-03-13", "americanprogress-office365.com": "2018-08-30", "americanprogress-outlook.com": "2018-08-30", "analyticemailmeter.com": "2026-03-21", "analyticsbar.org": "2018-03-14", "analyticsrequest.com": "2020-01-14", "analyticstest.net": "2018-03-14", "aneria.net": "2023-07-16", "aolnets.com": "2017-04-14", "apionedrive.com": "2018-08-30", "app-submitcentre.com": "2018-08-30", "appexsrv.net": "2018-03-14", "apple-assistance-localisation.com": "2017-02-27", "apple-care-support.com": "2017-02-27", "apple-checker.org": "2017-04-13", "apple-cloud-connect.com": "2017-02-27", "apple-iclods.org": "2017-04-13", "apple-iclouds.com": "2018-09-18", "apple-iclouds.net": "2017-02-27", "apple-id-service.com": "2017-02-27", "apple-iphone-services.com": "2017-02-27", "apple-iphonesecurity-icloud.com": "2017-02-27", "apple-location-id.com": "2017-02-27", "apple-realertlogin.gq": "2017-11-10", "apple-search.info": "2017-04-13", "apple-security-support.info": "2017-02-27", "apple-support-securityiphone.com": "2017-02-27", "apple-uptoday.org": "2017-04-13", "applecloudupdate.com": "2017-02-27", "appleid-login-appleid.ga": "2017-11-10", "appleid-manageaccountloginupdated.ga": "2017-11-10", "appleid-security-icloud.com": "2017-02-27", "appleidcustomer-servicess-com-loginaccount.ga": "2017-11-10", "appleidcustomer-servicess-com-loginaccount.gq": "2017-11-10", "appleupdate.org": "2019-03-19", "apps4updates.com": "2017-02-27", "appservicegroup.com": "2017-04-10", "apptaskserver.com": "2017-04-10", "arghpxdge01-airgas.com": "2017-02-27", "armaghanteb.com": "2022-01-29", "armpress.net": "2023-07-16", "armypress.org": "2018-09-18", "arnf.bg": "2018-09-18", "as23-updater-symantec.org": "2020-01-14", "asisonlline.org": "2018-09-18", "assaas.org": "2018-09-18", "asus-service.net": "2017-04-14", "audiwheel.com": "2018-03-14", "ausameetings.com": "2018-09-05", "autoupdater.org": "2018-08-30", "azureon-line.com": "2015-03-18", "b-of-americ.com": "2015-12-19", "baltichost.org": "2021-01-16", "bbc-press.org": "2018-09-05", "bbcnewsweek.com": "2015-12-19", "bbcweather.org": "2018-10-05", "beatguitar.com": "2019-04-08", "beststreammusic.com": "2018-10-05", "biathlovvorld.com": "2018-10-29", "biocpl.org": "2018-09-05", "bl4kj2.zapto.org": "2020-09-13", "blackpartshare.com": "2020-02-24", "blacktivist.info": "2018-08-30", "blu172maillive.com": "2020-04-06", "bmlv-gv.eu": "2017-04-14", "bohack51.ddns.net": "2019-12-14", "bonjourcheck.com": "2017-11-07", "bostondyn.com": "2018-09-18", "bostondynamlcs.com": "2018-09-18", "brnlv-gv.eu": "2017-04-14", "brokersads.com": "2018-09-18", "brookings.sharepoint.liveoffice365.me": "2018-08-30", "brownvelocity.org": "2018-10-05", "browsersecurity.ga": "2017-11-10", "bulgariaholidays.bg": "2019-06-19", "bulgariatripholidays.com": "2018-10-05", "bulletin-center.com": "2018-09-18", "bytly.org": "2018-09-18", "caciltd.com": "2018-09-18", "calc-dwn.infinityfreeapp.com": "2024-05-31", "calendar-ua.firstcloudit.com": "2024-03-18", "calendarua.firstcloudit.com": "2024-03-18", "capisp.com": "2018-09-05", "caribou-forge-server.new.c66.me": "2022-06-26", "carlos88.ddns.net": "2017-10-11", "catholicsinaliance.org": "2020-04-06", "cavuslawfirm.com": "2017-02-27", "cbiuaebank.com": "2015-12-19", "cbiuaebn.com": "2015-12-19", "cc-yahoo-inc.org": "2020-04-06", "cdn-nrdata.live": "2022-01-01", "cdnmsnupdate.com": "2017-11-07", "cdnverify.net": "2018-08-30", "centralinsumos.com.bo": "2022-01-29", "cercoselectricos.cl": "2022-01-29", "ceriossl.info": "2023-07-16", "cgna.info": "2020-01-14", "change-password.gq": "2017-11-10", "change-password.ml": "2020-03-19", "changepassword-hotmail.com": "2018-08-30", "changepassword-yahoo.com": "2018-09-18", "chatgpt4beta.com": "2023-04-19", "check-fix.com": "2015-03-18", "checkfindmyiphone.com": "2017-02-27", "checklogin.in": "2022-01-01", "checkmalware.info": "2015-03-18", "checkmalware.org": "2015-03-18", "checkwinframe.com": "2015-03-18", "chmail.in": "2018-09-18", "chmail.ir.udelivered.tk": "2018-10-29", "chmali.ir": "2018-09-18", "chujdrtuityui.mydiscussion.net": "2024-11-05", "ciscohelpcenter.com": "2018-09-05", "ciscosupports.com": "2022-01-01", "ckgob.com": "2019-03-13", "cleanphonetrksftware.com": "2018-08-30", "cleantarea-customerlogin-com.ga": "2017-11-10", "clickchekker.com": "2018-09-18", "clickchekkker.com": "2018-09-18", "clientareasecurity1.gq": "2017-11-10", "clientareasecurity4.gq": "2017-11-10", "cloud-apple-support.com": "2017-02-27", "cloud-id-localisation.com": "2017-02-27", "clouddrive.infinityfreeapp.com": "2024-05-31", "cloudflarecdn.com": "2017-03-30", "cloudmicrosoft365.com": "2018-08-30", "cloudupgrade.org": "2017-03-30", "cluz.someguydelivery.com": "2024-09-02", "cmdswitch.xyz": "2020-01-14", "cn5n8a92vtc00004a0t0gks3tbcyyyyyd.oast.fun": "2024-06-15", "cnnpolitics.eu": "2018-09-05", "coindmarket.com": "2018-10-05", "com-0cd.net": "2018-09-18", "com-recoverylogin.gq": "2017-11-10", "com-supportlogin-adminverification.ga": "2017-11-10", "config-panel.frge.io": "2023-07-15", "connectsmd.net": "2019-03-13", "consumerpanel.eu3.biz": "2022-01-14", "consumerpanel.eu3.org": "2022-01-14", "consumerpanel0x254a2.frge.io": "2024-05-31", "consumerpanelapp.42web.io": "2024-05-31", "consumerspanel.frge.io": "2022-03-08", "consumerspanelsrv.eu3.org": "2022-01-14", "contentdeliverysrv.net": "2020-02-24", "coronavirus5g.site": "2021-04-29", "counterterorexpo.com": "2018-09-18", "cpcpipe.com": "2023-04-19", "cpcpipe.org": "2023-04-19", "creekcounty.net": "2018-10-05", "cryptogo.net": "2019-10-07", "cryptokind.com": "2019-03-13", "csert.net": "2017-02-27", "cubenergy-my-sharepoint.com": "2020-01-14", "cubic.com.co": "2018-09-18", "cublc.com": "2018-09-18", "cyb3rc.com": "2019-09-23", "czyrqdnvpujmmjkfhhvs2x9oyfsn6gd7t.oast.fun": "2024-06-15", "czyrqdnvpujmmjkfhhvs4knf1av02demj.oast.fun": "2023-12-28", "czyrqdnvpujmmjkfhhvs9647ioh30wxvd.oast.fun": "2024-06-15", "czyrqdnvpujmmjkfhhvsclx05sfi23bfr.oast.fun": "2023-12-28", "czyrqdnvpujmmjkfhhvseabz1q5olrum5.oast.fun": "2024-06-15", "czyrqdnvpujmmjkfhhvsgapqr3hclnhhj.oast.fun": "2023-12-28", "czyrqdnvpujmmjkfhhvsqfxkqz68qzjcd.oast.fun": "2024-06-15", "czyrqdnvpujmmjkfhhvsqslblw0mawilr.oast.fun": "2024-06-15", "czyrqdnvpujmmjkfhhvsvlaax17vd5r6v.oast.fun": "2023-12-28", "d6231738c34.john-pc.c.mswordupdate17.com": "2017-11-07", "d6238051c34.placehol-6f699a.c.mswordupdate17.com": "2017-11-07", "d6238111c34.placehol-6f699a.c.mswordupdate17.com": "2017-11-07", "d6238158c34.placehol-6f699a.c.mswordupdate17.com": "2017-11-07", "d6238210c34.placehol-6f699a.c.mswordupdate17.com": "2017-11-07", "d6261013c34.placehol-6f699a.c.mswordupdate17.com": "2017-11-07", "d6261024c34.placehol-6f699a.c.mswordupdate17.com": "2017-11-07", "d6261034c34.placehol-6f699a.c.mswordupdate17.com": "2017-11-07", "dailyforeignnews.com": "2017-03-30", "dailypoliticsnews.com": "2018-09-05", "dancemusicstream.com": "2022-01-01", "darksecurity.ga": "2017-11-10", "dataclen.org": "2018-09-05", "dateosx.com": "2017-02-27", "daysheduler.org": "2018-10-05", "dbca10b5-63e0-42ec-ad10-de13be96dc42.dnshook.site": "2026-03-26", "decisionoverpregnantroad.com": "2019-03-13", "defenceglobaladviser.com": "2017-02-27", "defenceiq.us": "2018-09-05", "defencereview.eu": "2017-04-14", "defencereview.net": "2017-04-14", "defensenews.org": "2020-04-06", "delivery-mail-service.com": "2017-02-27", "delivery-ukrinmash-service.infinityfreeapp.com": "2024-05-31", "delivery-yahoo.com": "2017-04-14", "delivery-yandex.ru": "2019-10-07", "deshcoin.com": "2019-03-13", "digital-email-software.great-site.net": "2021-10-08", "diplomatnews.org": "2017-03-30", "diplomatscouncil.org": "2017-02-27", "dkvnz.com": "2018-09-18", "dls-gov.firstcloudit.com": "2024-03-18", "dmsclock.org": "2019-03-13", "dncvotebuilder.com": "2018-08-30", "dns-sec-login-apple-invoice-confirmations.ga": "2017-11-10", "dns-webapps-login-account-secure-servers.ga": "2017-11-10", "doads.org": "2025-01-13", "doc.gmail.com.gyehddhrggdii323sdhnshiswh2udhqjwdhhfjcjeuejcj.zhblz.com": "2024-10-26", "dochardproofing.com": "2019-03-13", "docs.google.com.spreadsheets.d.1ip6eeakdebmwteh36vana4hu-glaeksstsht-boujdk.zhblz.com": "2024-10-26", "docs77.com": "2020-01-14", "document-c.infinityfreeapp.com": "2023-12-16", "document-d.infinityfreeapp.com": "2024-05-31", "documentation.gq": "2017-11-10", "documents-cloud.infinityfreeapp.com": "2024-05-31", "documentshandler.ga": "2017-11-10", "doorbehindentirerelationship.com": "2022-01-01", "dotnetupdatechecker.com": "2017-04-14", "downloadable.infinityfreeapp.com": "2024-05-31", "downloadc.infinityfreeapp.com": "2024-05-31", "downloaddoc.infinityfreeapp.com": "2023-12-01", "downloadfile.infinityfreeapp.com": "2023-12-05", "downloadingdoc.infinityfreeapp.com": "2023-12-16", "downloadinge.infinityfreeapp.com": "2024-05-31", "downloadingf.infinityfreeapp.com": "2023-12-05", "downloadingq.infinityfreeapp.com": "2024-05-31", "downloadingw.infinityfreeapp.com": "2024-05-31", "downloadx.infinityfreeapp.com": "2024-05-31", "downloadz.infinityfreeapp.com": "2024-05-31", "dowssys.com": "2018-08-30", "dpkshodnya-mysharepoint.com": "2020-01-14", "drive-auth.com": "2019-10-07", "drive-google.ga": "2019-10-07", "drive365us.com": "2020-12-10", "driverfordell.com": "2019-03-13", "drivers-update.info": "2015-10-21", "driversupdate.info": "2018-08-30", "drivres-update.info": "2015-12-19", "dryf.shneez.com": "2024-09-02", "dvsservice.com": "2018-08-30", "dvsservice.net": "2018-08-30", "dxtveuux.com": "2020-01-14", "e-gov-am.firstcloudit.com": "2024-03-18", "e-gov.firstcloudit.com": "2024-03-18", "e-mail-supports.com": "2019-10-07", "e-military.firstcloudit.com": "2024-03-18", "e-mod.firstcloudit.com": "2024-03-18", "e-nas.firstcloudit.com": "2023-12-28", "e-post.byegm.web.tr": "2020-04-06", "e-presidencia.firstcloudit.com": "2024-03-18", "e-wody.firstcloudit.com": "2024-06-15", "easycache.net": "2017-03-30", "ebramka.info": "2019-03-13", "ecards-yahoo.com": "2018-09-18", "ecitcom.net": "2019-03-13", "edit-mail-yahoo.com": "2020-04-06", "eecomission.firstcloudit.com": "2024-08-23", "eecommission-drive.firstcloudit.com": "2024-03-18", "eecommission.firstcloudit.com": "2024-03-18", "egreetingsfrom.us": "2018-09-18", "egypressoffice.com": "2018-08-30", "elaxo.org": "2017-11-07", "electionleaks.com": "2019-09-23", "emailanalytics.com.ua": "2026-03-21", "emailloginerror.gq": "2017-11-10", "emailprovider.org": "2017-02-27", "emails-aol.com": "2017-02-27", "emailyandex.ru": "2019-10-07", "emod.firstcloudit.com": "2024-03-18", "en-marche.co": "2019-07-08", "encoder-info.tk": "2018-03-14", "englishlessons-houston.com": "2022-01-29", "enisa-europa.com": "2017-04-14", "enisa-europa.org": "2017-04-14", "eo1ws2wgj75rdfd.m.pipedream.net": "2024-05-31", "eo2mxtqmeqzafqi.m.pipedream.net": "2022-05-06", "eo6kgbwpysq0laa.m.pipedream.net": "2024-05-31", "eogo85tybrrn2r.m.pipedream.net": "2024-05-31", "eomhv6vdu4v5qyt.m.pipedream.net": "2024-05-31", "eopkne8kapj01xi.m.pipedream.net": "2023-07-16", "eos93vb2cwsu3xf.m.pipedream.net": "2023-07-16", "eottxji4yk4vg5x.m.pipedream.net": "2024-05-31", "eoy6vrzslpn9vu.m.pipedream.net": "2024-05-31", "eoytfd39hbrspa3.m.pipedream.net": "2024-05-31", "errorreporting.net": "2024-12-22", "esco-plvnlch.com": "2020-01-26", "escochart.com": "2018-10-05", "escochartzone.com": "2019-06-19", "eservicesystems.net": "2017-03-30", "esetsmart.org": "2018-10-12", "eskvortsov.com": "2020-01-14", "etcrem.net": "2018-03-14", "euronews24.info": "2018-09-05", "europeanda.com": "2017-04-14", "europehistoricalmuseum.com": "2018-08-30", "euroreport24.com": "2018-09-05", "eurosatary.com": "2018-09-18", "eurosator.com": "2018-09-18", "eurosatory-2014.com": "2018-09-18", "eurosatory2014.com": "2018-09-18", "euspa-vacancy.firstcloudit.com": "2024-04-06", "evbrax.org": "2018-08-28", "evronaval.com": "2018-09-18", "evrosatory.com": "2018-09-18", "exchangetrusts.com": "2017-02-27", "experience-improvement.com": "2024-12-22", "experiencewithweakkid.com": "2019-05-30", "extad.info": "2018-08-30", "extstat.info": "2018-08-30", "facebook-login-page.gq": "2017-11-10", "facebookonlinenotice.com": "2017-02-27", "facebookservices.org": "2017-02-27", "failure-login.ga": "2017-11-10", "familynearbysuitablenumber.com": "2022-01-01", "farele.co": "2019-10-07", "farnboroughair2014.com": "2018-09-18", "fastcontech.com": "2018-08-30", "fastdataexchange.org": "2018-03-14", "fastfileconverter.org": "2017-11-07", "fastphotobucket.com": "2018-08-30", "faststoragefiles.org": "2017-11-07", "fatherinfriendlyroad.com": "2019-06-13", "fbarticles.com": "2017-02-27", "fbcdn.store": "2018-08-28", "fbonlinelottery.com": "2015-12-19", "fdsagdfg.rf.gd": "2024-05-31", "fes-auth.com": "2019-03-13", "fghjdfhdzggjjdfd.rf.gd": "2024-10-23", "fgjgjuyfkuuyk.blogspot.com": "2024-09-21", "fil-luge.com": "2018-10-29", "file-download.infinityfreeapp.com": "2024-05-31", "filedwn.infinityfreeapp.com": "2024-05-31", "filehosting.infinityfreeapp.com": "2024-05-31", "files-presidencia.firstcloudit.com": "2024-03-18", "fileshelp.ga": "2017-11-10", "fileshelp.gq": "2017-11-10", "fileshelpprotut.ga": "2017-11-10", "fileshelpprotut.gq": "2017-11-10", "filestore.gq": "2017-11-10", "filihosting.infinityfreeapp.com": "2024-05-31", "finance-reports.everyday.com-w13.net": "2018-09-18", "finemagicball.org": "2017-03-30", "fisski.ca": "2018-10-29", "flammaautomoveis.com.br": "2022-01-29", "flashcontentdelivery.net": "2017-11-07", "flashsecurity.org": "2018-09-18", "flickr-service.com": "2018-09-18", "fnbcorporate.co.za": "2018-10-05", "foreignreview.com": "2017-04-14", "forsvaret.co": "2018-09-18", "fountainrate.com": "2023-07-16", "fraispei.com": "2026-03-21", "freefoodaid.com": "2026-02-02", "fsportal.net": "2017-11-07", "ftp.fraispei.com": "2026-03-21", "ftp.password-google.com": "2019-10-07", "fubnt.com": "2015-12-19", "functiondiscovery.net": "2019-04-12", "fundseats.com": "2018-10-05", "funnymems.com": "2018-08-30", "g-analytics.net": "2018-09-18", "game-wins.com": "2024-12-22", "gcsd.firstcloudit.com": "2024-01-30", "gdforum.info": "2018-09-18", "gdforum.net": "2018-09-18", "geaviations.com": "2018-09-18", "generalscaningcorp.org": "2017-02-27", "generalsecuritycorp.org": "2017-02-27", "generalsecurityscan.com": "2017-02-27", "genericnetworkaddress.com": "2018-10-05", "georgia-travel.org": "2018-10-05", "getstatpro.com": "2021-06-03", "getvps.site": "2021-08-07", "getwindowsupdates.com": "2017-02-27", "global-news-world.com": "2023-07-16", "global-world-news.net": "2023-07-16", "globaldefencetalk.com": "2017-02-27", "globalnewsweekly.com": "2017-04-14", "globalresearching.org": "2017-04-10", "globaltechengineers.org": "2018-10-05", "globaltechresearch.org": "2017-04-10", "globeshippers.biz": "2015-12-19", "globeshippers.net": "2015-12-19", "gmailservicegroup.com": "2017-02-27", "gmailservices.org": "2017-02-27", "gnpad-gh-gov.org": "2017-02-27", "goldenbuckz.com": "2019-03-19", "goldsecurity.ga": "2017-11-10", "golivecamp.net": "2019-06-19", "google-login.ml": "2019-10-07", "google-passwd.com": "2019-10-07", "google-password.com": "2019-10-07", "google-password.ml": "2019-10-07", "google-settings.com": "2018-09-18", "google-vservice.com": "2017-02-27", "googlea.net63.net": "2017-11-07", "googlesetting.com": "2015-12-19", "gooogle-login.com": "2019-10-07", "gov-kw.com": "2019-10-07", "gov.hu.com": "2018-09-18", "gov.vppdr.com": "2026-03-18", "gpufps.com": "2020-02-24", "gpwpl.com": "2018-09-18", "greetingcardproject.com": "2018-09-18", "greetingcardsproject.com": "2018-09-18", "groupsincevisibleend.com": "2022-01-01", "gsandsc.com": "2015-12-19", "gshippers.com": "2015-12-19", "gtranm.com": "2018-08-30", "guytillintelligentposition.com": "2019-06-13", "hatdfg-rhgreh684.frge.io": "2022-03-08", "heidelberqcement.com": "2018-09-18", "hello76.com": "2019-03-13", "help-msoutlook.com": "2018-08-30", "help-yahoo-service.com": "2020-04-06", "helpfromhome.co": "2018-09-18", "helpmicrosoft.net": "2018-08-30", "hesselawchambers.com": "2015-12-19", "hhcghibvywzedwa2iyvsuzzhx8.2.d.255.adobeproduct.com": "2017-11-07", "historicalfilms720hd.com": "2019-04-03", "hostapp.link": "2022-01-01", "hostedopenfiles.net": "2019-03-13", "hostsvcnet.com": "2018-03-14", "hotfix-update.com": "2015-03-18", "hotfixmsupload.com": "2018-08-30", "hothookup.net": "2018-09-18", "hotmail-monitor.com": "2018-08-30", "hourduringstrictsense.com": "2022-01-01", "hp-apps.com": "2019-02-05", "hubsg.net": "2018-08-30", "hudsonorg-my-sharepoint.com": "2018-08-28", "hurriyet.org.uk": "2019-10-07", "hushmali.com": "2018-09-18", "i.analyticemailmeter.com": "2026-03-21", "i.emailanalytics.com.ua": "2026-03-21", "i.mailnalysis.com": "2026-03-21", "i.zimbra-metadata.com": "2026-03-21", "i.zimbrasoft.com.ua": "2026-03-21", "i.zimbrastat.com": "2026-03-21", "i.zmailanalytics.com": "2026-03-21", "iacr-tcc.org": "2017-04-14", "iadb-online.com": "2017-02-27", "iboxmit.com": "2018-10-05", "icloud-id-en.com": "2017-02-27", "icloud-id-localisation.com": "2017-02-27", "icloud-id-security.com": "2017-02-27", "icloud-id-services.com": "2017-02-27", "icloud-iphone-services.com": "2017-02-27", "icloud-iphonesecurity.com": "2017-02-27", "icloud-localisation-id.com": "2017-02-27", "icloud-security-support.com": "2017-02-27", "icloud-service-apple.com": "2017-02-27", "icloud-support-id.com": "2017-02-27", "id-icloud-localisation.com": "2017-02-27", "id-icloud-support.com": "2017-02-27", "id-unconfirmeduser.frge.io": "2022-03-08", "id24556.tk": "2020-03-19", "id451295.com": "2020-03-19", "id6589.com": "2020-03-19", "identification-apple-id.com": "2017-02-27", "identification-apple.com": "2017-02-27", "identification-icloud-id.com": "2017-02-27", "ifcdsc.org": "2018-09-18", "iforgot-verification.com": "2019-03-13", "igfcw.torresemello.com": "2024-09-02", "iihf.eu": "2018-10-29", "ikmtrust.com": "2017-11-07", "imf-eu.org": "2017-02-27", "imperialc0nsult.com": "2018-09-18", "in-eternal-memory-of.com": "2018-09-18", "info-apple-login-security.gq": "2017-11-10", "info-mod.firstcloudit.com": "2024-03-18", "info2t.com": "2017-03-30", "int-live.com": "2019-10-07", "inteldrv64.com": "2018-08-30", "intelintelligence.org": "2018-08-30", "intelmeserver.com": "2018-08-30", "intelnetservice.com": "2015-12-19", "intelstatistics.com": "2019-03-13", "intelsupport.net": "2015-12-19", "intelsupportcenter.com": "2018-08-30", "intelsupportcenter.net": "2018-08-30", "internalsecurity.us": "2024-12-22", "intuitanalys.com": "2018-09-18", "intuitstatistic.com": "2018-09-18", "intuitstatistics.info": "2018-09-18", "ip113.ip-91-134-203.eu": "2017-11-07", "ipv6-microsoft.com": "2018-08-30", "iraqinews.info": "2020-04-06", "istc-cloud.com": "2026-03-21", "istoreapple.com": "2017-02-27", "itune-app.com": "2017-02-27", "itunes-helper.net": "2017-02-27", "jazzradiostream.com": "2019-04-03", "jeremizo888.ddns.net": "2017-10-11", "jflynci.com": "2017-11-07", "jimbeam.live": "2022-01-27", "jkbfgkjdffghh.linkpc.net": "2024-10-02", "jkcfgjgfcjty.fast-page.org": "2024-10-02", "joshel.com": "2017-04-10", "jp-login.gq": "2017-11-10", "junlper.net": "2018-09-18", "jzit.wocircuitfitness.com": "2024-09-02", "kakashka.chmail.in": "2018-09-18", "kavkazcentr.info": "2018-09-18", "kavkazjlhad.com": "2018-09-18", "kdmzlw.am.files.1drv.com": "2022-09-23", "kenlynton.com": "2018-08-30", "kfghjerrlknsm.line.pm": "2024-09-03", "kg-news.org": "2018-09-05", "kitegacc.com": "2018-09-18", "kitegacc.net": "2018-09-18", "kiteim.org": "2018-03-14", "kitten-268.frge.io": "2022-06-20", "kjghfkfgfdytku.infinityfreeapp.com": "2024-11-02", "knightconsults.com": "2019-03-13", "konami-game.com": "2018-09-18", "kremotevn.net": "2019-03-13", "kub-gas.com": "2020-01-14", "kvatral95.com": "2020-01-14", "kwqx.us": "2015-12-19", "kzgw-wody.firstcloudit.com": "2024-03-18", "lanmangraphics.com": "2024-12-22", "largefarm.net": "2015-12-19", "lasarenas.lt": "2019-03-13", "legacydiner.org": "2019-03-13", "lgemon.org": "2018-08-30", "lifeofmentalservice.com": "2018-03-14", "limited-resolution.com": "2017-02-27", "limited-verification.com": "2017-02-27", "link-google.com": "2018-09-18", "linkcuts.com": "2025-01-13", "linuxkrnl.net": "2018-08-30", "litu.su": "2018-09-18", "live-settings.com": "2019-10-07", "livemicrosoft.net": "2018-08-30", "liveoffice365.me": "2018-08-30", "liveweatherview.com": "2018-03-14", "localisation-apple-id.com": "2017-02-27", "localisation-apple-security.com": "2017-02-27", "localisation-apple.com": "2017-02-27", "localisation-id-apple.com": "2017-02-27", "localisation-id-icloud.com": "2017-02-27", "localisation-security.com": "2017-02-27", "localisation-support.com": "2017-02-27", "locked-service-security.ga": "2017-11-10", "log-in-osce.org": "2018-08-30", "login-bancochile-cl.ga": "2017-11-10", "login-on-live.com": "2018-08-30", "login-one.com": "2019-10-07", "login-osce.org": "2018-09-18", "login-outlook.com": "2018-08-30", "login-pap-web-access.ga": "2017-11-10", "login-recovery.gq": "2017-11-10", "login-resolve-limitations.com": "2017-02-27", "login-sec-apple-secure-account-updated.ga": "2017-11-10", "login-secure1-mobile.ga": "2017-11-10", "login-security-center.com": "2017-02-27", "login-security-notification.com": "2017-02-27", "login-security-verifications.com": "2017-02-27", "login-unlock-account.ga": "2017-11-10", "login-update-unlock.gq": "2017-11-10", "login.cloudmicrosoft365.com": "2018-08-30", "loginapps-info.ga": "2017-11-10", "loginpaypaas-securityuserid.ga": "2017-11-10", "loginservice-maintanceserversecurity.gq": "2017-11-10", "lonejade.com": "2023-07-16", "longsauce.com": "2026-02-06", "lopback.com": "2019-03-13", "loqin-microsoftonline.com": "2018-08-30", "loqin-yandex.ru": "2020-04-06", "loungecinemaclub.com": "2018-10-05", "lowprt.org": "2018-08-28", "lucyonmail.org": "2017-03-30", "lvueton.com": "2018-03-14", "lxwo.org": "2018-09-27", "mail-en-marche.fr": "2019-07-08", "mail-google.info": "2018-09-18", "mail-gov-ua.frge.io": "2023-07-16", "mail-hurriyet.com": "2019-10-07", "mail-ibu.eu": "2018-10-29", "mail-justus.com.ua": "2020-04-06", "mail-navy.ro": "2020-04-06", "mail-periodistas.net": "2017-02-27", "mail-service-yandex.ru": "2019-10-07", "mail.account-flickr.com": "2018-09-18", "mail.byegm.web.tr": "2020-04-06", "mail.chmail.in": "2018-09-18", "mail.g0v.me": "2020-04-06", "mail.hushmali.com": "2018-09-18", "mail.kuwaitarmy.gov-kw.com": "2019-10-07", "mail.mofa.g0v.qa": "2020-04-06", "mail.mrthelp.org": "2018-09-18", "mail.q0v.pl": "2015-12-19", "mail.rnil.am": "2018-09-18", "mail.rsaf.qov.sa.com": "2020-04-06", "mail.securitypractic.com": "2018-09-18", "mail.sofexjordanx.com": "2018-09-18", "mail.teiecomitalia.it": "2020-04-06", "mail.telecharger-01.com": "2018-09-18", "mail.unrightswire.org": "2019-10-07", "mail.windows-updater.com": "2018-09-18", "mail.ya-support.com": "2018-09-18", "mail.yahoo-monitor.com": "2018-09-18", "mail.zhblz.com": "2024-10-26", "mailerfeed.net": "2017-02-27", "mailhost-ut.ee": "2020-04-06", "mailhost.university-tartu.info": "2020-04-06", "mailmil.ae": "2020-04-06", "mailnalysis.com": "2026-03-21", "mailsettings-yandex.ru": "2019-10-07", "mailtransferservice.com": "2019-10-07", "majc.healthfloww.com": "2024-09-02", "malaytravelgroup.com": "2018-10-05", "malwarecheck.info": "2016-03-08", "manage-login.gq": "2017-11-10", "manage-logins.gq": "2017-11-10", "markburgston.com": "2019-10-07", "maskulan.duckdns.org": "2017-11-07", "maskulan.dynu.com": "2017-11-07", "mastconf.com": "2019-10-07", "masterofdigital.org": "2023-04-19", "maylaytravelgroup.com": "2019-05-30", "mdcrewonline.com": "2018-08-30", "mediarea.org": "2017-04-14", "megauploadfiles.org": "2019-03-13", "memcached.in": "2022-01-01", "memoinfo.ru": "2018-09-18", "meteost.com": "2018-03-14", "mfa-files.firstcloudit.com": "2024-03-18", "mfa-gov.info": "2018-09-18", "mfagreece.com": "2020-04-06", "mfanews.info": "2018-09-18", "mfanews.org": "2018-09-18", "mfapress.com": "2018-09-18", "mfapress.org": "2018-09-18", "mfauz.com": "2018-09-18", "micoft.com": "2018-08-30", "microsof-update.com": "2015-03-18", "microsofi.org": "2015-03-18", "microsoft-files.infinityfreeapp.com": "2024-05-31", "microsoft-onthehub.com": "2019-07-08", "microsoft-update-cdn.com": "2018-08-30", "microsoft-updatecdn.com": "2018-08-30", "microsoftcheckupdate.com": "2018-08-30", "microsoftcorpstatistic.com": "2018-08-30", "microsoftdccenter.com": "2017-02-27", "microsoftdriver.com": "2018-08-30", "microsoftdskservice.com": "2018-08-30", "microsoftfont.com": "2017-02-27", "microsofthelpcenter.info": "2018-08-30", "microsoftofficeupdate.net": "2017-02-27", "microsoftonlihe.com": "2018-08-30", "microsoftsecurepolicy.org": "2018-08-30", "microsoftstoreservice.com": "2018-08-30", "microsoftsupp.com": "2018-08-30", "microsoftupdated.com": "2017-11-07", "middle-eastreview.org": "2015-12-19", "military-info.eu": "2018-09-05", "militaryadviser.org": "2018-09-05", "militaryexponews.com": "2018-09-18", "militaryinf.com": "2018-09-18", "militaryobserver.net": "2017-04-14", "militarysupport.firstcloudit.com": "2024-03-18", "ministernetwork.org": "2019-10-17", "minjust-gov-ua.com": "2020-01-14", "miropc.org": "2018-03-14", "mlidef.com": "2018-08-30", "mobile-sanoma.net": "2020-04-06", "mobilehostsvc.com": "2017-02-27", "mod-files.ga": "2017-11-10", "moderntips.org": "2018-10-05", "modeselling.com": "2023-07-16", "mofa.farele.co": "2019-10-07", "moldstream.md": "2019-02-05", "moldtravelgroup.com": "2018-10-05", "molodirect.net": "2018-09-18", "monkey-129.getforge.site": "2022-06-26", "mountainsgide.com": "2020-02-24", "movieultimate.com": "2018-03-14", "mozilla-plugins.com": "2016-02-23", "mozillaplagins.com": "2016-02-23", "mrthelp.org": "2018-09-18", "ms-drivadptrwin.com": "2018-08-30", "ms-update.info": "2018-08-30", "ms-update.net": "2018-08-30", "ms-updates.com": "2018-08-30", "mscoresvw.com": "2017-03-30", "msfontserver.com": "2019-02-05", "msfontsrv.com": "2017-02-27", "msmodule.com": "2018-08-30", "msmodule.net": "2017-02-27", "msnsupportcare.com": "2018-08-30", "msoffice-cdn.comns3.cdnmsnupdate.com": "2017-11-07", "msofficeinstall.com": "2017-02-27", "msofficelab.com": "2019-04-03", "msoftonline.com": "2017-03-30", "msonlinelive.com": "2016-03-08", "msrdr.com": "2018-08-30", "msrole.com": "2022-01-01", "msrwr.com": "2018-08-30", "mswordupdate17.com": "2017-04-12", "munimonoce.com": "2017-04-12", "mvband.net": "2018-03-14", "mvsband.com": "2018-08-30", "mvtband.net": "2018-03-14", "mx.rnil.cl": "2018-09-18", "mx.unrightswire.org": "2019-10-07", "mx1.g0b.mx": "2018-09-18", "mx3.set121.com": "2018-09-18", "my-iri.org": "2018-08-28", "my-sharefile.com": "2019-07-08", "my-sharepoints.com": "2019-07-08", "my-ukr.net": "2020-01-14", "myaccountgoogle.ga": "2019-10-07", "mycloud-mail.ru": "2020-04-06", "mydocuments.gq": "2017-11-10", "myinvestgroup.com": "2017-11-07", "mymail-ukr.net": "2017-03-30", "mysent.org": "2020-01-14", "n.3.f.255.adobeproduct.com": "2017-11-07", "n.n.c.255.adobeproduct.com": "2017-11-07", "n.n.c.26055.adobeproduct.com": "2017-11-07", "n.n.c.303ff7b225c14f1498a2.cdnmsnupdate.com": "2017-11-07", "n0vinite.com": "2015-12-19", "name1d.site": "2021-04-12", "name4050.com": "2021-04-12", "nanetsdeb.com": "2018-08-30", "naoasch.com": "2018-08-30", "narrowpass.net": "2018-10-05", "nas-files.firstcloudit.com": "2023-12-28", "nationalzonehouse.com": "2022-01-01", "nato-hq.com": "2017-04-14", "nato-info.com": "2017-04-14", "nato-int.com": "2017-04-14", "nato-nevvs.org": "2017-02-27", "nato-news.com": "2018-09-05", "nato-press.com": "2015-10-21", "nato.nshq.in": "2018-09-18", "natoexhibitionff14.com": "2018-08-30", "natoint.com": "2017-03-30", "natopress.com": "2017-04-14", "natopress.org": "2017-04-14", "ndpmedia24.com": "2019-03-26", "ndsee.org": "2018-08-28", "nemaskalitnium.com": "2019-03-13", "neoderb.com": "2019-03-13", "netassistcache.com": "2017-04-14", "netcorpscanprotect.com": "2017-02-27", "nethostnet.com": "2018-03-14", "netschecker.com": "2018-09-18", "networkcentrals.com": "2019-06-13", "networkfilehosting.com": "2019-03-13", "networkschecker.net": "2017-11-07", "networkxc.net": "2019-03-13", "newaction-loginactivituresource.ga": "2017-11-10", "newfiles.ga": "2017-11-10", "newfilmts.com": "2018-03-14", "newfilmts.org": "2020-01-14", "news-almasirah.net": "2019-03-13", "news.intelsupportcenter.com": "2018-08-30", "newsdailyworld.com": "2017-03-30", "newsfromsource.com": "2019-03-13", "newstyleradio.net": "2019-06-13", "newsweekadviser.com": "2019-10-07", "nomartung.org": "2018-08-30", "northropgrumman.org.uk": "2018-09-18", "nortonupdate.org": "2017-03-30", "noticermk.com": "2018-08-30", "notificationstatus.com": "2018-08-30", "novinitie.com": "2015-12-19", "ns-secures-login-accountjp-updates-community.gq": "2017-11-10", "ns.mfanews.org": "2018-09-18", "ns1.al-wayi.com": "2018-09-18", "ns1.cdnmsnupdate.com": "2017-11-07", "ns1.fountainrate.com": "2023-07-16", "ns1.greetingcardproject.com": "2018-09-18", "ns1.lonejade.com": "2023-07-16", "ns1.mfanews.org": "2018-09-18", "ns1.modeselling.com": "2023-07-16", "ns1.oncetrips.com": "2023-07-16", "ns1.petdiary.net": "2026-03-11", "ns1.vtxhospital.com": "2023-07-16", "ns2.cdnmsnupdate.com": "2017-11-07", "ns2.fountainrate.com": "2023-07-16", "ns2.modeselling.com": "2023-07-16", "ns2.ntpupdateserver.com": "2017-11-07", "ns2.oncetrips.com": "2023-07-16", "ns2.petdiary.net": "2026-03-11", "ns2.vtxhospital.com": "2023-07-16", "ns3.cdnmsnupdate.com": "2017-11-07", "nshq.in": "2018-09-18", "ntpstatistics.com": "2019-02-05", "nursingdocumentation.gq": "2017-11-10", "nvidiagforceup.com": "2017-02-27", "office365-account.com": "2018-08-30", "office365-microsoft.com": "2018-08-30", "office365-onedrive.com": "2018-08-28", "office365-osf.am": "2019-07-16", "office365-osi.am": "2019-07-16", "officefont.com": "2017-02-27", "officemicroupdate.com": "2018-08-30", "officeupdater.com": "2018-08-30", "offlineupdates.com": "2017-02-27", "ohsxy.com": "2022-04-05", "oiagives.com": "2019-02-05", "oiatribe.com": "2019-02-05", "oncetrips.com": "2023-07-16", "one-drive.org": "2018-08-30", "onedrive-en-marche.fr": "2019-07-08", "onedrive-office365.com": "2018-08-30", "onedrive-outlook.com": "2018-08-30", "onedrive-sharedfile.com": "2019-07-08", "onedrive365.com": "2018-08-30", "onedrivemicrosoft.com": "2018-08-30", "onedrivemicrosoft365.com": "2017-03-30", "onedriveoffice365.com": "2018-08-30", "onedrv-live.com": "2019-07-08", "online-download.infinityfreeapp.com": "2024-05-31", "online-drive.infinityfreeapp.com": "2024-05-31", "online-reggi.com": "2018-03-14", "onlineubersplit.com": "2019-04-03", "opendoc.infinityfreeapp.com": "2023-12-05", "opendocument.infinityfreeapp.com": "2023-12-05", "opendocuments.infinityfreeapp.com": "2024-05-31", "options-mail.ru": "2020-04-06", "org.ohsxy.com": "2022-04-05", "org.security.ohsxy.com": "2022-04-05", "osce-info.com": "2018-09-05", "osce-military.org": "2015-12-19", "osce-oscc.org": "2017-04-14", "osce-press.com": "2020-04-06", "osce-press.org": "2018-09-05", "osfam.events": "2019-07-16", "osfam.team": "2019-07-16", "ourfiles.ga": "2017-11-10", "outlook-security.org": "2018-08-30", "outlook-update.live": "2022-01-01", "ovhsec.com": "2019-10-21", "packinstall.kozow.com": "2023-07-15", "pakistan-mofa.net": "2018-09-05", "pandadefender.com": "2020-01-14", "panelunregistertle-348.frge.io": "2023-07-15", "pasport-yandex.com": "2018-09-18", "pasport-yandex.ru": "2020-04-06", "pass-google.com": "2015-10-21", "password-google.com": "2019-10-07", "pavlodar.news": "2019-10-26", "pdf-document.ga": "2017-11-10", "peacefund.eu": "2017-11-07", "pentestinglab.com": "2019-10-07", "perfect-remote-service.com": "2019-03-13", "persa124.in": "2018-09-18", "petdiary.net": "2026-03-11", "petropershiyinukra.com": "2018-08-30", "philcfo.org": "2017-03-30", "photopoststories.com": "2019-01-08", "picturecrawling.com": "2018-10-05", "platnosci.biz": "2019-03-13", "pldtprv.net": "2018-08-30", "poczta.mon-gov.pl": "2020-04-06", "poczta.mon.q0v.pl": "2015-12-19", "pointtk.com": "2018-10-05", "politicalreview.eu": "2018-09-05", "politicsadvertisment.com": "2017-02-27", "politicsinform.com": "2018-09-05", "politicweekend.com": "2018-10-05", "popdancestream.com": "2020-04-03", "pornforyou.in": "2018-09-18", "portal-office.fr": "2019-07-08", "posta-hurriyet.com": "2019-10-07", "postfix-mail.firstcloudit.com": "2024-04-18", "postlkwarn.com": "2017-04-10", "postmarksmtp.com": "2019-03-13", "powerfromfamousbank.com": "2022-01-01", "powernoderesources.com": "2018-10-05", "powerpolymerindustry.com": "2019-10-17", "ppcodecs.com": "2018-03-14", "presidencia-docs.firstcloudit.com": "2024-01-30", "presidencia-files.firstcloudit.com": "2024-03-18", "presidencia-gob.firstcloudit.com": "2024-03-18", "presidencia-gov.firstcloudit.com": "2024-03-18", "pressservices.net": "2017-02-27", "primage.com.br": "2022-01-29", "privacy-facebook.me": "2020-04-06", "privacy-hotmail.com": "2018-08-30", "privacy-live.com": "2017-04-14", "privacy-ukr.net": "2017-02-27", "privacy-yahoo.com": "2017-04-14", "privacy-yahooservice.com": "2020-04-06", "privacy-yandex.ru": "2019-10-07", "privacy.google-settings.com": "2018-09-18", "pro.fraispei.com": "2026-03-21", "probenet.eu": "2019-03-13", "product-update.com": "2018-09-18", "profile-hotmail.com": "2017-03-30", "proposalprogram.com": "2019-02-26", "protectingcorpind.com": "2017-02-27", "protectingsearch.com": "2017-11-07", "protector-files.ga": "2017-11-10", "protectpanel.eu3.biz": "2022-01-14", "protonhardstorage.com": "2018-10-05", "proxysys-config.com": "2017-02-27", "pruintco.com": "2018-09-18", "publishdollar.com": "2017-03-30", "pus.akragames.net": "2019-10-07", "pwametalurgica.com.br": "2022-01-29", "q0v.pl": "2015-12-19", "qov.hu.com": "2015-12-19", "qov.info": "2018-08-30", "quadteximagery.com": "2022-01-29", "rada-zakon.firstcloudit.com": "2024-03-18", "radioplaymusicus.com": "2019-03-13", "rammatica.com": "2019-06-04", "rapidfileuploader.org": "2018-08-30", "raveston.com": "2019-06-04", "rdsnets.com": "2018-09-27", "reasonwithusefulpolicy.com": "2019-05-30", "recoverylogin-access.ga": "2017-11-10", "redirect.screenameaol.com": "2019-10-07", "redirect2app.cf": "2020-04-06", "regionsbnk.info": "2015-12-19", "regvirt.com": "2019-02-05", "reinstate-account.com": "2017-02-27", "remnet.org": "2019-03-13", "remonitor.net": "2019-03-13", "remotemanagesvc.net": "2019-03-13", "remotepx.net": "2018-09-27", "remsupport.org": "2018-08-30", "remsvc.net": "2019-03-13", "renodesmart.com": "2019-04-03", "report-yandex.ru": "2019-10-07", "reportscanprotecting.org": "2017-02-27", "researchcontinental.org": "2017-03-30", "reservecorpind.com": "2017-02-27", "reset-password-com.ga": "2017-11-10", "reset-service-identity-mail.42web.io": "2021-10-08", "restore-login-account.gq": "2017-11-10", "retaildemo.info": "2024-12-22", "reuters-press.com": "2018-09-05", "revampme.net": "2020-07-25", "review-quilogin.ga": "2017-11-10", "rhfcoin.com": "2019-03-13", "righttopregnantpower.com": "2018-03-14", "rn-mail.ru": "2020-04-06", "rnil.am": "2018-09-18", "rnil.cl": "2018-09-18", "robot-876.frge.io": "2023-04-19", "rockradiostream.com": "2019-04-03", "royalbsuk.com": "2015-12-19", "rpcnetconnect.com": "2018-09-27", "rsshotmail.com": "2017-02-27", "runssnetworks.com": "2017-11-07", "runvercheck.com": "2018-08-30", "sa7efa.com": "2019-03-13", "saleswarriorinc.com": "2022-01-29", "samsvung.com": "2017-02-27", "saojoaodaurtigars.com.br": "2022-01-29", "satellitedeluxpanorama.com": "2018-03-14", "scanmalware.info": "2015-03-18", "schooltillhungryprocess.com": "2019-05-30", "sdhjjekfp4k.com": "2017-11-07", "search-microsoft.com": "2018-08-30", "searchbrain.net": "2019-03-13", "seatreasures.org": "2015-12-19", "secao.com": "2019-11-15", "secao.org": "2018-08-30", "secnetcontrol.com": "2015-03-18", "secure-bankofamerica--login-com.ga": "2017-11-10", "secure-bankofamerica--login-com.gq": "2017-11-10", "secure-login-helpid-locked.gq": "2017-11-10", "secure-management-login-account-index-webpass.gq": "2017-11-10", "secure-mobile-login1.gq": "2017-11-10", "secure-remove-limitation.com": "2017-02-27", "secure-verification-center.com": "2017-02-27", "secure.actblues.com": "2018-08-30", "secure1-client-login.ga": "2017-11-10", "secure1-client-login.gq": "2017-11-10", "secure1-login-apps.gq": "2017-11-10", "secure5647login-com.ga": "2017-11-10", "secureconnectcompany.com": "2017-02-27", "securemicrosoftstatistic.com": "2018-08-30", "security-apple-id.com": "2017-02-27", "security-check.telegram.org.ohsxy.com": "2022-04-05", "security-icloud-apple.com": "2017-02-27", "security-icloud-localisation.com": "2017-02-27", "security-login-information.gq": "2017-11-10", "security-resolution-center.com": "2017-02-27", "security-verification.net": "2017-02-27", "security-verifications.com": "2017-02-27", "security.ohsxy.com": "2022-04-05", "securitycenter.ga": "2017-11-10", "securitymail.gq": "2017-11-10", "securitypractic.com": "2015-03-18", "securityprotectingcorp.com": "2017-04-10", "securitysls.com": "2018-08-30", "securityupdatereport.com": "2018-08-30", "senate.group": "2018-08-28", "senate.qov.info": "2018-08-30", "