{
  "aliases": [
    "apt-c-06",
    "apt06",
    "thinmon"
  ],
  "attack_id": "G0012",
  "attack_name": "Darkhotel",
  "attack_url": "https://attack.mitre.org/groups/G0012/",
  "counts": {
    "domain": 314,
    "ipv4": 3,
    "url": 2,
    "url_path": 7
  },
  "first_seen": {
    "domain": {
      "100100011100.com": "2019-06-24",
      "163pics.net": "2015-03-18",
      "163services.com": "2015-03-18",
      "42world.net": "2015-03-18",
      "779999977.com": "2019-06-24",
      "88dafa.biz": "2015-03-18",
      "academyhouse.us": "2015-03-18",
      "account163-mail.com": "2020-08-25",
      "ackr.myvnc.com": "2015-03-18",
      "acrobatup.com": "2015-03-18",
      "adobearm.com": "2015-03-18",
      "adobeplugs.net": "2015-03-18",
      "adoberegister.flashserv.net": "2015-03-18",
      "adobeupdates.com": "2015-03-18",
      "albasrostga.com": "2015-03-18",
      "alexa97.com": "2024-06-17",
      "alphacranes.com": "2015-03-18",
      "alphastros.com": "2015-03-18",
      "amanity50.biz": "2015-03-18",
      "anti-wars.org": "2015-03-18",
      "appfreetools.com": "2016-02-23",
      