sendmevideo.org": "2018-03-14", "seniorsecurityind.com": "2018-08-30", "serbview.com": "2019-03-13", "servertest123.tk": "2019-03-13", "service-account-home-login.gq": "2017-11-10", "service-autoreset-password-youraccount.ga": "2017-11-10", "service-hushmail.com": "2017-03-30", "service-login-apple-verify-account-locked.gq": "2017-11-10", "service-reset-password-moderate-digital.rf.gd": "2021-10-08", "service-ukr.net": "2020-04-06", "service-usa-tre.info": "2018-08-30", "service-yahoo.com": "2020-04-06", "service-yandex.ru": "2019-10-07", "servicecdp.com": "2017-04-12", "servicecorptech.com": "2018-08-30", "servicelogin-access-failed.gq": "2017-11-10", "services-loginaccount.ga": "2017-11-10", "servicesecupdate.com": "2018-08-30", "servicetlnt.net": "2018-09-27", "set121.com": "2018-09-18", "set133.com": "2018-09-18", "setnewcred.ukr.net.frge.io": "2023-07-15", "setnewcreds.ukr.net.frge.io": "2023-04-19", "setnewpass-yahoo.com": "2018-09-18", "setting-mail.ru": "2020-04-06", "settings-live.com": "2017-04-14", "settings-panel.frge.io": "2023-07-15", "settings-yahoo.com": "2015-12-19", "settinqs-yandex.ru": "2019-10-07", "sex-toy-shop.org": "2018-09-18", "sgg-files.firstcloudit.com": "2024-03-18", "sgg-gov.firstcloudit.com": "2024-01-30", "shared-rss.info": "2024-12-22", "sharefiles.gq": "2017-11-10", "shcserv.com": "2017-02-27", "showitem.lt": "2019-03-13", "shurl.biz": "2018-09-05", "signin-icloudsupport.com": "2017-02-27", "signin-login-php.ga": "2017-11-10", "skidkaturag.com": "2018-09-18", "smigroup-online.co.uk": "2018-09-18", "smtp-relay.frge.io": "2023-07-15", "smtprelayhost.com": "2017-11-10", "societyatcuriousteacher.com": "2019-03-13", "sofexjordan2014.com": "2018-09-18", "sofexjordanx.com": "2018-09-18", "soft-storage.com": "2018-09-18", "softupdates.info": "2015-12-19", "softwaresupportsv.com": "2018-08-30", "softwaresupportsv.name": "2019-03-13", "soligro.com": "2018-08-30", "soros-my-sharepoint.com": "2019-07-16", "sourcerepolist.org": "2020-01-14", "space-delivery.com": "2018-08-30", "spelns.com": "2018-08-30", "sportever.org": "2019-06-19", "sportszone71.com": "2017-03-30", "srilankadocuments.ga": "2017-11-10", "srv-yahoo.com": "2018-09-18", "ssandsc.com": "2015-12-19", "standartnevvs.com": "2015-12-19", "startthedownload.com": "2019-03-13", "statement-login-update-info.ga": "2017-11-10", "statisticsnetworks.com": "2019-03-13", "stockliquidationgroup.com": "2018-09-18", "storsvc.org": "2017-04-12", "stratforglobal.net": "2018-09-05", "streetunderrelevantpeople.com": "2019-05-30", "summary-loginconfirmation.ga": "2017-11-10", "sunmicrosystem.info": "2018-09-18", "support-cloud.life": "2020-12-09", "support-icloud-apple.com": "2017-02-27", "support-icloud-localisation.com": "2017-02-27", "support-localisation-icloud.com": "2017-02-27", "support-security-icloud.com": "2017-02-27", "support-svc.com": "2017-02-27", "supports-microsoft.com": "2018-08-30", "supservermgr.com": "2018-08-30", "surll.me": "2018-09-18", "svit-zer.com": "2019-03-13", "sweetcherry.org": "2018-09-18", "swsupporttools.com": "2018-09-05", "swvfy.noreplay-fca.com": "2024-09-02", "symantecsupport.org": "2017-03-30", "symanttec.org": "2015-03-18", "synacorzimbra.nl": "2026-03-21", "syrianhrc.org": "2019-10-07", "sysanalyticweb.com": "2018-09-27", "systembeforeniceparent.com": "2019-05-30", "systembetweendifficultquality.com": "2022-01-01", "systemfromcuriousmoment.com": "2019-03-13", "t-d-canadatrust.com": "2015-12-19", "tablebeforehelpfulperson.com": "2019-03-13", "tabsync.net": "2017-04-12", "taizfbuhgowpawhafyuq23nb2v9kq0rmg.oast.fun": "2024-04-06", "tbmm.qov.web.tr": "2020-04-06", "team-google.com": "2019-10-07", "techcruncln.com": "2015-12-19", "techielawfirms.com": "2015-12-19", "telecharger-01.com": "2018-09-18", "telegram.org.4234e8234ad0f.24o1.com": "2023-04-19", "telegram.org.ohsxy.com": "2022-04-05", "telegram.org.security.ohsxy.com": "2022-04-05", "telemetry-network.com": "2024-12-22", "telsec.org": "2022-04-05", "test.chmail.in": "2018-09-18", "test.fraispei.com": "2026-03-21", "testservice24.net": "2015-03-18", "testsnetcontrol.com": "2015-03-18", "thediplomat-press.com": "2018-09-05", "theguardiannews.org": "2018-09-05", "thepiratecinemaclub.org": "2018-10-05", "thesocialstrategies.com": "2019-06-19", "tieringservice.com": "2024-12-22", "timezoneutc.com": "2018-09-05", "togounoffice.com": "2015-12-19", "tolonevvs.com": "2018-09-18", "top-total.com": "2019-10-07", "topcinemaclub.com": "2018-10-05", "transfersevices.net": "2017-02-27", "transparency-office365.com": "2018-08-30", "transworldpetroleum.com": "2017-02-27", "travelbern.com": "2018-08-30", "treckanalytics.com": "2019-02-05", "treepastwillingmoment.com": "2018-03-14", "trend-news.org": "2018-09-05", "tripadvicecommunity.com": "2019-06-19", "truefashionnews.com": "2018-10-05", "turbify-biz-cesdaz.rf.gd": "2024-05-31", "tuyt8erti867i.synergize.co": "2024-11-14", "tvopen.online": "2018-08-28", "twiterservices.org": "2017-02-27", "ua-calendar.firstcloudit.com": "2023-12-28", "ua-consumerpanel.frge.io": "2022-03-08", "ubagroupsgh.com": "2015-12-19", "uber-mails.com": "2018-08-30", "ukraine.html-5.me": "2024-10-23", "ukrainesafe.is-great.org": "2024-11-01", "ukrainesafeurl.talebco.ir": "2024-10-29", "ukroboronprom.com.ukr.pm": "2023-04-19", "ukrprivacysite.frge.io": "2023-07-15", "ukrprivatesite.frge.io": "2023-04-19", "um10eset.net": "2018-10-12", "umizg.org": "2018-08-30", "un-unicef.org": "2015-12-19", "unbulletin.com": "2020-04-06", "unian-news.info": "2018-09-05", "unicomba.com": "2015-12-19", "unigymboom.com": "2019-02-05", "unimarkstamp.com": "2018-08-28", "uniquecorpind.com": "2017-04-10", "unisecproper.org": "2019-03-13", "unitednat.org": "2015-12-19", "unitednationsnews.eu": "2018-09-05", "unitedprosoftcompany.org": "2019-03-13", "universalcoba.com": "2015-12-19", "unizg.net": "2018-09-18", "unrightswire.org": "2019-10-07", "unsecured-login-attempt.ga": "2017-11-10", "update-adobe.com": "2017-02-27", "update-hub.com": "2018-09-18", "update-security-information.com": "2017-02-27", "update-zimbra.com": "2018-09-18", "updateapi.longmusic.com": "2018-09-18", "updatecenter.name": "2015-10-21", "updatepc.org": "2015-03-18", "updatepple.com": "2017-02-27", "updaterweb.com": "2021-06-03", "updates-windows.com": "2018-08-30", "updateservicecenter.blogspot.com": "2022-01-14", "updatesoftware24.com": "2015-03-18", "updatesrvx.net": "2017-02-27", "updatesvcsys.com": "2018-08-30", "updatesystem.info": "2018-08-30", "updatesystems.net": "2017-03-30", "updmanager.com": "2018-09-05", "uploader.sytes.net": "2017-03-30", "uploadsforyou.com": "2019-03-13", "urjaa.nitrocreditfix.com": "2024-09-02", "us-facebook.com": "2017-02-27", "us-mg6-mailreport.com": "2018-09-18", "us-mg6-transfermail-service.com": "2018-09-18", "us-mg6mail-service.com": "2018-09-18", "us-mg6mailyahoo.com": "2018-09-18", "us-mg7mail-transferservice.com": "2018-09-18", "us-westmail-undeliversystem.com": "2018-09-18", "utmserver.com": "2022-01-01", "uttlh.peterswaysales.com": "2024-09-02", "valuetable.hk": "2018-09-18", "varuhusmc.org": "2019-10-17", "vascothreatscan.org": "2017-11-07", "verify-login-account-iinformation.ga": "2017-11-10", "verify-login-account-iinformation.gq": "2017-11-10", "vermasterss.com": "2018-08-30", "versiontask.com": "2017-04-10", "vgjkifguotgi.talebco.ir": "2024-10-04", "vice-news.com": "2018-09-18", "virtsvc.com": "2018-10-05", "virusdefender.org": "2018-09-05", "visualrates.com": "2019-02-05", "viters.org": "2018-03-14", "vppdr.com": "2026-03-18", "vsnet.co": "2019-02-05", "vtxhospital.com": "2023-07-16", "vvorthyhands.org": "2018-09-18", "w9umi9wrvzsvlvstvfvslbumdfdvda5tl.1.d.255.adobeproduct.com": "2017-11-07", "watertolargeprice.com": "2019-03-13", "webcdelivery.com": "2018-03-14", "webchartzone.com": "2020-04-03", "webmail-gov.me": "2020-04-06", "webmail-ibsf.org": "2018-10-29", "webmail-mil.gr": "2020-04-06", "webmail-saic.com": "2017-03-30", "webmail-saic.net": "2018-08-30", "webmail.afghanistanmfa.net": "2019-10-07", "webmail.mofa.qov.ae": "2020-04-06", "webmail.westinqhousenuclear.com": "2017-04-14", "webmail.windows-updater.com": "2018-09-18", "webstp.com": "2018-09-27", "webversionact.org": "2018-08-30", "webviewres.net": "2018-08-30", "welcome-apple-protectyourpassword.gq": "2017-11-10", "wellnesscaremed.com": "2026-02-02", "wellnessmedcare.org": "2026-02-02", "westinqhousenuclear.com": "2017-04-14", "whatsapp-in.com": "2017-03-30", "win32support.com": "2018-08-30", "wind0ws.kz": "2018-09-18", "windous.kz": "2018-09-18", "windowofficeupdate.com": "2018-08-30", "windows-updater.com": "2015-03-18", "windows.mswordupdate17.com": "2017-11-07", "windows81.duckdns.org": "2017-11-07", "windowsappstore.net": "2018-08-30", "windowscheckupdater.net": "2017-03-30", "windowsdefltr.net": "2018-09-27", "windowsofficeupdate.com": "2017-02-27", "windowsupdater.net": "2018-08-30", "windowsxupdate.com": "2018-08-30", "winsyscheck.com": "2018-08-30", "winsyschecks.com": "2017-03-30", "winsystemsvc.net": "2017-02-27", "wintwinbtc.com": "2019-03-13", "winupdatesysmic.com": "2017-03-30", "wmdmediacodecs.com": "2018-03-14", "wmiapp.com": "2019-03-13", "wody-info-files.firstcloudit.com": "2024-03-18", "wordkeyvpload.net": "2022-01-27", "wordkeyvpload.org": "2022-01-27", "world-oil-company.com": "2018-09-18", "worldchanneltour.com": "2019-06-19", "worldimagebucket.com": "2018-10-05", "worldmilitarynews.org": "2017-03-30", "worldpoliticsnews.org": "2017-03-30", "worldpoliticsreviews.com": "2018-09-05", "worldpostjournal.com": "2018-09-05", "wpadsettings.net": "2017-02-27", "wscapi.com": "2017-04-12", "wsjworld.com": "2020-04-06", "wsusconnect.com": "2017-02-27", "www-logined-apple-authsecure.ga": "2017-11-10", "www.7daysinabudhabi.org": "2018-09-18", "www.account-flickr.com": "2018-09-18", "www.actblues.com": "2018-08-30", "www.adawareblock.com": "2018-09-18", "www.adobeupdater.org": "2018-08-30", "www.chmail.in": "2018-09-18", "www.dailyforeignnews.com": "2018-08-30", "www.diplomatnews.org": "2018-08-30", "www.dkvnz.com": "2018-09-18", "www.eurosatory-2014.com": "2018-09-18", "www.forsvaret.co": "2018-09-18", "www.gdforum.info": "2018-09-18", "www.info2t.com": "2018-08-30", "www.microsoftdriver.com": "2018-08-30", "www.microsofthelpcenter.info": "2018-08-30", "www.mscoresvw.com": "2018-08-30", "www.natoint.com": "2018-08-30", "www.office365-onedrive.com": "2018-08-30", "www.onedrive365.com": "2018-08-30", "www.servicesecupdate.com": "2018-08-30", "www.sofexjordanx.com": "2018-09-18", "www.sportszone71.com": "2018-08-30", "www.srv-yahoo.com": "2018-09-18", "www.surll.me": "2018-09-18", "www.symantecsupport.org": "2018-08-30", "www.us-mg7mail-transferservice.com": "2018-09-18", "www.us-westmail-undeliversystem.com": "2018-09-18", "www.valuetable.hk": "2018-09-18", "www.vljaihln.com": "2018-09-18", "www.windowscheckupdater.net": "2018-08-30", "www.winupdatesysmic.com": "2018-08-30", "www.worldmilitarynews.org": "2018-08-30", "www.ya-support.com": "2018-09-18", "www.yahoo-monitor.com": "2018-09-18", "xfgjgjkuykykgihguifdt.mywire.org": "2024-02-22", "xgfdstu6k.frge.io": "2024-05-31", "xn--amazo-d8a.com": "2017-02-27", "xuetue2013.com": "2018-09-18", "xzdgsdfhfgtjdfj.wuaze.com": "2024-05-31", "y-privacy.com": "2018-09-18", "ya-login.com": "2018-09-18", "ya-support.com": "2018-09-18", "yahoo-analytics.com": "2018-09-18", "yahoo-change-password.com": "2020-03-19", "yahoo-monitor.com": "2018-09-18", "yahoo.chmail.in": "2018-09-18", "yahoo.securepassword.info": "2020-04-06", "yandex-control.ru": "2019-10-07", "yandex-report.ru": "2019-10-07", "yandex-site.com": "2018-09-18", "yavuz16.org": "2018-09-18", "youtubeclip.org": "2018-09-18", "yovtube.co": "2015-12-19", "yuotubc.com": "2017-02-27", "zhblz.com": "2024-10-26", "zimbra-metadata.com": "2026-03-21", "zimbrasoft.com.ua": "2026-03-21", "zimbrastat.com": "2026-03-21", "zmailanalytics.com": "2026-03-21", "zoomailer.org": "2019-03-19", "zpfgr.com": "2019-03-13", "zxrgh.viouni.com": "2024-09-02" }, "ipv4": { "101.255.119.42:445": "2023-04-11", "103.140.186.148:53": "2026-04-08", "103.140.186.149:53": "2026-04-08", "103.140.186.155:53": "2026-04-08", "109.169.15.73": "2020-01-20", "113.160.234.229:445": "2023-04-11", "128.199.199.187:443": "2019-08-06", "144.126.202.227:22": "2026-01-02", "145.249.106.198:443": "2020-04-11", "148.252.42.42:54467": "2024-03-18", "163.172.67.233:5000": "2024-03-07", "167.114.153.55:443": "2019-08-06", "168.205.200.55:445": "2023-04-11", "172.114.170.18:445": "2024-04-18", "172.114.170.18:55155": "2024-03-18", "174.53.242.108:8080": "2024-05-31", "178.32.251.98": "2020-01-20", "18.157.68.73:15254": "2024-09-03", "18.192.93.86:11962": "2024-09-03", "18.197.239.109:10176": "2024-10-02", "181.209.99.204:445": "2023-04-11", "184.95.51.172": "2020-01-20", "185.117.88.22:53": "2026-04-08", "185.117.88.28:53": "2026-04-08", "185.117.88.29:53": "2026-04-08", "185.117.88.30:53": "2026-04-08", "185.117.88.31:53": "2026-04-08", "185.117.88.50:53": "2026-04-08", "185.117.88.60:53": "2026-04-08", "185.117.88.61:53": "2026-04-08", "185.117.88.62:53": "2026-04-08", "185.117.89.32:53": "2026-04-08", "185.117.89.46:53": "2026-04-08", "185.117.89.47:53": "2026-04-08", "185.132.17.160:445": "2023-04-11", "185.141.63.103": "2020-01-20", "185.234.73.58:53": "2026-04-08", "185.234.73.61:53": "2026-04-08", "185.234.73.62:53": "2026-04-08", "185.236.203.53:443": "2020-04-11", "185.237.166.224:53": "2026-04-08", "185.237.166.225:53": "2026-04-08", "185.237.166.226:53": "2026-04-08", "185.237.166.227:53": "2026-04-08", "185.237.166.228:53": "2026-04-08", "185.237.166.229:53": "2026-04-08", "185.237.166.230:53": "2026-04-08", "185.237.166.231:53": "2026-04-08", "185.237.166.232:53": "2026-04-08", "185.237.166.233:53": "2026-04-08", "185.237.166.234:53": "2026-04-08", "185.237.166.235:53": "2026-04-08", "185.237.166.236:53": "2026-04-08", "185.237.166.237:53": "2026-04-08", "185.237.166.238:53": "2026-04-08", "185.237.166.239:53": "2026-04-08", "185.237.166.240:53": "2026-04-08", "185.237.166.241:53": "2026-04-08", "185.237.166.242:53": "2026-04-08", "185.237.166.243:53": "2026-04-08", "185.237.166.244:53": "2026-04-08", "185.237.166.245:53": "2026-04-08", "185.237.166.246:53": "2026-04-08", "185.237.166.247:53": "2026-04-08", "185.237.166.248:53": "2026-04-08", "185.237.166.249:53": "2026-04-08", "185.237.166.55:53": "2026-04-08", "185.237.166.56:53": "2026-04-08", "185.237.166.57:53": "2026-04-08", "185.237.166.58:53": "2026-04-08", "185.237.166.59:53": "2026-04-08", "185.237.166.60:53": "2026-04-08", "185.237.166.61:53": "2026-04-08", "185.237.166.62:53": "2026-04-08", "185.237.166.63:53": "2026-04-08", "185.237.166.64:53": "2026-04-08", "185.237.166.65:53": "2026-04-08", "185.237.166.66:53": "2026-04-08", "185.237.166.67:53": "2026-04-08", "185.237.166.68:53": "2026-04-08", "185.237.166.69:53": "2026-04-08", "185.237.166.70:53": "2026-04-08", "185.237.166.71:53": "2026-04-08", "185.237.166.72:53": "2026-04-08", "185.237.166.73:53": "2026-04-08", "185.237.166.74:53": "2026-04-08", "185.237.166.75:53": "2026-04-08", "193.70.80.214": "2020-01-20", "194.126.178.8:445": "2023-12-28", "194.126.178.8:55555": "2024-03-18", "202.55.80.225:35770": "2024-01-22", "203.161.50.145:22": "2024-10-26", "203.161.50.145:5000": "2026-03-11", "203.161.50.145:6211": "2024-10-26", "203.161.50.145:8080": "2026-03-11", "203.161.50.145:8443": "2024-10-26", "203.161.50.145:8889": "2026-03-11", "213.32.252.221:445": "2023-04-11", "23.106.120.119:53": "2026-04-08", "23.200.147.10:80": "2020-10-29", "23.24.68.109:443": "2024-06-15", "24.142.165.2:445": "2023-12-09", "24.88.87.29:445": "2024-04-06", "3.67.15.169:1746": "2024-10-23", "31.220.61.251:443": "2019-08-06", "37.191.122.186:3578": "2023-07-16", "37.221.64.101:53": "2026-04-08", "37.221.64.116:53": "2026-04-08", "37.221.64.131:53": "2026-04-08", "37.221.64.148:53": "2026-04-08", "37.221.64.149:53": "2026-04-08", "37.221.64.150:53": "2026-04-08", "37.221.64.151:53": "2026-04-08", "37.221.64.163:53": "2026-04-08", "37.221.64.173:53": "2026-04-08", "37.221.64.199:53": "2026-04-08", "37.221.64.208:53": "2026-04-08", "37.221.64.224:53": "2026-04-08", "37.221.64.254:53": "2026-04-08", "37.221.64.77:53": "2026-04-08", "37.221.64.78:53": "2026-04-08", "37.221.64.93:53": "2026-04-08", "42.98.5.225:445": "2023-12-09", "45.61.169.221:445": "2024-10-26", "5.199.162.132:445": "2023-03-27", "5.226.137.151:53": "2026-04-08", "5.226.137.230:53": "2026-04-08", "5.226.137.231:53": "2026-04-08", "5.226.137.232:53": "2026-04-08", "5.226.137.234:53": "2026-04-08", "5.226.137.235:53": "2026-04-08", "5.226.137.242:53": "2026-04-08", "5.226.137.243:53": "2026-04-08", "5.226.137.244:53": "2026-04-08", "5.226.137.245:53": "2026-04-08", "50.173.136.70:445": "2023-12-05", "61.14.68.33:445": "2023-04-11", "62.4.36.126:8880": "2023-07-07", "64.120.31.100:53": "2026-04-08", "64.120.31.96:53": "2026-04-08", "64.120.31.97:53": "2026-04-08", "64.120.31.98:53": "2026-04-08", "64.120.31.99:53": "2026-04-08", "64.44.154.227:53": "2026-04-08", "64.44.154.237:53": "2026-04-08", "64.44.154.238:53": "2026-04-08", "64.44.154.239:53": "2026-04-08", "64.44.154.240:53": "2026-04-08", "68.76.150.97:8080": "2024-05-31", "69.162.253.21:445": "2023-04-11", "69.51.2.106:445": "2023-12-09", "73.80.9.137:35780": "2024-05-31", "77.83.197.37:53": "2026-04-08", "77.83.197.38:53": "2026-04-08", "77.83.197.39:53": "2026-04-08", "77.83.197.40:53": "2026-04-08", "77.83.197.41:53": "2026-04-08", "77.83.197.42:53": "2026-04-08", "77.83.197.43:53": "2026-04-08", "77.83.197.44:53": "2026-04-08", "77.83.197.45:53": "2026-04-08", "77.83.197.46:53": "2026-04-08", "77.83.197.47:53": "2026-04-08", "77.83.197.48:53": "2026-04-08", "77.83.197.49:53": "2026-04-08", "77.83.197.50:53": "2026-04-08", "77.83.197.51:53": "2026-04-08", "77.83.197.52:53": "2026-04-08", "77.83.197.53:53": "2026-04-08", "77.83.197.54:53": "2026-04-08", "77.83.197.55:53": "2026-04-08", "77.83.197.56:53": "2026-04-08", "77.83.197.57:53": "2026-04-08", "77.83.197.58:53": "2026-04-08", "77.83.197.59:53": "2026-04-08", "77.83.197.60:53": "2026-04-08", "77.83.198.39:53": "2026-04-08", "78.142.19.114": "2020-01-20", "79.141.160.78:53": "2026-04-08", "79.141.161.66:53": "2026-04-08", "79.141.161.67:53": "2026-04-08", "79.141.161.68:53": "2026-04-08", "79.141.161.69:53": "2026-04-08", "79.141.161.70:53": "2026-04-08", "79.141.161.71:53": "2026-04-08", "79.141.161.72:53": "2026-04-08", "79.141.161.73:53": "2026-04-08", "79.141.161.74:53": "2026-04-08", "79.141.161.75:53": "2026-04-08", "79.141.161.76:53": "2026-04-08", "79.141.161.77:53": "2026-04-08", "79.141.161.78:53": "2026-04-08", "79.141.161.79:53": "2026-04-08", "79.141.161.80:53": "2026-04-08", "79.141.161.81:53": "2026-04-08", "79.141.161.82:53": "2026-04-08", "79.141.161.83:53": "2026-04-08", "79.141.161.84:53": "2026-04-08", "79.141.161.85:53": "2026-04-08", "79.141.173.103:53": "2026-04-08", "79.141.173.119:53": "2026-04-08", "79.141.173.120:53": "2026-04-08", "79.141.173.121:53": "2026-04-08", "79.141.173.122:53": "2026-04-08", "79.141.173.123:53": "2026-04-08", "79.141.173.200:53": "2026-04-08", "79.141.173.210:53": "2026-04-08", "79.141.173.211:53": "2026-04-08", "79.141.173.231:53": "2026-04-08", "79.141.173.232:53": "2026-04-08", "79.141.173.233:53": "2026-04-08", "79.141.173.246:53": "2026-04-08", "79.141.173.247:53": "2026-04-08", "79.141.173.248:53": "2026-04-08", "79.141.173.249:53": "2026-04-08", "79.141.173.250:53": "2026-04-08", "79.141.173.251:53": "2026-04-08", "79.141.173.252:53": "2026-04-08", "79.141.173.253:53": "2026-04-08", "79.141.173.254:53": "2026-04-08", "79.141.173.70:53": "2026-04-08", "79.141.173.96:53": "2026-04-08", "79.141.173.97:53": "2026-04-08", "79.141.173.98:53": "2026-04-08", "79.143.87.229:53": "2026-04-08", "79.143.87.232:53": "2026-04-08", "79.143.87.240:53": "2026-04-08", "79.143.87.243:53": "2026-04-08", "79.143.87.249:53": "2026-04-08", "80.255.3.116": "2020-01-20", "82.118.242.171:443": "2019-08-06", "82.196.113.102:445": "2023-04-11", "85.195.206.7:445": "2023-03-16", "86.123.151.53:4430": "2024-02-22", "88.80.148.49:53": "2026-04-08", "88.80.148.53:53": "2026-04-08", "89.150.40.43:53": "2026-04-08", "89.150.40.86:53": "2026-04-08", "89.96.196.150:8080": "2023-09-05", "94.237.37.28:443": "2019-08-06" }, "url": { "109.248.148.42/agr-enum/progress-inform/cube.php": "2018-12-19", "145.249.105.165/resource-store/stockroom-center-service/check.php": "2018-12-19", "185.203.118.198/en_action_device/center_correct_customer/drivers-i7-x86.php": "2018-10-20", "188.241.58.170/live/owa/office.dotm": "2018-12-19", "188.241.58.170/local/s3/filters.php": "2018-12-19", "200.122.181.25/catalog/products/books.php": "2018-12-19", "45.124.132.127/action-center/centerforserviceandaction/service-and-action.php": "2018-10-20", "c4csa.org/includes/sources/felims.php": "2021-02-19", "http://101.255.119.42": "2023-04-11", "http://104.171.117.216": "2019-03-19", "http://109.248.148.42": "2022-12-16", "http://113.160.234.229": "2023-04-11", "http://168.205.200.55": "2023-04-11", "http://172.114.170.18": "2024-04-18", "http://181.209.99.204": "2023-04-11", "http://185.132.17.160": "2023-04-11", "http://185.221.202.35/software-protection/app.php": "2019-09-25", "http://185.221.202.36": "2020-05-05", "http://185.234.52.168": "2020-06-07", "http://185.236.203.53": "2020-04-11", "http://185.25.50.93": "2020-10-23", "http://185.25.51.114": "2020-10-23", "http://185.25.51.164": "2020-10-23", "http://185.25.51.198": "2020-10-23", "http://185.77.129.152": "2020-04-30", "http://185.77.131.110": "2020-12-10", "http://185.86.149.125": "2020-08-13", "http://188.241.68.121": "2020-10-23", "http://194.126.178.8": "2023-12-28", "http://194.187.249.126": "2020-04-11", "http://194.32.78.245": "2020-08-08", "http://198.27.64.218": "2024-04-18", "http://213.103.67.193": "2020-10-23", "http://213.252.244.219": "2020-10-23", "http://213.252.245.132": "2020-10-23", "http://213.252.245.32/ControllerReset/view/register/comid/sid.php": "2019-06-30", "http://213.32.252.221": "2023-04-11", "http://220.158.216.127": "2020-04-11", "http://222.15.23.121": "2020-10-23", "http://23.227.196.215": "2020-05-17", "http://23.24.68.109": "2024-06-15", "http://24.142.165.2": "2023-12-09", "http://24.88.87.29": "2024-04-06", "http://31.7.62.103": "2020-09-29", "http://37.120.140.215": "2019-11-20", "http://42.98.5.225": "2023-12-09", "http://46.102.152.127": "2020-10-23", "http://46.183.218.34": "2020-12-10", "http://46.183.223.227": "2020-10-23", "http://5.199.162.132": "2023-03-27", "http://50.173.136.70": "2023-12-05", "http://61.14.68.33": "2023-04-11", "http://69.162.253.21": "2023-04-11", "http://69.51.2.106": "2023-12-09", "http://69.90.132.215": "2020-08-20", "http://79.142.70.106": "2019-11-20", "http://80.255.12.252": "2020-12-10", "http://80.255.6.5": "2020-04-11", "http://82.196.113.102": "2023-04-11", "http://83.147.243.18": "2024-08-26", "http://85.195.206.7": "2023-03-17", "http://86.105.18.106": "2020-10-23", "http://86.105.18.111": "2020-10-23", "http://86.106.131.177": "2020-10-23", "http://88.209.251.6": "2023-12-28", "http://89.249.65.166": "2020-10-23", "http://89.249.65.234": "2020-10-23", "http://89.37.226.123/advance/portable_version/service.php": "2020-04-04", "http://89.37.226.148": "2020-06-10", "http://89.40.181.126": "2020-10-23", "http://89.45.67.153": "2020-10-23", "http://92.114.92.128": "2020-12-10", "http://93.113.131.117": "2020-10-23", "http://93.113.131.155": "2020-10-23", "http://93.115.38.132": "2020-04-30", "http://93.170.72.54": "2026-03-11", "http://94.156.189.120": "2019-06-04", "kompartpomiar.pl/grafika/": "2022-06-20", "mockbin.org/bin/4aa17a07-7635-4ee0-9f3a-449fcd91f342": "2023-05-02", "mockbin.org/bin/b8427b58-7497-46cd-a5b2-6ff6a40b4592": "2023-05-02", "mockbin.org/bin/e8bfd045-2b14-4afc-9372-b723f7d76918": "2023-05-02", "run.mocky.io/v3/1e88179a-3105-4a5c-9eb3-aebea36e9c21": "2023-05-02", "run.mocky.io/v3/22a2a2d8-84b9-4619-b8ba-359beb386cf9": "2025-01-13", "run.mocky.io/v3/3b44f33d-b6e5-4ec6-b120-99b6ac52f74b": "2023-05-02", "run.mocky.io/v3/47d78e98-8d12-452a-922b-bae56450a393": "2024-09-13", "run.mocky.io/v3/4e14d583-bbf5-4af3-9a86-4c0938a7802a": "2024-05-31", "run.mocky.io/v3/6ba09505-fa73-4d92-b209-641bfc51b6e2": "2024-10-02", "run.mocky.io/v3/6c446a45-05aa-4198-9a81-d4472d7e81cb": "2024-09-21", "run.mocky.io/v3/8dbd585e-805d-4b14-8485-c6da4c3ef5a7": "2024-10-04", "run.mocky.io/v3/a261411d-b869-4877-86f5-307e32ed6afa": "2023-05-02", "run.mocky.io/v3/a4b6625c-226e-4dbc-baec-1dbd854b8015": "2023-05-02", "run.mocky.io/v3/acea62da-ca05-46d1-bb80-0b036af7467c": "2023-05-02", "run.mocky.io/v3/da384ab3-f749-42d5-a076-40c248dece9b": "2024-11-02", "run.mocky.io/v3/df8e33e0-4c17-4564-917f-9fbff17f4571": "2024-10-04", "run.mocky.io/v3/ef206b51-4cf4-4c93-90bf-1e66673315b0": "2023-05-02", "run.mocky.io/v3/ef4c7798-fc09-42cd-8431-91a22d5728d9": "2023-05-02", "stayathomeclasses.com/slpw/up.php": "2026-01-02", "webhook.site/0d2dc90e-2d5e-49f8-8249-d7ab955c387a": "2024-05-08", "webhook.site/0ef0dcf7-f258-4d02-b274-cbf62a2000cf": "2024-05-08", "webhook.site/127df518-52be-46c5-bbb2-0479f4b9693b": "2024-05-08", "webhook.site/1658772a-4de8-4368-a604-980c90b0a1ed": "2024-05-08", "webhook.site/2d07e34c-3dd3-45e8-865c-3888a65ab885": "2024-05-08", "webhook.site/3f396db1-2016-4b69-9ec3-ffc417d5f3aa": "2024-05-08", "webhook.site/4ba464d9-0675-4a7a-9966-8f84e93290ba": "2024-05-08", "webhook.site/4e6cf717-e4d6-4f40-9f2d-134196fa5e7d/": "2026-02-14", "webhook.site/4fe5885c-f2f6-4905-8bc7-aef1a046a134": "2024-05-08", "webhook.site/508da0df-7ec9-420e-b1fe-958fbbe699d1": "2024-05-08", "webhook.site/5100fcc0-f6be-4b09-8c58-5a8a6706ec4f": "2024-05-08", "webhook.site/5744c020-a8d9-4755-abfb-cde6ccd450af/": "2026-02-14", "webhook.site/577b82c3-7249-44e9-9353-5eab106fead6": "2024-05-08", "webhook.site/5a8758c6-5702-4fea-9d5e-4fbdb6dd795f": "2024-05-08", "webhook.site/5dbed3be-f1c9-41e5-b5d5-e961d08b5fba/": "2026-02-14", "webhook.site/5e4c7949-30a2-4477-9e9b-e8828fc76a1b": "2024-05-08", "webhook.site/62114596-33f5-47fb-9012-0223529e5a13/": "2026-02-14", "webhook.site/66d5b9f9-a5eb-48e6-9476-9b6142b0c3ae": "2024-08-02", "webhook.site/66ea3bbc-29dc-4ece-b804-71c6ec7b77b6": "2024-05-08", "webhook.site/68d68fc7-aa94-4f2d-a727-d18fb40b0d69/": "2026-02-14", "webhook.site/7674f06b-e435-4470-a594-6d59578c552d": "2024-05-08", "webhook.site/8bf50371-5f9f-4d45-9320-922b068ebc2e": "2026-01-02", "webhook.site/90fea98f-fbdb-4847-be03-409d02a43caf": "2024-05-08", "webhook.site/92a1c89c-c371-4b93-a91c-cb0d61b3432d": "2024-03-07", "webhook.site/9a9cdaf8-120c-4de9-b17a-d6d8e2796a3b": "2024-05-08", "webhook.site/9c87649c-220d-425d-8331-ffc8d9b94a38": "2024-05-08", "webhook.site/a3f4e990-0b2a-4f6a-a02e-c573005de3ee/": "2026-02-14", "webhook.site/a72d8905-b15f-4e95-9a8f-5e4bb7dc9b3d/": "2026-02-14", "webhook.site/b10bd697-1a9f-4ec7-aa2f-1fa84ad916a1": "2024-05-08", "webhook.site/bc349b93-b047-42f8-a421-d45e3ec94dc5": "2024-05-08", "webhook.site/bec23763-b8d9-4191-99ba-04a4a163b4de": "2024-05-08", "webhook.site/c1112bb3-0e6e-4ba4-abe7-fb31388b47ad": "2024-05-08", "webhook.site/c29905ab-e5fa-446c-8958-4eab15d8fb80/": "2026-02-14", "webhook.site/c2dceeb0-d40d-41a2-8622-118fa974649c/": "2026-03-27", "webhook.site/c2e1be16-401b-4f60-8a0f-276b30417fda/": "2026-02-14", "webhook.site/c618ea32-2923-4c12-8151-8d0002b56af0": "2024-05-08", "webhook.site/d290377c-82b5-4765-acb8-454edf6425dd": "2024-08-02", "webhook.site/d466f7a7-63a1-4c04-8347-fe2d0a96081f": "2024-05-31", "webhook.site/d63049e3-1cbe-474b-9005-237517af53a7/": "2026-02-14", "webhook.site/dee016bf-21a2-45dd-86b4-6099747794c4": "2024-05-08", "webhook.site/e13d23aa-b6f8-4491-9adc-71f7f8c438df": "2024-05-08", "webhook.site/e2831741-d8c8-4971-9464-e52d34f9d611": "2024-03-18", "webhook.site/e7f39f18-bcb3-40e3-9e82-8cf7f807cc80": "2024-05-31", "webhook.site/efb79108-a2b5-4cba-844d-6352bb8fad8c": "2024-05-08", "webhook.site/f5eace0b-062b-402f-a006-63b97e4950c3": "2024-05-31", "webhook.site/f97bcee0-0d91-4503-a30c-027f1b34820f": "2024-05-08", "xbhp.com/dominargreatasianodyssey/wp-content/plugins/akismet/style.php": "2021-02-18" }, "url_path": { "/CheckNow864.php": "2020-10-23", "/KB7735-9927/security-serv/opt.php": "2020-10-23", "/LoG-statistic8397420934809/date-update9048353094c/StaticIpUpdateLog23741033.php": "2020-10-23", "/MsKZrpUfe.php": "2020-10-23", "/StaticIpUpdateLog23741033.php": "2020-10-23", "/SupportA91i/syshelpA774i/": "2020-10-23", "/SupportA91i/syshelpA774i/viewsupp.php": "2019-04-08", "/UpdateCertificate33-33725cnm^BB/CheckerNow-saMbA-99-36^11/CheckerSerface^8830-11.php": "2020-10-23", "/Verifica-El-Lanzamiento/Ayuda-Del-Sistema/obtenerId.php": "2019-04-08", "/action-center/centerforserviceandaction/service-and-action.php": "2019-03-18", "/advance/portable_version/service.php": "2019-04-08", "/advanced/portable_version/service.php": "2019-03-18", "/agr-enum/progress-inform/cube.php": "2019-04-08", "/apps.update/DetailsID/clientPID-118253.php": "2020-10-23", "/categories/buildings.php": "2020-06-07", "/client-update-info/version-id/version333.php": "2020-10-23", "/clientid-and-uniqued-r2/the-differenceU/Events76.php": "2020-10-23", "/company-device-support/values/correlate-sec.php": "2019-03-18", "/cumulative-security-update/Summary/details.php": "2020-10-23", "/daily-update-certifaicates52735462534234/update-15.dat/": "2020-10-23", "/data-extract/timermodule/update-client.php": "2020-10-23", "/database-update-centre/check-system-version/id=18862.php": "2020-10-23", "/db-module/version_1594/main.php": "2019-04-08", "/db7749sc.php": "2020-10-23", "/debug-info/pluginId/CLISD1934.php": "2020-10-23", "/en_action_device/center_correct_customer/drivers-i7-x86.php": "2019-04-08", "/execdwn.php": "2023-12-05", "/execdwn.php?id=": "2023-12-05", "/fdfd_iunb_hhert_ps.php": "2020-10-23", "/fdfd_iunub_hhert_ps.php": "2019-04-08", "/filedwn.php": "2023-12-05", "/filedwn.php?id=": "2023-12-05", "/func112SerErr.php": "2020-10-23", "/get-help-software/get-app-c/error-code-lookup.php": "2020-10-23", "/gft_piyes/ndhfkuryhs09/fdfd_iunb_hhert_ps.php": "2020-10-23", "/ghflYvz/vmwWIdx/realui.php": "2020-10-23", "/grenadLibS44-two/fIndToClose12t3/sol41.php": "2020-10-23", "/guard-service/Servers-ip4/upd-release": "2020-10-23", "/int-release/check-user/userid.php": "2020-10-23", "/local/s3/filters.php": "2019-04-08", "/locale/protocol/volume.php": "2019-03-18", "/managment/cb-secure/technology.php": "2020-12-09", "/manual/current/symphony.php": "2019-06-04", "/modules/Contact/Includes/1c.php": "2019-10-25", "/modules/Contact/Includes/2c.php": "2019-10-25", "/ndhfkuryhs09/": "2020-10-23", "/overstock/brand.php": "2020-05-05", "/pkg/image/do.php": "2019-04-08", "/protect/get-upd-id.php": "2020-08-08", "/ram-data/managerId/REM1234.php": "2020-10-23", "/resource-store/stockroom-center-service/check.php": "2019-04-08", "/search-release/Search-Version/crmclients.php": "2020-10-23", "/search-sys-update-release/base-sync/db7749sc.php": "2020-10-23", "/security-services-DMHA-group/info-update-version/id77820082.php": "2020-10-23", "/services-check-update/security-certificate-11-554/CheckNow864.php": "2020-10-23", "/setting-the-os-release/Support-OS-release/ApiMap.php": "2020-10-23", "/setwsdv4.php": "2020-10-23", "/srvSettings/conf4421i/": "2020-10-23", "/srvSettings/conf4421i/support.php": "2020-10-23", "/srv_upd_dest_two/destBB/en.php": "2020-10-23", "/stream-upd-service-two/definition/event.php": "2020-10-23", "/supportfsys/t863321i/func112SerErr.php": "2020-10-23", "/supptech18i/suppid.php": "2019-04-08", "/syshelp/kd8812u/": "2020-10-23", "/syshelp/kd8812u/protocol.php": "2020-10-23", "/tech99-04/litelib1/": "2020-10-23", "/tech99-04/litelib1/setwsdv4.php": "2020-10-23", "/techicalBS391-two/supptech18i/suppid.php": "2020-10-23", "/technet-support/library/online-service-description.php": "2019-03-18", "/test-update-16-8852418/temp727612430/checkUpdate89732468.php": "2020-10-23", "/test-update-17-8752417/temp827612480/checkUpdate79832467.php": "2020-10-23", "/update/dB-Release/NewBaseCheck.php": "2020-10-23", "/verification-online/service.911-19/check-verification-88291.php": "2020-10-23", "/versionID/Plugin0899/debug-release01119": "2020-10-23", "/wWpYdSMRulkdp/": "2020-10-23", "/wWpYdSMRulkdp/arpz/": "2020-10-23", "/wWpYdSMRulkdp/arpz/MsKZrpUfe.php": "2020-10-23", "/wwpydsmrulkdp/arpz/": "2020-04-30", "/zx-system/core/main-config.php": "2019-04-08" } }, "first_seen_precision": { "domain": {}, "ipv4": { "144.126.202.227:22": "at-or-before" }, "url": { "stayathomeclasses.com/slpw/up.php": "at-or-before", "webhook.site/8bf50371-5f9f-4d45-9320-922b068ebc2e": "at-or-before" }, "url_path": {} }, "first_seen_range": { "earliest": "2015-03-18", "latest": "2026-04-08" }, "generated_at": "2026-08-08T03:26:30+00:00", "indicators": { "domain": [ "000000027.xyz", "0x4fc271.tk", "0xf4a5.tk", "0xf4a54cf56.tk", "1000018.xyz", "1000020.xyz", "100plusapps.com", "1221.site", "15052021.space", "150520212.space", "150520213.space", "1681683130.website", "16868138130.space", "1833.site", "1oo7.net", "200200.duckdns.org", "2055.site", "2215.site", "29572459487545-4543543-543534255-454-35432524-5243523-234543.xyz", "2f9348243249382479234343284324023432748892349702394023.xyz", "32689657.xyz", "32689658.xyz", "32689659.xyz", "33655990.cyou", "34564414564.com", "357.duckdns.org", "365msoffice.com", "47e811dbe2ed0ea8d506af94c1bb7d4c.serveo.net", "4895458025-4545445-222435-9635794543-3242314342-234123423728.space", "48d83469-d0c6-4ade-8f82-e383fff094b8.webhook.site", "512521525-5245451515-985978774-2341235146436.xyz", "546874.tk", "5thelementq8.com", "645547657668787.com", "6c7aa72bd5f1d30203b80596f926b2b7.serveo.net", "73ce1aae8a9ba738b91040232524f51a.serveo.net", "78cc700b31dcd7c7f25fd7b0372259e3.serveo.net", "7daysinabudhabi.org", "90update.com", "910cf351-a05d-4f67-ab8e-6f62cfa8e26d.dnshook.site", "92ace7e653e9c32d2af9700592cc96ea.serveo.net", "9348243249382479234343284324023432748892349702394023.xyz", "9832473219412342343423243242364-34939246823743287468793247237.site", "99996665550.fun", "99kg.site", "9b5uja.am.files.1drv.com", "a.zhblz.com", "aa.69.mu", "aadexpo2014.co.za", "abbott-export.com", "academl.com", "acccountverify.com", "accesd-de-desjardins.com", "access-apple-login-account.gq", "access-google.com", "accgmail.com", "account-activity-verification-login.ga", "account-close-status.com", "account-flickr.com", "account-microsoftonline.com", "account-office365.com", "account-verify-comfirmation-info-login.ga", "account-verify-comfirmation-info-login.gq", "account.password-google.com", "accountgooogle.com", "accountlogin-inc.ga", "accounts-googlc.com", "accounts-gooogl.com", "accounts-office.fr", "accounts-qooqle.com", "accounts-updated.com", "accounts.rsshotmail.com", "accountsgooglemail.com", "accountsteam-en.com", "accountverify-disableinfo-login.gq", "accountverify.com", "accountverify.info", "acledit.com", "acrobatportable.com", "actblues.com", "action-yandex.ru", "activity-yandex.ru", "adawareblock.com", "adfs-senate.email", "adfs-senate.services", "adfs.senate.group", "adfs.senate.qov.info", "adobe-flash-updates.org", "adobeincorp.com", "adobemainsecurity.com", "adobeproduct.com", "adobestatistic.com", "adobestatistic.org", "adobeupdater.org", "adobeupdatetechnology.com", "adobeupgradeflash.com", "advpdxapi.com", "aerospacesystem.us.com", "afghanistanmfa.net", "ahr0cdovlzkyljiymi4ymdkundkvywn0a.0.d.255.adobeproduct.com", "aijazeera.org", "akadns.info", "akamaicachecdn.com", "akamaichecker.com", "akamaisoft.com", "akamaisoftupdate.com", "akamaitechnologysupport.com", "akamaitechupdate.com", "akragames.net", "al-wayi.com", "alert-new-login-com.ga", "aljazeera-news.com", "allcashin.com", "alphabitconsulting.com", "ambcomission.com", "americanprogress-office365.com", "americanprogress-outlook.com", "analyticemailmeter.com", "analyticsbar.org", "analyticsrequest.com", "analyticstest.net", "aneria.net", "aolnets.com", "apionedrive.com", "app-submitcentre.com", "appexsrv.net", "apple-assistance-localisation.com", "apple-care-support.com", "apple-checker.org", "apple-cloud-connect.com", "apple-iclods.org", "apple-iclouds.com", "apple-iclouds.net", "apple-id-service.com", "apple-iphone-services.com", "apple-iphonesecurity-icloud.com", "apple-location-id.com", "apple-realertlogin.gq", "apple-search.info", "apple-security-support.info", "apple-support-securityiphone.com", "apple-uptoday.org", "applecloudupdate.com", "appleid-login-appleid.ga", "appleid-manageaccountloginupdated.ga", "appleid-security-icloud.com", "appleidcustomer-servicess-com-loginaccount.ga", "appleidcustomer-servicess-com-loginaccount.gq", "appleupdate.org", "apps4updates.com", "appservicegroup.com", "apptaskserver.com", "arghpxdge01-airgas.com", "armaghanteb.com", "armpress.net", "armypress.org", "arnf.bg", "as23-updater-symantec.org", "asisonlline.org", "assaas.org", "asus-service.net", "audiwheel.com", "ausameetings.com", "autoupdater.org", "azureon-line.com", "b-of-americ.com", "baltichost.org", "bbc-press.org", "bbcnewsweek.com", "bbcweather.org", "beatguitar.com", "beststreammusic.com", "biathlovvorld.com", "biocpl.org", "bl4kj2.zapto.org", "blackpartshare.com", "blacktivist.info", "blu172maillive.com", "bmlv-gv.eu", "bohack51.ddns.net", "bonjourcheck.com", "bostondyn.com", "bostondynamlcs.com", "brnlv-gv.eu", "brokersads.com", "brookings.sharepoint.liveoffice365.me", "brownvelocity.org", "browsersecurity.ga", "bulgariaholidays.bg", "bulgariatripholidays.com", "bulletin-center.com", "bytly.org", "caciltd.com", "calc-dwn.infinityfreeapp.com", "calendar-ua.firstcloudit.com", "calendarua.firstcloudit.com", "capisp.com", "caribou-forge-server.new.c66.me", "carlos88.ddns.net", "catholicsinaliance.org", "cavuslawfirm.com", "cbiuaebank.com", "cbiuaebn.com", "cc-yahoo-inc.org", "cdn-nrdata.live", "cdnmsnupdate.com", "cdnverify.net", "centralinsumos.com.bo", "cercoselectricos.cl", "ceriossl.info", "cgna.info", "change-password.gq", "change-password.ml", "changepassword-hotmail.com", "changepassword-yahoo.com", "chatgpt4beta.com", "check-fix.com", "checkfindmyiphone.com", "checklogin.in", "checkmalware.info", "checkmalware.org", "checkwinframe.com", "chmail.in", "chmail.ir.udelivered.tk", "chmali.ir", "chujdrtuityui.mydiscussion.net", "ciscohelpcenter.com", "ciscosupports.com", "ckgob.com", "cleanphonetrksftware.com", "cleantarea-customerlogin-com.ga", "clickchekker.com", "clickchekkker.com", "clientareasecurity1.gq", "clientareasecurity4.gq", "cloud-apple-support.com", "cloud-id-localisation.com", "clouddrive.infinityfreeapp.com", "cloudflarecdn.com", "cloudmicrosoft365.com", "cloudupgrade.org", "cluz.someguydelivery.com", "cmdswitch.xyz", "cn5n8a92vtc00004a0t0gks3tbcyyyyyd.oast.fun", "cnnpolitics.eu", "coindmarket.com", "com-0cd.net", "com-recoverylogin.gq", "com-supportlogin-adminverification.ga", "config-panel.frge.io", "connectsmd.net", "consumerpanel.eu3.biz", "consumerpanel.eu3.org", "consumerpanel0x254a2.frge.io", "consumerpanelapp.42web.io", "consumerspanel.frge.io", "consumerspanelsrv.eu3.org", "contentdeliverysrv.net", "coronavirus5g.site", "counterterorexpo.com", "cpcpipe.com", "cpcpipe.org", "creekcounty.net", "cryptogo.net", "cryptokind.com", "csert.net", "cubenergy-my-sharepoint.com", "cubic.com.co", "cublc.com", "cyb3rc.com", "czyrqdnvpujmmjkfhhvs2x9oyfsn6gd7t.oast.fun", "czyrqdnvpujmmjkfhhvs4knf1av02demj.oast.fun", "czyrqdnvpujmmjkfhhvs9647ioh30wxvd.oast.fun", "czyrqdnvpujmmjkfhhvsclx05sfi23bfr.oast.fun", "czyrqdnvpujmmjkfhhvseabz1q5olrum5.oast.fun", "czyrqdnvpujmmjkfhhvsgapqr3hclnhhj.oast.fun", "czyrqdnvpujmmjkfhhvsqfxkqz68qzjcd.oast.fun", "czyrqdnvpujmmjkfhhvsqslblw0mawilr.oast.fun", "czyrqdnvpujmmjkfhhvsvlaax17vd5r6v.oast.fun", "d6231738c34.john-pc.c.mswordupdate17.com", "d6238051c34.placehol-6f699a.c.mswordupdate17.com", "d6238111c34.placehol-6f699a.c.mswordupdate17.com", "d6238158c34.placehol-6f699a.c.mswordupdate17.com", "d6238210c34.placehol-6f699a.c.mswordupdate17.com", "d6261013c34.placehol-6f699a.c.mswordupdate17.com", "d6261024c34.placehol-6f699a.c.mswordupdate17.com", "d6261034c34.placehol-6f699a.c.mswordupdate17.com", "dailyforeignnews.com", "dailypoliticsnews.com", "dancemusicstream.com", "darksecurity.ga", "dataclen.org", "dateosx.com", "daysheduler.org", "dbca10b5-63e0-42ec-ad10-de13be96dc42.dnshook.site", "decisionoverpregnantroad.com", "defenceglobaladviser.com", "defenceiq.us", "defencereview.eu", "defencereview.net", "defensenews.org", "delivery-mail-service.com", "delivery-ukrinmash-service.infinityfreeapp.com", "delivery-yahoo.com", "delivery-yandex.ru", "deshcoin.com", "digital-email-software.great-site.net", "diplomatnews.org", "diplomatscouncil.org", "dkvnz.com", "dls-gov.firstcloudit.com", "dmsclock.org", "dncvotebuilder.com", "dns-sec-login-apple-invoice-confirmations.ga", "dns-webapps-login-account-secure-servers.ga", "doads.org", "doc.gmail.com.gyehddhrggdii323sdhnshiswh2udhqjwdhhfjcjeuejcj.zhblz.com", "dochardproofing.com", "docs.google.com.spreadsheets.d.1ip6eeakdebmwteh36vana4hu-glaeksstsht-boujdk.zhblz.com", "docs77.com", "document-c.infinityfreeapp.com", "document-d.infinityfreeapp.com", "documentation.gq", "documents-cloud.infinityfreeapp.com", "documentshandler.ga", "doorbehindentirerelationship.com", "dotnetupdatechecker.com", "downloadable.infinityfreeapp.com", "downloadc.infinityfreeapp.com", "downloaddoc.infinityfreeapp.com", "downloadfile.infinityfreeapp.com", "downloadingdoc.infinityfreeapp.com", "downloadinge.infinityfreeapp.com", "downloadingf.infinityfreeapp.com", "downloadingq.infinityfreeapp.com", "downloadingw.infinityfreeapp.com", "downloadx.infinityfreeapp.com", "downloadz.infinityfreeapp.com", "dowssys.com", "dpkshodnya-mysharepoint.com", "drive-auth.com", "drive-google.ga", "drive365us.com", "driverfordell.com", "drivers-update.info", "driversupdate.info", "drivres-update.info", "dryf.shneez.com", "dvsservice.com", "dvsservice.net", "dxtveuux.com", "e-gov-am.firstcloudit.com", "e-gov.firstcloudit.com", "e-mail-supports.com", "e-military.firstcloudit.com", "e-mod.firstcloudit.com", "e-nas.firstcloudit.com", "e-post.byegm.web.tr", "e-presidencia.firstcloudit.com", "e-wody.firstcloudit.com", "easycache.net", "ebramka.info", "ecards-yahoo.com", "ecitcom.net", "edit-mail-yahoo.com", "eecomission.firstcloudit.com", "eecommission-drive.firstcloudit.com", "eecommission.firstcloudit.com", "egreetingsfrom.us", "egypressoffice.com", "elaxo.org", "electionleaks.com", "emailanalytics.com.ua", "emailloginerror.gq", "emailprovider.org", "emails-aol.com", "emailyandex.ru", "emod.firstcloudit.com", "en-marche.co", "encoder-info.tk", "englishlessons-houston.com", "enisa-europa.com", "enisa-europa.org", "eo1ws2wgj75rdfd.m.pipedream.net", "eo2mxtqmeqzafqi.m.pipedream.net", "eo6kgbwpysq0laa.m.pipedream.net", "eogo85tybrrn2r.m.pipedream.net", "eomhv6vdu4v5qyt.m.pipedream.net", "eopkne8kapj01xi.m.pipedream.net", "eos93vb2cwsu3xf.m.pipedream.net", "eottxji4yk4vg5x.m.pipedream.net", "eoy6vrzslpn9vu.m.pipedream.net", "eoytfd39hbrspa3.m.pipedream.net", "errorreporting.net", "esco-plvnlch.com", "escochart.com", "escochartzone.com", "eservicesystems.net", "esetsmart.org", "eskvortsov.com", "etcrem.net", "euronews24.info", "europeanda.com", "europehistoricalmuseum.com", "euroreport24.com", "eurosatary.com", "eurosator.com", "eurosatory-2014.com", "eurosatory2014.com", "euspa-vacancy.firstcloudit.com", "evbrax.org", "evronaval.com", "evrosatory.com", "exchangetrusts.com", "experience-improvement.com", "experiencewithweakkid.com", "extad.info", "extstat.info", "facebook-login-page.gq", "facebookonlinenotice.com", "facebookservices.org", "failure-login.ga", "familynearbysuitablenumber.com", "farele.co", "farnboroughair2014.com", "fastcontech.com", "fastdataexchange.org", "fastfileconverter.org", "fastphotobucket.com", "faststoragefiles.org", "fatherinfriendlyroad.com", "fbarticles.com", "fbcdn.store", "fbonlinelottery.com", "fdsagdfg.rf.gd", "fes-auth.com", "fghjdfhdzggjjdfd.rf.gd", "fgjgjuyfkuuyk.blogspot.com", "fil-luge.com", "file-download.infinityfreeapp.com", "filedwn.infinityfreeapp.com", "filehosting.infinityfreeapp.com", "files-presidencia.firstcloudit.com", "fileshelp.ga", "fileshelp.gq", "fileshelpprotut.ga", "fileshelpprotut.gq", "filestore.gq", "filihosting.infinityfreeapp.com", "finance-reports.everyday.com-w13.net", "finemagicball.org", "fisski.ca", "flammaautomoveis.com.br", "flashcontentdelivery.net", "flashsecurity.org", "flickr-service.com", "fnbcorporate.co.za", "foreignreview.com", "forsvaret.co", "fountainrate.com", "fraispei.com", "freefoodaid.com", "fsportal.net", "ftp.fraispei.com", "ftp.password-google.com", "fubnt.com", "functiondiscovery.net", "fundseats.com", "funnymems.com", "g-analytics.net", "game-wins.com", "gcsd.firstcloudit.com", "gdforum.info", "gdforum.net", "geaviations.com", "generalscaningcorp.org", "generalsecuritycorp.org", "generalsecurityscan.com", "genericnetworkaddress.com", "georgia-travel.org", "getstatpro.com", "getvps.site", "getwindowsupdates.com", "global-news-world.com", "global-world-news.net", "globaldefencetalk.com", "globalnewsweekly.com", "globalresearching.org", "globaltechengineers.org", "globaltechresearch.org", "globeshippers.biz", "globeshippers.net", "gmailservicegroup.com", "gmailservices.org", "gnpad-gh-gov.org", "goldenbuckz.com", "goldsecurity.ga", "golivecamp.net", "google-login.ml", "google-passwd.com", "google-password.com", "google-password.ml", "google-settings.com", "google-vservice.com", "googlea.net63.net", "googlesetting.com", "gooogle-login.com", "gov-kw.com", "gov.hu.com", "gov.vppdr.com", "gpufps.com", "gpwpl.com", "greetingcardproject.com", "greetingcardsproject.com", "groupsincevisibleend.com", "gsandsc.com", "gshippers.com", "gtranm.com", "guytillintelligentposition.com", "hatdfg-rhgreh684.frge.io", "heidelberqcement.com", "hello76.com", "help-msoutlook.com", "help-yahoo-service.com", "helpfromhome.co", "helpmicrosoft.net", "hesselawchambers.com", "hhcghibvywzedwa2iyvsuzzhx8.2.d.255.adobeproduct.com", "historicalfilms720hd.com", "hostapp.link", "hostedopenfiles.net", "hostsvcnet.com", "hotfix-update.com", "hotfixmsupload.com", "hothookup.net", "hotmail-monitor.com", "hourduringstrictsense.com", "hp-apps.com", "hubsg.net", "hudsonorg-my-sharepoint.com", "hurriyet.org.uk", "hushmali.com", "i.analyticemailmeter.com", "i.emailanalytics.com.ua", "i.mailnalysis.com", "i.zimbra-metadata.com", "i.zimbrasoft.com.ua", "i.zimbrastat.com", "i.zmailanalytics.com", "iacr-tcc.org", "iadb-online.com", "iboxmit.com", "icloud-id-en.com", "icloud-id-localisation.com", "icloud-id-security.com", "icloud-id-services.com", "icloud-iphone-services.com", "icloud-iphonesecurity.com", "icloud-localisation-id.com", "icloud-security-support.com", "icloud-service-apple.com", "icloud-support-id.com", "id-icloud-localisation.com", "id-icloud-support.com", "id-unconfirmeduser.frge.io", "id24556.tk", "id451295.com", "id6589.com", "identification-apple-id.com", "identification-apple.com", "identification-icloud-id.com", "ifcdsc.org", "iforgot-verification.com", "igfcw.torresemello.com", "iihf.eu", "ikmtrust.com", "imf-eu.org", "imperialc0nsult.com", "in-eternal-memory-of.com", "info-apple-login-security.gq", "info-mod.firstcloudit.com", "info2t.com", "int-live.com", "inteldrv64.com", "intelintelligence.org", "intelmeserver.com", "intelnetservice.com", "intelstatistics.com", "intelsupport.net", "intelsupportcenter.com", "intelsupportcenter.net", "internalsecurity.us", "intuitanalys.com", "intuitstatistic.com", "intuitstatistics.info", "ip113.ip-91-134-203.eu", "ipv6-microsoft.com", "iraqinews.info", "istc-cloud.com", "istoreapple.com", "itune-app.com", "itunes-helper.net", "jazzradiostream.com", "jeremizo888.ddns.net", "jflynci.com", "jimbeam.live", "jkbfgkjdffghh.linkpc.net", "jkcfgjgfcjty.fast-page.org", "joshel.com", "jp-login.gq", "junlper.net", "jzit.wocircuitfitness.com", "kakashka.chmail.in", "kavkazcentr.info", "kavkazjlhad.com", "kdmzlw.am.files.1drv.com", "kenlynton.com", "kfghjerrlknsm.line.pm", "kg-news.org", "kitegacc.com", "kitegacc.net", "kiteim.org", "kitten-268.frge.io", "kjghfkfgfdytku.infinityfreeapp.com", "knightconsults.com", "konami-game.com", "kremotevn.net", "kub-gas.com", "kvatral95.com", "kwqx.us", "kzgw-wody.firstcloudit.com", "lanmangraphics.com", "largefarm.net", "lasarenas.lt", "legacydiner.org", "lgemon.org", "lifeofmentalservice.com", "limited-resolution.com", "limited-verification.com", "link-google.com", "linkcuts.com", "linuxkrnl.net", "litu.su", "live-settings.com", "livemicrosoft.net", "liveoffice365.me", "liveweatherview.com", "localisation-apple-id.com", "localisation-apple-security.com", "localisation-apple.com", "localisation-id-apple.com", "localisation-id-icloud.com", "localisation-security.com", "localisation-support.com", "locked-service-security.ga", "log-in-osce.org", "login-bancochile-cl.ga", "login-on-live.com", "login-one.com", "login-osce.org", "login-outlook.com", "login-pap-web-access.ga", "login-recovery.gq", "login-resolve-limitations.com", "login-sec-apple-secure-account-updated.ga", "login-secure1-mobile.ga", "login-security-center.com", "login-security-notification.com", "login-security-verifications.com", "login-unlock-account.ga", "login-update-unlock.gq", "login.cloudmicrosoft365.com", "loginapps-info.ga", "loginpaypaas-securityuserid.ga", "loginservice-maintanceserversecurity.gq", "lonejade.com", "longsauce.com", "lopback.com", "loqin-microsoftonline.com", "loqin-yandex.ru", "loungecinemaclub.com", "lowprt.org", "lucyonmail.org", "lvueton.com", "lxwo.org", "mail-en-marche.fr", "mail-google.info", "mail-gov-ua.frge.io", "mail-hurriyet.com", "mail-ibu.eu", "mail-justus.com.ua", "mail-navy.ro", "mail-periodistas.net", "mail-service-yandex.ru", "mail.account-flickr.com", "mail.byegm.web.tr", "mail.chmail.in", "mail.g0v.me", "mail.hushmali.com", "mail.kuwaitarmy.gov-kw.com", "mail.mofa.g0v.qa", "mail.mrthelp.org", "mail.q0v.pl", "mail.rnil.am", "mail.rsaf.qov.sa.com", "mail.securitypractic.com", "mail.sofexjordanx.com", "mail.teiecomitalia.it", "mail.telecharger-01.com", "mail.unrightswire.org", "mail.windows-updater.com", "mail.ya-support.com", "mail.yahoo-monitor.com", "mail.zhblz.com", "mailerfeed.net", "mailhost-ut.ee", "mailhost.university-tartu.info", "mailmil.ae", "mailnalysis.com", "mailsettings-yandex.ru", "mailtransferservice.com", "majc.healthfloww.com", "malaytravelgroup.com", "malwarecheck.info", "manage-login.gq", "manage-logins.gq", "markburgston.com", "maskulan.duckdns.org", "maskulan.dynu.com", "mastconf.com", "masterofdigital.org", "maylaytravelgroup.com", "mdcrewonline.com", "mediarea.org", "megauploadfiles.org", "memcached.in", "memoinfo.ru", "meteost.com", "mfa-files.firstcloudit.com", "mfa-gov.info", "mfagreece.com", "mfanews.info", "mfanews.org", "mfapress.com", "mfapress.org", "mfauz.com", "micoft.com", "microsof-update.com", "microsofi.org", "microsoft-files.infinityfreeapp.com", "microsoft-onthehub.com", "microsoft-update-cdn.com", "microsoft-updatecdn.com", "microsoftcheckupdate.com", "microsoftcorpstatistic.com", "microsoftdccenter.com", "microsoftdriver.com", "microsoftdskservice.com", "microsoftfont.com", "microsofthelpcenter.info", "microsoftofficeupdate.net", "microsoftonlihe.com", "microsoftsecurepolicy.org", "microsoftstoreservice.com", "microsoftsupp.com", "microsoftupdated.com", "middle-eastreview.org", "military-info.eu", "militaryadviser.org", "militaryexponews.com", "militaryinf.com", "militaryobserver.net", "militarysupport.firstcloudit.com", "ministernetwork.org", "minjust-gov-ua.com", "miropc.org", "mlidef.com", "mobile-sanoma.net", "mobilehostsvc.com", "mod-files.ga", "moderntips.org", "modeselling.com", "mofa.farele.co", "moldstream.md", "moldtravelgroup.com", "molodirect.net", "monkey-129.getforge.site", "mountainsgide.com", "movieultimate.com", "mozilla-plugins.com", "mozillaplagins.com", "mrthelp.org", "ms-drivadptrwin.com", "ms-update.info", "ms-update.net", "ms-updates.com", "mscoresvw.com", "msfontserver.com", "msfontsrv.com", "msmodule.com", "msmodule.net", "msnsupportcare.com", "msoffice-cdn.comns3.cdnmsnupdate.com", "msofficeinstall.com", "msofficelab.com", "msoftonline.com", "msonlinelive.com", "msrdr.com", "msrole.com", "msrwr.com", "mswordupdate17.com", "munimonoce.com", "mvband.net", "mvsband.com", "mvtband.net", "mx.rnil.cl", "mx.unrightswire.org", "mx1.g0b.mx", "mx3.set121.com", "my-iri.org", "my-sharefile.com", "my-sharepoints.com", "my-ukr.net", "myaccountgoogle.ga", "mycloud-mail.ru", "mydocuments.gq", "myinvestgroup.com", "mymail-ukr.net", "mysent.org", "n.3.f.255.adobeproduct.com", "n.n.c.255.adobeproduct.com", "n.n.c.26055.adobeproduct.com", "n.n.c.303ff7b225c14f1498a2.cdnmsnupdate.com", "n0vinite.com", "name1d.site", "name4050.com", "nanetsdeb.com", "naoasch.com", "narrowpass.net", "nas-files.firstcloudit.com", "nationalzonehouse.com", "nato-hq.com", "nato-info.com", "nato-int.com", "nato-nevvs.org", "nato-news.com", "nato-press.com", "nato.nshq.in", "natoexhibitionff14.com", "natoint.com", "natopress.com", "natopress.org", "ndpmedia24.com", "ndsee.org", "nemaskalitnium.com", "neoderb.com", "netassistcache.com", "netcorpscanprotect.com", "nethostnet.com", "netschecker.com", "networkcentrals.com", "networkfilehosting.com", "networkschecker.net", "networkxc.net", "newaction-loginactivituresource.ga", "newfiles.ga", "newfilmts.com", "newfilmts.org", "news-almasirah.net", "news.intelsupportcenter.com", "newsdailyworld.com", "newsfromsource.com", "newstyleradio.net", "newsweekadviser.com", "nomartung.org", "northropgrumman.org.uk", "nortonupdate.org", "noticermk.com", "notificationstatus.com", "novinitie.com", "ns-secures-login-accountjp-updates-community.gq", "ns.mfanews.org", "ns1.al-wayi.com", "ns1.cdnmsnupdate.com", "ns1.fountainrate.com", "ns1.greetingcardproject.com", "ns1.lonejade.com", "ns1.mfanews.org", "ns1.modeselling.com", "ns1.oncetrips.com", "ns1.petdiary.net", "ns1.vtxhospital.com", "ns2.cdnmsnupdate.com", "ns2.fountainrate.com", "ns2.modeselling.com", "ns2.ntpupdateserver.com", "ns2.oncetrips.com", "ns2.petdiary.net", "ns2.vtxhospital.com", "ns3.cdnmsnupdate.com", "nshq.in", "ntpstatistics.com", "nursingdocumentation.gq", "nvidiagforceup.com", "office365-account.com", "office365-microsoft.com", "office365-onedrive.com", "office365-osf.am", "office365-osi.am", "officefont.com", "officemicroupdate.com", "officeupdater.com", "offlineupdates.com", "ohsxy.com", "oiagives.com", "oiatribe.com", "oncetrips.com", "one-drive.org", "onedrive-en-marche.fr", "onedrive-office365.com", "onedrive-outlook.com", "onedrive-sharedfile.com", "onedrive365.com", "onedrivemicrosoft.com", "onedrivemicrosoft365.com", "onedriveoffice365.com", "onedrv-live.com", "online-download.infinityfreeapp.com", "online-drive.infinityfreeapp.com", "online-reggi.com", "onlineubersplit.com", "opendoc.infinityfreeapp.com", "opendocument.infinityfreeapp.com", "opendocuments.infinityfreeapp.com", "options-mail.ru", "org.ohsxy.com", "org.security.ohsxy.com", "osce-info.com", "osce-military.org", "osce-oscc.org", "osce-press.com", "osce-press.org", "osfam.events", "osfam.team", "ourfiles.ga", "outlook-security.org", "outlook-update.live", "ovhsec.com", "packinstall.kozow.com", "pakistan-mofa.net", "pandadefender.com", "panelunregistertle-348.frge.io", "pasport-yandex.com", "pasport-yandex.ru", "pass-google.com", "password-google.com", "pavlodar.news", "pdf-document.ga", "peacefund.eu", "pentestinglab.com", "perfect-remote-service.com", "persa124.in", "petdiary.net", "petropershiyinukra.com", "philcfo.org", "photopoststories.com", "picturecrawling.com", "platnosci.biz", "pldtprv.net", "poczta.mon-gov.pl", "poczta.mon.q0v.pl", "pointtk.com", "politicalreview.eu", "politicsadvertisment.com", "politicsinform.com", "politicweekend.com", "popdancestream.com", "pornforyou.in", "portal-office.fr", "posta-hurriyet.com", "postfix-mail.firstcloudit.com", "postlkwarn.com", "postmarksmtp.com", "powerfromfamousbank.com", "powernoderesources.com", "powerpolymerindustry.com", "ppcodecs.com", "presidencia-docs.firstcloudit.com", "presidencia-files.firstcloudit.com", "presidencia-gob.firstcloudit.com", "presidencia-gov.firstcloudit.com", "pressservices.net", "primage.com.br", "privacy-facebook.me", "privacy-hotmail.com", "privacy-live.com", "privacy-ukr.net", "privacy-yahoo.com", "privacy-yahooservice.com", "privacy-yandex.ru", "privacy.google-settings.com", "pro.fraispei.com", "probenet.eu", "product-update.com", "profile-hotmail.com", "proposalprogram.com", "protectingcorpind.com", "protectingsearch.com", "protector-files.ga", "protectpanel.eu3.biz", "protonhardstorage.com", "proxysys-config.com", "pruintco.com", "publishdollar.com", "pus.akragames.net", "pwametalurgica.com.br", "q0v.pl", "qov.hu.com", "qov.info", "quadteximagery.com", "rada-zakon.firstcloudit.com", "radioplaymusicus.com", "rammatica.com", "rapidfileuploader.org", "raveston.com", "rdsnets.com", "reasonwithusefulpolicy.com", "recoverylogin-access.ga", "redirect.screenameaol.com", "redirect2app.cf", "regionsbnk.info", "regvirt.com", "reinstate-account.com", "remnet.org", "remonitor.net", "remotemanagesvc.net", "remotepx.net", "remsupport.org", "remsvc.net", "renodesmart.com", "report-yandex.ru", "reportscanprotecting.org", "researchcontinental.org", "reservecorpind.com", "reset-password-com.ga", "reset-service-identity-mail.42web.io", "restore-login-account.gq", "retaildemo.info", "reuters-press.com", "revampme.net", "review-quilogin.ga", "rhfcoin.com", "righttopregnantpower.com", "rn-mail.ru", "rnil.am", "rnil.cl", "robot-876.frge.io", "rockradiostream.com", "royalbsuk.com", "rpcnetconnect.com", "rsshotmail.com", "runssnetworks.com", "runvercheck.com", "sa7efa.com", "saleswarriorinc.com", "samsvung.com", "saojoaodaurtigars.com.br", "satellitedeluxpanorama.com", "scanmalware.info", "schooltillhungryprocess.com", "sdhjjekfp4k.com", "search-microsoft.com", "searchbrain.net", "seatreasures.org", "secao.com", "secao.org", "secnetcontrol.com", "secure-bankofamerica--login-com.ga", "secure-bankofamerica--login-com.gq", "secure-login-helpid-locked.gq", "secure-management-login-account-index-webpass.gq", "secure-mobile-login1.gq", "secure-remove-limitation.com", "secure-verification-center.com", "secure.actblues.com", "secure1-client-login.ga", "secure1-client-login.gq", "secure1-login-apps.gq", "secure5647login-com.ga", "secureconnectcompany.com", "securemicrosoftstatistic.com", "security-apple-id.com", "security-check.telegram.org.ohsxy.com", "security-icloud-apple.com", "security-icloud-localisation.com", "security-login-information.gq", "security-resolution-center.com", "security-verification.net", "security-verifications.com", "security.ohsxy.com", "securitycenter.ga", "securitymail.gq", "securitypractic.com", "securityprotectingcorp.com", "securitysls.com", "securityupdatereport.com", "senate.group", "senate.qov.info", "sendmevideo.org", "seniorsecurityind.com", "serbview.com", "servertest123.tk", "service-account-home-login.gq", "service-autoreset-password-youraccount.ga", "service-hushmail.com", "service-login-apple-verify-account-locked.gq", "service-reset-password-moderate-digital.rf.gd", "service-ukr.net", "service-usa-tre.info", "service-yahoo.com", "service-yandex.ru", "servicecdp.com", "servicecorptech.com", "servicelogin-access-failed.gq", "services-loginaccount.ga", "servicesecupdate.com", "servicetlnt.net", "set121.com", "set133.com", "setnewcred.ukr.net.frge.io", "setnewcreds.ukr.net.frge.io", "setnewpass-yahoo.com", "setting-mail.ru", "settings-live.com", "settings-panel.frge.io", "settings-yahoo.com", "settinqs-yandex.ru", "sex-toy-shop.org", "sgg-files.firstcloudit.com", "sgg-gov.firstcloudit.com", "shared-rss.info", "sharefiles.gq", "shcserv.com", "showitem.lt", "shurl.biz", "signin-icloudsupport.com", "signin-login-php.ga", "skidkaturag.com", "smigroup-online.co.uk", "smtp-relay.frge.io", "smtprelayhost.com", "societyatcuriousteacher.com", "sofexjordan2014.com", "sofexjordanx.com", "soft-storage.com", "softupdates.info", "softwaresupportsv.com", "softwaresupportsv.name", "soligro.com", "soros-my-sharepoint.com", "sourcerepolist.org", "space-delivery.com", "spelns.com", "sportever.org", "sportszone71.com", "srilankadocuments.ga", "srv-yahoo.com", "ssandsc.com", "standartnevvs.com", "startthedownload.com", "statement-login-update-info.ga", "statisticsnetworks.com", "stockliquidationgroup.com", "storsvc.org", "stratforglobal.net", "streetunderrelevantpeople.com", "summary-loginconfirmation.ga", "sunmicrosystem.info", "support-cloud.life", "support-icloud-apple.com", "support-icloud-localisation.com", "support-localisation-icloud.com", "support-security-icloud.com", "support-svc.com", "supports-microsoft.com", "supservermgr.com", "surll.me", "svit-zer.com", "sweetcherry.org", "swsupporttools.com", "swvfy.noreplay-fca.com", "symantecsupport.org", "symanttec.org", "synacorzimbra.nl", "syrianhrc.org", "sysanalyticweb.com", "systembeforeniceparent.com", "systembetweendifficultquality.com", "systemfromcuriousmoment.com", "t-d-canadatrust.com", "tablebeforehelpfulperson.com", "tabsync.net", "taizfbuhgowpawhafyuq23nb2v9kq0rmg.oast.fun", "tbmm.qov.web.tr", "team-google.com", "techcruncln.com", "techielawfirms.com", "telecharger-01.com", "telegram.org.4234e8234ad0f.24o1.com", "telegram.org.ohsxy.com", "telegram.org.security.ohsxy.com", "telemetry-network.com", "telsec.org", "test.chmail.in", "test.fraispei.com", "testservice24.net", "testsnetcontrol.com", "thediplomat-press.com", "theguardiannews.org", "thepiratecinemaclub.org", "thesocialstrategies.com", "tieringservice.com", "timezoneutc.com", "togounoffice.com", "tolonevvs.com", "top-total.com", "topcinemaclub.com", "transfersevices.net", "transparency-office365.com", "transworldpetroleum.com", "travelbern.com", "treckanalytics.com", "treepastwillingmoment.com", "trend-news.org", "tripadvicecommunity.com", "truefashionnews.com", "turbify-biz-cesdaz.rf.gd", "tuyt8erti867i.synergize.co", "tvopen.online", "twiterservices.org", "ua-calendar.firstcloudit.com", "ua-consumerpanel.frge.io", "ubagroupsgh.com", "uber-mails.com", "ukraine.html-5.me", "ukrainesafe.is-great.org", "ukrainesafeurl.talebco.ir", "ukroboronprom.com.ukr.pm", "ukrprivacysite.frge.io", "ukrprivatesite.frge.io", "um10eset.net", "umizg.org", "un-unicef.org", "unbulletin.com", "unian-news.info", "unicomba.com", "unigymboom.com", "unimarkstamp.com", "uniquecorpind.com", "unisecproper.org", "unitednat.org", "unitednationsnews.eu", "unitedprosoftcompany.org", "universalcoba.com", "unizg.net", "unrightswire.org", "unsecured-login-attempt.ga", "update-adobe.com", "update-hub.com", "update-security-information.com", "update-zimbra.com", "updateapi.longmusic.com", "updatecenter.name", "updatepc.org", "updatepple.com", "updaterweb.com", "updates-windows.com", "updateservicecenter.blogspot.com", "updatesoftware24.com", "updatesrvx.net", "updatesvcsys.com", "updatesystem.info", "updatesystems.net", "updmanager.com", "uploader.sytes.net", "uploadsforyou.com", "urjaa.nitrocreditfix.com", "us-facebook.com", "us-mg6-mailreport.com", "us-mg6-transfermail-service.com", "us-mg6mail-service.com", "us-mg6mailyahoo.com", "us-mg7mail-transferservice.com", "us-westmail-undeliversystem.com", "utmserver.com", "uttlh.peterswaysales.com", "valuetable.hk", "varuhusmc.org", "vascothreatscan.org", "verify-login-account-iinformation.ga", "verify-login-account-iinformation.gq", "vermasterss.com", "versiontask.com", "vgjkifguotgi.talebco.ir", "vice-news.com", "virtsvc.com", "virusdefender.org", "visualrates.com", "viters.org", "vppdr.com", "vsnet.co", "vtxhospital.com", "vvorthyhands.org", "w9umi9wrvzsvlvstvfvslbumdfdvda5tl.1.d.255.adobeproduct.com", "watertolargeprice.com", "webcdelivery.com", "webchartzone.com", "webmail-gov.me", "webmail-ibsf.org", "webmail-mil.gr", "webmail-saic.com", "webmail-saic.net", "webmail.afghanistanmfa.net", "webmail.mofa.qov.ae", "webmail.westinqhousenuclear.com", "webmail.windows-updater.com", "webstp.com", "webversionact.org", "webviewres.net", "welcome-apple-protectyourpassword.gq", "wellnesscaremed.com", "wellnessmedcare.org", "westinqhousenuclear.com", "whatsapp-in.com", "win32support.com", "wind0ws.kz", "windous.kz", "windowofficeupdate.com", "windows-updater.com", "windows.mswordupdate17.com", "windows81.duckdns.org", "windowsappstore.net", "windowscheckupdater.net", "windowsdefltr.net", "windowsofficeupdate.com", "windowsupdater.net", "windowsxupdate.com", "winsyscheck.com", "winsyschecks.com", "winsystemsvc.net", "wintwinbtc.com", "winupdatesysmic.com", "wmdmediacodecs.com", "wmiapp.com", "wody-info-files.firstcloudit.com", "wordkeyvpload.net", "wordkeyvpload.org", "world-oil-company.com", "worldchanneltour.com", "worldimagebucket.com", "worldmilitarynews.org", "worldpoliticsnews.org", "worldpoliticsreviews.com", "worldpostjournal.com", "wpadsettings.net", "wscapi.com", "wsjworld.com", "wsusconnect.com", "www-logined-apple-authsecure.ga", "www.7daysinabudhabi.org", "www.account-flickr.com", "www.actblues.com", "www.adawareblock.com", "www.adobeupdater.org", "www.chmail.in", "www.dailyforeignnews.com", "www.diplomatnews.org", "www.dkvnz.com", "www.eurosatory-2014.com", "www.forsvaret.co", "www.gdforum.info", "www.info2t.com", "www.microsoftdriver.com", "www.microsofthelpcenter.info", "www.mscoresvw.com", "www.natoint.com", "www.office365-onedrive.com", "www.onedrive365.com", "www.servicesecupdate.com", "www.sofexjordanx.com", "www.sportszone71.com", "www.srv-yahoo.com", "www.surll.me", "www.symantecsupport.org", "www.us-mg7mail-transferservice.com", "www.us-westmail-undeliversystem.com", "www.valuetable.hk", "www.vljaihln.com", "www.windowscheckupdater.net", "www.winupdatesysmic.com", "www.worldmilitarynews.org", "www.ya-support.com", "www.yahoo-monitor.com", "xfgjgjkuykykgihguifdt.mywire.org", "xgfdstu6k.frge.io", "xn--amazo-d8a.com", "xuetue2013.com", "xzdgsdfhfgtjdfj.wuaze.com", "y-privacy.com", "ya-login.com", "ya-support.com", "yahoo-analytics.com", "yahoo-change-password.com", "yahoo-monitor.com", "yahoo.chmail.in", "yahoo.securepassword.info", "yandex-control.ru", "yandex-report.ru", "yandex-site.com", "yavuz16.org", "youtubeclip.org", "yovtube.co", "yuotubc.com", "zhblz.com", "zimbra-metadata.com", "zimbrasoft.com.ua", "zimbrastat.com", "zmailanalytics.com", "zoomailer.org", "zpfgr.com", "zxrgh.viouni.com" ], "ipv4": [ "101.255.119.42:445", "103.140.186.148:53", "103.140.186.149:53", "103.140.186.155:53", "109.169.15.73", "113.160.234.229:445", "128.199.199.187:443", "144.126.202.227:22", "145.249.106.198:443", "148.252.42.42:54467", "163.172.67.233:5000", "167.114.153.55:443", "168.205.200.55:445", "172.114.170.18:445", "172.114.170.18:55155", "174.53.242.108:8080", "178.32.251.98", "18.157.68.73:15254", "18.192.93.86:11962", "18.197.239.109:10176", "181.209.99.204:445", "184.95.51.172", "185.117.88.22:53", "185.117.88.28:53", "185.117.88.29:53", "185.117.88.30:53", "185.117.88.31:53", "185.117.88.50:53", "185.117.88.60:53", "185.117.88.61:53", "185.117.88.62:53", "185.117.89.32:53", "185.117.89.46:53", "185.117.89.47:53", "185.132.17.160:445", "185.141.63.103", "185.234.73.58:53", "185.234.73.61:53", "185.234.73.62:53", "185.236.203.53:443", "185.237.166.224:53", "185.237.166.225:53", "185.237.166.226:53", "185.237.166.227:53", "185.237.166.228:53", "185.237.166.229:53", "185.237.166.230:53", "185.237.166.231:53", "185.237.166.232:53", "185.237.166.233:53", "185.237.166.234:53", "185.237.166.235:53", "185.237.166.236:53", "185.237.166.237:53", "185.237.166.238:53", "185.237.166.239:53", "185.237.166.240:53", "185.237.166.241:53", "185.237.166.242:53", "185.237.166.243:53", "185.237.166.244:53", "185.237.166.245:53", "185.237.166.246:53", "185.237.166.247:53", "185.237.166.248:53", "185.237.166.249:53", "185.237.166.55:53", "185.237.166.56:53", "185.237.166.57:53", "185.237.166.58:53", "185.237.166.59:53", "185.237.166.60:53", "185.237.166.61:53", "185.237.166.62:53", "185.237.166.63:53", "185.237.166.64:53", "185.237.166.65:53", "185.237.166.66:53", "185.237.166.67:53", "185.237.166.68:53", "185.237.166.69:53", "185.237.166.70:53", "185.237.166.71:53", "185.237.166.72:53", "185.237.166.73:53", "185.237.166.74:53", "185.237.166.75:53", "193.70.80.214", "194.126.178.8:445", "194.126.178.8:55555", "202.55.80.225:35770", "203.161.50.145:22", "203.161.50.145:5000", "203.161.50.145:6211", "203.161.50.145:8080", "203.161.50.145:8443", "203.161.50.145:8889", "213.32.252.221:445", "23.106.120.119:53", "23.200.147.10:80", "23.24.68.109:443", "24.142.165.2:445", "24.88.87.29:445", "3.67.15.169:1746", "31.220.61.251:443", "37.191.122.186:3578", "37.221.64.101:53", "37.221.64.116:53", "37.221.64.131:53", "37.221.64.148:53", "37.221.64.149:53", "37.221.64.150:53", "37.221.64.151:53", "37.221.64.163:53", "37.221.64.173:53", "37.221.64.199:53", "37.221.64.208:53", "37.221.64.224:53", "37.221.64.254:53", "37.221.64.77:53", "37.221.64.78:53", "37.221.64.93:53", "42.98.5.225:445", "45.61.169.221:445", "5.199.162.132:445", "5.226.137.151:53", "5.226.137.230:53", "5.226.137.231:53", "5.226.137.232:53", "5.226.137.234:53", "5.226.137.235:53", "5.226.137.242:53", "5.226.137.243:53", "5.226.137.244:53", "5.226.137.245:53", "50.173.136.70:445", "61.14.68.33:445", "62.4.36.126:8880", "64.120.31.100:53", "64.120.31.96:53", "64.120.31.97:53", "64.120.31.98:53", "64.120.31.99:53", "64.44.154.227:53", "64.44.154.237:53", "64.44.154.238:53", "64.44.154.239:53", "64.44.154.240:53", "68.76.150.97:8080", "69.162.253.21:445", "69.51.2.106:445", "73.80.9.137:35780", "77.83.197.37:53", "77.83.197.38:53", "77.83.197.39:53", "77.83.197.40:53", "77.83.197.41:53", "77.83.197.42:53", "77.83.197.43:53", "77.83.197.44:53", "77.83.197.45:53", "77.83.197.46:53", "77.83.197.47:53", "77.83.197.48:53", "77.83.197.49:53", "77.83.197.50:53", "77.83.197.51:53", "77.83.197.52:53", "77.83.197.53:53", "77.83.197.54:53", "77.83.197.55:53", "77.83.197.56:53", "77.83.197.57:53", "77.83.197.58:53", "77.83.197.59:53", "77.83.197.60:53", "77.83.198.39:53", "78.142.19.114", "79.141.160.78:53", "79.141.161.66:53", "79.141.161.67:53", "79.141.161.68:53", "79.141.161.69:53", "79.141.161.70:53", "79.141.161.71:53", "79.141.161.72:53", "79.141.161.73:53", "79.141.161.74:53", "79.141.161.75:53", "79.141.161.76:53", "79.141.161.77:53", "79.141.161.78:53", "79.141.161.79:53", "79.141.161.80:53", "79.141.161.81:53", "79.141.161.82:53", "79.141.161.83:53", "79.141.161.84:53", "79.141.161.85:53", "79.141.173.103:53", "79.141.173.119:53", "79.141.173.120:53", "79.141.173.121:53", "79.141.173.122:53", "79.141.173.123:53", "79.141.173.200:53", "79.141.173.210:53", "79.141.173.211:53", "79.141.173.231:53", "79.141.173.232:53", "79.141.173.233:53", "79.141.173.246:53", "79.141.173.247:53", "79.141.173.248:53", "79.141.173.249:53", "79.141.173.250:53", "79.141.173.251:53", "79.141.173.252:53", "79.141.173.253:53", "79.141.173.254:53", "79.141.173.70:53", "79.141.173.96:53", "79.141.173.97:53", "79.141.173.98:53", "79.143.87.229:53", "79.143.87.232:53", "79.143.87.240:53", "79.143.87.243:53", "79.143.87.249:53", "80.255.3.116", "82.118.242.171:443", "82.196.113.102:445", "85.195.206.7:445", "86.123.151.53:4430", "88.80.148.49:53", "88.80.148.53:53", "89.150.40.43:53", "89.150.40.86:53", "89.96.196.150:8080", "94.237.37.28:443" ], "url": [ "109.248.148.42/agr-enum/progress-inform/cube.php", "145.249.105.165/resource-store/stockroom-center-service/check.php", "185.203.118.198/en_action_device/center_correct_customer/drivers-i7-x86.php", "188.241.58.170/live/owa/office.dotm", "188.241.58.170/local/s3/filters.php", "200.122.181.25/catalog/products/books.php", "45.124.132.127/action-center/centerforserviceandaction/service-and-action.php", "c4csa.org/includes/sources/felims.php", "http://101.255.119.42", "http://104.171.117.216", "http://109.248.148.42", "http://113.160.234.229", "http://168.205.200.55", "http://172.114.170.18", "http://181.209.99.204", "http://185.132.17.160", "http://185.221.202.35/software-protection/app.php", "http://185.221.202.36", "http://185.234.52.168", "http://185.236.203.53", "http://185.25.50.93", "http://185.25.51.114", "http://185.25.51.164", "http://185.25.51.198", "http://185.77.129.152", "http://185.77.131.110", "http://185.86.149.125", "http://188.241.68.121", "http://194.126.178.8", "http://194.187.249.126", "http://194.32.78.245", "http://198.27.64.218", "http://213.103.67.193", "http://213.252.244.219", "http://213.252.245.132", "http://213.252.245.32/ControllerReset/view/register/comid/sid.php", "http://213.32.252.221", "http://220.158.216.127", "http://222.15.23.121", "http://23.227.196.215", "http://23.24.68.109", "http://24.142.165.2", "http://24.88.87.29", "http://31.7.62.103", "http://37.120.140.215", "http://42.98.5.225", "http://46.102.152.127", "http://46.183.218.34", "http://46.183.223.227", "http://5.199.162.132", "http://50.173.136.70", "http://61.14.68.33", "http://69.162.253.21", "http://69.51.2.106", "http://69.90.132.215", "http://79.142.70.106", "http://80.255.12.252", "http://80.255.6.5", "http://82.196.113.102", "http://83.147.243.18", "http://85.195.206.7", "http://86.105.18.106", "http://86.105.18.111", "http://86.106.131.177", "http://88.209.251.6", "http://89.249.65.166", "http://89.249.65.234", "http://89.37.226.123/advance/portable_version/service.php", "http://89.37.226.148", "http://89.40.181.126", "http://89.45.67.153", "http://92.114.92.128", "http://93.113.131.117", "http://93.113.131.155", "http://93.115.38.132", "http://93.170.72.54", "http://94.156.189.120", "kompartpomiar.pl/grafika/", "mockbin.org/bin/4aa17a07-7635-4ee0-9f3a-449fcd91f342", "mockbin.org/bin/b8427b58-7497-46cd-a5b2-6ff6a40b4592", "mockbin.org/bin/e8bfd045-2b14-4afc-9372-b723f7d76918", "run.mocky.io/v3/1e88179a-3105-4a5c-9eb3-aebea36e9c21", "run.mocky.io/v3/22a2a2d8-84b9-4619-b8ba-359beb386cf9", "run.mocky.io/v3/3b44f33d-b6e5-4ec6-b120-99b6ac52f74b", "run.mocky.io/v3/47d78e98-8d12-452a-922b-bae56450a393", "run.mocky.io/v3/4e14d583-bbf5-4af3-9a86-4c0938a7802a", "run.mocky.io/v3/6ba09505-fa73-4d92-b209-641bfc51b6e2", "run.mocky.io/v3/6c446a45-05aa-4198-9a81-d4472d7e81cb", "run.mocky.io/v3/8dbd585e-805d-4b14-8485-c6da4c3ef5a7", "run.mocky.io/v3/a261411d-b869-4877-86f5-307e32ed6afa", "run.mocky.io/v3/a4b6625c-226e-4dbc-baec-1dbd854b8015", "run.mocky.io/v3/acea62da-ca05-46d1-bb80-0b036af7467c", "run.mocky.io/v3/da384ab3-f749-42d5-a076-40c248dece9b", "run.mocky.io/v3/df8e33e0-4c17-4564-917f-9fbff17f4571", "run.mocky.io/v3/ef206b51-4cf4-4c93-90bf-1e66673315b0", "run.mocky.io/v3/ef4c7798-fc09-42cd-8431-91a22d5728d9", "stayathomeclasses.com/slpw/up.php", "webhook.site/0d2dc90e-2d5e-49f8-8249-d7ab955c387a", "webhook.site/0ef0dcf7-f258-4d02-b274-cbf62a2000cf", "webhook.site/127df518-52be-46c5-bbb2-0479f4b9693b", "webhook.site/1658772a-4de8-4368-a604-980c90b0a1ed", "webhook.site/2d07e34c-3dd3-45e8-865c-3888a65ab885", "webhook.site/3f396db1-2016-4b69-9ec3-ffc417d5f3aa", "webhook.site/4ba464d9-0675-4a7a-9966-8f84e93290ba", "webhook.site/4e6cf717-e4d6-4f40-9f2d-134196fa5e7d/", "webhook.site/4fe5885c-f2f6-4905-8bc7-aef1a046a134", "webhook.site/508da0df-7ec9-420e-b1fe-958fbbe699d1", "webhook.site/5100fcc0-f6be-4b09-8c58-5a8a6706ec4f", "webhook.site/5744c020-a8d9-4755-abfb-cde6ccd450af/", "webhook.site/577b82c3-7249-44e9-9353-5eab106fead6", "webhook.site/5a8758c6-5702-4fea-9d5e-4fbdb6dd795f", "webhook.site/5dbed3be-f1c9-41e5-b5d5-e961d08b5fba/", "webhook.site/5e4c7949-30a2-4477-9e9b-e8828fc76a1b", "webhook.site/62114596-33f5-47fb-9012-0223529e5a13/", "webhook.site/66d5b9f9-a5eb-48e6-9476-9b6142b0c3ae", "webhook.site/66ea3bbc-29dc-4ece-b804-71c6ec7b77b6", "webhook.site/68d68fc7-aa94-4f2d-a727-d18fb40b0d69/", "webhook.site/7674f06b-e435-4470-a594-6d59578c552d", "webhook.site/8bf50371-5f9f-4d45-9320-922b068ebc2e", "webhook.site/90fea98f-fbdb-4847-be03-409d02a43caf", "webhook.site/92a1c89c-c371-4b93-a91c-cb0d61b3432d", "webhook.site/9a9cdaf8-120c-4de9-b17a-d6d8e2796a3b", "webhook.site/9c87649c-220d-425d-8331-ffc8d9b94a38", "webhook.site/a3f4e990-0b2a-4f6a-a02e-c573005de3ee/", "webhook.site/a72d8905-b15f-4e95-9a8f-5e4bb7dc9b3d/", "webhook.site/b10bd697-1a9f-4ec7-aa2f-1fa84ad916a1", "webhook.site/bc349b93-b047-42f8-a421-d45e3ec94dc5", "webhook.site/bec23763-b8d9-4191-99ba-04a4a163b4de", "webhook.site/c1112bb3-0e6e-4ba4-abe7-fb31388b47ad", "webhook.site/c29905ab-e5fa-446c-8958-4eab15d8fb80/", "webhook.site/c2dceeb0-d40d-41a2-8622-118fa974649c/", "webhook.site/c2e1be16-401b-4f60-8a0f-276b30417fda/", "webhook.site/c618ea32-2923-4c12-8151-8d0002b56af0", "webhook.site/d290377c-82b5-4765-acb8-454edf6425dd", "webhook.site/d466f7a7-63a1-4c04-8347-fe2d0a96081f", "webhook.site/d63049e3-1cbe-474b-9005-237517af53a7/", "webhook.site/dee016bf-21a2-45dd-86b4-6099747794c4", "webhook.site/e13d23aa-b6f8-4491-9adc-71f7f8c438df", "webhook.site/e2831741-d8c8-4971-9464-e52d34f9d611", "webhook.site/e7f39f18-bcb3-40e3-9e82-8cf7f807cc80", "webhook.site/efb79108-a2b5-4cba-844d-6352bb8fad8c", "webhook.site/f5eace0b-062b-402f-a006-63b97e4950c3", "webhook.site/f97bcee0-0d91-4503-a30c-027f1b34820f", "xbhp.com/dominargreatasianodyssey/wp-content/plugins/akismet/style.php" ], "url_path": [ "/CheckNow864.php", "/KB7735-9927/security-serv/opt.php", "/LoG-statistic8397420934809/date-update9048353094c/StaticIpUpdateLog23741033.php", "/MsKZrpUfe.php", "/StaticIpUpdateLog23741033.php", "/SupportA91i/syshelpA774i/", "/SupportA91i/syshelpA774i/viewsupp.php", "/UpdateCertificate33-33725cnm^BB/CheckerNow-saMbA-99-36^11/CheckerSerface^8830-11.php", "/Verifica-El-Lanzamiento/Ayuda-Del-Sistema/obtenerId.php", "/action-center/centerforserviceandaction/service-and-action.php", "/advance/portable_version/service.php", "/advanced/portable_version/service.php", "/agr-enum/progress-inform/cube.php", "/apps.update/DetailsID/clientPID-118253.php", "/categories/buildings.php", "/client-update-info/version-id/version333.php", "/clientid-and-uniqued-r2/the-differenceU/Events76.php", "/company-device-support/values/correlate-sec.php", "/cumulative-security-update/Summary/details.php", "/daily-update-certifaicates52735462534234/update-15.dat/", "/data-extract/timermodule/update-client.php", "/database-update-centre/check-system-version/id=18862.php", "/db-module/version_1594/main.php", "/db7749sc.php", "/debug-info/pluginId/CLISD1934.php", "/en_action_device/center_correct_customer/drivers-i7-x86.php", "/execdwn.php", "/execdwn.php?id=", "/fdfd_iunb_hhert_ps.php", "/fdfd_iunub_hhert_ps.php", "/filedwn.php", "/filedwn.php?id=", "/func112SerErr.php", "/get-help-software/get-app-c/error-code-lookup.php", "/gft_piyes/ndhfkuryhs09/fdfd_iunb_hhert_ps.php", "/ghflYvz/vmwWIdx/realui.php", "/grenadLibS44-two/fIndToClose12t3/sol41.php", "/guard-service/Servers-ip4/upd-release", "/int-release/check-user/userid.php", "/local/s3/filters.php", "/locale/protocol/volume.php", "/managment/cb-secure/technology.php", "/manual/current/symphony.php", "/modules/Contact/Includes/1c.php", "/modules/Contact/Includes/2c.php", "/ndhfkuryhs09/", "/overstock/brand.php", "/pkg/image/do.php", "/protect/get-upd-id.php", "/ram-data/managerId/REM1234.php", "/resource-store/stockroom-center-service/check.php", "/search-release/Search-Version/crmclients.php", "/search-sys-update-release/base-sync/db7749sc.php", "/security-services-DMHA-group/info-update-version/id77820082.php", "/services-check-update/security-certificate-11-554/CheckNow864.php", "/setting-the-os-release/Support-OS-release/ApiMap.php", "/setwsdv4.php", "/srvSettings/conf4421i/", "/srvSettings/conf4421i/support.php", "/srv_upd_dest_two/destBB/en.php", "/stream-upd-service-two/definition/event.php", "/supportfsys/t863321i/func112SerErr.php", "/supptech18i/suppid.php", "/syshelp/kd8812u/", "/syshelp/kd8812u/protocol.php", "/tech99-04/litelib1/", "/tech99-04/litelib1/setwsdv4.php", "/techicalBS391-two/supptech18i/suppid.php", "/technet-support/library/online-service-description.php", "/test-update-16-8852418/temp727612430/checkUpdate89732468.php", "/test-update-17-8752417/temp827612480/checkUpdate79832467.php", "/update/dB-Release/NewBaseCheck.php", "/verification-online/service.911-19/check-verification-88291.php", "/versionID/Plugin0899/debug-release01119", "/wWpYdSMRulkdp/", "/wWpYdSMRulkdp/arpz/", "/wWpYdSMRulkdp/arpz/MsKZrpUfe.php", "/wwpydsmrulkdp/arpz/", "/zx-system/core/main-config.php" ] }, "last_modified": "2026-07-24T10:08:11+00:00", "maltrail_groups": [ "SOFACY" ], "references": [ "http://permalink.gmane.org/gmane.comp.security.ids.snort.emerging-sigs/22170", "http://pwc.blogs.com/files/cto-tib-20150420-01a.pdf", "http://pwc.blogs.com/files/tactical-intelligence-bulletin---sofacy-phishing-.pdf", "http://report.threatbook.cn/ST.pdf", "http://researchcenter.paloaltonetworks.com/2016/02/a-look-into-fysbis-sofacys-linux-backdoor", "http://researchcenter.paloaltonetworks.com/2016/06/unit42-new-sofacy-attacks-against-us-government-agency/", "http://researchcenter.paloaltonetworks.com/2016/12/unit42-let-ride-sofacy-groups-dealerschoice-attacks-continue/", "http://www.hexcapes.com/sofacy-in-poland/", "http://www.symantec.com/security_response/earthlink_writeup.jsp?docid=2014-110315-1233-99", "http://www.welivesecurity.com/2014/10/08/sednit-espionage-group-now-using-custom-exploit-kit/", "https://app.any.run/tasks/09da60cd-710f-4466-9942-c4eb4862e7fb/", "https://app.any.run/tasks/0f0eb583-abcf-4e0f-a803-2b1d3bfdfe47/", "https://app.any.run/tasks/396ccb39-ca44-4ae9-8584-96a8093ffc31/", "https://app.any.run/tasks/41b1658f-1bb2-4891-8053-9401706b3ff7/", "https://app.any.run/tasks/50eb1524-d95b-481e-b9d1-766c0a1fda74/", "https://app.any.run/tasks/516fee6f-1b98-40d2-8dd1-65b9c79bd05e/", "https://app.any.run/tasks/54a21ac9-f915-4556-8800-6f384fbbc6be/", "https://app.any.run/tasks/5bd56fb0-573e-471c-8503-6fe1a7f86b01", "https://app.any.run/tasks/8ac81174-d6d0-43d3-b2d2-c26e167a296b/", "https://app.any.run/tasks/9abe2703-3750-4728-a932-129177b2a72a/", "https://app.any.run/tasks/aa73504a-563a-4dd7-8724-3afe54de02f2/", "https://app.any.run/tasks/c841c920-8d04-4164-9e22-a288fb6f91d3/", "https://app.any.run/tasks/d6a8d1db-52c8-4371-b6d3-bf740408bb10/", "https://asert.arbornetworks.com/lojax-fancy-since-2016/", "https://blog.angelalonso.es/2017/10/hunting-apt28-cve-2017-11292-flash.html?m=0", "https://blog.bushidotoken.net/2022/01/tracking-renewable-energy-intelligence.html", "https://blog.cluster25.duskrise.com/2022/09/23/in-the-footsteps-of-the-fancy-bear-powerpoint-graphite/", "https://blog.google/threat-analysis-group/ukraine-remains-russias-biggest-cyber-focus-in-2023/", "https://blog.google/threat-analysis-group/update-threat-landscape-ukraine/", "https://blog.malwarebytes.com/threat-intelligence/2022/06/russias-apt28-uses-fear-of-nuclear-war-to-spread-follina-docs-in-ukraine/", "https://blog.sekoia.io/apt28-leverages-multiple-phishing-techniques-to-target-ukrainian-civil-society/", "https://blog.trendmicro.com/trendlabs-security-intelligence/pawn-storm-ramps-up-spear-phishing-before-zero-days-get-patched/", "https://blog.trendmicro.com/trendlabs-security-intelligence/update-pawn-storm-new-targets-politically-motivated-campaigns/", "https://blog.yoroi.company/research/apt28-and-upcoming-elections-possible-interference-signals/", "https://cdn.area1security.com/reports/Area-1-Security-PhishingBarismaHoldings.pdf", "https://cert.gov.ua/article/341128 (# Ukrainian)", "https://cert.gov.ua/article/39253 (Ukrainian, #UAC-0094)", "https://cert.gov.ua/article/40102 (Ukrainian)", "https://cert.gov.ua/article/4492467 (Ukrainian)", "https://cert.gov.ua/article/4905829 (Ukrainian)", "https://cert.gov.ua/article/5105791 (Ukrainian)", "https://cert.gov.ua/article/6276894", "https://cert.gov.ua/article/6281123 (# UAC-0001)", "https://cert.gov.ua/article/6284730 (# lamehug)", "https://cert.pl/posts/2024/05/apt28-kampania/", "https://cluster25.io/wp-content/uploads/2021/05/2021-05_FancyBear.pdf (# SkinnyBoy)", "https://community.emergingthreats.net/t/ruleset-update-summary-2024-11-21-v10747/2154", "https://community.riskiq.com/projects/47b45f6d-3b11-2082-0c04-dd8720fd3b67", "https://community.riskiq.com/projects/6290b968-d907-d5fb-c31e-9b7bf830ec2c", "https://community.riskiq.com/projects/8b14d778-99be-d744-af06-36ffc0937b38", "https://ctrlaltintel.com/threat%20research/FancyBear/", "https://doc.emergingthreats.net/bin/view/Main/2023662", "https://documents.trendmicro.com/assets/appendix_looking-into-a-cyber-attack-facilitator-in-the-netherlands.pdf", "https://documents.trendmicro.com/assets/txt/Pawn%20Storm%20Deploys%20PRISMA%20IOCs-xQ48S7H.txt", "https://github.com/blackorbird/APT_REPORT/blob/master/APT28/IOC/2019-04-05-ioc-mark.txt", "https://github.com/eset/malware-ioc/blob/master/sednit/part1.adoc", "https://github.com/eset/malware-ioc/blob/master/sednit/part2.adoc", "https://github.com/ti-research-io/ti/blob/main/ioc_extender/ET_APT28.json", "https://go.recordedfuture.com/hubfs/reports/CTA-RU-2024-0530.pdf", "https://harfanglab.io/en/insidethelab/compromised-routers-infrastructure-target-europe-caucasus/", "https://hunt.io/blog/operation-roundish-apt28-roundcube-exploitation", "https://media.defense.gov/2020/Aug/13/2002476465/-1/-1/0/CSA_DROVORUB_RUSSIAN_GRU_MALWARE_AUG_2020.PDF", "https://medium.com/@rsatter/decoding-the-gru-indictment-bfb2c08fe362", "https://meltx0r.github.io/tech/2019/10/24/apt28.html", "https://msrc-blog.microsoft.com/2019/08/05/corporate-iot-a-path-to-intrusion/", "https://otx.alienvault.com/pulse/55346adeb45ff536ca3ffd2c/", "https://otx.alienvault.com/pulse/5cab3bf39e861d5e97554699", "https://otx.alienvault.com/pulse/5ce65ec381f415c7dc794d41", "https://otx.alienvault.com/pulse/5cefdae12f7645afa995961e", "https://otx.alienvault.com/pulse/5d2db9cc8e1eb4d4d4be15e5", "https://otx.alienvault.com/pulse/5d88c12375a272432c4cd9ec", "https://otx.alienvault.com/pulse/5db2cff18faf1f1d826cd074", "https://otx.alienvault.com/pulse/5e1da5a3ca48088035ce6c5a", "https://otx.alienvault.com/pulse/5e736669fcc47a29220ce3f0", "https://otx.alienvault.com/pulse/5f3581cc4138be1d82c183b8", "https://otx.alienvault.com/pulse/5f6a13f6bd6ff146fa3967de", "https://otx.alienvault.com/pulse/5f9b0ac2ac1088826c07eb3b", "https://otx.alienvault.com/pulse/5fd10cde3563e4121cbab5c7", "https://otx.alienvault.com/pulse/602fe96189be26708dfafe17/", "https://otx.alienvault.com/pulse/60eff240c7c9cb4f24907049", "https://otx.alienvault.com/pulse/61e6de4edebb498761384f2a", "https://otx.alienvault.com/pulse/64403596d7a47d80451657c3", "https://otx.alienvault.com/pulse/64676e2dffb6057207af2037", "https://otx.alienvault.com/pulse/6579b53c00375a2dcfaaf952", "https://otx.alienvault.com/pulse/65bcd6e5cc24f8906b1a212a", "https://otx.alienvault.com/pulse/663b9c27bdf8af853c0e1e03", "https://pastebin.com/44bJm0Gf", "https://pastebin.com/FJDa0MA8", "https://pastebin.com/atN2w5SE", "https://pub.expmon.com/analysis/311631/", "https://pwc.blogs.com/files/tactical-intelligence-bulletin---sofacy-phishing-.pdf", "https://quointelligence.eu/2020/09/apt28-zebrocy-malware-campaign-nato-theme/", "https://s3.amazonaws.com/snort-org/www/rules/community/community-rules.tar.gz", "https://securelist.com/a-slice-of-2017-sofacy-activity/83930/", "https://securelist.com/blog/research/72924/sofacy-apt-hits-high-profile-targets-with-updated-toolset/", "https://securelist.com/zebrocys-multilanguage-malware-salad/90680/", "https://securityintelligence.com/x-force/itg05-leverages-malware-arsenal/", "https://securityintelligence.com/x-force/itg05-ops-leverage-israel-hamas-conflict-lures-to-deliver-headlace-malware/", "https://snort-org-site.s3.amazonaws.com/production/release_files/files/000/012/156/original/snort3-community-rules.tar.gz", "https://strikeready.com/blog/finding-the-unknown-unknowns-part-1/", "https://threatconnect.com/blog/how-to-investigate-incidents-in-threatconnect/", "https://threatconnect.com/blog/using-fancy-bear-ssl-certificate-information-to-identify-their-infrastructure/", "https://threatconnect.com/finding-nemohost-fancy-bear-infrastructure/", "https://twitter.com/Arkbird_SOLG/status/1336834398784786432", "https://twitter.com/Bank_Security/status/1048113406597910528", "https://twitter.com/Bank_Security/status/1115130011160383488", "https://twitter.com/BushidoToken/status/1740431013397078407", "https://twitter.com/ClearskySec/status/1139160272755744774", "https://twitter.com/Cyber0verload/status/1677361473427841029", "https://twitter.com/DrunkBinary/status/1032706788678950914", "https://twitter.com/Jan0fficial/status/1053227074792706048", "https://twitter.com/Jane_0sint/status/1698702459739255016", "https://twitter.com/Joseliyo_Jstnk/status/1730631107899437490", "https://twitter.com/Joseliyo_Jstnk/status/1730631116564951437", "https://twitter.com/Joseliyo_Jstnk/status/1769699442045657261", "https://twitter.com/Joseliyo_Jstnk/status/1776248416210702679", "https://twitter.com/LastlineLabs/status/1022865021343330305", "https://twitter.com/Mao_Ware/status/1092797858301034496", "https://twitter.com/MavericksInt/status/1765783346519425331", "https://twitter.com/RedDrip7/status/1362343352759250946", "https://twitter.com/RedDrip7/status/1640342052327108609", "https://twitter.com/ShadowChasing1/status/1251164774982795266", "https://twitter.com/ShadowChasing1/status/1291931828723408896", "https://twitter.com/StopMalvertisin/status/1653441365496459270", "https://twitter.com/VK_Intel/status/1075307666434600960", "https://twitter.com/VK_Intel/status/1076912689119748096", "https://twitter.com/VK_Intel/status/1088145389356806146", "https://twitter.com/VK_Intel/status/1092324957772750848", "https://twitter.com/VK_Intel/status/1115080282221293568", "https://twitter.com/VK_Intel/status/1145270462559195137", "https://twitter.com/Vishnyak0v/status/1197129423830626318", "https://twitter.com/Vishnyak0v/status/1257606954085646337", "https://twitter.com/Vishnyak0v/status/1269651391980736513", "https://twitter.com/Vishnyak0v/status/1310861022954225664", "https://twitter.com/angel11VR/status/1636474327926206470", "https://twitter.com/billyleonard/status/1446226367008313344", "https://twitter.com/billyleonard/status/1482034733072752640", "https://twitter.com/blackorbird/status/1107593605252677633", "https://twitter.com/cluster25_io/status/1400467624912318470", "https://twitter.com/cyber__sloth/status/1677068498625867777", "https://twitter.com/daphiel/status/1148128770014011392", "https://twitter.com/dewan202/status/1107348923826491392", "https://twitter.com/dewan202/status/1255582744110862345", "https://twitter.com/dimitribest/status/1780815421983109459", "https://twitter.com/drb_ra/status/1696958416516759956", "https://twitter.com/felixaime/status/1760750756699812296", "https://twitter.com/h2jazi/status/1749489799184937094", "https://twitter.com/k3yp0d/status/1752285465284170186", "https://twitter.com/k3yp0d/status/1780888686025961824", "https://twitter.com/kyleehmke/status/1105151293486710785", "https://twitter.com/kyleehmke/status/1113085089909440513", "https://twitter.com/kyleehmke/status/1150834700069552130", "https://twitter.com/kyleehmke/status/1186114823341400064", "https://twitter.com/kyleehmke/status/1207779048086286336", "https://twitter.com/kyleehmke/status/1216905172305227776", "https://twitter.com/kyleehmke/status/1286779311626870791", "https://twitter.com/kyleehmke/status/1286779313384312834", "https://twitter.com/pancak3lullz/status/1176856452780179456", "https://twitter.com/teamcymru_S2/status/1540390953516765185", "https://twitter.com/ydklijnsma/status/1218599851669233666", "https://unit42.paloaltonetworks.com/dear-joohn-sofacy-groups-global-campaign/", "https://unit42.paloaltonetworks.com/fighting-ursa-car-for-sale-phishing-lure/", "https://unit42.paloaltonetworks.com/russian-apt-fighting-ursa-exploits-cve-2023-233397/", "https://unit42.paloaltonetworks.com/threat-brief-cve-2023-23397/", "https://unit42.paloaltonetworks.com/unit42-sofacy-continues-global-attacks-wheels-new-cannon-trojan/", "https://unit42.paloaltonetworks.com/unit42-sofacy-uses-dealerschoice-target-european-government-agency/", "https://us-cert.cisa.gov/ncas/analysis-reports/ar20-303b", "https://vxcube.com/recent-threats-ioc/5c74c73ca39bb5786f9664d3/detail", "https://www.accenture.com/t20190213T141124Z__w__/us-en/_acnmedia/PDF-94/Accenture-SNAKEMACKEREL-Threat-Campaign-Likely-Targeting-NATO-Members-Defense-and-Military-Outlets.pdf", "https://www.alienvault.com/open-threat-exchange/blog/from-russia-with-love-sofacy-sednit-apt28-is-in-town", "https://www.bleepingcomputer.com/news/security/microsoft-disrupts-apt28-hacking-campaign-aimed-at-us-midterm-elections/", "https://www.emanueledelucia.net/apt28-sofacy-seduploader-under-the-christmas-tree/", "https://www.fireeye.com/blog/threat-research/2015/04/probable_apt28_useo.html", "https://www.fireeye.com/resources/pdfs/apt28.pdf", "https://www.intezer.com/blog/malware-analysis/targeted-phishing-attack-against-ukrainian-government-expands-to-georgia/", "https://www.intezer.com/blog/research/russian-apt-uses-covid-19-lures-to-deliver-zebrocy/", "https://www.jigsawsecurityenterprise.com/single-post/2017/11/01/Malicious-Documents-Targeting-Security-Professionals", "https://www.joesandbox.com/analysis/828645?idtype=analysisid#iocs", "https://www.kroll.com/en/publications/cyber/fancy-bear-gonepostal-espionage-tool-backdoor-access-microsoft-outlook", "https://www.linkedin.com/pulse/xagent-spyware-targeting-ios-devices-western-europe-dmitry-bestuzhev-xunle/", "https://www.ncsc.gov.uk/content/files/protected_files/article_files/IOC-APT28-malware-advisory.pdf", "https://www.ncsc.gov.uk/news/apt28-exploit-routers-to-enable-dns-hijacking-operations", "https://www.proofpoint.com/us/blog/threat-insight/ta422s-dedicated-exploitation-loop-same-week-after-week", "https://www.proofpoint.com/us/blog/threat-insight/ta488-targets-zimbra-mailservers-half-click-exploits", "https://www.proofpoint.com/us/threat-insight/post/apt28-racing-exploit-cve-2017-11292-flash-vulnerability-patches-are-deployed", "https://www.root9b.com/sites/default/files/whitepapers/R9b_FSOFACY_0.pdf", "https://www.seqrite.com/blog/operation-ghostmail-zimbra-xss-russian-apt-ukraine/", "https://www.symantec.com/security_response/writeup.jsp?docid=2016-031520-4610-99&tabid=2", "https://www.threatconnect.com/blog/fancy-bear-leverages-blogspot/", "https://www.tr1adx.net/intel/public/TIB-00001_IOC_Domain.txt", "https://www.trellix.com/en-us/about/newsroom/stories/threat-labs/prime-ministers-office-compromised.html", "https://www.trendmicro.com/en_us/research/26/c/pawn-storm-targets-govt-infra.html", "https://www.trendmicro.com/vinfo/us/security/news/cyber-attacks/probing-pawn-storm-cyberespionage-campaign-through-scanning-credential-phishing-and-more", "https://www.vice.com/en_us/article/vvaxy8/evidence-linking-russian-hackers-fancy-bear-to-macron-phishing", "https://www.virustotal.com/#/file/b40909ac0b70b7bd82465dfc7761a6b4e0df55b894dd42290e3f72cb4280fa44/community", "https://www.virustotal.com/#/ip-address/52.28.203.25", "https://www.virustotal.com/gui/file/02de72e43d578c45d9d6359299cb2d47771081617ff01363b736414eb831deea/detection", "https://www.virustotal.com/gui/file/0be114fe30ef5042890c17033b63d7c9e0363972fcc15a61433c598dd33f49d1/detection", "https://www.virustotal.com/gui/file/18f891a3737bb53cd1ab451e2140654a376a43b2d75f6695f3133d47a41952b6/detection", "https://www.virustotal.com/gui/file/1bcc09d482a1c84a06c4f1da85ba90b33ec269b873b51d153de4ef8e19cb1592/detection", "https://www.virustotal.com/gui/file/1dd03c4ea4d630a59f73e053d705185e27e2e2545dd9caedb26a824ac5d11466/detection", "https://www.virustotal.com/gui/file/1ed863a32372160b3a25549aad25d48d5352d9b4f58d4339408c4eea69807f50/detection", "https://www.virustotal.com/gui/file/1ee602e9b6e4e58dfff0fb8606a41336723169f8d6b4b1b433372bf6573baf40/detection", "https://www.virustotal.com/gui/file/2431578b5ba5a8569a689807bdb827e3d445a16cc013ed8eba7b7bfea661d76a/detection", "https://www.virustotal.com/gui/file/2631f95e9a46c821a701269a76b15bb065764cc15a0b268a4d1eac045975c9b8/detection", "https://www.virustotal.com/gui/file/2ac6735e8e0b23b222161690adf172aec668894d170299e9ff2c54a4ec25b1f4/detection", "https://www.virustotal.com/gui/file/362a8297a0ff603553e992626a8e28c0aa19d038557da82fe6f4526988601be7/behavior/Tencent%20HABO", "https://www.virustotal.com/gui/file/384c9a19dd6f0f73bee575e54801f9608883ae31db1b399a28b8cc5f7aa9a26c/detection", "https://www.virustotal.com/gui/file/3b548a851fb889d3cc84243eb8ce9cbf8a857c7d725a24408934c0d8342d5811/detection", "https://www.virustotal.com/gui/file/3d165a9bd4738fd3c1922643bd45204ff91bc37f2c5aa3f47d97523f7fd9e8ed/detection", "https://www.virustotal.com/gui/file/40a7fd89b9e51b0a515ac2355036d203357be90a2200b9c506b95c12db54c7aa/detection", "https://www.virustotal.com/gui/file/44935484933a13fb6632e8db92229cf1c5777333fa5a3c0a374b37428add69fb/detection", "https://www.virustotal.com/gui/file/451f3d427ac21632f38619ef96dece25798918866d44fe82ff1ed30996f998dc/detection", "https://www.virustotal.com/gui/file/479fd5e5bd5566a0252acd4ec29c5abc0dac501d0d6e9f316612b52aa48a3587/detection", "https://www.virustotal.com/gui/file/4df72b051d8e3b97640ea3819da75ffb34df75aeb40403edb3e8482a8465dfab/detection", "https://www.virustotal.com/gui/file/506e7512c897514e9d312a1532d2e2949ec8ebd73f6ca52740fb5e3306f08843/detection", "https://www.virustotal.com/gui/file/53142380d75e3f54490f2896b58f308e6b91bec841d09b4e88985cb5b7812031/detection", "https://www.virustotal.com/gui/file/5a17cfaea0cc3a82242fdd11b53140c0b56256d769b07c33757d61e0a0a6ec02/detection", "https://www.virustotal.com/gui/file/5b52bc196bfc207d43eedfe585df96fcfabbdead087ff79fcdcdd4d08c7806db/detection", "https://www.virustotal.com/gui/file/64b0037dde987c78edf807a1bd7f09cdfac072ec2a59954cc4918828b7e608a3/behavior", "https://www.virustotal.com/gui/file/64b26a92652bfb67cbe18217b6508fce460eff859526b2e256d3f1b9eab338b0/detection", "https://www.virustotal.com/gui/file/654a19f0773bbba1e63b0fee936b261fe14ca0222fba71150d688fbb9f3dac60/detection", "https://www.virustotal.com/gui/file/6954b6930afed2602e15400e38408883d2b94a2c643ff3070ccd7f87b043061d/detection", "https://www.virustotal.com/gui/file/76f8f159637c9201e98ed1aab5e0359ea983c5cce8ced832bae13dffab0f73a8/detection", "https://www.virustotal.com/gui/file/7bed81cbbc5d368beb4531a373bad5a38aef7947f565048ad4ba597a821897c6/detection", "https://www.virustotal.com/gui/file/7edacdf35900e722b798dbc891159cf1ede9f6d671a86b0f01f9ef802202aa73/detection", "https://www.virustotal.com/gui/file/7f698295230f59c7ca8193322eb48d71cd203f3675139f2da99e326589bfdad3/detection", "https://www.virustotal.com/gui/file/86a9ca34790e219ddc371fa154c51a9a2930e2afdebf4fc0889d2ba94d6acfc1/detection", "https://www.virustotal.com/gui/file/87f363afc9778efc78dd3e0ced112d8d66a09a8924091f0927ed02a7b64850d2/detection", "https://www.virustotal.com/gui/file/8b77e8199c61c0d97b7a40e35feedf21a168a62696b18bbb4d49766332c2c8a8/detection", "https://www.virustotal.com/gui/file/8d6a24eac7a90860edaf6721856ff11ce0cff9dd3dc9c2b546a3fdf9d15be4ed/detection", "https://www.virustotal.com/gui/file/9097d9cf5e6659e869bf2edf766741b687e3d8570036d853c0ca59ae72f9e9fc/detection", "https://www.virustotal.com/gui/file/969d2776df0674a1cca0f74c2fccbc43802b4f2b62ecccecc26ed538e9565eae/detection", "https://www.virustotal.com/gui/file/98a97978f84a2ca6f2c05a4e15e60e9ab7ea3a77b36b26a83ae8562f58b6749d/detection", "https://www.virustotal.com/gui/file/a097400e060edf1190002a30c64506da0f72f92f96ed526b01cb4c00d5df2f0c/detection", "https://www.virustotal.com/gui/file/a5418213e34f81913726f19cdeefa8d9e3d425a8786eda086e56faacea1372ae/detection", "https://www.virustotal.com/gui/file/a665cd40efaca89e9257d083328e13446428281d133895f984e847d93634e736/detection", "https://www.virustotal.com/gui/file/aaa20b39bcf056f42509069dc3faccefd70cd69a3972560fe7c3745c9c40e1f7/detection", "https://www.virustotal.com/gui/file/aac3b1221366cf7e4421bdd555d0bc33d4b92d6f65fa58c1bb4d8474db883fec/detection", "https://www.virustotal.com/gui/file/aef94d2451e1eb943d2b1ee5ed48d923ffff4baeb0d26ebe4450d6e151bf28c8/detection", "https://www.virustotal.com/gui/file/b2ba51b4491da8604ff9410d6e004971e3cd9a321390d0258e294ac42010b546/detection", "https://www.virustotal.com/gui/file/b72188ba545ad865eb34954afbbdf2c9e8ebc465a87c5122cebb711f41005939/detection", "https://www.virustotal.com/gui/file/bdb33bbb4ea11884b15f67e5c974136e6294aa87459cdc276ac2eea85b1deaa3/detection", "https://www.virustotal.com/gui/file/be3cccc2c62c0033aebcf91a6587eb815a1994cf268c42cf92ed856b6cf556aa/detection", "https://www.virustotal.com/gui/file/be859b4f4576ec09b69a2ef2d119939f7eb31de121aa01d38e1f0b2290f5a15e/detection", "https://www.virustotal.com/gui/file/c194f619d1ed73c0f0721d818564aa8238aceba94d1e721942c5cb67cbba68ff/detection", "https://www.virustotal.com/gui/file/c91183175ce77360006f964841eb4048cf37cb82103f2573e262927be4c7607f/detection", "https://www.virustotal.com/gui/file/c9b3ef44640e0fe297d76e770454ee2597e474f5d0cb406e376da8d504db0117/detection", "https://www.virustotal.com/gui/file/ca5dd056e948b1d25bda3a96a0bc6001e20ef20c9516c86718e41817943400fa/detection", "https://www.virustotal.com/gui/file/d37779e16a92da7bd05eae50c64b36e2e2022eb441382be686fda4dbd1800e90/detection", "https://www.virustotal.com/gui/file/d6af1c9f5ce407e53ec73c8e7187ed804fb4f80cf8dbd6722fc69e15e135db2e/detection", "https://www.virustotal.com/gui/file/daaa271cee97853bf4e235b55cb34c1f03ea6f8d3c958f86728d41f418b0bf01/detection", "https://www.virustotal.com/gui/file/e23b7a912f6bd16d634a1acce41922f277242ec8ab9c354754b5e97a0bab85d0/detection", "https://www.virustotal.com/gui/file/ece085c17ac5e822b78c533366e725bc845e215dcda78c0502ebd7f33ccb06ed/detection", "https://www.virustotal.com/gui/file/f112876e875d43791da675e1187254eb2c839b7051d465ae83568274412d644a/detection", "https://www.virustotal.com/gui/file/fa8a4d544ffb3ca9d51448772f478f303602023e0cd70af4b9f85d3b72b4cd27/detection", "https://www.virustotal.com/gui/file/fd3f13db41cd5b442fa26ba8bc0e9703ed243b3516374e3ef89be71cbf07436b/detection", "https://www.virustotal.com/gui/file/fed537aade989abe4eb76a7a27756e66861fe92322c4b359feca8e01b85b438b/detection", "https://www.virustotal.com/gui/ip-address/104.171.117.216/relations", "https://www.virustotal.com/gui/ip-address/145.249.106.198/relations", "https://www.virustotal.com/gui/ip-address/185.236.203.53/relations", "https://www.virustotal.com/gui/ip-address/185.77.129.152/relations", "https://www.virustotal.com/gui/ip-address/193.106.191.202/relations", "https://www.virustotal.com/gui/ip-address/194.33.40.72/relations", "https://www.virustotal.com/gui/ip-address/23.227.196.215/relations", "https://www.virustotal.com/gui/ip-address/45.146.164.37/relations", "https://www.virustotal.com/gui/ip-address/45.150.67.87/relations", "https://www.virustotal.com/gui/ip-address/5.149.253.45/relations", "https://www.virustotal.com/gui/ip-address/86.123.151.53/relations", "https://www.virustotal.com/gui/ip-address/93.115.38.132/relations", "https://www.vkremez.com/2018/12/lets-learn-dissecting-apt28sofacy.html", "https://www.vkremez.com/2019/01/lets-learn-progression-of-apt28-autoit.html", "https://www.welivesecurity.com/2018/04/24/sednit-update-analysis-zebrocy/", "https://www.welivesecurity.com/wp-content/uploads/2018/09/ESET-LoJax.pdf", "https://www.zscaler.com/blogs/security-research/apt28-leverages-cve-2026-21509-operation-neusploit", "https://x.com/Cyber0verload/status/1829953345009672433", "https://x.com/Cyber0verload/status/1834259021060014302", "https://x.com/Cyber0verload/status/1841924570351018233", "https://x.com/HaifeiLi/status/2018353377965723761", "https://x.com/Joseliyo_Jstnk/status/1826879652960346411", "https://x.com/LAB52io/status/2022281566513180933", "https://x.com/RakeshKrish12/status/1830493704911728980", "https://x.com/StrikeReadyLabs/status/1826585308734931266", "https://x.com/StrikeReadyLabs/status/1826950349384495489", "https://x.com/StrikeReadyLabs/status/1829562262253617411", "https://x.com/StrikeReadyLabs/status/1830933284248776936", "https://x.com/StrikeReadyLabs/status/1834217191060779174", "https://x.com/StrikeReadyLabs/status/1837316398760022252", "https://x.com/StrikeReadyLabs/status/1841288172950499624", "https://x.com/StrikeReadyLabs/status/1849084042966094183", "https://x.com/StrikeReadyLabs/status/1851266545793617938", "https://x.com/StrikeReadyLabs/status/1852167112367689933", "https://x.com/StrikeReadyLabs/status/1853769628696113337", "https://x.com/StrikeReadyLabs/status/1857059598072455426", "https://x.com/StrikeReadyLabs/status/1878779709590565064", "https://x.com/Tac_Mangusta/status/1828077900475580901", "https://x.com/TeamDreier/status/2035301205031719170", "https://x.com/_CERT_UA/status/2018240505218314369", "https://x.com/smica83/status/2018659460261318958", "https://x.com/smica83/status/2020539423285203102", "https://x.com/smica83/status/2037477379530953027" ], "related": [ { "evidence": [ { "detail": "3 shared indicators", "kind": "infrastructure", "weight": 3.0 }, { "detail": "shares Tor, reGeorg", "kind": "software", "weight": 0.667 } ], "slug": "G0016" }, { "evidence": [ { "detail": "3 shared indicators", "kind": "infrastructure", "weight": 3.0 } ], "slug": "G0038" }, { "evidence": [ { "detail": "2 shared indicators", "kind": "infrastructure", "weight": 2.0 } ], "slug": "MERCENARYAMANDA" }, { "evidence": [ { "detail": "2 shared indicators", "kind": "infrastructure", "weight": 2.0 } ], "slug": "G0034" }, { "evidence": [ { "detail": "1 shared indicator", "kind": "infrastructure", "weight": 1.0 } ], "slug": "G0081" }, { "evidence": [ { "detail": "1 shared indicator", "kind": "infrastructure", "weight": 1.0 } ], "slug": "G0064" }, { "evidence": [ { "detail": "1 shared indicator", "kind": "infrastructure", "weight": 1.0 } ], "slug": "G0058" }, { "evidence": [ { "detail": "1 shared indicator", "kind": "infrastructure", "weight": 1.0 } ], "slug": "G0052" }, { "evidence": [ { "detail": "1 shared indicator", "kind": "infrastructure", "weight": 1.0 } ], "slug": "MIDDLEEAST" }, { "evidence": [ { "detail": "1 shared indicator", "kind": "infrastructure", "weight": 1.0 } ], "slug": "GAZA" }, { "evidence": [ { "detail": "1 shared indicator", "kind": "infrastructure", "weight": 1.0 } ], "slug": "INNAPUT" }, { "evidence": [ { "detail": "1 shared indicator", "kind": "infrastructure", "weight": 1.0 } ], "slug": "UNCLASSIFIED" }, { "evidence": [ { "detail": "3 reports cite both", "kind": "reporting", "weight": 3.0 } ], "slug": "UNC1151" }, { "evidence": [ { "detail": "2 reports cite both", "kind": "reporting", "weight": 2.0 } ], "slug": "CARETO" }, { "evidence": [ { "detail": "2 reports cite both", "kind": "reporting", "weight": 2.0 } ], "slug": "SAGUARO" }, { "evidence": [ { "detail": "shares Responder, reGeorg", "kind": "software", "weight": 0.667 } ], "slug": "G1003" }, { "evidence": [ { "detail": "shares Winexe", "kind": "software", "weight": 0.5 } ], "slug": "G0091" }, { "evidence": [ { "detail": "shares Responder", "kind": "software", "weight": 0.333 } ], "slug": "G0032" }, { "evidence": [ { "detail": "shares Tor", "kind": "software", "weight": 0.333 } ], "slug": "G0065" }, { "evidence": [ { "detail": "shares Wevtutil", "kind": "software", "weight": 0.333 } ], "slug": "G0129" }, { "evidence": [ { "detail": "shares Wevtutil", "kind": "software", "weight": 0.333 } ], "slug": "G1054" } ], "slug": "G0007", "timeline": [ { "counts": { "ipv4": 182 }, "first_seen": "2026-04-08", "indicators": { "ipv4": [ "103.140.186.148:53", "103.140.186.149:53", "103.140.186.155:53", "185.117.88.22:53", "185.117.88.28:53", "185.117.88.29:53", "185.117.88.30:53", "185.117.88.31:53", "185.117.88.50:53", "185.117.88.60:53", "185.117.88.61:53", "185.117.88.62:53", "185.117.89.32:53", "185.117.89.46:53", "185.117.89.47:53", "185.234.73.58:53", "185.234.73.61:53", "185.234.73.62:53", "185.237.166.224:53", "185.237.166.225:53", "185.237.166.226:53", "185.237.166.227:53", "185.237.166.228:53", "185.237.166.229:53", "185.237.166.230:53", "185.237.166.231:53", "185.237.166.232:53", "185.237.166.233:53", "185.237.166.234:53", "185.237.166.235:53", "185.237.166.236:53", "185.237.166.237:53", "185.237.166.238:53", "185.237.166.239:53", "185.237.166.240:53", "185.237.166.241:53", "185.237.166.242:53", "185.237.166.243:53", "185.237.166.244:53", "185.237.166.245:53", "185.237.166.246:53", "185.237.166.247:53", "185.237.166.248:53", "185.237.166.249:53", "185.237.166.55:53", "185.237.166.56:53", "185.237.166.57:53", "185.237.166.58:53", "185.237.166.59:53", "185.237.166.60:53", "185.237.166.61:53", "185.237.166.62:53", "185.237.166.63:53", "185.237.166.64:53", "185.237.166.65:53", "185.237.166.66:53", "185.237.166.67:53", "185.237.166.68:53", "185.237.166.69:53", "185.237.166.70:53", "185.237.166.71:53", "185.237.166.72:53", "185.237.166.73:53", "185.237.166.74:53", "185.237.166.75:53", "23.106.120.119:53", "37.221.64.101:53", "37.221.64.116:53", "37.221.64.131:53", "37.221.64.148:53", "37.221.64.149:53", "37.221.64.150:53", "37.221.64.151:53", "37.221.64.163:53", "37.221.64.173:53", "37.221.64.199:53", "37.221.64.208:53", "37.221.64.224:53", "37.221.64.254:53", "37.221.64.77:53", "37.221.64.78:53", "37.221.64.93:53", "5.226.137.151:53", "5.226.137.230:53", "5.226.137.231:53", "5.226.137.232:53", "5.226.137.234:53", "5.226.137.235:53", "5.226.137.242:53", "5.226.137.243:53", "5.226.137.244:53", "5.226.137.245:53", "64.120.31.100:53", "64.120.31.96:53", "64.120.31.97:53", "64.120.31.98:53", "64.120.31.99:53", "64.44.154.227:53", "64.44.154.237:53", "64.44.154.238:53", "64.44.154.239:53", "64.44.154.240:53", "77.83.197.37:53", "77.83.197.38:53", "77.83.197.39:53", "77.83.197.40:53", "77.83.197.41:53", "77.83.197.42:53", "77.83.197.43:53", "77.83.197.44:53", "77.83.197.45:53", "77.83.197.46:53", "77.83.197.47:53", "77.83.197.48:53", "77.83.197.49:53", "77.83.197.50:53", "77.83.197.51:53", "77.83.197.52:53", "77.83.197.53:53", "77.83.197.54:53", "77.83.197.55:53", "77.83.197.56:53", "77.83.197.57:53", "77.83.197.58:53", "77.83.197.59:53", "77.83.197.60:53", "77.83.198.39:53", "79.141.160.78:53", "79.141.161.66:53", "79.141.161.67:53", "79.141.161.68:53", "79.141.161.69:53", "79.141.161.70:53", "79.141.161.71:53", "79.141.161.72:53", "79.141.161.73:53", "79.141.161.74:53", "79.141.161.75:53", "79.141.161.76:53", "79.141.161.77:53", "79.141.161.78:53", "79.141.161.79:53", "79.141.161.80:53", "79.141.161.81:53", "79.141.161.82:53", "79.141.161.83:53", "79.141.161.84:53", "79.141.161.85:53", "79.141.173.103:53", "79.141.173.119:53", "79.141.173.120:53", "79.141.173.121:53", "79.141.173.122:53", "79.141.173.123:53", "79.141.173.200:53", "79.141.173.210:53", "79.141.173.211:53", "79.141.173.231:53", "79.141.173.232:53", "79.141.173.233:53", "79.141.173.246:53", "79.141.173.247:53", "79.141.173.248:53", "79.141.173.249:53", "79.141.173.250:53", "79.141.173.251:53", "79.141.173.252:53", "79.141.173.253:53", "79.141.173.254:53", "79.141.173.70:53", "79.141.173.96:53", "79.141.173.97:53", "79.141.173.98:53", "79.143.87.229:53", "79.143.87.232:53", "79.143.87.240:53", "79.143.87.243:53", "79.143.87.249:53", "88.80.148.49:53", "88.80.148.53:53", "89.150.40.43:53", "89.150.40.86:53" ] }, "precision": "exact", "references": [ "https://www.ncsc.gov.uk/news/apt28-exploit-routers-to-enable-dns-hijacking-operations" ], "total": 182 }, { "counts": { "url": 1 }, "first_seen": "2026-03-27", "indicators": { "url": [ "webhook.site/c2dceeb0-d40d-41a2-8622-118fa974649c/" ] }, "precision": "exact", "references": [ "https://x.com/smica83/status/2037477379530953027", "https://www.virustotal.com/gui/file/479fd5e5bd5566a0252acd4ec29c5abc0dac501d0d6e9f316612b52aa48a3587/detection" ], "total": 1 }, { "counts": { "domain": 2 }, "first_seen": "2026-03-26", "indicators": { "domain": [ "910cf351-a05d-4f67-ab8e-6f62cfa8e26d.dnshook.site", "dbca10b5-63e0-42ec-ad10-de13be96dc42.dnshook.site" ] }, "precision": "exact", "references": [ "https://www.trendmicro.com/en_us/research/26/c/pawn-storm-targets-govt-infra.html", "https://documents.trendmicro.com/assets/txt/Pawn%20Storm%20Deploys%20PRISMA%20IOCs-xQ48S7H.txt" ], "total": 2 }, { "counts": { "domain": 20 }, "first_seen": "2026-03-21", "indicators": { "domain": [ "analyticemailmeter.com", "emailanalytics.com.ua", "fraispei.com", "ftp.fraispei.com", "i.analyticemailmeter.com", "i.emailanalytics.com.ua", "i.mailnalysis.com", "i.zimbra-metadata.com", "i.zimbrasoft.com.ua", "i.zimbrastat.com", "i.zmailanalytics.com", "istc-cloud.com", "mailnalysis.com", "pro.fraispei.com", "synacorzimbra.nl", "test.fraispei.com", "zimbra-metadata.com", "zimbrasoft.com.ua", "zimbrastat.com", "zmailanalytics.com" ] }, "precision": "exact", "references": [ "https://x.com/TeamDreier/status/2035301205031719170", "https://www.seqrite.com/blog/operation-ghostmail-zimbra-xss-russian-apt-ukraine/", "https://www.proofpoint.com/us/blog/threat-insight/ta488-targets-zimbra-mailservers-half-click-exploits" ], "total": 20 }, { "counts": { "domain": 2 }, "first_seen": "2026-03-18", "indicators": { "domain": [ "gov.vppdr.com", "vppdr.com" ] }, "precision": "exact", "references": [ "https://ctrlaltintel.com/threat%20research/FancyBear/" ], "total": 2 }, { "counts": { "domain": 4, "ipv4": 3, "url": 1 }, "first_seen": "2026-03-11", "indicators": { "domain": [ "a.zhblz.com", "ns1.petdiary.net", "ns2.petdiary.net", "petdiary.net" ], "ipv4": [ "203.161.50.145:5000", "203.161.50.145:8080", "203.161.50.145:8889" ], "url": [ "http://93.170.72.54" ] }, "precision": "exact", "references": [ "https://cert.gov.ua/article/6281123 (# UAC-0001)", "https://hunt.io/blog/operation-roundish-apt28-roundcube-exploitation" ], "total": 8 }, { "counts": { "url": 10 }, "first_seen": "2026-02-14", "indicators": { "url": [ "webhook.site/4e6cf717-e4d6-4f40-9f2d-134196fa5e7d/", "webhook.site/5744c020-a8d9-4755-abfb-cde6ccd450af/", "webhook.site/5dbed3be-f1c9-41e5-b5d5-e961d08b5fba/", "webhook.site/62114596-33f5-47fb-9012-0223529e5a13/", "webhook.site/68d68fc7-aa94-4f2d-a727-d18fb40b0d69/", "webhook.site/a3f4e990-0b2a-4f6a-a02e-c573005de3ee/", "webhook.site/a72d8905-b15f-4e95-9a8f-5e4bb7dc9b3d/", "webhook.site/c29905ab-e5fa-446c-8958-4eab15d8fb80/", "webhook.site/c2e1be16-401b-4f60-8a0f-276b30417fda/", "webhook.site/d63049e3-1cbe-474b-9005-237517af53a7/" ] }, "precision": "exact", "references": [ "https://x.com/LAB52io/status/2022281566513180933", "https://www.virustotal.com/gui/file/9097d9cf5e6659e869bf2edf766741b687e3d8570036d853c0ca59ae72f9e9fc/detection" ], "total": 10 }, { "counts": { "domain": 1 }, "first_seen": "2026-02-09", "indicators": { "domain": [ "48d83469-d0c6-4ade-8f82-e383fff094b8.webhook.site" ] }, "precision": "exact", "references": [ "https://x.com/smica83/status/2020539423285203102", "https://www.virustotal.com/gui/file/506e7512c897514e9d312a1532d2e2949ec8ebd73f6ca52740fb5e3306f08843/detection" ], "total": 1 }, { "counts": { "domain": 1 }, "first_seen": "2026-02-06", "indicators": { "domain": [ "longsauce.com" ] }, "precision": "exact", "references": [ "https://x.com/smica83/status/2018659460261318958", "https://www.virustotal.com/gui/file/be859b4f4576ec09b69a2ef2d119939f7eb31de121aa01d38e1f0b2290f5a15e/detection" ], "total": 1 }, { "counts": { "domain": 3 }, "first_seen": "2026-02-02", "indicators": { "domain": [ "freefoodaid.com", "wellnesscaremed.com", "wellnessmedcare.org" ] }, "precision": "exact", "references": [ "https://x.com/HaifeiLi/status/2018353377965723761", "https://x.com/_CERT_UA/status/2018240505218314369", "https://pub.expmon.com/analysis/311631/", "https://www.zscaler.com/blogs/security-research/apt28-leverages-cve-2026-21509-operation-neusploit", "https://www.virustotal.com/gui/file/1ed863a32372160b3a25549aad25d48d5352d9b4f58d4339408c4eea69807f50/detection", "https://www.virustotal.com/gui/file/b2ba51b4491da8604ff9410d6e004971e3cd9a321390d0258e294ac42010b546/detection", "https://www.virustotal.com/gui/file/fed537aade989abe4eb76a7a27756e66861fe92322c4b359feca8e01b85b438b/detection", "https://www.virustotal.com/gui/file/5a17cfaea0cc3a82242fdd11b53140c0b56256d769b07c33757d61e0a0a6ec02/detection", "https://www.virustotal.com/gui/file/c91183175ce77360006f964841eb4048cf37cb82103f2573e262927be4c7607f/detection", "https://www.virustotal.com/gui/file/969d2776df0674a1cca0f74c2fccbc43802b4f2b62ecccecc26ed538e9565eae/detection", "https://www.virustotal.com/gui/file/c9b3ef44640e0fe297d76e770454ee2597e474f5d0cb406e376da8d504db0117/detection", "https://www.virustotal.com/gui/file/fd3f13db41cd5b442fa26ba8bc0e9703ed243b3516374e3ef89be71cbf07436b/detection" ], "total": 3 }, { "counts": { "ipv4": 1, "url": 1 }, "first_seen": "2026-01-02", "indicators": { "ipv4": [ "144.126.202.227:22" ], "url": [ "stayathomeclasses.com/slpw/up.php" ] }, "precision": "at-or-before", "references": [ "https://cert.gov.ua/article/6284730 (# lamehug)", "https://app.any.run/tasks/5bd56fb0-573e-471c-8503-6fe1a7f86b01", "https://www.virustotal.com/gui/file/d6af1c9f5ce407e53ec73c8e7187ed804fb4f80cf8dbd6722fc69e15e135db2e/detection", "https://www.virustotal.com/gui/file/bdb33bbb4ea11884b15f67e5c974136e6294aa87459cdc276ac2eea85b1deaa3/detection" ], "total": 2 }, { "counts": { "url": 1 }, "first_seen": "2026-01-02", "indicators": { "url": [ "webhook.site/8bf50371-5f9f-4d45-9320-922b068ebc2e" ] }, "precision": "at-or-before", "references": [ "https://www.kroll.com/en/publications/cyber/fancy-bear-gonepostal-espionage-tool-backdoor-access-microsoft-outlook" ], "total": 1 }, { "counts": { "domain": 2, "url": 1 }, "first_seen": "2025-01-13", "indicators": { "domain": [ "doads.org", "linkcuts.com" ], "url": [ "run.mocky.io/v3/22a2a2d8-84b9-4619-b8ba-359beb386cf9" ] }, "precision": "exact", "references": [ "https://x.com/StrikeReadyLabs/status/1878779709590565064", "https://www.virustotal.com/gui/file/53142380d75e3f54490f2896b58f308e6b91bec841d09b4e88985cb5b7812031/detection" ], "total": 3 }, { "counts": { "domain": 9 }, "first_seen": "2024-12-22", "indicators": { "domain": [ "errorreporting.net", "experience-improvement.com", "game-wins.com", "internalsecurity.us", "lanmangraphics.com", "retaildemo.info", "shared-rss.info", "telemetry-network.com", "tieringservice.com" ] }, "precision": "exact", "references": [ "https://community.emergingthreats.net/t/ruleset-update-summary-2024-11-21-v10747/2154" ], "total": 9 }, { "counts": { "domain": 1 }, "first_seen": "2024-11-14", "indicators": { "domain": [ "tuyt8erti867i.synergize.co" ] }, "precision": "exact", "references": [ "https://x.com/StrikeReadyLabs/status/1857059598072455426", "https://www.virustotal.com/gui/file/44935484933a13fb6632e8db92229cf1c5777333fa5a3c0a374b37428add69fb/detection" ], "total": 1 }, { "counts": { "domain": 1 }, "first_seen": "2024-11-05", "indicators": { "domain": [ "chujdrtuityui.mydiscussion.net" ] }, "precision": "exact", "references": [ "https://x.com/StrikeReadyLabs/status/1853769628696113337", "https://www.virustotal.com/gui/file/be3cccc2c62c0033aebcf91a6587eb815a1994cf268c42cf92ed856b6cf556aa/detection" ], "total": 1 }, { "counts": { "domain": 1, "url": 1 }, "first_seen": "2024-11-02", "indicators": { "domain": [ "kjghfkfgfdytku.infinityfreeapp.com" ], "url": [ "run.mocky.io/v3/da384ab3-f749-42d5-a076-40c248dece9b" ] }, "precision": "exact", "references": [ "https://strikeready.com/blog/finding-the-unknown-unknowns-part-1/" ], "total": 2 }, { "counts": { "domain": 1 }, "first_seen": "2024-11-01", "indicators": { "domain": [ "ukrainesafe.is-great.org" ] }, "precision": "exact", "references": [ "https://x.com/StrikeReadyLabs/status/1852167112367689933" ], "total": 1 }, { "counts": { "domain": 1 }, "first_seen": "2024-10-29", "indicators": { "domain": [ "ukrainesafeurl.talebco.ir" ] }, "precision": "exact", "references": [ "https://x.com/StrikeReadyLabs/status/1851266545793617938", "https://www.virustotal.com/gui/file/fa8a4d544ffb3ca9d51448772f478f303602023e0cd70af4b9f85d3b72b4cd27/detection" ], "total": 1 }, { "counts": { "domain": 4, "ipv4": 4 }, "first_seen": "2024-10-26", "indicators": { "domain": [ "doc.gmail.com.gyehddhrggdii323sdhnshiswh2udhqjwdhhfjcjeuejcj.zhblz.com", "docs.google.com.spreadsheets.d.1ip6eeakdebmwteh36vana4hu-glaeksstsht-boujdk.zhblz.com", "mail.zhblz.com", "zhblz.com" ], "ipv4": [ "203.161.50.145:22", "203.161.50.145:6211", "203.161.50.145:8443", "45.61.169.221:445" ] }, "precision": "exact", "references": [ "https://cert.gov.ua/article/6281123 (# UAC-0001)", "https://hunt.io/blog/operation-roundish-apt28-roundcube-exploitation" ], "total": 8 }, { "counts": { "domain": 1, "ipv4": 1 }, "first_seen": "2024-10-23", "indicators": { "domain": [ "ukraine.html-5.me" ], "ipv4": [ "3.67.15.169:1746" ] }, "precision": "exact", "references": [ "https://x.com/StrikeReadyLabs/status/1849084042966094183", "https://www.virustotal.com/gui/file/a097400e060edf1190002a30c64506da0f72f92f96ed526b01cb4c00d5df2f0c/detection" ], "total": 2 }, { "counts": { "domain": 1 }, "first_seen": "2024-10-23", "indicators": { "domain": [ "fghjdfhdzggjjdfd.rf.gd" ] }, "precision": "exact", "references": [ "https://www.virustotal.com/gui/file/86a9ca34790e219ddc371fa154c51a9a2930e2afdebf4fc0889d2ba94d6acfc1/detection" ], "total": 1 }, { "counts": { "domain": 1, "url": 2 }, "first_seen": "2024-10-04", "indicators": { "domain": [ "vgjkifguotgi.talebco.ir" ], "url": [ "run.mocky.io/v3/8dbd585e-805d-4b14-8485-c6da4c3ef5a7", "run.mocky.io/v3/df8e33e0-4c17-4564-917f-9fbff17f4571" ] }, "precision": "exact", "references": [ "https://x.com/Cyber0verload/status/1841924570351018233" ], "total": 3 }, { "counts": { "domain": 2, "ipv4": 1, "url": 1 }, "first_seen": "2024-10-02", "indicators": { "domain": [ "jkbfgkjdffghh.linkpc.net", "jkcfgjgfcjty.fast-page.org" ], "ipv4": [ "18.197.239.109:10176" ], "url": [ "run.mocky.io/v3/6ba09505-fa73-4d92-b209-641bfc51b6e2" ] }, "precision": "exact", "references": [ "https://x.com/StrikeReadyLabs/status/1841288172950499624", "https://www.virustotal.com/gui/file/1bcc09d482a1c84a06c4f1da85ba90b33ec269b873b51d153de4ef8e19cb1592/detection", "https://www.virustotal.com/gui/file/3d165a9bd4738fd3c1922643bd45204ff91bc37f2c5aa3f47d97523f7fd9e8ed/detection" ], "total": 4 }, { "counts": { "domain": 2, "url": 1 }, "first_seen": "2024-09-21", "indicators": { "domain": [ "47e811dbe2ed0ea8d506af94c1bb7d4c.serveo.net", "fgjgjuyfkuuyk.blogspot.com" ], "url": [ "run.mocky.io/v3/6c446a45-05aa-4198-9a81-d4472d7e81cb" ] }, "precision": "exact", "references": [ "https://x.com/StrikeReadyLabs/status/1837316398760022252", "https://www.virustotal.com/gui/file/8b77e8199c61c0d97b7a40e35feedf21a168a62696b18bbb4d49766332c2c8a8/detection" ], "total": 3 }, { "counts": { "url": 1 }, "first_seen": "2024-09-13", "indicators": { "url": [ "run.mocky.io/v3/47d78e98-8d12-452a-922b-bae56450a393" ] }, "precision": "exact", "references": [ "https://x.com/StrikeReadyLabs/status/1834217191060779174", "https://x.com/Cyber0verload/status/1834259021060014302" ], "total": 1 }, { "counts": { "domain": 1, "ipv4": 2 }, "first_seen": "2024-09-03", "indicators": { "domain": [ "kfghjerrlknsm.line.pm" ], "ipv4": [ "18.157.68.73:15254", "18.192.93.86:11962" ] }, "precision": "exact", "references": [ "https://x.com/StrikeReadyLabs/status/1830933284248776936", "https://www.virustotal.com/gui/file/f112876e875d43791da675e1187254eb2c839b7051d465ae83568274412d644a/detection", "https://www.virustotal.com/gui/file/64b26a92652bfb67cbe18217b6508fce460eff859526b2e256d3f1b9eab338b0/detection" ], "total": 3 }, { "counts": { "domain": 9 }, "first_seen": "2024-09-02", "indicators": { "domain": [ "cluz.someguydelivery.com", "dryf.shneez.com", "igfcw.torresemello.com", "jzit.wocircuitfitness.com", "majc.healthfloww.com", "swvfy.noreplay-fca.com", "urjaa.nitrocreditfix.com", "uttlh.peterswaysales.com", "zxrgh.viouni.com" ] }, "precision": "exact", "references": [ "https://x.com/RakeshKrish12/status/1830493704911728980" ], "total": 9 }, { "counts": { "domain": 2 }, "first_seen": "2024-08-31", "indicators": { "domain": [ "6c7aa72bd5f1d30203b80596f926b2b7.serveo.net", "78cc700b31dcd7c7f25fd7b0372259e3.serveo.net" ] }, "precision": "exact", "references": [ "https://x.com/Cyber0verload/status/1829953345009672433", "https://x.com/StrikeReadyLabs/status/1829562262253617411", "https://www.virustotal.com/gui/file/98a97978f84a2ca6f2c05a4e15e60e9ab7ea3a77b36b26a83ae8562f58b6749d/detection", "https://www.virustotal.com/gui/file/654a19f0773bbba1e63b0fee936b261fe14ca0222fba71150d688fbb9f3dac60/detection" ], "total": 2 }, { "counts": { "url": 1 }, "first_seen": "2024-08-26", "indicators": { "url": [ "http://83.147.243.18" ] }, "precision": "exact", "references": [ "https://x.com/Tac_Mangusta/status/1828077900475580901", "https://www.virustotal.com/gui/file/aaa20b39bcf056f42509069dc3faccefd70cd69a3972560fe7c3745c9c40e1f7/detection" ], "total": 1 }, { "counts": { "domain": 1 }, "first_seen": "2024-08-23", "indicators": { "domain": [ "73ce1aae8a9ba738b91040232524f51a.serveo.net" ] }, "precision": "exact", "references": [ "https://x.com/Cyber0verload/status/1829953345009672433", "https://x.com/StrikeReadyLabs/status/1826585308734931266", "https://x.com/StrikeReadyLabs/status/1826950349384495489", "https://www.virustotal.com/gui/file/c194f619d1ed73c0f0721d818564aa8238aceba94d1e721942c5cb67cbba68ff/detection", "https://www.virustotal.com/gui/file/2431578b5ba5a8569a689807bdb827e3d445a16cc013ed8eba7b7bfea661d76a/detection" ], "total": 1 }, { "counts": { "domain": 1 }, "first_seen": "2024-08-23", "indicators": { "domain": [ "eecomission.firstcloudit.com" ] }, "precision": "exact", "references": [ "https://twitter.com/Joseliyo_Jstnk/status/1769699442045657261", "https://x.com/Joseliyo_Jstnk/status/1826879652960346411", "https://securityintelligence.com/x-force/itg05-leverages-malware-arsenal/", "https://www.virustotal.com/gui/file/18f891a3737bb53cd1ab451e2140654a376a43b2d75f6695f3133d47a41952b6/detection", "https://www.virustotal.com/gui/file/40a7fd89b9e51b0a515ac2355036d203357be90a2200b9c506b95c12db54c7aa/detection", "https://www.virustotal.com/gui/file/451f3d427ac21632f38619ef96dece25798918866d44fe82ff1ed30996f998dc/detection", "https://www.virustotal.com/gui/file/64b0037dde987c78edf807a1bd7f09cdfac072ec2a59954cc4918828b7e608a3/behavior" ], "total": 1 }, { "counts": { "domain": 1 }, "first_seen": "2024-08-22", "indicators": { "domain": [ "92ace7e653e9c32d2af9700592cc96ea.serveo.net" ] }, "precision": "exact", "references": [ "https://x.com/Cyber0verload/status/1829953345009672433", "https://x.com/StrikeReadyLabs/status/1826585308734931266", "https://x.com/StrikeReadyLabs/status/1826950349384495489", "https://www.virustotal.com/gui/file/c194f619d1ed73c0f0721d818564aa8238aceba94d1e721942c5cb67cbba68ff/detection", "https://www.virustotal.com/gui/file/2431578b5ba5a8569a689807bdb827e3d445a16cc013ed8eba7b7bfea661d76a/detection" ], "total": 1 }, { "counts": { "url": 2 }, "first_seen": "2024-08-02", "indicators": { "url": [ "webhook.site/66d5b9f9-a5eb-48e6-9476-9b6142b0c3ae", "webhook.site/d290377c-82b5-4765-acb8-454edf6425dd" ] }, "precision": "exact", "references": [ "https://unit42.paloaltonetworks.com/fighting-ursa-car-for-sale-phishing-lure/" ], "total": 2 }, { "counts": { "domain": 7, "ipv4": 1, "url": 1 }, "first_seen": "2024-06-15", "indicators": { "domain": [ "cn5n8a92vtc00004a0t0gks3tbcyyyyyd.oast.fun", "czyrqdnvpujmmjkfhhvs2x9oyfsn6gd7t.oast.fun", "czyrqdnvpujmmjkfhhvs9647ioh30wxvd.oast.fun", "czyrqdnvpujmmjkfhhvseabz1q5olrum5.oast.fun", "czyrqdnvpujmmjkfhhvsqfxkqz68qzjcd.oast.fun", "czyrqdnvpujmmjkfhhvsqslblw0mawilr.oast.fun", "e-wody.firstcloudit.com" ], "ipv4": [ "23.24.68.109:443" ], "url": [ "http://23.24.68.109" ] }, "precision": "exact", "references": [ "https://twitter.com/BushidoToken/status/1740431013397078407", "https://twitter.com/k3yp0d/status/1752285465284170186", "https://cert.gov.ua/article/6276894", "https://harfanglab.io/en/insidethelab/compromised-routers-infrastructure-target-europe-caucasus/", "https://otx.alienvault.com/pulse/65bcd6e5cc24f8906b1a212a" ], "total": 9 }, { "counts": { "domain": 33, "ipv4": 3, "url": 4 }, "first_seen": "2024-05-31", "indicators": { "domain": [ "calc-dwn.infinityfreeapp.com", "clouddrive.infinityfreeapp.com", "consumerpanel0x254a2.frge.io", "consumerpanelapp.42web.io", "delivery-ukrinmash-service.infinityfreeapp.com", "document-d.infinityfreeapp.com", "documents-cloud.infinityfreeapp.com", "downloadable.infinityfreeapp.com", "downloadc.infinityfreeapp.com", "downloadinge.infinityfreeapp.com", "downloadingq.infinityfreeapp.com", "downloadingw.infinityfreeapp.com", "downloadx.infinityfreeapp.com", "downloadz.infinityfreeapp.com", "eo1ws2wgj75rdfd.m.pipedream.net", "eo6kgbwpysq0laa.m.pipedream.net", "eogo85tybrrn2r.m.pipedream.net", "eomhv6vdu4v5qyt.m.pipedream.net", "eottxji4yk4vg5x.m.pipedream.net", "eoy6vrzslpn9vu.m.pipedream.net", "eoytfd39hbrspa3.m.pipedream.net", "fdsagdfg.rf.gd", "file-download.infinityfreeapp.com", "filedwn.infinityfreeapp.com", "filehosting.infinityfreeapp.com", "filihosting.infinityfreeapp.com", "microsoft-files.infinityfreeapp.com", "online-download.infinityfreeapp.com", "online-drive.infinityfreeapp.com", "opendocuments.infinityfreeapp.com", "turbify-biz-cesdaz.rf.gd", "xgfdstu6k.frge.io", "xzdgsdfhfgtjdfj.wuaze.com" ], "ipv4": [ "174.53.242.108:8080", "68.76.150.97:8080", "73.80.9.137:35780" ], "url": [ "run.mocky.io/v3/4e14d583-bbf5-4af3-9a86-4c0938a7802a", "webhook.site/d466f7a7-63a1-4c04-8347-fe2d0a96081f", "webhook.site/e7f39f18-bcb3-40e3-9e82-8cf7f807cc80", "webhook.site/f5eace0b-062b-402f-a006-63b97e4950c3" ] }, "precision": "exact", "references": [ "https://go.recordedfuture.com/hubfs/reports/CTA-RU-2024-0530.pdf" ], "total": 40 }, { "counts": { "url": 27 }, "first_seen": "2024-05-08", "indicators": { "url": [ "webhook.site/0d2dc90e-2d5e-49f8-8249-d7ab955c387a", "webhook.site/0ef0dcf7-f258-4d02-b274-cbf62a2000cf", "webhook.site/127df518-52be-46c5-bbb2-0479f4b9693b", "webhook.site/1658772a-4de8-4368-a604-980c90b0a1ed", "webhook.site/2d07e34c-3dd3-45e8-865c-3888a65ab885", "webhook.site/3f396db1-2016-4b69-9ec3-ffc417d5f3aa", "webhook.site/4ba464d9-0675-4a7a-9966-8f84e93290ba", "webhook.site/4fe5885c-f2f6-4905-8bc7-aef1a046a134", "webhook.site/508da0df-7ec9-420e-b1fe-958fbbe699d1", "webhook.site/5100fcc0-f6be-4b09-8c58-5a8a6706ec4f", "webhook.site/577b82c3-7249-44e9-9353-5eab106fead6", "webhook.site/5a8758c6-5702-4fea-9d5e-4fbdb6dd795f", "webhook.site/5e4c7949-30a2-4477-9e9b-e8828fc76a1b", "webhook.site/66ea3bbc-29dc-4ece-b804-71c6ec7b77b6", "webhook.site/7674f06b-e435-4470-a594-6d59578c552d", "webhook.site/90fea98f-fbdb-4847-be03-409d02a43caf", "webhook.site/9a9cdaf8-120c-4de9-b17a-d6d8e2796a3b", "webhook.site/9c87649c-220d-425d-8331-ffc8d9b94a38", "webhook.site/b10bd697-1a9f-4ec7-aa2f-1fa84ad916a1", "webhook.site/bc349b93-b047-42f8-a421-d45e3ec94dc5", "webhook.site/bec23763-b8d9-4191-99ba-04a4a163b4de", "webhook.site/c1112bb3-0e6e-4ba4-abe7-fb31388b47ad", "webhook.site/c618ea32-2923-4c12-8151-8d0002b56af0", "webhook.site/dee016bf-21a2-45dd-86b4-6099747794c4", "webhook.site/e13d23aa-b6f8-4491-9adc-71f7f8c438df", "webhook.site/efb79108-a2b5-4cba-844d-6352bb8fad8c", "webhook.site/f97bcee0-0d91-4503-a30c-027f1b34820f" ] }, "precision": "exact", "references": [ "https://cert.pl/posts/2024/05/apt28-kampania/", "https://otx.alienvault.com/pulse/663b9c27bdf8af853c0e1e03" ], "total": 27 }, { "counts": { "domain": 1, "ipv4": 1, "url": 1 }, "first_seen": "2024-04-18", "indicators": { "domain": [ "postfix-mail.firstcloudit.com" ], "ipv4": [ "172.114.170.18:445" ], "url": [ "http://172.114.170.18" ] }, "precision": "exact", "references": [ "https://twitter.com/k3yp0d/status/1780888686025961824", "https://www.virustotal.com/gui/file/6954b6930afed2602e15400e38408883d2b94a2c643ff3070ccd7f87b043061d/detection" ], "total": 3 }, { "counts": { "url": 1 }, "first_seen": "2024-04-18", "indicators": { "url": [ "http://198.27.64.218" ] }, "precision": "exact", "references": [ "https://twitter.com/dimitribest/status/1780815421983109459", "https://www.linkedin.com/pulse/xagent-spyware-targeting-ios-devices-western-europe-dmitry-bestuzhev-xunle/", "https://www.joesandbox.com/analysis/828645?idtype=analysisid#iocs", "https://www.virustotal.com/gui/file/a665cd40efaca89e9257d083328e13446428281d133895f984e847d93634e736/detection" ], "total": 1 }, { "counts": { "domain": 2, "ipv4": 1, "url": 1 }, "first_seen": "2024-04-06", "indicators": { "domain": [ "euspa-vacancy.firstcloudit.com", "taizfbuhgowpawhafyuq23nb2v9kq0rmg.oast.fun" ], "ipv4": [ "24.88.87.29:445" ], "url": [ "http://24.88.87.29" ] }, "precision": "exact", "references": [ "https://twitter.com/Joseliyo_Jstnk/status/1776248416210702679" ], "total": 4 }, { "counts": { "domain": 22, "ipv4": 3, "url": 1 }, "first_seen": "2024-03-18", "indicators": { "domain": [ "calendar-ua.firstcloudit.com", "calendarua.firstcloudit.com", "dls-gov.firstcloudit.com", "e-gov-am.firstcloudit.com", "e-gov.firstcloudit.com", "e-military.firstcloudit.com", "e-mod.firstcloudit.com", "e-presidencia.firstcloudit.com", "eecommission-drive.firstcloudit.com", "eecommission.firstcloudit.com", "emod.firstcloudit.com", "files-presidencia.firstcloudit.com", "info-mod.firstcloudit.com", "kzgw-wody.firstcloudit.com", "mfa-files.firstcloudit.com", "militarysupport.firstcloudit.com", "presidencia-files.firstcloudit.com", "presidencia-gob.firstcloudit.com", "presidencia-gov.firstcloudit.com", "rada-zakon.firstcloudit.com", "sgg-files.firstcloudit.com", "wody-info-files.firstcloudit.com" ], "ipv4": [ "148.252.42.42:54467", "172.114.170.18:55155", "194.126.178.8:55555" ], "url": [ "webhook.site/e2831741-d8c8-4971-9464-e52d34f9d611" ] }, "precision": "exact", "references": [ "https://twitter.com/Joseliyo_Jstnk/status/1769699442045657261", "https://x.com/Joseliyo_Jstnk/status/1826879652960346411", "https://securityintelligence.com/x-force/itg05-leverages-malware-arsenal/", "https://www.virustotal.com/gui/file/18f891a3737bb53cd1ab451e2140654a376a43b2d75f6695f3133d47a41952b6/detection", "https://www.virustotal.com/gui/file/40a7fd89b9e51b0a515ac2355036d203357be90a2200b9c506b95c12db54c7aa/detection", "https://www.virustotal.com/gui/file/451f3d427ac21632f38619ef96dece25798918866d44fe82ff1ed30996f998dc/detection", "https://www.virustotal.com/gui/file/64b0037dde987c78edf807a1bd7f09cdfac072ec2a59954cc4918828b7e608a3/behavior" ], "total": 26 }, { "counts": { "ipv4": 1, "url": 1 }, "first_seen": "2024-03-07", "indicators": { "ipv4": [ "163.172.67.233:5000" ], "url": [ "webhook.site/92a1c89c-c371-4b93-a91c-cb0d61b3432d" ] }, "precision": "exact", "references": [ "https://twitter.com/MavericksInt/status/1765783346519425331", "https://www.virustotal.com/gui/file/ca5dd056e948b1d25bda3a96a0bc6001e20ef20c9516c86718e41817943400fa/detection", "https://www.virustotal.com/gui/file/aef94d2451e1eb943d2b1ee5ed48d923ffff4baeb0d26ebe4450d6e151bf28c8/detection", "https://www.virustotal.com/gui/file/7bed81cbbc5d368beb4531a373bad5a38aef7947f565048ad4ba597a821897c6/detection" ], "total": 2 }, { "counts": { "domain": 1, "ipv4": 1 }, "first_seen": "2024-02-22", "indicators": { "domain": [ "xfgjgjkuykykgihguifdt.mywire.org" ], "ipv4": [ "86.123.151.53:4430" ] }, "precision": "exact", "references": [ "https://twitter.com/felixaime/status/1760750756699812296", "https://www.virustotal.com/gui/ip-address/86.123.151.53/relations" ], "total": 2 }, { "counts": { "domain": 3 }, "first_seen": "2024-01-30", "indicators": { "domain": [ "gcsd.firstcloudit.com", "presidencia-docs.firstcloudit.com", "sgg-gov.firstcloudit.com" ] }, "precision": "exact", "references": [ "https://twitter.com/BushidoToken/status/1740431013397078407", "https://twitter.com/k3yp0d/status/1752285465284170186", "https://cert.gov.ua/article/6276894", "https://harfanglab.io/en/insidethelab/compromised-routers-infrastructure-target-europe-caucasus/", "https://otx.alienvault.com/pulse/65bcd6e5cc24f8906b1a212a" ], "total": 3 }, { "counts": { "ipv4": 1 }, "first_seen": "2024-01-22", "indicators": { "ipv4": [ "202.55.80.225:35770" ] }, "precision": "exact", "references": [ "https://twitter.com/h2jazi/status/1749489799184937094", "https://www.virustotal.com/gui/file/8d6a24eac7a90860edaf6721856ff11ce0cff9dd3dc9c2b546a3fdf9d15be4ed/detection", "https://www.virustotal.com/gui/file/a5418213e34f81913726f19cdeefa8d9e3d425a8786eda086e56faacea1372ae/detection" ], "total": 1 }, { "counts": { "domain": 7, "ipv4": 1, "url": 2 }, "first_seen": "2023-12-28", "indicators": { "domain": [ "czyrqdnvpujmmjkfhhvs4knf1av02demj.oast.fun", "czyrqdnvpujmmjkfhhvsclx05sfi23bfr.oast.fun", "czyrqdnvpujmmjkfhhvsgapqr3hclnhhj.oast.fun", "czyrqdnvpujmmjkfhhvsvlaax17vd5r6v.oast.fun", "e-nas.firstcloudit.com", "nas-files.firstcloudit.com", "ua-calendar.firstcloudit.com" ], "ipv4": [ "194.126.178.8:445" ], "url": [ "http://194.126.178.8", "http://88.209.251.6" ] }, "precision": "exact", "references": [ "https://twitter.com/BushidoToken/status/1740431013397078407", "https://twitter.com/k3yp0d/status/1752285465284170186", "https://cert.gov.ua/article/6276894", "https://harfanglab.io/en/insidethelab/compromised-routers-infrastructure-target-europe-caucasus/", "https://otx.alienvault.com/pulse/65bcd6e5cc24f8906b1a212a" ], "total": 10 }, { "counts": { "domain": 2 }, "first_seen": "2023-12-16", "indicators": { "domain": [ "document-c.infinityfreeapp.com", "downloadingdoc.infinityfreeapp.com" ] }, "precision": "exact", "references": [ "https://www.proofpoint.com/us/blog/threat-insight/ta422s-dedicated-exploitation-loop-same-week-after-week", "https://securityintelligence.com/x-force/itg05-ops-leverage-israel-hamas-conflict-lures-to-deliver-headlace-malware/", "https://twitter.com/Jane_0sint/status/1698702459739255016", "https://twitter.com/drb_ra/status/1696958416516759956", "https://twitter.com/Joseliyo_Jstnk/status/1730631107899437490", "https://twitter.com/Joseliyo_Jstnk/status/1730631116564951437", "https://otx.alienvault.com/pulse/6579b53c00375a2dcfaaf952", "https://app.any.run/tasks/aa73504a-563a-4dd7-8724-3afe54de02f2/", "https://www.virustotal.com/gui/file/2ac6735e8e0b23b222161690adf172aec668894d170299e9ff2c54a4ec25b1f4/detection", "https://www.virustotal.com/gui/file/d37779e16a92da7bd05eae50c64b36e2e2022eb441382be686fda4dbd1800e90/detection" ], "total": 2 }, { "counts": { "ipv4": 3, "url": 3 }, "first_seen": "2023-12-09", "indicators": { "ipv4": [ "24.142.165.2:445", "42.98.5.225:445", "69.51.2.106:445" ], "url": [ "http://24.142.165.2", "http://42.98.5.225", "http://69.51.2.106" ] }, "precision": "exact", "references": [ "https://unit42.paloaltonetworks.com/threat-brief-cve-2023-23397/", "https://unit42.paloaltonetworks.com/russian-apt-fighting-ursa-exploits-cve-2023-233397/" ], "total": 6 }, { "counts": { "domain": 4, "ipv4": 1, "url": 1, "url_path": 4 }, "first_seen": "2023-12-05", "indicators": { "domain": [ "downloadfile.infinityfreeapp.com", "downloadingf.infinityfreeapp.com", "opendoc.infinityfreeapp.com", "opendocument.infinityfreeapp.com" ], "ipv4": [ "50.173.136.70:445" ], "url": [ "http://50.173.136.70" ], "url_path": [ "/execdwn.php", "/execdwn.php?id=", "/filedwn.php", "/filedwn.php?id=" ] }, "precision": "exact", "references": [ "https://www.proofpoint.com/us/blog/threat-insight/ta422s-dedicated-exploitation-loop-same-week-after-week", "https://securityintelligence.com/x-force/itg05-ops-leverage-israel-hamas-conflict-lures-to-deliver-headlace-malware/", "https://twitter.com/Jane_0sint/status/1698702459739255016", "https://twitter.com/drb_ra/status/1696958416516759956", "https://twitter.com/Joseliyo_Jstnk/status/1730631107899437490", "https://twitter.com/Joseliyo_Jstnk/status/1730631116564951437", "https://otx.alienvault.com/pulse/6579b53c00375a2dcfaaf952", "https://app.any.run/tasks/aa73504a-563a-4dd7-8724-3afe54de02f2/", "https://www.virustotal.com/gui/file/2ac6735e8e0b23b222161690adf172aec668894d170299e9ff2c54a4ec25b1f4/detection", "https://www.virustotal.com/gui/file/d37779e16a92da7bd05eae50c64b36e2e2022eb441382be686fda4dbd1800e90/detection" ], "total": 10 }, { "counts": { "domain": 1 }, "first_seen": "2023-12-01", "indicators": { "domain": [ "downloaddoc.infinityfreeapp.com" ] }, "precision": "exact", "references": [ "https://www.proofpoint.com/us/blog/threat-insight/ta422s-dedicated-exploitation-loop-same-week-after-week", "https://securityintelligence.com/x-force/itg05-ops-leverage-israel-hamas-conflict-lures-to-deliver-headlace-malware/", "https://twitter.com/Jane_0sint/status/1698702459739255016", "https://twitter.com/drb_ra/status/1696958416516759956", "https://twitter.com/Joseliyo_Jstnk/status/1730631107899437490", "https://twitter.com/Joseliyo_Jstnk/status/1730631116564951437", "https://otx.alienvault.com/pulse/6579b53c00375a2dcfaaf952", "https://app.any.run/tasks/aa73504a-563a-4dd7-8724-3afe54de02f2/", "https://www.virustotal.com/gui/file/2ac6735e8e0b23b222161690adf172aec668894d170299e9ff2c54a4ec25b1f4/detection", "https://www.virustotal.com/gui/file/d37779e16a92da7bd05eae50c64b36e2e2022eb441382be686fda4dbd1800e90/detection" ], "total": 1 }, { "counts": { "ipv4": 1 }, "first_seen": "2023-09-05", "indicators": { "ipv4": [ "89.96.196.150:8080" ] }, "precision": "exact", "references": [ "https://www.proofpoint.com/us/blog/threat-insight/ta422s-dedicated-exploitation-loop-same-week-after-week", "https://securityintelligence.com/x-force/itg05-ops-leverage-israel-hamas-conflict-lures-to-deliver-headlace-malware/", "https://twitter.com/Jane_0sint/status/1698702459739255016", "https://twitter.com/drb_ra/status/1696958416516759956", "https://twitter.com/Joseliyo_Jstnk/status/1730631107899437490", "https://twitter.com/Joseliyo_Jstnk/status/1730631116564951437", "https://otx.alienvault.com/pulse/6579b53c00375a2dcfaaf952", "https://app.any.run/tasks/aa73504a-563a-4dd7-8724-3afe54de02f2/", "https://www.virustotal.com/gui/file/2ac6735e8e0b23b222161690adf172aec668894d170299e9ff2c54a4ec25b1f4/detection", "https://www.virustotal.com/gui/file/d37779e16a92da7bd05eae50c64b36e2e2022eb441382be686fda4dbd1800e90/detection" ], "total": 1 }, { "counts": { "domain": 19 }, "first_seen": "2023-07-16", "indicators": { "domain": [ "aneria.net", "armpress.net", "ceriossl.info", "fountainrate.com", "global-news-world.com", "global-world-news.net", "lonejade.com", "modeselling.com", "ns1.fountainrate.com", "ns1.lonejade.com", "ns1.modeselling.com", "ns1.oncetrips.com", "ns1.vtxhospital.com", "ns2.fountainrate.com", "ns2.modeselling.com", "ns2.oncetrips.com", "ns2.vtxhospital.com", "oncetrips.com", "vtxhospital.com" ] }, "precision": "exact", "references": [ "https://cert.gov.ua/article/4905829 (Ukrainian)" ], "total": 19 }, { "counts": { "domain": 3, "ipv4": 1 }, "first_seen": "2023-07-16", "indicators": { "domain": [ "eopkne8kapj01xi.m.pipedream.net", "eos93vb2cwsu3xf.m.pipedream.net", "mail-gov-ua.frge.io" ], "ipv4": [ "37.191.122.186:3578" ] }, "precision": "exact", "references": [ "https://cert.gov.ua/article/5105791 (Ukrainian)" ], "total": 4 }, { "counts": { "domain": 6 }, "first_seen": "2023-07-15", "indicators": { "domain": [ "config-panel.frge.io", "packinstall.kozow.com", "panelunregistertle-348.frge.io", "settings-panel.frge.io", "smtp-relay.frge.io", "ukrprivacysite.frge.io" ] }, "precision": "exact", "references": [ "https://blog.sekoia.io/apt28-leverages-multiple-phishing-techniques-to-target-ukrainian-civil-society/", "https://otx.alienvault.com/pulse/64676e2dffb6057207af2037" ], "total": 6 }, { "counts": { "domain": 1 }, "first_seen": "2023-07-15", "indicators": { "domain": [ "setnewcred.ukr.net.frge.io" ] }, "precision": "exact", "references": [ "https://blog.sekoia.io/apt28-leverages-multiple-phishing-techniques-to-target-ukrainian-civil-society/", "https://otx.alienvault.com/pulse/64676e2dffb6057207af2037", "https://cert.gov.ua/article/5105791 (Ukrainian)" ], "total": 1 }, { "counts": { "ipv4": 1 }, "first_seen": "2023-07-07", "indicators": { "ipv4": [ "62.4.36.126:8880" ] }, "precision": "exact", "references": [ "https://twitter.com/cyber__sloth/status/1677068498625867777", "https://twitter.com/Cyber0verload/status/1677361473427841029", "https://www.virustotal.com/gui/file/4df72b051d8e3b97640ea3819da75ffb34df75aeb40403edb3e8482a8465dfab/detection" ], "total": 1 }, { "counts": { "url": 10 }, "first_seen": "2023-05-02", "indicators": { "url": [ "mockbin.org/bin/4aa17a07-7635-4ee0-9f3a-449fcd91f342", "mockbin.org/bin/b8427b58-7497-46cd-a5b2-6ff6a40b4592", "mockbin.org/bin/e8bfd045-2b14-4afc-9372-b723f7d76918", "run.mocky.io/v3/1e88179a-3105-4a5c-9eb3-aebea36e9c21", "run.mocky.io/v3/3b44f33d-b6e5-4ec6-b120-99b6ac52f74b", "run.mocky.io/v3/a261411d-b869-4877-86f5-307e32ed6afa", "run.mocky.io/v3/a4b6625c-226e-4dbc-baec-1dbd854b8015", "run.mocky.io/v3/acea62da-ca05-46d1-bb80-0b036af7467c", "run.mocky.io/v3/ef206b51-4cf4-4c93-90bf-1e66673315b0", "run.mocky.io/v3/ef4c7798-fc09-42cd-8431-91a22d5728d9" ] }, "precision": "exact", "references": [ "https://twitter.com/StopMalvertisin/status/1653441365496459270", "https://cert.gov.ua/article/4492467 (Ukrainian)" ], "total": 10 }, { "counts": { "domain": 9 }, "first_seen": "2023-04-19", "indicators": { "domain": [ "chatgpt4beta.com", "cpcpipe.com", "cpcpipe.org", "masterofdigital.org", "robot-876.frge.io", "setnewcreds.ukr.net.frge.io", "telegram.org.4234e8234ad0f.24o1.com", "ukroboronprom.com.ukr.pm", "ukrprivatesite.frge.io" ] }, "precision": "exact", "references": [ "https://cert.gov.ua/article/39253 (Ukrainian, #UAC-0094)", "https://blog.google/threat-analysis-group/ukraine-remains-russias-biggest-cyber-focus-in-2023/", "https://otx.alienvault.com/pulse/64403596d7a47d80451657c3", "https://www.virustotal.com/gui/ip-address/193.106.191.202/relations", "https://www.virustotal.com/gui/ip-address/45.150.67.87/relations" ], "total": 9 }, { "counts": { "ipv4": 9, "url": 9 }, "first_seen": "2023-04-11", "indicators": { "ipv4": [ "101.255.119.42:445", "113.160.234.229:445", "168.205.200.55:445", "181.209.99.204:445", "185.132.17.160:445", "213.32.252.221:445", "61.14.68.33:445", "69.162.253.21:445", "82.196.113.102:445" ], "url": [ "http://101.255.119.42", "http://113.160.234.229", "http://168.205.200.55", "http://181.209.99.204", "http://185.132.17.160", "http://213.32.252.221", "http://61.14.68.33", "http://69.162.253.21", "http://82.196.113.102" ] }, "precision": "exact", "references": [ "https://unit42.paloaltonetworks.com/threat-brief-cve-2023-23397/", "https://unit42.paloaltonetworks.com/russian-apt-fighting-ursa-exploits-cve-2023-233397/" ], "total": 18 }, { "counts": { "ipv4": 1, "url": 1 }, "first_seen": "2023-03-27", "indicators": { "ipv4": [ "5.199.162.132:445" ], "url": [ "http://5.199.162.132" ] }, "precision": "exact", "references": [ "https://twitter.com/RedDrip7/status/1640342052327108609", "https://www.virustotal.com/gui/file/ece085c17ac5e822b78c533366e725bc845e215dcda78c0502ebd7f33ccb06ed/detection" ], "total": 2 }, { "counts": { "url": 1 }, "first_seen": "2023-03-17", "indicators": { "url": [ "http://85.195.206.7" ] }, "precision": "exact", "references": [ "https://twitter.com/angel11VR/status/1636474327926206470", "https://pastebin.com/FJDa0MA8" ], "total": 1 }, { "counts": { "ipv4": 1 }, "first_seen": "2023-03-16", "indicators": { "ipv4": [ "85.195.206.7:445" ] }, "precision": "exact", "references": [ "https://twitter.com/angel11VR/status/1636474327926206470", "https://pastebin.com/FJDa0MA8" ], "total": 1 }, { "counts": { "url": 1 }, "first_seen": "2022-12-16", "indicators": { "url": [ "http://109.248.148.42" ] }, "precision": "exact", "references": [ "https://www.virustotal.com/gui/file/87f363afc9778efc78dd3e0ced112d8d66a09a8924091f0927ed02a7b64850d2/detection" ], "total": 1 }, { "counts": { "domain": 2 }, "first_seen": "2022-09-23", "indicators": { "domain": [ "9b5uja.am.files.1drv.com", "kdmzlw.am.files.1drv.com" ] }, "precision": "exact", "references": [ "https://blog.cluster25.duskrise.com/2022/09/23/in-the-footsteps-of-the-fancy-bear-powerpoint-graphite/" ], "total": 2 }, { "counts": { "domain": 2 }, "first_seen": "2022-06-26", "indicators": { "domain": [ "caribou-forge-server.new.c66.me", "monkey-129.getforge.site" ] }, "precision": "exact", "references": [ "https://twitter.com/teamcymru_S2/status/1540390953516765185" ], "total": 2 }, { "counts": { "domain": 1, "url": 1 }, "first_seen": "2022-06-20", "indicators": { "domain": [ "kitten-268.frge.io" ], "url": [ "kompartpomiar.pl/grafika/" ] }, "precision": "exact", "references": [ "https://blog.malwarebytes.com/threat-intelligence/2022/06/russias-apt28-uses-fear-of-nuclear-war-to-spread-follina-docs-in-ukraine/", "https://cert.gov.ua/article/341128 (# Ukrainian)", "https://www.virustotal.com/gui/file/daaa271cee97853bf4e235b55cb34c1f03ea6f8d3c958f86728d41f418b0bf01/detection" ], "total": 2 }, { "counts": { "domain": 1 }, "first_seen": "2022-05-06", "indicators": { "domain": [ "eo2mxtqmeqzafqi.m.pipedream.net" ] }, "precision": "exact", "references": [ "https://cert.gov.ua/article/40102 (Ukrainian)" ], "total": 1 }, { "counts": { "domain": 8 }, "first_seen": "2022-04-05", "indicators": { "domain": [ "ohsxy.com", "org.ohsxy.com", "org.security.ohsxy.com", "security-check.telegram.org.ohsxy.com", "security.ohsxy.com", "telegram.org.ohsxy.com", "telegram.org.security.ohsxy.com", "telsec.org" ] }, "precision": "exact", "references": [ "https://cert.gov.ua/article/39253 (Ukrainian, #UAC-0094)", "https://blog.google/threat-analysis-group/ukraine-remains-russias-biggest-cyber-focus-in-2023/", "https://otx.alienvault.com/pulse/64403596d7a47d80451657c3", "https://www.virustotal.com/gui/ip-address/193.106.191.202/relations", "https://www.virustotal.com/gui/ip-address/45.150.67.87/relations" ], "total": 8 }, { "counts": { "domain": 4 }, "first_seen": "2022-03-08", "indicators": { "domain": [ "consumerspanel.frge.io", "hatdfg-rhgreh684.frge.io", "id-unconfirmeduser.frge.io", "ua-consumerpanel.frge.io" ] }, "precision": "exact", "references": [ "https://blog.google/threat-analysis-group/update-threat-landscape-ukraine/" ], "total": 4 }, { "counts": { "domain": 11 }, "first_seen": "2022-01-29", "indicators": { "domain": [ "alphabitconsulting.com", "armaghanteb.com", "centralinsumos.com.bo", "cercoselectricos.cl", "englishlessons-houston.com", "flammaautomoveis.com.br", "primage.com.br", "pwametalurgica.com.br", "quadteximagery.com", "saleswarriorinc.com", "saojoaodaurtigars.com.br" ] }, "precision": "exact", "references": [ "https://blog.bushidotoken.net/2022/01/tracking-renewable-energy-intelligence.html", "https://otx.alienvault.com/pulse/61e6de4edebb498761384f2a" ], "total": 11 }, { "counts": { "domain": 3 }, "first_seen": "2022-01-27", "indicators": { "domain": [ "jimbeam.live", "wordkeyvpload.net", "wordkeyvpload.org" ] }, "precision": "exact", "references": [ "https://www.trellix.com/en-us/about/newsroom/stories/threat-labs/prime-ministers-office-compromised.html", "https://www.virustotal.com/gui/file/1ee602e9b6e4e58dfff0fb8606a41336723169f8d6b4b1b433372bf6573baf40/detection" ], "total": 3 }, { "counts": { "domain": 5 }, "first_seen": "2022-01-14", "indicators": { "domain": [ "consumerpanel.eu3.biz", "consumerpanel.eu3.org", "consumerspanelsrv.eu3.org", "protectpanel.eu3.biz", "updateservicecenter.blogspot.com" ] }, "precision": "exact", "references": [ "https://twitter.com/billyleonard/status/1482034733072752640" ], "total": 5 }, { "counts": { "domain": 16 }, "first_seen": "2022-01-01", "indicators": { "domain": [ "cdn-nrdata.live", "checklogin.in", "ciscosupports.com", "dancemusicstream.com", "doorbehindentirerelationship.com", "familynearbysuitablenumber.com", "groupsincevisibleend.com", "hostapp.link", "hourduringstrictsense.com", "memcached.in", "msrole.com", "nationalzonehouse.com", "outlook-update.live", "powerfromfamousbank.com", "systembetweendifficultquality.com", "utmserver.com" ] }, "precision": "exact", "references": [ "https://github.com/ti-research-io/ti/blob/main/ioc_extender/ET_APT28.json" ], "total": 16 }, { "counts": { "domain": 2 }, "first_seen": "2021-12-17", "indicators": { "domain": [ "29572459487545-4543543-543534255-454-35432524-5243523-234543.xyz", "512521525-5245451515-985978774-2341235146436.xyz" ] }, "precision": "exact", "references": [ "https://www.intezer.com/blog/malware-analysis/targeted-phishing-attack-against-ukrainian-government-expands-to-georgia/", "https://otx.alienvault.com/pulse/60eff240c7c9cb4f24907049", "http://report.threatbook.cn/ST.pdf" ], "total": 2 }, { "counts": { "domain": 3 }, "first_seen": "2021-10-08", "indicators": { "domain": [ "digital-email-software.great-site.net", "reset-service-identity-mail.42web.io", "service-reset-password-moderate-digital.rf.gd" ] }, "precision": "exact", "references": [ "https://twitter.com/billyleonard/status/1446226367008313344" ], "total": 3 }, { "counts": { "domain": 5 }, "first_seen": "2021-08-07", "indicators": { "domain": [ "150520212.space", "150520213.space", "32689659.xyz", "99996665550.fun", "getvps.site" ] }, "precision": "exact", "references": [ "https://www.virustotal.com/gui/ip-address/45.146.164.37/relations", "https://www.virustotal.com/gui/file/b72188ba545ad865eb34954afbbdf2c9e8ebc465a87c5122cebb711f41005939/detection" ], "total": 5 }, { "counts": { "domain": 7 }, "first_seen": "2021-07-17", "indicators": { "domain": [ "000000027.xyz", "15052021.space", "2f9348243249382479234343284324023432748892349702394023.xyz", "32689657.xyz", "32689658.xyz", "4895458025-4545445-222435-9635794543-3242314342-234123423728.space", "99kg.site" ] }, "precision": "exact", "references": [ "https://www.intezer.com/blog/malware-analysis/targeted-phishing-attack-against-ukrainian-government-expands-to-georgia/", "https://otx.alienvault.com/pulse/60eff240c7c9cb4f24907049", "http://report.threatbook.cn/ST.pdf" ], "total": 7 }, { "counts": { "domain": 8 }, "first_seen": "2021-07-13", "indicators": { "domain": [ "1221.site", "1681683130.website", "16868138130.space", "1833.site", "2215.site", "33655990.cyou", "9348243249382479234343284324023432748892349702394023.xyz", "9832473219412342343423243242364-34939246823743287468793247237.site" ] }, "precision": "exact", "references": [ "https://www.intezer.com/blog/malware-analysis/targeted-phishing-attack-against-ukrainian-government-expands-to-georgia/", "https://otx.alienvault.com/pulse/60eff240c7c9cb4f24907049", "http://report.threatbook.cn/ST.pdf" ], "total": 8 }, { "counts": { "domain": 2 }, "first_seen": "2021-06-03", "indicators": { "domain": [ "getstatpro.com", "updaterweb.com" ] }, "precision": "exact", "references": [ "https://twitter.com/cluster25_io/status/1400467624912318470", "https://cluster25.io/wp-content/uploads/2021/05/2021-05_FancyBear.pdf (# SkinnyBoy)", "https://www.virustotal.com/gui/ip-address/194.33.40.72/relations", "https://www.virustotal.com/gui/ip-address/5.149.253.45/relations" ], "total": 2 }, { "counts": { "domain": 2 }, "first_seen": "2021-04-29", "indicators": { "domain": [ "1000018.xyz", "coronavirus5g.site" ] }, "precision": "exact", "references": [ "https://www.intezer.com/blog/malware-analysis/targeted-phishing-attack-against-ukrainian-government-expands-to-georgia/", "https://otx.alienvault.com/pulse/60eff240c7c9cb4f24907049", "http://report.threatbook.cn/ST.pdf" ], "total": 2 }, { "counts": { "domain": 1 }, "first_seen": "2021-04-28", "indicators": { "domain": [ "1000020.xyz" ] }, "precision": "exact", "references": [ "https://www.intezer.com/blog/malware-analysis/targeted-phishing-attack-against-ukrainian-government-expands-to-georgia/", "https://otx.alienvault.com/pulse/60eff240c7c9cb4f24907049", "http://report.threatbook.cn/ST.pdf" ], "total": 1 }, { "counts": { "domain": 3 }, "first_seen": "2021-04-12", "indicators": { "domain": [ "2055.site", "name1d.site", "name4050.com" ] }, "precision": "exact", "references": [ "https://www.intezer.com/blog/malware-analysis/targeted-phishing-attack-against-ukrainian-government-expands-to-georgia/", "https://otx.alienvault.com/pulse/60eff240c7c9cb4f24907049", "http://report.threatbook.cn/ST.pdf" ], "total": 3 }, { "counts": { "url": 1 }, "first_seen": "2021-02-19", "indicators": { "url": [ "c4csa.org/includes/sources/felims.php" ] }, "precision": "exact", "references": [ "https://twitter.com/RedDrip7/status/1362343352759250946", "https://otx.alienvault.com/pulse/602fe96189be26708dfafe17/", "https://www.virustotal.com/gui/file/1dd03c4ea4d630a59f73e053d705185e27e2e2545dd9caedb26a824ac5d11466/detection", "https://www.virustotal.com/gui/file/3b548a851fb889d3cc84243eb8ce9cbf8a857c7d725a24408934c0d8342d5811/detection" ], "total": 1 }, { "counts": { "url": 1 }, "first_seen": "2021-02-18", "indicators": { "url": [ "xbhp.com/dominargreatasianodyssey/wp-content/plugins/akismet/style.php" ] }, "precision": "exact", "references": [ "https://twitter.com/RedDrip7/status/1362343352759250946", "https://otx.alienvault.com/pulse/602fe96189be26708dfafe17/", "https://www.virustotal.com/gui/file/1dd03c4ea4d630a59f73e053d705185e27e2e2545dd9caedb26a824ac5d11466/detection", "https://www.virustotal.com/gui/file/3b548a851fb889d3cc84243eb8ce9cbf8a857c7d725a24408934c0d8342d5811/detection" ], "total": 1 }, { "counts": { "domain": 1 }, "first_seen": "2021-01-16", "indicators": { "domain": [ "baltichost.org" ] }, "precision": "exact", "references": [ "https://s3.amazonaws.com/snort-org/www/rules/community/community-rules.tar.gz", "https://snort-org-site.s3.amazonaws.com/production/release_files/files/000/012/156/original/snort3-community-rules.tar.gz" ], "total": 1 }, { "counts": { "domain": 1, "url": 4 }, "first_seen": "2020-12-10", "indicators": { "domain": [ "drive365us.com" ], "url": [ "http://185.77.131.110", "http://46.183.218.34", "http://80.255.12.252", "http://92.114.92.128" ] }, "precision": "exact", "references": [ "https://twitter.com/Arkbird_SOLG/status/1336834398784786432" ], "total": 5 }, { "counts": { "domain": 1, "url_path": 1 }, "first_seen": "2020-12-09", "indicators": { "domain": [ "support-cloud.life" ], "url_path": [ "/managment/cb-secure/technology.php" ] }, "precision": "exact", "references": [ "https://www.intezer.com/blog/research/russian-apt-uses-covid-19-lures-to-deliver-zebrocy/", "https://otx.alienvault.com/pulse/5fd10cde3563e4121cbab5c7" ], "total": 2 }, { "counts": { "ipv4": 1 }, "first_seen": "2020-10-29", "indicators": { "ipv4": [ "23.200.147.10:80" ] }, "precision": "exact", "references": [ "https://us-cert.cisa.gov/ncas/analysis-reports/ar20-303b", "https://otx.alienvault.com/pulse/5f9b0ac2ac1088826c07eb3b", "https://www.virustotal.com/gui/file/2631f95e9a46c821a701269a76b15bb065764cc15a0b268a4d1eac045975c9b8/detection", "https://www.virustotal.com/gui/file/0be114fe30ef5042890c17033b63d7c9e0363972fcc15a61433c598dd33f49d1/detection" ], "total": 1 }, { "counts": { "url": 20, "url_path": 50 }, "first_seen": "2020-10-23", "indicators": { "url": [ "http://185.25.50.93", "http://185.25.51.114", "http://185.25.51.164", "http://185.25.51.198", "http://188.241.68.121", "http://213.103.67.193", "http://213.252.244.219", "http://213.252.245.132", "http://222.15.23.121", "http://46.102.152.127", "http://46.183.223.227", "http://86.105.18.106", "http://86.105.18.111", "http://86.106.131.177", "http://89.249.65.166", "http://89.249.65.234", "http://89.40.181.126", "http://89.45.67.153", "http://93.113.131.117", "http://93.113.131.155" ], "url_path": [ "/CheckNow864.php", "/KB7735-9927/security-serv/opt.php", "/LoG-statistic8397420934809/date-update9048353094c/StaticIpUpdateLog23741033.php", "/MsKZrpUfe.php", "/StaticIpUpdateLog23741033.php", "/SupportA91i/syshelpA774i/", "/UpdateCertificate33-33725cnm^BB/CheckerNow-saMbA-99-36^11/CheckerSerface^8830-11.php", "/apps.update/DetailsID/clientPID-118253.php", "/client-update-info/version-id/version333.php", "/clientid-and-uniqued-r2/the-differenceU/Events76.php", "/cumulative-security-update/Summary/details.php", "/daily-update-certifaicates52735462534234/update-15.dat/", "/data-extract/timermodule/update-client.php", "/database-update-centre/check-system-version/id=18862.php", "/db7749sc.php", "/debug-info/pluginId/CLISD1934.php", "/fdfd_iunb_hhert_ps.php", "/func112SerErr.php", "/get-help-software/get-app-c/error-code-lookup.php", "/gft_piyes/ndhfkuryhs09/fdfd_iunb_hhert_ps.php", "/ghflYvz/vmwWIdx/realui.php", "/grenadLibS44-two/fIndToClose12t3/sol41.php", "/guard-service/Servers-ip4/upd-release", "/int-release/check-user/userid.php", "/ndhfkuryhs09/", "/ram-data/managerId/REM1234.php", "/search-release/Search-Version/crmclients.php", "/search-sys-update-release/base-sync/db7749sc.php", "/security-services-DMHA-group/info-update-version/id77820082.php", "/services-check-update/security-certificate-11-554/CheckNow864.php", "/setting-the-os-release/Support-OS-release/ApiMap.php", "/setwsdv4.php", "/srvSettings/conf4421i/", "/srvSettings/conf4421i/support.php", "/srv_upd_dest_two/destBB/en.php", "/stream-upd-service-two/definition/event.php", "/supportfsys/t863321i/func112SerErr.php", "/syshelp/kd8812u/", "/syshelp/kd8812u/protocol.php", "/tech99-04/litelib1/", "/tech99-04/litelib1/setwsdv4.php", "/techicalBS391-two/supptech18i/suppid.php", "/test-update-16-8852418/temp727612430/checkUpdate89732468.php", "/test-update-17-8752417/temp827612480/checkUpdate79832467.php", "/update/dB-Release/NewBaseCheck.php", "/verification-online/service.911-19/check-verification-88291.php", "/versionID/Plugin0899/debug-release01119", "/wWpYdSMRulkdp/", "/wWpYdSMRulkdp/arpz/", "/wWpYdSMRulkdp/arpz/MsKZrpUfe.php" ] }, "precision": "exact", "references": [ "https://www.welivesecurity.com/2018/04/24/sednit-update-analysis-zebrocy/" ], "total": 70 }, { "counts": { "url": 1 }, "first_seen": "2020-09-29", "indicators": { "url": [ "http://31.7.62.103" ] }, "precision": "exact", "references": [ "https://twitter.com/Vishnyak0v/status/1310861022954225664", "https://www.virustotal.com/gui/file/7f698295230f59c7ca8193322eb48d71cd203f3675139f2da99e326589bfdad3/detection", "https://www.virustotal.com/gui/file/e23b7a912f6bd16d634a1acce41922f277242ec8ab9c354754b5e97a0bab85d0/detection" ], "total": 1 }, { "counts": { "domain": 1 }, "first_seen": "2020-09-13", "indicators": { "domain": [ "bl4kj2.zapto.org" ] }, "precision": "exact", "references": [ "https://www.virustotal.com/gui/file/76f8f159637c9201e98ed1aab5e0359ea983c5cce8ced832bae13dffab0f73a8/detection" ], "total": 1 }, { "counts": { "url": 1 }, "first_seen": "2020-08-20", "indicators": { "url": [ "http://69.90.132.215" ] }, "precision": "exact", "references": [ "https://www.virustotal.com/gui/file/02de72e43d578c45d9d6359299cb2d47771081617ff01363b736414eb831deea/detection" ], "total": 1 }, { "counts": { "url": 1 }, "first_seen": "2020-08-13", "indicators": { "url": [ "http://185.86.149.125" ] }, "precision": "exact", "references": [ "https://media.defense.gov/2020/Aug/13/2002476465/-1/-1/0/CSA_DROVORUB_RUSSIAN_GRU_MALWARE_AUG_2020.PDF", "https://otx.alienvault.com/pulse/5f3581cc4138be1d82c183b8" ], "total": 1 }, { "counts": { "url": 1, "url_path": 1 }, "first_seen": "2020-08-08", "indicators": { "url": [ "http://194.32.78.245" ], "url_path": [ "/protect/get-upd-id.php" ] }, "precision": "exact", "references": [ "https://twitter.com/ShadowChasing1/status/1291931828723408896", "https://www.virustotal.com/gui/file/aac3b1221366cf7e4421bdd555d0bc33d4b92d6f65fa58c1bb4d8474db883fec/detection", "https://quointelligence.eu/2020/09/apt28-zebrocy-malware-campaign-nato-theme/", "https://otx.alienvault.com/pulse/5f6a13f6bd6ff146fa3967de" ], "total": 2 }, { "counts": { "domain": 1 }, "first_seen": "2020-07-25", "indicators": { "domain": [ "revampme.net" ] }, "precision": "exact", "references": [ "https://twitter.com/kyleehmke/status/1286779311626870791", "https://twitter.com/kyleehmke/status/1286779313384312834" ], "total": 1 }, { "counts": { "url": 1 }, "first_seen": "2020-06-10", "indicators": { "url": [ "http://89.37.226.148" ] }, "precision": "exact", "references": [ "https://app.any.run/tasks/0f0eb583-abcf-4e0f-a803-2b1d3bfdfe47/" ], "total": 1 }, { "counts": { "url": 1, "url_path": 1 }, "first_seen": "2020-06-07", "indicators": { "url": [ "http://185.234.52.168" ], "url_path": [ "/categories/buildings.php" ] }, "precision": "exact", "references": [ "https://twitter.com/Vishnyak0v/status/1269651391980736513" ], "total": 2 }, { "counts": { "url": 1 }, "first_seen": "2020-05-17", "indicators": { "url": [ "http://23.227.196.215" ] }, "precision": "exact", "references": [ "https://www.virustotal.com/gui/ip-address/23.227.196.215/relations" ], "total": 1 }, { "counts": { "url": 1, "url_path": 1 }, "first_seen": "2020-05-05", "indicators": { "url": [ "http://185.221.202.36" ], "url_path": [ "/overstock/brand.php" ] }, "precision": "exact", "references": [ "https://twitter.com/Vishnyak0v/status/1257606954085646337" ], "total": 2 }, { "counts": { "url": 2 }, "first_seen": "2020-04-30", "indicators": { "url": [ "http://185.77.129.152", "http://93.115.38.132" ] }, "precision": "exact", "references": [ "https://twitter.com/dewan202/status/1255582744110862345", "https://www.virustotal.com/gui/file/7edacdf35900e722b798dbc891159cf1ede9f6d671a86b0f01f9ef802202aa73/detection", "https://www.virustotal.com/gui/ip-address/185.77.129.152/relations", "https://www.virustotal.com/gui/ip-address/93.115.38.132/relations", "https://www.welivesecurity.com/2018/04/24/sednit-update-analysis-zebrocy/" ], "total": 2 }, { "counts": { "url_path": 1 }, "first_seen": "2020-04-30", "indicators": { "url_path": [ "/wwpydsmrulkdp/arpz/" ] }, "precision": "exact", "references": [ "https://twitter.com/dewan202/status/1255582744110862345", "https://www.virustotal.com/gui/file/7edacdf35900e722b798dbc891159cf1ede9f6d671a86b0f01f9ef802202aa73/detection", "https://www.virustotal.com/gui/ip-address/185.77.129.152/relations", "https://www.virustotal.com/gui/ip-address/93.115.38.132/relations" ], "total": 1 }, { "counts": { "url": 3 }, "first_seen": "2020-04-11", "indicators": { "url": [ "http://194.187.249.126", "http://220.158.216.127", "http://80.255.6.5" ] }, "precision": "exact", "references": [ "https://www.vkremez.com/2019/01/lets-learn-progression-of-apt28-autoit.html", "https://www.virustotal.com/gui/ip-address/145.249.106.198/relations", "https://www.virustotal.com/gui/ip-address/185.236.203.53/relations", "https://www.virustotal.com/gui/file/5b52bc196bfc207d43eedfe585df96fcfabbdead087ff79fcdcdd4d08c7806db/detection", "https://www.virustotal.com/gui/file/384c9a19dd6f0f73bee575e54801f9608883ae31db1b399a28b8cc5f7aa9a26c/detection", "https://www.welivesecurity.com/2018/04/24/sednit-update-analysis-zebrocy/" ], "total": 3 }, { "counts": { "ipv4": 2, "url": 1 }, "first_seen": "2020-04-11", "indicators": { "ipv4": [ "145.249.106.198:443", "185.236.203.53:443" ], "url": [ "http://185.236.203.53" ] }, "precision": "exact", "references": [ "https://www.vkremez.com/2019/01/lets-learn-progression-of-apt28-autoit.html", "https://www.virustotal.com/gui/ip-address/145.249.106.198/relations", "https://www.virustotal.com/gui/ip-address/185.236.203.53/relations", "https://www.virustotal.com/gui/file/5b52bc196bfc207d43eedfe585df96fcfabbdead087ff79fcdcdd4d08c7806db/detection", "https://www.virustotal.com/gui/file/384c9a19dd6f0f73bee575e54801f9608883ae31db1b399a28b8cc5f7aa9a26c/detection" ], "total": 3 }, { "counts": { "domain": 41 }, "first_seen": "2020-04-06", "indicators": { "domain": [ "aijazeera.org", "blu172maillive.com", "catholicsinaliance.org", "cc-yahoo-inc.org", "defensenews.org", "e-post.byegm.web.tr", "edit-mail-yahoo.com", "help-yahoo-service.com", "iraqinews.info", "loqin-yandex.ru", "mail-justus.com.ua", "mail-navy.ro", "mail.byegm.web.tr", "mail.g0v.me", "mail.mofa.g0v.qa", "mail.rsaf.qov.sa.com", "mail.teiecomitalia.it", "mailhost-ut.ee", "mailhost.university-tartu.info", "mailmil.ae", "mfagreece.com", "mobile-sanoma.net", "mycloud-mail.ru", "options-mail.ru", "osce-press.com", "pasport-yandex.ru", "poczta.mon-gov.pl", "privacy-facebook.me", "privacy-yahooservice.com", "redirect2app.cf", "rn-mail.ru", "service-ukr.net", "service-yahoo.com", "setting-mail.ru", "tbmm.qov.web.tr", "unbulletin.com", "webmail-gov.me", "webmail-mil.gr", "webmail.mofa.qov.ae", "wsjworld.com", "yahoo.securepassword.info" ] }, "precision": "exact", "references": [ "https://documents.trendmicro.com/assets/appendix_looking-into-a-cyber-attack-facilitator-in-the-netherlands.pdf", "https://vxcube.com/recent-threats-ioc/5c74c73ca39bb5786f9664d3/detail" ], "total": 41 }, { "counts": { "url": 1 }, "first_seen": "2020-04-04", "indicators": { "url": [ "http://89.37.226.123/advance/portable_version/service.php" ] }, "precision": "exact", "references": [ "https://www.vkremez.com/2018/12/lets-learn-dissecting-apt28sofacy.html" ], "total": 1 }, { "counts": { "domain": 2 }, "first_seen": "2020-04-03", "indicators": { "domain": [ "popdancestream.com", "webchartzone.com" ] }, "precision": "exact", "references": [ "http://www.hexcapes.com/sofacy-in-poland/" ], "total": 2 }, { "counts": { "domain": 9 }, "first_seen": "2020-03-19", "indicators": { "domain": [ "0x4fc271.tk", "0xf4a5.tk", "0xf4a54cf56.tk", "546874.tk", "change-password.ml", "id24556.tk", "id451295.com", "id6589.com", "yahoo-change-password.com" ] }, "precision": "exact", "references": [ "https://www.trendmicro.com/vinfo/us/security/news/cyber-attacks/probing-pawn-storm-cyberespionage-campaign-through-scanning-credential-phishing-and-more", "https://otx.alienvault.com/pulse/5e736669fcc47a29220ce3f0" ], "total": 9 }, { "counts": { "domain": 3 }, "first_seen": "2020-02-24", "indicators": { "domain": [ "blackpartshare.com", "contentdeliverysrv.net", "mountainsgide.com" ] }, "precision": "exact", "references": [ "https://www.proofpoint.com/us/threat-insight/post/apt28-racing-exploit-cve-2017-11292-flash-vulnerability-patches-are-deployed", "https://blog.angelalonso.es/2017/10/hunting-apt28-cve-2017-11292-flash.html?m=0", "https://www.virustotal.com/gui/file/362a8297a0ff603553e992626a8e28c0aa19d038557da82fe6f4526988601be7/behavior/Tencent%20HABO" ], "total": 3 }, { "counts": { "domain": 1 }, "first_seen": "2020-02-24", "indicators": { "domain": [ "gpufps.com" ] }, "precision": "exact", "references": [ "https://doc.emergingthreats.net/bin/view/Main/2023662" ], "total": 1 }, { "counts": { "domain": 1 }, "first_seen": "2020-01-26", "indicators": { "domain": [ "esco-plvnlch.com" ] }, "precision": "exact", "references": [ "https://cdn.area1security.com/reports/Area-1-Security-PhishingBarismaHoldings.pdf", "https://otx.alienvault.com/pulse/5e1da5a3ca48088035ce6c5a", "https://twitter.com/kyleehmke/status/1207779048086286336", "https://twitter.com/kyleehmke/status/1216905172305227776" ], "total": 1 }, { "counts": { "ipv4": 7 }, "first_seen": "2020-01-20", "indicators": { "ipv4": [ "109.169.15.73", "178.32.251.98", "184.95.51.172", "185.141.63.103", "193.70.80.214", "78.142.19.114", "80.255.3.116" ] }, "precision": "exact", "references": [ "https://twitter.com/ydklijnsma/status/1218599851669233666" ], "total": 7 }, { "counts": { "domain": 11 }, "first_seen": "2020-01-14", "indicators": { "domain": [ "analyticsrequest.com", "as23-updater-symantec.org", "cgna.info", "cmdswitch.xyz", "docs77.com", "dxtveuux.com", "eskvortsov.com", "mysent.org", "newfilmts.org", "pandadefender.com", "sourcerepolist.org" ] }, "precision": "exact", "references": [ "https://threatconnect.com/finding-nemohost-fancy-bear-infrastructure/" ], "total": 11 }, { "counts": { "domain": 6 }, "first_seen": "2020-01-14", "indicators": { "domain": [ "cubenergy-my-sharepoint.com", "dpkshodnya-mysharepoint.com", "kub-gas.com", "kvatral95.com", "minjust-gov-ua.com", "my-ukr.net" ] }, "precision": "exact", "references": [ "https://cdn.area1security.com/reports/Area-1-Security-PhishingBarismaHoldings.pdf", "https://otx.alienvault.com/pulse/5e1da5a3ca48088035ce6c5a", "https://twitter.com/kyleehmke/status/1207779048086286336", "https://twitter.com/kyleehmke/status/1216905172305227776" ], "total": 6 }, { "counts": { "domain": 1 }, "first_seen": "2019-12-14", "indicators": { "domain": [ "bohack51.ddns.net" ] }, "precision": "exact", "references": [ "https://twitter.com/ShadowChasing1/status/1251164774982795266" ], "total": 1 }, { "counts": { "url": 2 }, "first_seen": "2019-11-20", "indicators": { "url": [ "http://37.120.140.215", "http://79.142.70.106" ] }, "precision": "exact", "references": [ "https://twitter.com/Vishnyak0v/status/1197129423830626318" ], "total": 2 }, { "counts": { "domain": 1 }, "first_seen": "2019-11-15", "indicators": { "domain": [ "secao.com" ] }, "precision": "exact", "references": [ "https://twitter.com/LastlineLabs/status/1022865021343330305" ], "total": 1 }, { "counts": { "domain": 1 }, "first_seen": "2019-10-26", "indicators": { "domain": [ "pavlodar.news" ] }, "precision": "exact", "references": [ "https://meltx0r.github.io/tech/2019/10/24/apt28.html", "https://otx.alienvault.com/pulse/5db2cff18faf1f1d826cd074" ], "total": 1 }, { "counts": { "url_path": 2 }, "first_seen": "2019-10-25", "indicators": { "url_path": [ "/modules/Contact/Includes/1c.php", "/modules/Contact/Includes/2c.php" ] }, "precision": "exact", "references": [ "https://meltx0r.github.io/tech/2019/10/24/apt28.html", "https://otx.alienvault.com/pulse/5db2cff18faf1f1d826cd074" ], "total": 2 }, { "counts": { "domain": 1 }, "first_seen": "2019-10-21", "indicators": { "domain": [ "ovhsec.com" ] }, "precision": "exact", "references": [ "https://twitter.com/kyleehmke/status/1186114823341400064" ], "total": 1 }, { "counts": { "domain": 3 }, "first_seen": "2019-10-17", "indicators": { "domain": [ "ministernetwork.org", "powerpolymerindustry.com", "varuhusmc.org" ] }, "precision": "exact", "references": [ "https://threatconnect.com/finding-nemohost-fancy-bear-infrastructure/" ], "total": 3 }, { "counts": { "domain": 50 }, "first_seen": "2019-10-07", "indicators": { "domain": [ "account.password-google.com", "accountgooogle.com", "accounts-gooogl.com", "accounts-qooqle.com", "accountsgooglemail.com", "action-yandex.ru", "activity-yandex.ru", "afghanistanmfa.net", "akragames.net", "cryptogo.net", "delivery-yandex.ru", "drive-auth.com", "drive-google.ga", "e-mail-supports.com", "emailyandex.ru", "farele.co", "ftp.password-google.com", "google-login.ml", "google-passwd.com", "google-password.com", "google-password.ml", "gooogle-login.com", "gov-kw.com", "hurriyet.org.uk", "login-one.com", "mail-service-yandex.ru", "mail.unrightswire.org", "mailsettings-yandex.ru", "mailtransferservice.com", "markburgston.com", "mastconf.com", "mofa.farele.co", "mx.unrightswire.org", "myaccountgoogle.ga", "newsweekadviser.com", "password-google.com", "pentestinglab.com", "privacy-yandex.ru", "pus.akragames.net", "redirect.screenameaol.com", "report-yandex.ru", "service-yandex.ru", "settinqs-yandex.ru", "syrianhrc.org", "team-google.com", "top-total.com", "unrightswire.org", "webmail.afghanistanmfa.net", "yandex-control.ru", "yandex-report.ru" ] }, "precision": "exact", "references": [ "https://threatconnect.com/blog/how-to-investigate-incidents-in-threatconnect/" ], "total": 50 }, { "counts": { "domain": 5 }, "first_seen": "2019-10-07", "indicators": { "domain": [ "int-live.com", "live-settings.com", "mail-hurriyet.com", "mail.kuwaitarmy.gov-kw.com", "posta-hurriyet.com" ] }, "precision": "exact", "references": [ "https://threatconnect.com/blog/how-to-investigate-incidents-in-threatconnect/", "https://documents.trendmicro.com/assets/appendix_looking-into-a-cyber-attack-facilitator-in-the-netherlands.pdf", "https://vxcube.com/recent-threats-ioc/5c74c73ca39bb5786f9664d3/detail" ], "total": 5 }, { "counts": { "url": 1 }, "first_seen": "2019-09-25", "indicators": { "url": [ "http://185.221.202.35/software-protection/app.php" ] }, "precision": "exact", "references": [ "https://twitter.com/pancak3lullz/status/1176856452780179456" ], "total": 1 }, { "counts": { "domain": 2 }, "first_seen": "2019-09-23", "indicators": { "domain": [ "cyb3rc.com", "electionleaks.com" ] }, "precision": "exact", "references": [ "https://medium.com/@rsatter/decoding-the-gru-indictment-bfb2c08fe362", "https://otx.alienvault.com/pulse/5d88c12375a272432c4cd9ec" ], "total": 2 }, { "counts": { "ipv4": 5 }, "first_seen": "2019-08-06", "indicators": { "ipv4": [ "128.199.199.187:443", "167.114.153.55:443", "31.220.61.251:443", "82.118.242.171:443", "94.237.37.28:443" ] }, "precision": "exact", "references": [ "https://msrc-blog.microsoft.com/2019/08/05/corporate-iot-a-path-to-intrusion/" ], "total": 5 }, { "counts": { "domain": 4 }, "first_seen": "2019-07-16", "indicators": { "domain": [ "office365-osf.am", "office365-osi.am", "osfam.events", "osfam.team" ] }, "precision": "exact", "references": [ "https://twitter.com/kyleehmke/status/1150834700069552130", "https://otx.alienvault.com/pulse/5d2db9cc8e1eb4d4d4be15e5" ], "total": 4 }, { "counts": { "domain": 1 }, "first_seen": "2019-07-16", "indicators": { "domain": [ "soros-my-sharepoint.com" ] }, "precision": "exact", "references": [ "https://twitter.com/kyleehmke/status/1150834700069552130", "https://otx.alienvault.com/pulse/5d2db9cc8e1eb4d4d4be15e5", "https://cdn.area1security.com/reports/Area-1-Security-PhishingBarismaHoldings.pdf", "https://otx.alienvault.com/pulse/5e1da5a3ca48088035ce6c5a", "https://twitter.com/kyleehmke/status/1207779048086286336", "https://twitter.com/kyleehmke/status/1216905172305227776" ], "total": 1 }, { "counts": { "domain": 5 }, "first_seen": "2019-07-08", "indicators": { "domain": [ "accounts-office.fr", "en-marche.co", "mail-en-marche.fr", "onedrive-en-marche.fr", "portal-office.fr" ] }, "precision": "exact", "references": [ "https://www.vice.com/en_us/article/vvaxy8/evidence-linking-russian-hackers-fancy-bear-to-macron-phishing" ], "total": 5 }, { "counts": { "domain": 5 }, "first_seen": "2019-07-08", "indicators": { "domain": [ "microsoft-onthehub.com", "my-sharefile.com", "my-sharepoints.com", "onedrive-sharedfile.com", "onedrv-live.com" ] }, "precision": "exact", "references": [ "https://twitter.com/daphiel/status/1148128770014011392" ], "total": 5 }, { "counts": { "url": 1 }, "first_seen": "2019-06-30", "indicators": { "url": [ "http://213.252.245.32/ControllerReset/view/register/comid/sid.php" ] }, "precision": "exact", "references": [ "https://twitter.com/VK_Intel/status/1145270462559195137" ], "total": 1 }, { "counts": { "domain": 5 }, "first_seen": "2019-06-19", "indicators": { "domain": [ "bulgariaholidays.bg", "escochartzone.com", "thesocialstrategies.com", "tripadvicecommunity.com", "worldchanneltour.com" ] }, "precision": "exact", "references": [ "https://community.riskiq.com/projects/47b45f6d-3b11-2082-0c04-dd8720fd3b67" ], "total": 5 }, { "counts": { "domain": 1 }, "first_seen": "2019-06-19", "indicators": { "domain": [ "sportever.org" ] }, "precision": "exact", "references": [ "https://community.riskiq.com/projects/8b14d778-99be-d744-af06-36ffc0937b38" ], "total": 1 }, { "counts": { "domain": 1 }, "first_seen": "2019-06-19", "indicators": { "domain": [ "golivecamp.net" ] }, "precision": "exact", "references": [ "https://community.riskiq.com/projects/6290b968-d907-d5fb-c31e-9b7bf830ec2c" ], "total": 1 }, { "counts": { "domain": 4 }, "first_seen": "2019-06-13", "indicators": { "domain": [ "fatherinfriendlyroad.com", "guytillintelligentposition.com", "networkcentrals.com", "newstyleradio.net" ] }, "precision": "exact", "references": [ "https://twitter.com/ClearskySec/status/1139160272755744774" ], "total": 4 }, { "counts": { "domain": 2, "url": 1, "url_path": 1 }, "first_seen": "2019-06-04", "indicators": { "domain": [ "rammatica.com", "raveston.com" ], "url": [ "http://94.156.189.120" ], "url_path": [ "/manual/current/symphony.php" ] }, "precision": "exact", "references": [ "https://securelist.com/zebrocys-multilanguage-malware-salad/90680/" ], "total": 4 }, { "counts": { "domain": 4 }, "first_seen": "2019-05-30", "indicators": { "domain": [ "experiencewithweakkid.com", "reasonwithusefulpolicy.com", "streetunderrelevantpeople.com", "systembeforeniceparent.com" ] }, "precision": "exact", "references": [ "https://threatconnect.com/finding-nemohost-fancy-bear-infrastructure/", "https://www.virustotal.com/#/file/b40909ac0b70b7bd82465dfc7761a6b4e0df55b894dd42290e3f72cb4280fa44/community", "https://otx.alienvault.com/pulse/5cefdae12f7645afa995961e" ], "total": 4 }, { "counts": { "domain": 2 }, "first_seen": "2019-05-30", "indicators": { "domain": [ "maylaytravelgroup.com", "schooltillhungryprocess.com" ] }, "precision": "exact", "references": [ "https://www.virustotal.com/#/file/b40909ac0b70b7bd82465dfc7761a6b4e0df55b894dd42290e3f72cb4280fa44/community", "https://otx.alienvault.com/pulse/5cefdae12f7645afa995961e" ], "total": 2 }, { "counts": { "domain": 1 }, "first_seen": "2019-04-12", "indicators": { "domain": [ "functiondiscovery.net" ] }, "precision": "exact", "references": [ "https://blog.yoroi.company/research/apt28-and-upcoming-elections-possible-interference-signals/" ], "total": 1 }, { "counts": { "domain": 1, "url_path": 8 }, "first_seen": "2019-04-08", "indicators": { "domain": [ "beatguitar.com" ], "url_path": [ "/advance/portable_version/service.php", "/agr-enum/progress-inform/cube.php", "/db-module/version_1594/main.php", "/en_action_device/center_correct_customer/drivers-i7-x86.php", "/local/s3/filters.php", "/pkg/image/do.php", "/resource-store/stockroom-center-service/check.php", "/zx-system/core/main-config.php" ] }, "precision": "exact", "references": [ "https://twitter.com/Bank_Security/status/1115130011160383488", "https://pastebin.com/atN2w5SE", "https://github.com/blackorbird/APT_REPORT/blob/master/APT28/IOC/2019-04-05-ioc-mark.txt", "https://otx.alienvault.com/pulse/5cab3bf39e861d5e97554699" ], "total": 9 }, { "counts": { "url_path": 2 }, "first_seen": "2019-04-08", "indicators": { "url_path": [ "/fdfd_iunub_hhert_ps.php", "/supptech18i/suppid.php" ] }, "precision": "exact", "references": [ "https://twitter.com/VK_Intel/status/1115080282221293568" ], "total": 2 }, { "counts": { "url_path": 2 }, "first_seen": "2019-04-08", "indicators": { "url_path": [ "/SupportA91i/syshelpA774i/viewsupp.php", "/Verifica-El-Lanzamiento/Ayuda-Del-Sistema/obtenerId.php" ] }, "precision": "exact", "references": [ "https://twitter.com/Bank_Security/status/1115130011160383488", "https://pastebin.com/atN2w5SE", "https://github.com/blackorbird/APT_REPORT/blob/master/APT28/IOC/2019-04-05-ioc-mark.txt", "https://otx.alienvault.com/pulse/5cab3bf39e861d5e97554699", "https://www.welivesecurity.com/2018/04/24/sednit-update-analysis-zebrocy/" ], "total": 2 }, { "counts": { "domain": 6 }, "first_seen": "2019-04-03", "indicators": { "domain": [ "historicalfilms720hd.com", "jazzradiostream.com", "msofficelab.com", "onlineubersplit.com", "renodesmart.com", "rockradiostream.com" ] }, "precision": "exact", "references": [ "https://twitter.com/kyleehmke/status/1113085089909440513" ], "total": 6 }, { "counts": { "domain": 1 }, "first_seen": "2019-03-26", "indicators": { "domain": [ "ndpmedia24.com" ] }, "precision": "exact", "references": [ "https://unit42.paloaltonetworks.com/unit42-sofacy-uses-dealerschoice-target-european-government-agency/" ], "total": 1 }, { "counts": { "domain": 2, "url": 1 }, "first_seen": "2019-03-19", "indicators": { "domain": [ "goldenbuckz.com", "zoomailer.org" ], "url": [ "http://104.171.117.216" ] }, "precision": "exact", "references": [ "https://twitter.com/dewan202/status/1107348923826491392", "https://www.virustotal.com/gui/ip-address/104.171.117.216/relations" ], "total": 3 }, { "counts": { "domain": 1 }, "first_seen": "2019-03-19", "indicators": { "domain": [ "appleupdate.org" ] }, "precision": "exact", "references": [ "https://twitter.com/blackorbird/status/1107593605252677633" ], "total": 1 }, { "counts": { "url_path": 1 }, "first_seen": "2019-03-18", "indicators": { "url_path": [ "/company-device-support/values/correlate-sec.php" ] }, "precision": "exact", "references": [ "https://twitter.com/VK_Intel/status/1092324957772750848", "https://twitter.com/Bank_Security/status/1115130011160383488", "https://pastebin.com/atN2w5SE", "https://github.com/blackorbird/APT_REPORT/blob/master/APT28/IOC/2019-04-05-ioc-mark.txt", "https://otx.alienvault.com/pulse/5cab3bf39e861d5e97554699" ], "total": 1 }, { "counts": { "url_path": 1 }, "first_seen": "2019-03-18", "indicators": { "url_path": [ "/locale/protocol/volume.php" ] }, "precision": "exact", "references": [ "https://twitter.com/VK_Intel/status/1088145389356806146" ], "total": 1 }, { "counts": { "url_path": 1 }, "first_seen": "2019-03-18", "indicators": { "url_path": [ "/technet-support/library/online-service-description.php" ] }, "precision": "exact", "references": [ "https://twitter.com/VK_Intel/status/1076912689119748096", "https://twitter.com/Bank_Security/status/1115130011160383488", "https://pastebin.com/atN2w5SE", "https://github.com/blackorbird/APT_REPORT/blob/master/APT28/IOC/2019-04-05-ioc-mark.txt", "https://otx.alienvault.com/pulse/5cab3bf39e861d5e97554699", "https://www.intezer.com/blog/research/russian-apt-uses-covid-19-lures-to-deliver-zebrocy/", "https://otx.alienvault.com/pulse/5fd10cde3563e4121cbab5c7" ], "total": 1 }, { "counts": { "url_path": 1 }, "first_seen": "2019-03-18", "indicators": { "url_path": [ "/advanced/portable_version/service.php" ] }, "precision": "exact", "references": [ "https://twitter.com/VK_Intel/status/1075307666434600960" ], "total": 1 }, { "counts": { "url_path": 1 }, "first_seen": "2019-03-18", "indicators": { "url_path": [ "/action-center/centerforserviceandaction/service-and-action.php" ] }, "precision": "exact", "references": [ "https://twitter.com/Mao_Ware/status/1092797858301034496", "https://twitter.com/Bank_Security/status/1115130011160383488", "https://pastebin.com/atN2w5SE", "https://github.com/blackorbird/APT_REPORT/blob/master/APT28/IOC/2019-04-05-ioc-mark.txt", "https://otx.alienvault.com/pulse/5cab3bf39e861d5e97554699", "https://otx.alienvault.com/pulse/5ce65ec381f415c7dc794d41" ], "total": 1 }, { "counts": { "domain": 57 }, "first_seen": "2019-03-13", "indicators": { "domain": [ "5thelementq8.com", "90update.com", "ambcomission.com", "ckgob.com", "connectsmd.net", "cryptokind.com", "decisionoverpregnantroad.com", "deshcoin.com", "dmsclock.org", "dochardproofing.com", "driverfordell.com", "ebramka.info", "ecitcom.net", "fes-auth.com", "hello76.com", "hostedopenfiles.net", "iforgot-verification.com", "intelstatistics.com", "knightconsults.com", "kremotevn.net", "lasarenas.lt", "legacydiner.org", "lopback.com", "megauploadfiles.org", "nemaskalitnium.com", "neoderb.com", "networkfilehosting.com", "networkxc.net", "news-almasirah.net", "newsfromsource.com", "perfect-remote-service.com", "platnosci.biz", "postmarksmtp.com", "probenet.eu", "remnet.org", "remonitor.net", "remotemanagesvc.net", "remsvc.net", "rhfcoin.com", "sa7efa.com", "searchbrain.net", "serbview.com", "showitem.lt", "societyatcuriousteacher.com", "softwaresupportsv.name", "startthedownload.com", "statisticsnetworks.com", "svit-zer.com", "systemfromcuriousmoment.com", "tablebeforehelpfulperson.com", "unisecproper.org", "unitedprosoftcompany.org", "uploadsforyou.com", "watertolargeprice.com", "wintwinbtc.com", "wmiapp.com", "zpfgr.com" ] }, "precision": "exact", "references": [ "https://threatconnect.com/finding-nemohost-fancy-bear-infrastructure/" ], "total": 57 }, { "counts": { "domain": 2 }, "first_seen": "2019-03-13", "indicators": { "domain": [ "radioplaymusicus.com", "servertest123.tk" ] }, "precision": "exact", "references": [ "https://twitter.com/kyleehmke/status/1105151293486710785" ], "total": 2 }, { "counts": { "domain": 1 }, "first_seen": "2019-02-26", "indicators": { "domain": [ "proposalprogram.com" ] }, "precision": "exact", "references": [ "https://www.accenture.com/t20190213T141124Z__w__/us-en/_acnmedia/PDF-94/Accenture-SNAKEMACKEREL-Threat-Campaign-Likely-Targeting-NATO-Members-Defense-and-Military-Outlets.pdf" ], "total": 1 }, { "counts": { "domain": 9 }, "first_seen": "2019-02-05", "indicators": { "domain": [ "hp-apps.com", "moldstream.md", "msfontserver.com", "oiagives.com", "oiatribe.com", "regvirt.com", "unigymboom.com", "visualrates.com", "vsnet.co" ] }, "precision": "exact", "references": [ "https://asert.arbornetworks.com/lojax-fancy-since-2016/" ], "total": 9 }, { "counts": { "domain": 2 }, "first_seen": "2019-02-05", "indicators": { "domain": [ "ntpstatistics.com", "treckanalytics.com" ] }, "precision": "exact", "references": [ "https://asert.arbornetworks.com/lojax-fancy-since-2016/", "https://threatconnect.com/finding-nemohost-fancy-bear-infrastructure/" ], "total": 2 }, { "counts": { "domain": 1 }, "first_seen": "2019-01-08", "indicators": { "domain": [ "photopoststories.com" ] }, "precision": "exact", "references": [ "https://www.emanueledelucia.net/apt28-sofacy-seduploader-under-the-christmas-tree/", "https://www.accenture.com/t20190213T141124Z__w__/us-en/_acnmedia/PDF-94/Accenture-SNAKEMACKEREL-Threat-Campaign-Likely-Targeting-NATO-Members-Defense-and-Military-Outlets.pdf" ], "total": 1 }, { "counts": { "url": 2 }, "first_seen": "2018-12-19", "indicators": { "url": [ "188.241.58.170/live/owa/office.dotm", "200.122.181.25/catalog/products/books.php" ] }, "precision": "exact", "references": [ "https://unit42.paloaltonetworks.com/unit42-sofacy-continues-global-attacks-wheels-new-cannon-trojan/" ], "total": 2 }, { "counts": { "url": 2 }, "first_seen": "2018-12-19", "indicators": { "url": [ "109.248.148.42/agr-enum/progress-inform/cube.php", "145.249.105.165/resource-store/stockroom-center-service/check.php" ] }, "precision": "exact", "references": [ "https://unit42.paloaltonetworks.com/dear-joohn-sofacy-groups-global-campaign/" ], "total": 2 }, { "counts": { "url": 1 }, "first_seen": "2018-12-19", "indicators": { "url": [ "188.241.58.170/local/s3/filters.php" ] }, "precision": "exact", "references": [ "https://unit42.paloaltonetworks.com/unit42-sofacy-continues-global-attacks-wheels-new-cannon-trojan/", "https://unit42.paloaltonetworks.com/dear-joohn-sofacy-groups-global-campaign/" ], "total": 1 }, { "counts": { "domain": 8 }, "first_seen": "2018-10-29", "indicators": { "domain": [ "adfs.senate.group", "biathlovvorld.com", "chmail.ir.udelivered.tk", "fil-luge.com", "fisski.ca", "iihf.eu", "mail-ibu.eu", "webmail-ibsf.org" ] }, "precision": "exact", "references": [ "https://blog.trendmicro.com/trendlabs-security-intelligence/update-pawn-storm-new-targets-politically-motivated-campaigns/" ], "total": 8 }, { "counts": { "url": 1 }, "first_seen": "2018-10-20", "indicators": { "url": [ "185.203.118.198/en_action_device/center_correct_customer/drivers-i7-x86.php" ] }, "precision": "exact", "references": [ "https://twitter.com/Jan0fficial/status/1053227074792706048", "https://pastebin.com/44bJm0Gf", "https://unit42.paloaltonetworks.com/dear-joohn-sofacy-groups-global-campaign/" ], "total": 1 }, { "counts": { "url": 1 }, "first_seen": "2018-10-20", "indicators": { "url": [ "45.124.132.127/action-center/centerforserviceandaction/service-and-action.php" ] }, "precision": "exact", "references": [ "https://twitter.com/Jan0fficial/status/1053227074792706048", "https://pastebin.com/44bJm0Gf" ], "total": 1 }, { "counts": { "domain": 2 }, "first_seen": "2018-10-12", "indicators": { "domain": [ "esetsmart.org", "um10eset.net" ] }, "precision": "exact", "references": [ "https://threatconnect.com/finding-nemohost-fancy-bear-infrastructure/" ], "total": 2 }, { "counts": { "domain": 21 }, "first_seen": "2018-10-05", "indicators": { "domain": [ "beststreammusic.com", "bulgariatripholidays.com", "creekcounty.net", "daysheduler.org", "escochart.com", "fnbcorporate.co.za", "fundseats.com", "genericnetworkaddress.com", "georgia-travel.org", "globaltechengineers.org", "loungecinemaclub.com", "malaytravelgroup.com", "moderntips.org", "moldtravelgroup.com", "narrowpass.net", "politicweekend.com", "powernoderesources.com", "protonhardstorage.com", "topcinemaclub.com", "truefashionnews.com", "worldimagebucket.com" ] }, "precision": "exact", "references": [ "https://twitter.com/Bank_Security/status/1048113406597910528", "https://www.ncsc.gov.uk/content/files/protected_files/article_files/IOC-APT28-malware-advisory.pdf" ], "total": 21 }, { "counts": { "domain": 7 }, "first_seen": "2018-10-05", "indicators": { "domain": [ "bbcweather.org", "brownvelocity.org", "coindmarket.com", "iboxmit.com", "pointtk.com", "thepiratecinemaclub.org", "virtsvc.com" ] }, "precision": "exact", "references": [ "https://twitter.com/Bank_Security/status/1048113406597910528", "https://www.ncsc.gov.uk/content/files/protected_files/article_files/IOC-APT28-malware-advisory.pdf", "https://threatconnect.com/finding-nemohost-fancy-bear-infrastructure/" ], "total": 7 }, { "counts": { "domain": 1 }, "first_seen": "2018-10-05", "indicators": { "domain": [ "picturecrawling.com" ] }, "precision": "exact", "references": [ "https://twitter.com/Bank_Security/status/1048113406597910528", "https://www.ncsc.gov.uk/content/files/protected_files/article_files/IOC-APT28-malware-advisory.pdf", "http://www.hexcapes.com/sofacy-in-poland/" ], "total": 1 }, { "counts": { "domain": 2 }, "first_seen": "2018-09-27", "indicators": { "domain": [ "rdsnets.com", "rpcnetconnect.com" ] }, "precision": "exact", "references": [ "https://www.welivesecurity.com/wp-content/uploads/2018/09/ESET-LoJax.pdf", "https://threatconnect.com/finding-nemohost-fancy-bear-infrastructure/" ], "total": 2 }, { "counts": { "domain": 2 }, "first_seen": "2018-09-27", "indicators": { "domain": [ "remotepx.net", "sysanalyticweb.com" ] }, "precision": "exact", "references": [ "https://www.welivesecurity.com/wp-content/uploads/2018/09/ESET-LoJax.pdf", "https://asert.arbornetworks.com/lojax-fancy-since-2016/" ], "total": 2 }, { "counts": { "domain": 2 }, "first_seen": "2018-09-27", "indicators": { "domain": [ "servicetlnt.net", "windowsdefltr.net" ] }, "precision": "exact", "references": [ "https://blog.trendmicro.com/trendlabs-security-intelligence/pawn-storm-ramps-up-spear-phishing-before-zero-days-get-patched/", "https://threatconnect.com/finding-nemohost-fancy-bear-infrastructure/" ], "total": 2 }, { "counts": { "domain": 1 }, "first_seen": "2018-09-27", "indicators": { "domain": [ "webstp.com" ] }, "precision": "exact", "references": [ "https://www.welivesecurity.com/wp-content/uploads/2018/09/ESET-LoJax.pdf", "https://asert.arbornetworks.com/lojax-fancy-since-2016/", "https://threatconnect.com/finding-nemohost-fancy-bear-infrastructure/" ], "total": 1 }, { "counts": { "domain": 1 }, "first_seen": "2018-09-27", "indicators": { "domain": [ "lxwo.org" ] }, "precision": "exact", "references": [ "https://www.welivesecurity.com/wp-content/uploads/2018/09/ESET-LoJax.pdf" ], "total": 1 }, { "counts": { "domain": 172 }, "first_seen": "2018-09-18", "indicators": { "domain": [ "100plusapps.com", "7daysinabudhabi.org", "aa.69.mu", "aadexpo2014.co.za", "abbott-export.com", "academl.com", "accesd-de-desjardins.com", "account-flickr.com", "aerospacesystem.us.com", "al-wayi.com", "allcashin.com", "apple-iclouds.com", "armypress.org", "arnf.bg", "asisonlline.org", "assaas.org", "bostondyn.com", "bostondynamlcs.com", "brokersads.com", "bulletin-center.com", "bytly.org", "caciltd.com", "changepassword-yahoo.com", "chmail.in", "chmali.ir", "clickchekker.com", "clickchekkker.com", "com-0cd.net", "counterterorexpo.com", "cubic.com.co", "cublc.com", "dkvnz.com", "ecards-yahoo.com", "egreetingsfrom.us", "eurosatary.com", "eurosator.com", "eurosatory-2014.com", "eurosatory2014.com", "evronaval.com", "evrosatory.com", "farnboroughair2014.com", "finance-reports.everyday.com-w13.net", "flashsecurity.org", "flickr-service.com", "forsvaret.co", "g-analytics.net", "geaviations.com", "google-settings.com", "gov.hu.com", "gpwpl.com", "greetingcardproject.com", "greetingcardsproject.com", "heidelberqcement.com", "helpfromhome.co", "hothookup.net", "hushmali.com", "ifcdsc.org", "imperialc0nsult.com", "in-eternal-memory-of.com", "intuitanalys.com", "intuitstatistic.com", "intuitstatistics.info", "junlper.net", "kakashka.chmail.in", "kavkazcentr.info", "kavkazjlhad.com", "kitegacc.com", "kitegacc.net", "konami-game.com", "link-google.com", "litu.su", "login-osce.org", "mail-google.info", "mail.account-flickr.com", "mail.chmail.in", "mail.hushmali.com", "mail.mrthelp.org", "mail.rnil.am", "mail.securitypractic.com", "mail.sofexjordanx.com", "mail.telecharger-01.com", "mail.windows-updater.com", "mail.ya-support.com", "mail.yahoo-monitor.com", "memoinfo.ru", "mfa-gov.info", "mfanews.info", "mfanews.org", "mfapress.com", "mfapress.org", "mfauz.com", "militaryexponews.com", "militaryinf.com", "molodirect.net", "mrthelp.org", "mx.rnil.cl", "mx1.g0b.mx", "mx3.set121.com", "nato.nshq.in", "netschecker.com", "northropgrumman.org.uk", "ns.mfanews.org", "ns1.al-wayi.com", "ns1.greetingcardproject.com", "ns1.mfanews.org", "nshq.in", "persa124.in", "pornforyou.in", "privacy.google-settings.com", "product-update.com", "pruintco.com", "rnil.am", "rnil.cl", "set121.com", "set133.com", "setnewpass-yahoo.com", "sex-toy-shop.org", "skidkaturag.com", "smigroup-online.co.uk", "sofexjordan2014.com", "sofexjordanx.com", "srv-yahoo.com", "stockliquidationgroup.com", "sunmicrosystem.info", "surll.me", "sweetcherry.org", "telecharger-01.com", "test.chmail.in", "tolonevvs.com", "unizg.net", "update-hub.com", "update-zimbra.com", "updateapi.longmusic.com", "us-mg6-mailreport.com", "us-mg6-transfermail-service.com", "us-mg6mail-service.com", "us-mg6mailyahoo.com", "us-mg7mail-transferservice.com", "us-westmail-undeliversystem.com", "valuetable.hk", "vice-news.com", "vvorthyhands.org", "webmail.windows-updater.com", "wind0ws.kz", "windous.kz", "world-oil-company.com", "www.7daysinabudhabi.org", "www.account-flickr.com", "www.adawareblock.com", "www.chmail.in", "www.dkvnz.com", "www.eurosatory-2014.com", "www.forsvaret.co", "www.gdforum.info", "www.sofexjordanx.com", "www.srv-yahoo.com", "www.surll.me", "www.us-mg7mail-transferservice.com", "www.us-westmail-undeliversystem.com", "www.valuetable.hk", "www.vljaihln.com", "www.ya-support.com", "www.yahoo-monitor.com", "xuetue2013.com", "y-privacy.com", "ya-login.com", "ya-support.com", "yahoo-analytics.com", "yahoo-monitor.com", "yahoo.chmail.in", "yavuz16.org", "youtubeclip.org" ] }, "precision": "exact", "references": [ "https://pwc.blogs.com/files/tactical-intelligence-bulletin---sofacy-phishing-.pdf" ], "total": 172 }, { "counts": { "domain": 4 }, "first_seen": "2018-09-18", "indicators": { "domain": [ "gdforum.info", "gdforum.net", "pasport-yandex.com", "yandex-site.com" ] }, "precision": "exact", "references": [ "https://pwc.blogs.com/files/tactical-intelligence-bulletin---sofacy-phishing-.pdf", "https://threatconnect.com/blog/how-to-investigate-incidents-in-threatconnect/" ], "total": 4 }, { "counts": { "domain": 1 }, "first_seen": "2018-09-18", "indicators": { "domain": [ "soft-storage.com" ] }, "precision": "exact", "references": [ "https://pwc.blogs.com/files/tactical-intelligence-bulletin---sofacy-phishing-.pdf", "https://threatconnect.com/finding-nemohost-fancy-bear-infrastructure/" ], "total": 1 }, { "counts": { "domain": 23 }, "first_seen": "2018-09-05", "indicators": { "domain": [ "ausameetings.com", "bbc-press.org", "biocpl.org", "capisp.com", "cnnpolitics.eu", "dailypoliticsnews.com", "dataclen.org", "euronews24.info", "kg-news.org", "militaryadviser.org", "osce-press.org", "pakistan-mofa.net", "politicalreview.eu", "politicsinform.com", "shurl.biz", "stratforglobal.net", "swsupporttools.com", "thediplomat-press.com", "theguardiannews.org", "trend-news.org", "unitednationsnews.eu", "virusdefender.org", "worldpostjournal.com" ] }, "precision": "exact", "references": [ "https://github.com/eset/malware-ioc/blob/master/sednit/part1.adoc" ], "total": 23 }, { "counts": { "domain": 6 }, "first_seen": "2018-09-05", "indicators": { "domain": [ "euroreport24.com", "military-info.eu", "nato-news.com", "osce-info.com", "reuters-press.com", "worldpoliticsreviews.com" ] }, "precision": "exact", "references": [ "https://github.com/eset/malware-ioc/blob/master/sednit/part1.adoc", "https://documents.trendmicro.com/assets/appendix_looking-into-a-cyber-attack-facilitator-in-the-netherlands.pdf", "https://vxcube.com/recent-threats-ioc/5c74c73ca39bb5786f9664d3/detail" ], "total": 6 }, { "counts": { "domain": 3 }, "first_seen": "2018-09-05", "indicators": { "domain": [ "akamaisoft.com", "ciscohelpcenter.com", "timezoneutc.com" ] }, "precision": "exact", "references": [ "https://github.com/eset/malware-ioc/blob/master/sednit/part2.adoc" ], "total": 3 }, { "counts": { "domain": 1 }, "first_seen": "2018-09-05", "indicators": { "domain": [ "updmanager.com" ] }, "precision": "exact", "references": [ "https://www.virustotal.com/#/ip-address/52.28.203.25", "https://github.com/eset/malware-ioc/blob/master/sednit/part2.adoc" ], "total": 1 }, { "counts": { "domain": 1 }, "first_seen": "2018-09-05", "indicators": { "domain": [ "1oo7.net" ] }, "precision": "exact", "references": [ "https://github.com/eset/malware-ioc/blob/master/sednit/part2.adoc", "https://threatconnect.com/finding-nemohost-fancy-bear-infrastructure/" ], "total": 1 }, { "counts": { "domain": 1 }, "first_seen": "2018-09-05", "indicators": { "domain": [ "aljazeera-news.com" ] }, "precision": "exact", "references": [ "https://github.com/eset/malware-ioc/blob/master/sednit/part1.adoc", "https://threatconnect.com/finding-nemohost-fancy-bear-infrastructure/", "https://threatconnect.com/blog/how-to-investigate-incidents-in-threatconnect/" ], "total": 1 }, { "counts": { "domain": 1 }, "first_seen": "2018-09-05", "indicators": { "domain": [ "unian-news.info" ] }, "precision": "exact", "references": [ "https://github.com/eset/malware-ioc/blob/master/sednit/part1.adoc", "https://threatconnect.com/blog/how-to-investigate-incidents-in-threatconnect/" ], "total": 1 }, { "counts": { "domain": 1 }, "first_seen": "2018-09-05", "indicators": { "domain": [ "defenceiq.us" ] }, "precision": "exact", "references": [ "https://github.com/eset/malware-ioc/blob/master/sednit/part1.adoc", "https://pwc.blogs.com/files/tactical-intelligence-bulletin---sofacy-phishing-.pdf" ], "total": 1 }, { "counts": { "domain": 80 }, "first_seen": "2018-08-30", "indicators": { "domain": [ "account-microsoftonline.com", "account-office365.com", "accounts.rsshotmail.com", "actblues.com", "adobestatistic.com", "adobestatistic.org", "akamaitechnologysupport.com", "americanprogress-office365.com", "americanprogress-outlook.com", "apionedrive.com", "brookings.sharepoint.liveoffice365.me", "fastcontech.com", "help-msoutlook.com", "hotfixmsupload.com", "intelintelligence.org", "intelsupportcenter.com", "intelsupportcenter.net", "ipv6-microsoft.com", "liveoffice365.me", "login-on-live.com", "login-outlook.com", "login.cloudmicrosoft365.com", "loqin-microsoftonline.com", "microsoft-update-cdn.com", "microsoft-updatecdn.com", "microsoftcheckupdate.com", "microsoftcorpstatistic.com", "microsoftdskservice.com", "microsoftonlihe.com", "microsoftsecurepolicy.org", "ms-drivadptrwin.com", "ms-update.info", "ms-update.net", "ms-updates.com", "msmodule.com", "msnsupportcare.com", "news.intelsupportcenter.com", "notificationstatus.com", "office365-account.com", "officemicroupdate.com", "officeupdater.com", "one-drive.org", "onedrive-office365.com", "onedrive-outlook.com", "onedrive365.com", "onedrivemicrosoft.com", "onedriveoffice365.com", "outlook-security.org", "qov.info", "search-microsoft.com", "secure.actblues.com", "securemicrosoftstatistic.com", "senate.qov.info", "seniorsecurityind.com", "supports-microsoft.com", "transparency-office365.com", "updates-windows.com", "webmail-saic.net", "win32support.com", "windowofficeupdate.com", "windowsupdater.net", "windowsxupdate.com", "winsyscheck.com", "www.actblues.com", "www.adobeupdater.org", "www.dailyforeignnews.com", "www.diplomatnews.org", "www.info2t.com", "www.microsoftdriver.com", "www.microsofthelpcenter.info", "www.mscoresvw.com", "www.natoint.com", "www.office365-onedrive.com", "www.onedrive365.com", "www.servicesecupdate.com", "www.sportszone71.com", "www.symantecsupport.org", "www.windowscheckupdater.net", "www.winupdatesysmic.com", "www.worldmilitarynews.org" ] }, "precision": "exact", "references": [ "https://www.tr1adx.net/intel/public/TIB-00001_IOC_Domain.txt" ], "total": 80 }, { "counts": { "domain": 31 }, "first_seen": "2018-08-30", "indicators": { "domain": [ "34564414564.com", "645547657668787.com", "access-google.com", "app-submitcentre.com", "autoupdater.org", "blacktivist.info", "cleanphonetrksftware.com", "dncvotebuilder.com", "egypressoffice.com", "extad.info", "extstat.info", "hubsg.net", "intelmeserver.com", "log-in-osce.org", "micoft.com", "mlidef.com", "msrdr.com", "msrwr.com", "naoasch.com", "petropershiyinukra.com", "pldtprv.net", "securitysls.com", "securityupdatereport.com", "service-usa-tre.info", "servicecorptech.com", "servicesecupdate.com", "soligro.com", "uber-mails.com", "umizg.org", "updatesvcsys.com", "updatesystem.info" ] }, "precision": "exact", "references": [ "https://www.tr1adx.net/intel/public/TIB-00001_IOC_Domain.txt", "https://threatconnect.com/finding-nemohost-fancy-bear-infrastructure/" ], "total": 31 }, { "counts": { "domain": 9 }, "first_seen": "2018-08-30", "indicators": { "domain": [ "acrobatportable.com", "dowssys.com", "europehistoricalmuseum.com", "fastphotobucket.com", "funnymems.com", "mdcrewonline.com", "travelbern.com", "webversionact.org", "webviewres.net" ] }, "precision": "exact", "references": [ "https://threatconnect.com/blog/using-fancy-bear-ssl-certificate-information-to-identify-their-infrastructure/", "https://app.any.run/tasks/516fee6f-1b98-40d2-8dd1-65b9c79bd05e/", "https://app.any.run/tasks/41b1658f-1bb2-4891-8053-9401706b3ff7/", "https://app.any.run/tasks/09da60cd-710f-4466-9942-c4eb4862e7fb/", "https://app.any.run/tasks/d6a8d1db-52c8-4371-b6d3-bf740408bb10/", "https://app.any.run/tasks/c841c920-8d04-4164-9e22-a288fb6f91d3/" ], "total": 9 }, { "counts": { "domain": 8 }, "first_seen": "2018-08-30", "indicators": { "domain": [ "dvsservice.net", "gtranm.com", "lgemon.org", "mvsband.com", "noticermk.com", "remsupport.org", "runvercheck.com", "spelns.com" ] }, "precision": "exact", "references": [ "https://www.tr1adx.net/intel/public/TIB-00001_IOC_Domain.txt", "https://threatconnect.com/blog/using-fancy-bear-ssl-certificate-information-to-identify-their-infrastructure/", "https://app.any.run/tasks/516fee6f-1b98-40d2-8dd1-65b9c79bd05e/", "https://app.any.run/tasks/41b1658f-1bb2-4891-8053-9401706b3ff7/", "https://app.any.run/tasks/09da60cd-710f-4466-9942-c4eb4862e7fb/", "https://app.any.run/tasks/d6a8d1db-52c8-4371-b6d3-bf740408bb10/", "https://app.any.run/tasks/c841c920-8d04-4164-9e22-a288fb6f91d3/", "https://threatconnect.com/finding-nemohost-fancy-bear-infrastructure/" ], "total": 8 }, { "counts": { "domain": 6 }, "first_seen": "2018-08-30", "indicators": { "domain": [ "cdnverify.net", "nanetsdeb.com", "nomartung.org", "rapidfileuploader.org", "supservermgr.com", "vermasterss.com" ] }, "precision": "exact", "references": [ "https://threatconnect.com/blog/using-fancy-bear-ssl-certificate-information-to-identify-their-infrastructure/", "https://app.any.run/tasks/516fee6f-1b98-40d2-8dd1-65b9c79bd05e/", "https://app.any.run/tasks/41b1658f-1bb2-4891-8053-9401706b3ff7/", "https://app.any.run/tasks/09da60cd-710f-4466-9942-c4eb4862e7fb/", "https://app.any.run/tasks/d6a8d1db-52c8-4371-b6d3-bf740408bb10/", "https://app.any.run/tasks/c841c920-8d04-4164-9e22-a288fb6f91d3/", "https://threatconnect.com/finding-nemohost-fancy-bear-infrastructure/" ], "total": 6 }, { "counts": { "domain": 5 }, "first_seen": "2018-08-30", "indicators": { "domain": [ "changepassword-hotmail.com", "helpmicrosoft.net", "hotmail-monitor.com", "livemicrosoft.net", "privacy-hotmail.com" ] }, "precision": "exact", "references": [ "https://www.tr1adx.net/intel/public/TIB-00001_IOC_Domain.txt", "https://pwc.blogs.com/files/tactical-intelligence-bulletin---sofacy-phishing-.pdf" ], "total": 5 }, { "counts": { "domain": 4 }, "first_seen": "2018-08-30", "indicators": { "domain": [ "advpdxapi.com", "driversupdate.info", "kenlynton.com", "softwaresupportsv.com" ] }, "precision": "exact", "references": [ "https://www.tr1adx.net/intel/public/TIB-00001_IOC_Domain.txt", "https://github.com/eset/malware-ioc/blob/master/sednit/part2.adoc", "https://threatconnect.com/finding-nemohost-fancy-bear-infrastructure/" ], "total": 4 }, { "counts": { "domain": 3 }, "first_seen": "2018-08-30", "indicators": { "domain": [ "adobeupdatetechnology.com", "akamaitechupdate.com", "dvsservice.com" ] }, "precision": "exact", "references": [ "https://www.tr1adx.net/intel/public/TIB-00001_IOC_Domain.txt", "https://threatconnect.com/blog/using-fancy-bear-ssl-certificate-information-to-identify-their-infrastructure/", "https://app.any.run/tasks/516fee6f-1b98-40d2-8dd1-65b9c79bd05e/", "https://app.any.run/tasks/41b1658f-1bb2-4891-8053-9401706b3ff7/", "https://app.any.run/tasks/09da60cd-710f-4466-9942-c4eb4862e7fb/", "https://app.any.run/tasks/d6a8d1db-52c8-4371-b6d3-bf740408bb10/", "https://app.any.run/tasks/c841c920-8d04-4164-9e22-a288fb6f91d3/" ], "total": 3 }, { "counts": { "domain": 3 }, "first_seen": "2018-08-30", "indicators": { "domain": [ "inteldrv64.com", "microsofthelpcenter.info", "microsoftsupp.com" ] }, "precision": "exact", "references": [ "https://www.tr1adx.net/intel/public/TIB-00001_IOC_Domain.txt", "https://github.com/eset/malware-ioc/blob/master/sednit/part2.adoc" ], "total": 3 }, { "counts": { "domain": 2 }, "first_seen": "2018-08-30", "indicators": { "domain": [ "microsoftdriver.com", "windowsappstore.net" ] }, "precision": "exact", "references": [ "https://www.tr1adx.net/intel/public/TIB-00001_IOC_Domain.txt", "https://www.virustotal.com/#/ip-address/52.28.203.25", "https://github.com/eset/malware-ioc/blob/master/sednit/part2.adoc" ], "total": 2 }, { "counts": { "domain": 2 }, "first_seen": "2018-08-30", "indicators": { "domain": [ "cloudmicrosoft365.com", "office365-microsoft.com" ] }, "precision": "exact", "references": [ "https://www.tr1adx.net/intel/public/TIB-00001_IOC_Domain.txt", "https://threatconnect.com/blog/how-to-investigate-incidents-in-threatconnect/" ], "total": 2 }, { "counts": { "domain": 1 }, "first_seen": "2018-08-30", "indicators": { "domain": [ "secao.org" ] }, "precision": "exact", "references": [ "https://www.tr1adx.net/intel/public/TIB-00001_IOC_Domain.txt", "https://www.welivesecurity.com/wp-content/uploads/2018/09/ESET-LoJax.pdf", "https://threatconnect.com/finding-nemohost-fancy-bear-infrastructure/" ], "total": 1 }, { "counts": { "domain": 1 }, "first_seen": "2018-08-30", "indicators": { "domain": [ "linuxkrnl.net" ] }, "precision": "exact", "references": [ "https://www.tr1adx.net/intel/public/TIB-00001_IOC_Domain.txt", "https://threatconnect.com/finding-nemohost-fancy-bear-infrastructure/", "https://medium.com/@rsatter/decoding-the-gru-indictment-bfb2c08fe362", "https://otx.alienvault.com/pulse/5d88c12375a272432c4cd9ec" ], "total": 1 }, { "counts": { "domain": 1 }, "first_seen": "2018-08-30", "indicators": { "domain": [ "natoexhibitionff14.com" ] }, "precision": "exact", "references": [ "https://www.tr1adx.net/intel/public/TIB-00001_IOC_Domain.txt", "https://pwc.blogs.com/files/tactical-intelligence-bulletin---sofacy-phishing-.pdf", "https://threatconnect.com/finding-nemohost-fancy-bear-infrastructure/" ], "total": 1 }, { "counts": { "domain": 1 }, "first_seen": "2018-08-30", "indicators": { "domain": [ "acledit.com" ] }, "precision": "exact", "references": [ "https://www.tr1adx.net/intel/public/TIB-00001_IOC_Domain.txt", "https://github.com/eset/malware-ioc/blob/master/sednit/part1.adoc", "https://threatconnect.com/finding-nemohost-fancy-bear-infrastructure/" ], "total": 1 }, { "counts": { "domain": 1 }, "first_seen": "2018-08-30", "indicators": { "domain": [ "adfs.senate.qov.info" ] }, "precision": "exact", "references": [ "https://www.tr1adx.net/intel/public/TIB-00001_IOC_Domain.txt", "https://blog.trendmicro.com/trendlabs-security-intelligence/update-pawn-storm-new-targets-politically-motivated-campaigns/" ], "total": 1 }, { "counts": { "domain": 1 }, "first_seen": "2018-08-30", "indicators": { "domain": [ "space-delivery.com" ] }, "precision": "exact", "references": [ "https://threatconnect.com/blog/using-fancy-bear-ssl-certificate-information-to-identify-their-infrastructure/", "https://app.any.run/tasks/516fee6f-1b98-40d2-8dd1-65b9c79bd05e/", "https://app.any.run/tasks/41b1658f-1bb2-4891-8053-9401706b3ff7/", "https://app.any.run/tasks/09da60cd-710f-4466-9942-c4eb4862e7fb/", "https://app.any.run/tasks/d6a8d1db-52c8-4371-b6d3-bf740408bb10/", "https://app.any.run/tasks/c841c920-8d04-4164-9e22-a288fb6f91d3/", "https://threatconnect.com/finding-nemohost-fancy-bear-infrastructure/", "https://www.proofpoint.com/us/threat-insight/post/apt28-racing-exploit-cve-2017-11292-flash-vulnerability-patches-are-deployed", "https://blog.angelalonso.es/2017/10/hunting-apt28-cve-2017-11292-flash.html?m=0", "https://www.virustotal.com/gui/file/362a8297a0ff603553e992626a8e28c0aa19d038557da82fe6f4526988601be7/behavior/Tencent%20HABO" ], "total": 1 }, { "counts": { "domain": 1 }, "first_seen": "2018-08-30", "indicators": { "domain": [ "microsoftstoreservice.com" ] }, "precision": "exact", "references": [ "https://threatconnect.com/blog/using-fancy-bear-ssl-certificate-information-to-identify-their-infrastructure/", "https://app.any.run/tasks/516fee6f-1b98-40d2-8dd1-65b9c79bd05e/", "https://app.any.run/tasks/41b1658f-1bb2-4891-8053-9401706b3ff7/", "https://app.any.run/tasks/09da60cd-710f-4466-9942-c4eb4862e7fb/", "https://app.any.run/tasks/d6a8d1db-52c8-4371-b6d3-bf740408bb10/", "https://app.any.run/tasks/c841c920-8d04-4164-9e22-a288fb6f91d3/", "https://blog.trendmicro.com/trendlabs-security-intelligence/pawn-storm-ramps-up-spear-phishing-before-zero-days-get-patched/" ], "total": 1 }, { "counts": { "domain": 3 }, "first_seen": "2018-08-28", "indicators": { "domain": [ "my-iri.org", "office365-onedrive.com", "senate.group" ] }, "precision": "exact", "references": [ "https://www.tr1adx.net/intel/public/TIB-00001_IOC_Domain.txt", "https://www.bleepingcomputer.com/news/security/microsoft-disrupts-apt28-hacking-campaign-aimed-at-us-midterm-elections/" ], "total": 3 }, { "counts": { "domain": 3 }, "first_seen": "2018-08-28", "indicators": { "domain": [ "fbcdn.store", "tvopen.online", "unimarkstamp.com" ] }, "precision": "exact", "references": [ "https://twitter.com/DrunkBinary/status/1032706788678950914", "https://threatconnect.com/finding-nemohost-fancy-bear-infrastructure/" ], "total": 3 }, { "counts": { "domain": 2 }, "first_seen": "2018-08-28", "indicators": { "domain": [ "adfs-senate.email", "adfs-senate.services" ] }, "precision": "exact", "references": [ "https://www.tr1adx.net/intel/public/TIB-00001_IOC_Domain.txt", "https://www.bleepingcomputer.com/news/security/microsoft-disrupts-apt28-hacking-campaign-aimed-at-us-midterm-elections/", "https://blog.trendmicro.com/trendlabs-security-intelligence/update-pawn-storm-new-targets-politically-motivated-campaigns/" ], "total": 2 }, { "counts": { "domain": 2 }, "first_seen": "2018-08-28", "indicators": { "domain": [ "evbrax.org", "lowprt.org" ] }, "precision": "exact", "references": [ "https://www.tr1adx.net/intel/public/TIB-00001_IOC_Domain.txt", "https://twitter.com/DrunkBinary/status/1032706788678950914", "https://threatconnect.com/blog/using-fancy-bear-ssl-certificate-information-to-identify-their-infrastructure/", "https://app.any.run/tasks/516fee6f-1b98-40d2-8dd1-65b9c79bd05e/", "https://app.any.run/tasks/41b1658f-1bb2-4891-8053-9401706b3ff7/", "https://app.any.run/tasks/09da60cd-710f-4466-9942-c4eb4862e7fb/", "https://app.any.run/tasks/d6a8d1db-52c8-4371-b6d3-bf740408bb10/", "https://app.any.run/tasks/c841c920-8d04-4164-9e22-a288fb6f91d3/", "https://threatconnect.com/finding-nemohost-fancy-bear-infrastructure/" ], "total": 2 }, { "counts": { "domain": 1 }, "first_seen": "2018-08-28", "indicators": { "domain": [ "hudsonorg-my-sharepoint.com" ] }, "precision": "exact", "references": [ "https://www.tr1adx.net/intel/public/TIB-00001_IOC_Domain.txt", "https://www.bleepingcomputer.com/news/security/microsoft-disrupts-apt28-hacking-campaign-aimed-at-us-midterm-elections/", "https://cdn.area1security.com/reports/Area-1-Security-PhishingBarismaHoldings.pdf", "https://otx.alienvault.com/pulse/5e1da5a3ca48088035ce6c5a", "https://twitter.com/kyleehmke/status/1207779048086286336", "https://twitter.com/kyleehmke/status/1216905172305227776" ], "total": 1 }, { "counts": { "domain": 1 }, "first_seen": "2018-08-28", "indicators": { "domain": [ "ndsee.org" ] }, "precision": "exact", "references": [ "https://www.tr1adx.net/intel/public/TIB-00001_IOC_Domain.txt", "https://twitter.com/DrunkBinary/status/1032706788678950914", "https://threatconnect.com/finding-nemohost-fancy-bear-infrastructure/" ], "total": 1 }, { "counts": { "domain": 13 }, "first_seen": "2018-03-14", "indicators": { "domain": [ "analyticsbar.org", "analyticstest.net", "audiwheel.com", "encoder-info.tk", "etcrem.net", "lifeofmentalservice.com", "liveweatherview.com", "lvueton.com", "movieultimate.com", "online-reggi.com", "righttopregnantpower.com", "sendmevideo.org", "webcdelivery.com" ] }, "precision": "exact", "references": [ "https://securelist.com/a-slice-of-2017-sofacy-activity/83930/", "https://app.any.run/tasks/54a21ac9-f915-4556-8800-6f384fbbc6be/", "https://app.any.run/tasks/50eb1524-d95b-481e-b9d1-766c0a1fda74/", "https://app.any.run/tasks/396ccb39-ca44-4ae9-8584-96a8093ffc31/", "https://app.any.run/tasks/9abe2703-3750-4728-a932-129177b2a72a/" ], "total": 13 }, { "counts": { "domain": 7 }, "first_seen": "2018-03-14", "indicators": { "domain": [ "fastdataexchange.org", "hostsvcnet.com", "kiteim.org", "meteost.com", "mvband.net", "nethostnet.com", "treepastwillingmoment.com" ] }, "precision": "exact", "references": [ "https://securelist.com/a-slice-of-2017-sofacy-activity/83930/", "https://app.any.run/tasks/54a21ac9-f915-4556-8800-6f384fbbc6be/", "https://app.any.run/tasks/50eb1524-d95b-481e-b9d1-766c0a1fda74/", "https://app.any.run/tasks/396ccb39-ca44-4ae9-8584-96a8093ffc31/", "https://app.any.run/tasks/9abe2703-3750-4728-a932-129177b2a72a/", "https://threatconnect.com/finding-nemohost-fancy-bear-infrastructure/" ], "total": 7 }, { "counts": { "domain": 4 }, "first_seen": "2018-03-14", "indicators": { "domain": [ "mvtband.net", "ppcodecs.com", "satellitedeluxpanorama.com", "viters.org" ] }, "precision": "exact", "references": [ "https://securelist.com/a-slice-of-2017-sofacy-activity/83930/", "https://app.any.run/tasks/54a21ac9-f915-4556-8800-6f384fbbc6be/", "https://app.any.run/tasks/50eb1524-d95b-481e-b9d1-766c0a1fda74/", "https://app.any.run/tasks/396ccb39-ca44-4ae9-8584-96a8093ffc31/", "https://app.any.run/tasks/9abe2703-3750-4728-a932-129177b2a72a/", "https://threatconnect.com/blog/using-fancy-bear-ssl-certificate-information-to-identify-their-infrastructure/", "https://app.any.run/tasks/516fee6f-1b98-40d2-8dd1-65b9c79bd05e/", "https://app.any.run/tasks/41b1658f-1bb2-4891-8053-9401706b3ff7/", "https://app.any.run/tasks/09da60cd-710f-4466-9942-c4eb4862e7fb/", "https://app.any.run/tasks/d6a8d1db-52c8-4371-b6d3-bf740408bb10/", "https://app.any.run/tasks/c841c920-8d04-4164-9e22-a288fb6f91d3/", "https://threatconnect.com/finding-nemohost-fancy-bear-infrastructure/" ], "total": 4 }, { "counts": { "domain": 2 }, "first_seen": "2018-03-14", "indicators": { "domain": [ "miropc.org", "newfilmts.com" ] }, "precision": "exact", "references": [ "https://www.tr1adx.net/intel/public/TIB-00001_IOC_Domain.txt", "https://securelist.com/a-slice-of-2017-sofacy-activity/83930/", "https://app.any.run/tasks/54a21ac9-f915-4556-8800-6f384fbbc6be/", "https://app.any.run/tasks/50eb1524-d95b-481e-b9d1-766c0a1fda74/", "https://app.any.run/tasks/396ccb39-ca44-4ae9-8584-96a8093ffc31/", "https://app.any.run/tasks/9abe2703-3750-4728-a932-129177b2a72a/", "https://threatconnect.com/finding-nemohost-fancy-bear-infrastructure/" ], "total": 2 }, { "counts": { "domain": 1 }, "first_seen": "2018-03-14", "indicators": { "domain": [ "wmdmediacodecs.com" ] }, "precision": "exact", "references": [ "https://www.tr1adx.net/intel/public/TIB-00001_IOC_Domain.txt", "https://securelist.com/a-slice-of-2017-sofacy-activity/83930/", "https://app.any.run/tasks/54a21ac9-f915-4556-8800-6f384fbbc6be/", "https://app.any.run/tasks/50eb1524-d95b-481e-b9d1-766c0a1fda74/", "https://app.any.run/tasks/396ccb39-ca44-4ae9-8584-96a8093ffc31/", "https://app.any.run/tasks/9abe2703-3750-4728-a932-129177b2a72a/", "https://threatconnect.com/blog/using-fancy-bear-ssl-certificate-information-to-identify-their-infrastructure/", "https://app.any.run/tasks/516fee6f-1b98-40d2-8dd1-65b9c79bd05e/", "https://app.any.run/tasks/41b1658f-1bb2-4891-8053-9401706b3ff7/", "https://app.any.run/tasks/09da60cd-710f-4466-9942-c4eb4862e7fb/", "https://app.any.run/tasks/d6a8d1db-52c8-4371-b6d3-bf740408bb10/", "https://app.any.run/tasks/c841c920-8d04-4164-9e22-a288fb6f91d3/", "https://threatconnect.com/finding-nemohost-fancy-bear-infrastructure/" ], "total": 1 }, { "counts": { "domain": 1 }, "first_seen": "2018-03-14", "indicators": { "domain": [ "appexsrv.net" ] }, "precision": "exact", "references": [ "https://securelist.com/a-slice-of-2017-sofacy-activity/83930/", "https://app.any.run/tasks/54a21ac9-f915-4556-8800-6f384fbbc6be/", "https://app.any.run/tasks/50eb1524-d95b-481e-b9d1-766c0a1fda74/", "https://app.any.run/tasks/396ccb39-ca44-4ae9-8584-96a8093ffc31/", "https://app.any.run/tasks/9abe2703-3750-4728-a932-129177b2a72a/", "https://blog.trendmicro.com/trendlabs-security-intelligence/pawn-storm-ramps-up-spear-phishing-before-zero-days-get-patched/" ], "total": 1 }, { "counts": { "domain": 88 }, "first_seen": "2017-11-10", "indicators": { "domain": [ "access-apple-login-account.gq", "account-activity-verification-login.ga", "account-verify-comfirmation-info-login.ga", "account-verify-comfirmation-info-login.gq", "accountlogin-inc.ga", "accountverify-disableinfo-login.gq", "alert-new-login-com.ga", "apple-realertlogin.gq", "appleid-login-appleid.ga", "appleid-manageaccountloginupdated.ga", "appleidcustomer-servicess-com-loginaccount.ga", "appleidcustomer-servicess-com-loginaccount.gq", "browsersecurity.ga", "change-password.gq", "cleantarea-customerlogin-com.ga", "clientareasecurity1.gq", "clientareasecurity4.gq", "com-recoverylogin.gq", "com-supportlogin-adminverification.ga", "darksecurity.ga", "dns-sec-login-apple-invoice-confirmations.ga", "dns-webapps-login-account-secure-servers.ga", "documentation.gq", "documentshandler.ga", "emailloginerror.gq", "facebook-login-page.gq", "failure-login.ga", "fileshelp.ga", "fileshelp.gq", "fileshelpprotut.ga", "fileshelpprotut.gq", "filestore.gq", "goldsecurity.ga", "info-apple-login-security.gq", "jp-login.gq", "locked-service-security.ga", "login-bancochile-cl.ga", "login-pap-web-access.ga", "login-recovery.gq", "login-sec-apple-secure-account-updated.ga", "login-secure1-mobile.ga", "login-unlock-account.ga", "login-update-unlock.gq", "loginapps-info.ga", "loginpaypaas-securityuserid.ga", "loginservice-maintanceserversecurity.gq", "manage-login.gq", "manage-logins.gq", "mod-files.ga", "mydocuments.gq", "newaction-loginactivituresource.ga", "newfiles.ga", "ns-secures-login-accountjp-updates-community.gq", "nursingdocumentation.gq", "ourfiles.ga", "pdf-document.ga", "protector-files.ga", "recoverylogin-access.ga", "reset-password-com.ga", "restore-login-account.gq", "review-quilogin.ga", "secure-bankofamerica--login-com.ga", "secure-bankofamerica--login-com.gq", "secure-login-helpid-locked.gq", "secure-management-login-account-index-webpass.gq", "secure-mobile-login1.gq", "secure1-client-login.ga", "secure1-client-login.gq", "secure1-login-apps.gq", "secure5647login-com.ga", "security-login-information.gq", "securitycenter.ga", "securitymail.gq", "service-account-home-login.gq", "service-autoreset-password-youraccount.ga", "service-login-apple-verify-account-locked.gq", "servicelogin-access-failed.gq", "services-loginaccount.ga", "sharefiles.gq", "signin-login-php.ga", "srilankadocuments.ga", "statement-login-update-info.ga", "summary-loginconfirmation.ga", "unsecured-login-attempt.ga", "verify-login-account-iinformation.ga", "verify-login-account-iinformation.gq", "welcome-apple-protectyourpassword.gq", "www-logined-apple-authsecure.ga" ] }, "precision": "exact", "references": [ "https://www.threatconnect.com/blog/fancy-bear-leverages-blogspot/" ], "total": 88 }, { "counts": { "domain": 1 }, "first_seen": "2017-11-10", "indicators": { "domain": [ "smtprelayhost.com" ] }, "precision": "exact", "references": [ "https://www.tr1adx.net/intel/public/TIB-00001_IOC_Domain.txt", "https://www.threatconnect.com/blog/fancy-bear-leverages-blogspot/", "https://threatconnect.com/finding-nemohost-fancy-bear-infrastructure/", "https://threatconnect.com/blog/how-to-investigate-incidents-in-threatconnect/" ], "total": 1 }, { "counts": { "domain": 30 }, "first_seen": "2017-11-07", "indicators": { "domain": [ "200200.duckdns.org", "357.duckdns.org", "ahr0cdovlzkyljiymi4ymdkundkvywn0a.0.d.255.adobeproduct.com", "d6231738c34.john-pc.c.mswordupdate17.com", "d6238051c34.placehol-6f699a.c.mswordupdate17.com", "d6238111c34.placehol-6f699a.c.mswordupdate17.com", "d6238158c34.placehol-6f699a.c.mswordupdate17.com", "d6238210c34.placehol-6f699a.c.mswordupdate17.com", "d6261013c34.placehol-6f699a.c.mswordupdate17.com", "d6261024c34.placehol-6f699a.c.mswordupdate17.com", "d6261034c34.placehol-6f699a.c.mswordupdate17.com", "flashcontentdelivery.net", "googlea.net63.net", "hhcghibvywzedwa2iyvsuzzhx8.2.d.255.adobeproduct.com", "ip113.ip-91-134-203.eu", "maskulan.duckdns.org", "maskulan.dynu.com", "msoffice-cdn.comns3.cdnmsnupdate.com", "n.3.f.255.adobeproduct.com", "n.n.c.255.adobeproduct.com", "n.n.c.26055.adobeproduct.com", "n.n.c.303ff7b225c14f1498a2.cdnmsnupdate.com", "ns1.cdnmsnupdate.com", "ns2.cdnmsnupdate.com", "ns2.ntpupdateserver.com", "ns3.cdnmsnupdate.com", "protectingsearch.com", "w9umi9wrvzsvlvstvfvslbumdfdvda5tl.1.d.255.adobeproduct.com", "windows.mswordupdate17.com", "windows81.duckdns.org" ] }, "precision": "exact", "references": [ "https://www.jigsawsecurityenterprise.com/single-post/2017/11/01/Malicious-Documents-Targeting-Security-Professionals", "https://app.any.run/tasks/8ac81174-d6d0-43d3-b2d2-c26e167a296b/" ], "total": 30 }, { "counts": { "domain": 7 }, "first_seen": "2017-11-07", "indicators": { "domain": [ "adobeproduct.com", "bonjourcheck.com", "faststoragefiles.org", "networkschecker.net", "runssnetworks.com", "sdhjjekfp4k.com", "vascothreatscan.org" ] }, "precision": "exact", "references": [ "https://www.tr1adx.net/intel/public/TIB-00001_IOC_Domain.txt", "https://www.jigsawsecurityenterprise.com/single-post/2017/11/01/Malicious-Documents-Targeting-Security-Professionals", "https://app.any.run/tasks/8ac81174-d6d0-43d3-b2d2-c26e167a296b/", "https://threatconnect.com/finding-nemohost-fancy-bear-infrastructure/" ], "total": 7 }, { "counts": { "domain": 3 }, "first_seen": "2017-11-07", "indicators": { "domain": [ "cdnmsnupdate.com", "fastfileconverter.org", "microsoftupdated.com" ] }, "precision": "exact", "references": [ "https://www.jigsawsecurityenterprise.com/single-post/2017/11/01/Malicious-Documents-Targeting-Security-Professionals", "https://app.any.run/tasks/8ac81174-d6d0-43d3-b2d2-c26e167a296b/", "https://threatconnect.com/finding-nemohost-fancy-bear-infrastructure/" ], "total": 3 }, { "counts": { "domain": 1 }, "first_seen": "2017-11-07", "indicators": { "domain": [ "ikmtrust.com" ] }, "precision": "exact", "references": [ "https://www.jigsawsecurityenterprise.com/single-post/2017/11/01/Malicious-Documents-Targeting-Security-Professionals", "https://app.any.run/tasks/8ac81174-d6d0-43d3-b2d2-c26e167a296b/", "https://www.welivesecurity.com/wp-content/uploads/2018/09/ESET-LoJax.pdf", "https://threatconnect.com/finding-nemohost-fancy-bear-infrastructure/" ], "total": 1 }, { "counts": { "domain": 1 }, "first_seen": "2017-11-07", "indicators": { "domain": [ "jflynci.com" ] }, "precision": "exact", "references": [ "https://www.jigsawsecurityenterprise.com/single-post/2017/11/01/Malicious-Documents-Targeting-Security-Professionals", "https://app.any.run/tasks/8ac81174-d6d0-43d3-b2d2-c26e167a296b/", "https://www.welivesecurity.com/wp-content/uploads/2018/09/ESET-LoJax.pdf", "https://asert.arbornetworks.com/lojax-fancy-since-2016/", "https://threatconnect.com/finding-nemohost-fancy-bear-infrastructure/" ], "total": 1 }, { "counts": { "domain": 1 }, "first_seen": "2017-11-07", "indicators": { "domain": [ "elaxo.org" ] }, "precision": "exact", "references": [ "https://www.jigsawsecurityenterprise.com/single-post/2017/11/01/Malicious-Documents-Targeting-Security-Professionals", "https://app.any.run/tasks/8ac81174-d6d0-43d3-b2d2-c26e167a296b/", "https://www.welivesecurity.com/wp-content/uploads/2018/09/ESET-LoJax.pdf", "https://asert.arbornetworks.com/lojax-fancy-since-2016/" ], "total": 1 }, { "counts": { "domain": 1 }, "first_seen": "2017-11-07", "indicators": { "domain": [ "myinvestgroup.com" ] }, "precision": "exact", "references": [ "https://www.jigsawsecurityenterprise.com/single-post/2017/11/01/Malicious-Documents-Targeting-Security-Professionals", "https://app.any.run/tasks/8ac81174-d6d0-43d3-b2d2-c26e167a296b/", "https://threatconnect.com/blog/using-fancy-bear-ssl-certificate-information-to-identify-their-infrastructure/", "https://app.any.run/tasks/516fee6f-1b98-40d2-8dd1-65b9c79bd05e/", "https://app.any.run/tasks/41b1658f-1bb2-4891-8053-9401706b3ff7/", "https://app.any.run/tasks/09da60cd-710f-4466-9942-c4eb4862e7fb/", "https://app.any.run/tasks/d6a8d1db-52c8-4371-b6d3-bf740408bb10/", "https://app.any.run/tasks/c841c920-8d04-4164-9e22-a288fb6f91d3/" ], "total": 1 }, { "counts": { "domain": 1 }, "first_seen": "2017-11-07", "indicators": { "domain": [ "fsportal.net" ] }, "precision": "exact", "references": [ "https://www.jigsawsecurityenterprise.com/single-post/2017/11/01/Malicious-Documents-Targeting-Security-Professionals", "https://app.any.run/tasks/8ac81174-d6d0-43d3-b2d2-c26e167a296b/", "https://securelist.com/a-slice-of-2017-sofacy-activity/83930/", "https://app.any.run/tasks/54a21ac9-f915-4556-8800-6f384fbbc6be/", "https://app.any.run/tasks/50eb1524-d95b-481e-b9d1-766c0a1fda74/", "https://app.any.run/tasks/396ccb39-ca44-4ae9-8584-96a8093ffc31/", "https://app.any.run/tasks/9abe2703-3750-4728-a932-129177b2a72a/", "https://threatconnect.com/finding-nemohost-fancy-bear-infrastructure/" ], "total": 1 }, { "counts": { "domain": 1 }, "first_seen": "2017-11-07", "indicators": { "domain": [ "peacefund.eu" ] }, "precision": "exact", "references": [ "https://www.jigsawsecurityenterprise.com/single-post/2017/11/01/Malicious-Documents-Targeting-Security-Professionals", "https://app.any.run/tasks/8ac81174-d6d0-43d3-b2d2-c26e167a296b/", "https://asert.arbornetworks.com/lojax-fancy-since-2016/" ], "total": 1 }, { "counts": { "domain": 2 }, "first_seen": "2017-10-11", "indicators": { "domain": [ "carlos88.ddns.net", "jeremizo888.ddns.net" ] }, "precision": "exact", "references": [ "https://www.jigsawsecurityenterprise.com/single-post/2017/11/01/Malicious-Documents-Targeting-Security-Professionals", "https://app.any.run/tasks/8ac81174-d6d0-43d3-b2d2-c26e167a296b/" ], "total": 2 }, { "counts": { "domain": 21 }, "first_seen": "2017-04-14", "indicators": { "domain": [ "aolnets.com", "asus-service.net", "bmlv-gv.eu", "brnlv-gv.eu", "defencereview.net", "delivery-yahoo.com", "enisa-europa.com", "enisa-europa.org", "europeanda.com", "foreignreview.com", "globalnewsweekly.com", "iacr-tcc.org", "mediarea.org", "nato-info.com", "nato-int.com", "natopress.org", "netassistcache.com", "osce-oscc.org", "settings-live.com", "webmail.westinqhousenuclear.com", "westinqhousenuclear.com" ] }, "precision": "exact", "references": [ "http://pwc.blogs.com/files/cto-tib-20150420-01a.pdf" ], "total": 21 }, { "counts": { "domain": 4 }, "first_seen": "2017-04-14", "indicators": { "domain": [ "defencereview.eu", "militaryobserver.net", "nato-hq.com", "natopress.com" ] }, "precision": "exact", "references": [ "http://pwc.blogs.com/files/cto-tib-20150420-01a.pdf", "https://github.com/eset/malware-ioc/blob/master/sednit/part1.adoc" ], "total": 4 }, { "counts": { "domain": 2 }, "first_seen": "2017-04-14", "indicators": { "domain": [ "privacy-live.com", "privacy-yahoo.com" ] }, "precision": "exact", "references": [ "http://pwc.blogs.com/files/cto-tib-20150420-01a.pdf", "https://pwc.blogs.com/files/tactical-intelligence-bulletin---sofacy-phishing-.pdf" ], "total": 2 }, { "counts": { "domain": 1 }, "first_seen": "2017-04-14", "indicators": { "domain": [ "akamaicachecdn.com" ] }, "precision": "exact", "references": [ "https://www.tr1adx.net/intel/public/TIB-00001_IOC_Domain.txt", "https://threatconnect.com/finding-nemohost-fancy-bear-infrastructure/" ], "total": 1 }, { "counts": { "domain": 1 }, "first_seen": "2017-04-14", "indicators": { "domain": [ "dotnetupdatechecker.com" ] }, "precision": "exact", "references": [ "https://www.tr1adx.net/intel/public/TIB-00001_IOC_Domain.txt" ], "total": 1 }, { "counts": { "domain": 4 }, "first_seen": "2017-04-13", "indicators": { "domain": [ "apple-checker.org", "apple-iclods.org", "apple-search.info", "apple-uptoday.org" ] }, "precision": "exact", "references": [ "https://www.tr1adx.net/intel/public/TIB-00001_IOC_Domain.txt", "https://threatconnect.com/finding-nemohost-fancy-bear-infrastructure/" ], "total": 4 }, { "counts": { "domain": 3 }, "first_seen": "2017-04-12", "indicators": { "domain": [ "storsvc.org", "tabsync.net", "wscapi.com" ] }, "precision": "exact", "references": [ "http://researchcenter.paloaltonetworks.com/2016/06/unit42-new-sofacy-attacks-against-us-government-agency/", "https://github.com/eset/malware-ioc/blob/master/sednit/part1.adoc" ], "total": 3 }, { "counts": { "domain": 2 }, "first_seen": "2017-04-12", "indicators": { "domain": [ "munimonoce.com", "servicecdp.com" ] }, "precision": "exact", "references": [ "http://researchcenter.paloaltonetworks.com/2016/06/unit42-new-sofacy-attacks-against-us-government-agency/" ], "total": 2 }, { "counts": { "domain": 1 }, "first_seen": "2017-04-12", "indicators": { "domain": [ "mswordupdate17.com" ] }, "precision": "exact", "references": [ "https://threatconnect.com/finding-nemohost-fancy-bear-infrastructure/" ], "total": 1 }, { "counts": { "domain": 3 }, "first_seen": "2017-04-10", "indicators": { "domain": [ "securityprotectingcorp.com", "uniquecorpind.com", "versiontask.com" ] }, "precision": "exact", "references": [ "http://researchcenter.paloaltonetworks.com/2016/12/unit42-let-ride-sofacy-groups-dealerschoice-attacks-continue/", "https://securelist.com/a-slice-of-2017-sofacy-activity/83930/", "https://app.any.run/tasks/54a21ac9-f915-4556-8800-6f384fbbc6be/", "https://app.any.run/tasks/50eb1524-d95b-481e-b9d1-766c0a1fda74/", "https://app.any.run/tasks/396ccb39-ca44-4ae9-8584-96a8093ffc31/", "https://app.any.run/tasks/9abe2703-3750-4728-a932-129177b2a72a/", "https://blog.trendmicro.com/trendlabs-security-intelligence/pawn-storm-ramps-up-spear-phishing-before-zero-days-get-patched/" ], "total": 3 }, { "counts": { "domain": 3 }, "first_seen": "2017-04-10", "indicators": { "domain": [ "adobeupgradeflash.com", "globalresearching.org", "postlkwarn.com" ] }, "precision": "exact", "references": [ "http://researchcenter.paloaltonetworks.com/2016/12/unit42-let-ride-sofacy-groups-dealerschoice-attacks-continue/", "https://securelist.com/a-slice-of-2017-sofacy-activity/83930/", "https://app.any.run/tasks/54a21ac9-f915-4556-8800-6f384fbbc6be/", "https://app.any.run/tasks/50eb1524-d95b-481e-b9d1-766c0a1fda74/", "https://app.any.run/tasks/396ccb39-ca44-4ae9-8584-96a8093ffc31/", "https://app.any.run/tasks/9abe2703-3750-4728-a932-129177b2a72a/" ], "total": 3 }, { "counts": { "domain": 2 }, "first_seen": "2017-04-10", "indicators": { "domain": [ "akamaisoftupdate.com", "globaltechresearch.org" ] }, "precision": "exact", "references": [ "https://www.tr1adx.net/intel/public/TIB-00001_IOC_Domain.txt", "http://researchcenter.paloaltonetworks.com/2016/12/unit42-let-ride-sofacy-groups-dealerschoice-attacks-continue/", "https://threatconnect.com/blog/using-fancy-bear-ssl-certificate-information-to-identify-their-infrastructure/", "https://app.any.run/tasks/516fee6f-1b98-40d2-8dd1-65b9c79bd05e/", "https://app.any.run/tasks/41b1658f-1bb2-4891-8053-9401706b3ff7/", "https://app.any.run/tasks/09da60cd-710f-4466-9942-c4eb4862e7fb/", "https://app.any.run/tasks/d6a8d1db-52c8-4371-b6d3-bf740408bb10/", "https://app.any.run/tasks/c841c920-8d04-4164-9e22-a288fb6f91d3/", "https://threatconnect.com/finding-nemohost-fancy-bear-infrastructure/" ], "total": 2 }, { "counts": { "domain": 2 }, "first_seen": "2017-04-10", "indicators": { "domain": [ "apptaskserver.com", "joshel.com" ] }, "precision": "exact", "references": [ "http://researchcenter.paloaltonetworks.com/2016/12/unit42-let-ride-sofacy-groups-dealerschoice-attacks-continue/", "https://threatconnect.com/blog/using-fancy-bear-ssl-certificate-information-to-identify-their-infrastructure/", "https://app.any.run/tasks/516fee6f-1b98-40d2-8dd1-65b9c79bd05e/", "https://app.any.run/tasks/41b1658f-1bb2-4891-8053-9401706b3ff7/", "https://app.any.run/tasks/09da60cd-710f-4466-9942-c4eb4862e7fb/", "https://app.any.run/tasks/d6a8d1db-52c8-4371-b6d3-bf740408bb10/", "https://app.any.run/tasks/c841c920-8d04-4164-9e22-a288fb6f91d3/" ], "total": 2 }, { "counts": { "domain": 1 }, "first_seen": "2017-04-10", "indicators": { "domain": [ "appservicegroup.com" ] }, "precision": "exact", "references": [ "http://researchcenter.paloaltonetworks.com/2016/12/unit42-let-ride-sofacy-groups-dealerschoice-attacks-continue/", "https://threatconnect.com/blog/using-fancy-bear-ssl-certificate-information-to-identify-their-infrastructure/", "https://app.any.run/tasks/516fee6f-1b98-40d2-8dd1-65b9c79bd05e/", "https://app.any.run/tasks/41b1658f-1bb2-4891-8053-9401706b3ff7/", "https://app.any.run/tasks/09da60cd-710f-4466-9942-c4eb4862e7fb/", "https://app.any.run/tasks/d6a8d1db-52c8-4371-b6d3-bf740408bb10/", "https://app.any.run/tasks/c841c920-8d04-4164-9e22-a288fb6f91d3/", "https://threatconnect.com/finding-nemohost-fancy-bear-infrastructure/" ], "total": 1 }, { "counts": { "domain": 18 }, "first_seen": "2017-03-30", "indicators": { "domain": [ "accounts-googlc.com", "cloudupgrade.org", "easycache.net", "finemagicball.org", "info2t.com", "lucyonmail.org", "msoftonline.com", "mymail-ukr.net", "newsdailyworld.com", "onedrivemicrosoft365.com", "philcfo.org", "profile-hotmail.com", "publishdollar.com", "service-hushmail.com", "sportszone71.com", "uploader.sytes.net", "whatsapp-in.com", "winsyschecks.com" ] }, "precision": "exact", "references": [ "https://www.tr1adx.net/intel/public/TIB-00001_IOC_Domain.txt" ], "total": 18 }, { "counts": { "domain": 8 }, "first_seen": "2017-03-30", "indicators": { "domain": [ "dailyforeignnews.com", "diplomatnews.org", "mscoresvw.com", "natoint.com", "windowscheckupdater.net", "winupdatesysmic.com", "worldmilitarynews.org", "worldpoliticsnews.org" ] }, "precision": "exact", "references": [ "https://www.tr1adx.net/intel/public/TIB-00001_IOC_Domain.txt", "https://github.com/eset/malware-ioc/blob/master/sednit/part1.adoc" ], "total": 8 }, { "counts": { "domain": 3 }, "first_seen": "2017-03-30", "indicators": { "domain": [ "cloudflarecdn.com", "nortonupdate.org", "updatesystems.net" ] }, "precision": "exact", "references": [ "https://www.tr1adx.net/intel/public/TIB-00001_IOC_Domain.txt", "https://github.com/eset/malware-ioc/blob/master/sednit/part2.adoc", "https://threatconnect.com/finding-nemohost-fancy-bear-infrastructure/" ], "total": 3 }, { "counts": { "domain": 1 }, "first_seen": "2017-03-30", "indicators": { "domain": [ "eservicesystems.net" ] }, "precision": "exact", "references": [ "https://www.tr1adx.net/intel/public/TIB-00001_IOC_Domain.txt", "https://threatconnect.com/finding-nemohost-fancy-bear-infrastructure/", "https://documents.trendmicro.com/assets/appendix_looking-into-a-cyber-attack-facilitator-in-the-netherlands.pdf", "https://vxcube.com/recent-threats-ioc/5c74c73ca39bb5786f9664d3/detail" ], "total": 1 }, { "counts": { "domain": 1 }, "first_seen": "2017-03-30", "indicators": { "domain": [ "adobeupdater.org" ] }, "precision": "exact", "references": [ "https://www.tr1adx.net/intel/public/TIB-00001_IOC_Domain.txt", "https://threatconnect.com/finding-nemohost-fancy-bear-infrastructure/" ], "total": 1 }, { "counts": { "domain": 1 }, "first_seen": "2017-03-30", "indicators": { "domain": [ "webmail-saic.com" ] }, "precision": "exact", "references": [ "https://www.tr1adx.net/intel/public/TIB-00001_IOC_Domain.txt", "https://pwc.blogs.com/files/tactical-intelligence-bulletin---sofacy-phishing-.pdf" ], "total": 1 }, { "counts": { "domain": 1 }, "first_seen": "2017-03-30", "indicators": { "domain": [ "symantecsupport.org" ] }, "precision": "exact", "references": [ "https://www.tr1adx.net/intel/public/TIB-00001_IOC_Domain.txt", "https://github.com/eset/malware-ioc/blob/master/sednit/part2.adoc" ], "total": 1 }, { "counts": { "domain": 1 }, "first_seen": "2017-03-30", "indicators": { "domain": [ "researchcontinental.org" ] }, "precision": "exact", "references": [ "https://www.tr1adx.net/intel/public/TIB-00001_IOC_Domain.txt", "http://researchcenter.paloaltonetworks.com/2016/12/unit42-let-ride-sofacy-groups-dealerschoice-attacks-continue/" ], "total": 1 }, { "counts": { "domain": 124 }, "first_seen": "2017-02-27", "indicators": { "domain": [ "365msoffice.com", "acccountverify.com", "accgmail.com", "account-close-status.com", "accounts-updated.com", "accountsteam-en.com", "accountverify.com", "accountverify.info", "adobemainsecurity.com", "akadns.info", "akamaichecker.com", "apple-assistance-localisation.com", "apple-care-support.com", "apple-cloud-connect.com", "apple-iclouds.net", "apple-id-service.com", "apple-iphone-services.com", "apple-iphonesecurity-icloud.com", "apple-location-id.com", "apple-security-support.info", "apple-support-securityiphone.com", "appleid-security-icloud.com", "apps4updates.com", "arghpxdge01-airgas.com", "cavuslawfirm.com", "checkfindmyiphone.com", "cloud-apple-support.com", "cloud-id-localisation.com", "csert.net", "defenceglobaladviser.com", "delivery-mail-service.com", "diplomatscouncil.org", "emailprovider.org", "emails-aol.com", "exchangetrusts.com", "facebookonlinenotice.com", "facebookservices.org", "fbarticles.com", "generalscaningcorp.org", "getwindowsupdates.com", "globaldefencetalk.com", "gmailservicegroup.com", "gmailservices.org", "gnpad-gh-gov.org", "google-vservice.com", "iadb-online.com", "icloud-id-en.com", "icloud-id-localisation.com", "icloud-id-security.com", "icloud-id-services.com", "icloud-iphone-services.com", "icloud-iphonesecurity.com", "icloud-localisation-id.com", "icloud-security-support.com", "icloud-service-apple.com", "icloud-support-id.com", "id-icloud-localisation.com", "id-icloud-support.com", "identification-apple-id.com", "identification-apple.com", "identification-icloud-id.com", "imf-eu.org", "istoreapple.com", "itune-app.com", "limited-resolution.com", "limited-verification.com", "localisation-apple-id.com", "localisation-apple-security.com", "localisation-apple.com", "localisation-id-apple.com", "localisation-id-icloud.com", "localisation-security.com", "localisation-support.com", "login-resolve-limitations.com", "login-security-notification.com", "login-security-verifications.com", "mail-periodistas.net", "mailerfeed.net", "microsoftfont.com", "microsoftofficeupdate.net", "mobilehostsvc.com", "msfontsrv.com", "msmodule.net", "msofficeinstall.com", "nato-nevvs.org", "nvidiagforceup.com", "officefont.com", "offlineupdates.com", "politicsadvertisment.com", "pressservices.net", "privacy-ukr.net", "protectingcorpind.com", "proxysys-config.com", "reinstate-account.com", "rsshotmail.com", "samsvung.com", "secure-remove-limitation.com", "secure-verification-center.com", "secureconnectcompany.com", "security-apple-id.com", "security-icloud-apple.com", "security-icloud-localisation.com", "security-resolution-center.com", "security-verification.net", "security-verifications.com", "signin-icloudsupport.com", "support-icloud-apple.com", "support-icloud-localisation.com", "support-localisation-icloud.com", "support-security-icloud.com", "support-svc.com", "transfersevices.net", "transworldpetroleum.com", "twiterservices.org", "update-adobe.com", "update-security-information.com", "updatepple.com", "updatesrvx.net", "us-facebook.com", "windowsofficeupdate.com", "winsystemsvc.net", "wpadsettings.net", "xn--amazo-d8a.com", "yuotubc.com" ] }, "precision": "exact", "references": [ "https://www.tr1adx.net/intel/public/TIB-00001_IOC_Domain.txt" ], "total": 124 }, { "counts": { "domain": 4 }, "first_seen": "2017-02-27", "indicators": { "domain": [ "applecloudupdate.com", "dateosx.com", "reportscanprotecting.org", "wsusconnect.com" ] }, "precision": "exact", "references": [ "https://www.tr1adx.net/intel/public/TIB-00001_IOC_Domain.txt", "https://threatconnect.com/blog/using-fancy-bear-ssl-certificate-information-to-identify-their-infrastructure/", "https://app.any.run/tasks/516fee6f-1b98-40d2-8dd1-65b9c79bd05e/", "https://app.any.run/tasks/41b1658f-1bb2-4891-8053-9401706b3ff7/", "https://app.any.run/tasks/09da60cd-710f-4466-9942-c4eb4862e7fb/", "https://app.any.run/tasks/d6a8d1db-52c8-4371-b6d3-bf740408bb10/", "https://app.any.run/tasks/c841c920-8d04-4164-9e22-a288fb6f91d3/", "https://threatconnect.com/finding-nemohost-fancy-bear-infrastructure/" ], "total": 4 }, { "counts": { "domain": 3 }, "first_seen": "2017-02-27", "indicators": { "domain": [ "generalsecuritycorp.org", "login-security-center.com", "reservecorpind.com" ] }, "precision": "exact", "references": [ "https://www.tr1adx.net/intel/public/TIB-00001_IOC_Domain.txt", "https://threatconnect.com/finding-nemohost-fancy-bear-infrastructure/" ], "total": 3 }, { "counts": { "domain": 3 }, "first_seen": "2017-02-27", "indicators": { "domain": [ "adobe-flash-updates.org", "generalsecurityscan.com", "shcserv.com" ] }, "precision": "exact", "references": [ "https://www.tr1adx.net/intel/public/TIB-00001_IOC_Domain.txt", "https://securelist.com/a-slice-of-2017-sofacy-activity/83930/", "https://app.any.run/tasks/54a21ac9-f915-4556-8800-6f384fbbc6be/", "https://app.any.run/tasks/50eb1524-d95b-481e-b9d1-766c0a1fda74/", "https://app.any.run/tasks/396ccb39-ca44-4ae9-8584-96a8093ffc31/", "https://app.any.run/tasks/9abe2703-3750-4728-a932-129177b2a72a/" ], "total": 3 }, { "counts": { "domain": 1 }, "first_seen": "2017-02-27", "indicators": { "domain": [ "microsoftdccenter.com" ] }, "precision": "exact", "references": [ "https://www.tr1adx.net/intel/public/TIB-00001_IOC_Domain.txt", "https://threatconnect.com/blog/using-fancy-bear-ssl-certificate-information-to-identify-their-infrastructure/", "https://app.any.run/tasks/516fee6f-1b98-40d2-8dd1-65b9c79bd05e/", "https://app.any.run/tasks/41b1658f-1bb2-4891-8053-9401706b3ff7/", "https://app.any.run/tasks/09da60cd-710f-4466-9942-c4eb4862e7fb/", "https://app.any.run/tasks/d6a8d1db-52c8-4371-b6d3-bf740408bb10/", "https://app.any.run/tasks/c841c920-8d04-4164-9e22-a288fb6f91d3/" ], "total": 1 }, { "counts": { "domain": 1 }, "first_seen": "2017-02-27", "indicators": { "domain": [ "netcorpscanprotect.com" ] }, "precision": "exact", "references": [ "https://www.tr1adx.net/intel/public/TIB-00001_IOC_Domain.txt", "https://securelist.com/a-slice-of-2017-sofacy-activity/83930/", "https://app.any.run/tasks/54a21ac9-f915-4556-8800-6f384fbbc6be/", "https://app.any.run/tasks/50eb1524-d95b-481e-b9d1-766c0a1fda74/", "https://app.any.run/tasks/396ccb39-ca44-4ae9-8584-96a8093ffc31/", "https://app.any.run/tasks/9abe2703-3750-4728-a932-129177b2a72a/", "https://threatconnect.com/finding-nemohost-fancy-bear-infrastructure/" ], "total": 1 }, { "counts": { "domain": 1 }, "first_seen": "2017-02-27", "indicators": { "domain": [ "itunes-helper.net" ] }, "precision": "exact", "references": [ "https://www.tr1adx.net/intel/public/TIB-00001_IOC_Domain.txt", "https://documents.trendmicro.com/assets/appendix_looking-into-a-cyber-attack-facilitator-in-the-netherlands.pdf", "https://vxcube.com/recent-threats-ioc/5c74c73ca39bb5786f9664d3/detail" ], "total": 1 }, { "counts": { "domain": 1 }, "first_seen": "2016-03-08", "indicators": { "domain": [ "msonlinelive.com" ] }, "precision": "exact", "references": [ "http://www.welivesecurity.com/2014/10/08/sednit-espionage-group-now-using-custom-exploit-kit/" ], "total": 1 }, { "counts": { "domain": 1 }, "first_seen": "2016-03-08", "indicators": { "domain": [ "malwarecheck.info" ] }, "precision": "exact", "references": [ "http://www.symantec.com/security_response/earthlink_writeup.jsp?docid=2014-110315-1233-99", "https://www.tr1adx.net/intel/public/TIB-00001_IOC_Domain.txt", "https://pwc.blogs.com/files/tactical-intelligence-bulletin---sofacy-phishing-.pdf", "https://threatconnect.com/finding-nemohost-fancy-bear-infrastructure/" ], "total": 1 }, { "counts": { "domain": 2 }, "first_seen": "2016-02-23", "indicators": { "domain": [ "mozilla-plugins.com", "mozillaplagins.com" ] }, "precision": "exact", "references": [ "http://researchcenter.paloaltonetworks.com/2016/02/a-look-into-fysbis-sofacys-linux-backdoor", "https://www.symantec.com/security_response/writeup.jsp?docid=2016-031520-4610-99&tabid=2" ], "total": 2 }, { "counts": { "domain": 25 }, "first_seen": "2015-12-19", "indicators": { "domain": [ "b-of-americ.com", "cbiuaebank.com", "cbiuaebn.com", "fbonlinelottery.com", "fubnt.com", "globeshippers.biz", "globeshippers.net", "gsandsc.com", "gshippers.com", "hesselawchambers.com", "kwqx.us", "largefarm.net", "middle-eastreview.org", "regionsbnk.info", "royalbsuk.com", "seatreasures.org", "ssandsc.com", "t-d-canadatrust.com", "techielawfirms.com", "togounoffice.com", "ubagroupsgh.com", "un-unicef.org", "unicomba.com", "unitednat.org", "universalcoba.com" ] }, "precision": "exact", "references": [ "https://www.root9b.com/sites/default/files/whitepapers/R9b_FSOFACY_0.pdf" ], "total": 25 }, { "counts": { "domain": 6 }, "first_seen": "2015-12-19", "indicators": { "domain": [ "mail.q0v.pl", "n0vinite.com", "novinitie.com", "poczta.mon.q0v.pl", "q0v.pl", "standartnevvs.com" ] }, "precision": "exact", "references": [ "https://www.fireeye.com/resources/pdfs/apt28.pdf", "https://pwc.blogs.com/files/tactical-intelligence-bulletin---sofacy-phishing-.pdf" ], "total": 6 }, { "counts": { "domain": 3 }, "first_seen": "2015-12-19", "indicators": { "domain": [ "osce-military.org", "settings-yahoo.com", "techcruncln.com" ] }, "precision": "exact", "references": [ "https://www.root9b.com/sites/default/files/whitepapers/R9b_FSOFACY_0.pdf", "http://pwc.blogs.com/files/cto-tib-20150420-01a.pdf" ], "total": 3 }, { "counts": { "domain": 2 }, "first_seen": "2015-12-19", "indicators": { "domain": [ "googlesetting.com", "yovtube.co" ] }, "precision": "exact", "references": [ "https://www.root9b.com/sites/default/files/whitepapers/R9b_FSOFACY_0.pdf", "https://pwc.blogs.com/files/tactical-intelligence-bulletin---sofacy-phishing-.pdf" ], "total": 2 }, { "counts": { "domain": 2 }, "first_seen": "2015-12-19", "indicators": { "domain": [ "intelsupport.net", "softupdates.info" ] }, "precision": "exact", "references": [ "https://securelist.com/blog/research/72924/sofacy-apt-hits-high-profile-targets-with-updated-toolset/", "http://pwc.blogs.com/files/cto-tib-20150420-01a.pdf" ], "total": 2 }, { "counts": { "domain": 2 }, "first_seen": "2015-12-19", "indicators": { "domain": [ "drivres-update.info", "intelnetservice.com" ] }, "precision": "exact", "references": [ "https://securelist.com/blog/research/72924/sofacy-apt-hits-high-profile-targets-with-updated-toolset/" ], "total": 2 }, { "counts": { "domain": 1 }, "first_seen": "2015-12-19", "indicators": { "domain": [ "bbcnewsweek.com" ] }, "precision": "exact", "references": [ "https://www.root9b.com/sites/default/files/whitepapers/R9b_FSOFACY_0.pdf", "https://www.tr1adx.net/intel/public/TIB-00001_IOC_Domain.txt" ], "total": 1 }, { "counts": { "domain": 1 }, "first_seen": "2015-12-19", "indicators": { "domain": [ "qov.hu.com" ] }, "precision": "exact", "references": [ "https://www.root9b.com/sites/default/files/whitepapers/R9b_FSOFACY_0.pdf", "https://www.fireeye.com/resources/pdfs/apt28.pdf", "https://pwc.blogs.com/files/tactical-intelligence-bulletin---sofacy-phishing-.pdf" ], "total": 1 }, { "counts": { "domain": 2 }, "first_seen": "2015-10-21", "indicators": { "domain": [ "nato-press.com", "pass-google.com" ] }, "precision": "exact", "references": [ "https://www.fireeye.com/blog/threat-research/2015/04/probable_apt28_useo.html", "https://otx.alienvault.com/pulse/55346adeb45ff536ca3ffd2c/" ], "total": 2 }, { "counts": { "domain": 1 }, "first_seen": "2015-10-21", "indicators": { "domain": [ "drivers-update.info" ] }, "precision": "exact", "references": [ "https://www.tr1adx.net/intel/public/TIB-00001_IOC_Domain.txt", "https://www.fireeye.com/blog/threat-research/2015/04/probable_apt28_useo.html", "https://otx.alienvault.com/pulse/55346adeb45ff536ca3ffd2c/", "https://threatconnect.com/finding-nemohost-fancy-bear-infrastructure/" ], "total": 1 }, { "counts": { "domain": 1 }, "first_seen": "2015-10-21", "indicators": { "domain": [ "updatecenter.name" ] }, "precision": "exact", "references": [ "https://github.com/eset/malware-ioc/blob/master/sednit/part2.adoc", "https://www.fireeye.com/blog/threat-research/2015/04/probable_apt28_useo.html", "https://otx.alienvault.com/pulse/55346adeb45ff536ca3ffd2c/" ], "total": 1 }, { "counts": { "domain": 6 }, "first_seen": "2015-03-18", "indicators": { "domain": [ "adobeincorp.com", "checkmalware.info", "checkwinframe.com", "microsofi.org", "secnetcontrol.com", "updatesoftware24.com" ] }, "precision": "exact", "references": [ "https://www.alienvault.com/open-threat-exchange/blog/from-russia-with-love-sofacy-sednit-apt28-is-in-town", "http://permalink.gmane.org/gmane.comp.security.ids.snort.emerging-sigs/22170", "http://pwc.blogs.com/files/tactical-intelligence-bulletin---sofacy-phishing-.pdf", "https://www.tr1adx.net/intel/public/TIB-00001_IOC_Domain.txt", "https://threatconnect.com/finding-nemohost-fancy-bear-infrastructure/" ], "total": 6 }, { "counts": { "domain": 4 }, "first_seen": "2015-03-18", "indicators": { "domain": [ "check-fix.com", "hotfix-update.com", "symanttec.org", "testsnetcontrol.com" ] }, "precision": "exact", "references": [ "https://www.alienvault.com/open-threat-exchange/blog/from-russia-with-love-sofacy-sednit-apt28-is-in-town", "http://permalink.gmane.org/gmane.comp.security.ids.snort.emerging-sigs/22170", "http://pwc.blogs.com/files/tactical-intelligence-bulletin---sofacy-phishing-.pdf" ], "total": 4 }, { "counts": { "domain": 2 }, "first_seen": "2015-03-18", "indicators": { "domain": [ "testservice24.net", "updatepc.org" ] }, "precision": "exact", "references": [ "https://www.alienvault.com/open-threat-exchange/blog/from-russia-with-love-sofacy-sednit-apt28-is-in-town", "http://permalink.gmane.org/gmane.comp.security.ids.snort.emerging-sigs/22170", "http://pwc.blogs.com/files/tactical-intelligence-bulletin---sofacy-phishing-.pdf", "https://www.tr1adx.net/intel/public/TIB-00001_IOC_Domain.txt", "https://pwc.blogs.com/files/tactical-intelligence-bulletin---sofacy-phishing-.pdf", "https://threatconnect.com/finding-nemohost-fancy-bear-infrastructure/" ], "total": 2 }, { "counts": { "domain": 2 }, "first_seen": "2015-03-18", "indicators": { "domain": [ "checkmalware.org", "scanmalware.info" ] }, "precision": "exact", "references": [ "https://www.alienvault.com/open-threat-exchange/blog/from-russia-with-love-sofacy-sednit-apt28-is-in-town", "http://permalink.gmane.org/gmane.comp.security.ids.snort.emerging-sigs/22170", "http://pwc.blogs.com/files/tactical-intelligence-bulletin---sofacy-phishing-.pdf", "http://www.symantec.com/security_response/earthlink_writeup.jsp?docid=2014-110315-1233-99", "https://www.tr1adx.net/intel/public/TIB-00001_IOC_Domain.txt", "https://pwc.blogs.com/files/tactical-intelligence-bulletin---sofacy-phishing-.pdf", "https://threatconnect.com/finding-nemohost-fancy-bear-infrastructure/" ], "total": 2 }, { "counts": { "domain": 1 }, "first_seen": "2015-03-18", "indicators": { "domain": [ "microsof-update.com" ] }, "precision": "exact", "references": [ "https://www.alienvault.com/open-threat-exchange/blog/from-russia-with-love-sofacy-sednit-apt28-is-in-town", "http://permalink.gmane.org/gmane.comp.security.ids.snort.emerging-sigs/22170", "http://pwc.blogs.com/files/tactical-intelligence-bulletin---sofacy-phishing-.pdf", "https://www.tr1adx.net/intel/public/TIB-00001_IOC_Domain.txt" ], "total": 1 }, { "counts": { "domain": 1 }, "first_seen": "2015-03-18", "indicators": { "domain": [ "securitypractic.com" ] }, "precision": "exact", "references": [ "https://www.alienvault.com/open-threat-exchange/blog/from-russia-with-love-sofacy-sednit-apt28-is-in-town", "http://permalink.gmane.org/gmane.comp.security.ids.snort.emerging-sigs/22170", "http://pwc.blogs.com/files/tactical-intelligence-bulletin---sofacy-phishing-.pdf", "https://pwc.blogs.com/files/tactical-intelligence-bulletin---sofacy-phishing-.pdf", "https://www.fireeye.com/blog/threat-research/2015/04/probable_apt28_useo.html", "https://otx.alienvault.com/pulse/55346adeb45ff536ca3ffd2c/" ], "total": 1 }, { "counts": { "domain": 1 }, "first_seen": "2015-03-18", "indicators": { "domain": [ "windows-updater.com" ] }, "precision": "exact", "references": [ "https://www.alienvault.com/open-threat-exchange/blog/from-russia-with-love-sofacy-sednit-apt28-is-in-town", "http://permalink.gmane.org/gmane.comp.security.ids.snort.emerging-sigs/22170", "http://pwc.blogs.com/files/tactical-intelligence-bulletin---sofacy-phishing-.pdf", "http://www.welivesecurity.com/2014/10/08/sednit-espionage-group-now-using-custom-exploit-kit/", "https://pwc.blogs.com/files/tactical-intelligence-bulletin---sofacy-phishing-.pdf" ], "total": 1 }, { "counts": { "domain": 1 }, "first_seen": "2015-03-18", "indicators": { "domain": [ "adawareblock.com" ] }, "precision": "exact", "references": [ "https://www.alienvault.com/open-threat-exchange/blog/from-russia-with-love-sofacy-sednit-apt28-is-in-town", "http://permalink.gmane.org/gmane.comp.security.ids.snort.emerging-sigs/22170", "http://pwc.blogs.com/files/tactical-intelligence-bulletin---sofacy-phishing-.pdf", "http://www.symantec.com/security_response/earthlink_writeup.jsp?docid=2014-110315-1233-99", "https://pwc.blogs.com/files/tactical-intelligence-bulletin---sofacy-phishing-.pdf" ], "total": 1 }, { "counts": { "domain": 1 }, "first_seen": "2015-03-18", "indicators": { "domain": [ "azureon-line.com" ] }, "precision": "exact", "references": [ "https://www.alienvault.com/open-threat-exchange/blog/from-russia-with-love-sofacy-sednit-apt28-is-in-town", "http://permalink.gmane.org/gmane.comp.security.ids.snort.emerging-sigs/22170", "http://pwc.blogs.com/files/tactical-intelligence-bulletin---sofacy-phishing-.pdf", "http://researchcenter.paloaltonetworks.com/2016/02/a-look-into-fysbis-sofacys-linux-backdoor", "http://www.welivesecurity.com/2014/10/08/sednit-espionage-group-now-using-custom-exploit-kit/", "https://pwc.blogs.com/files/tactical-intelligence-bulletin---sofacy-phishing-.pdf", "https://www.symantec.com/security_response/writeup.jsp?docid=2016-031520-4610-99&tabid=2" ], "total": 1 } ] }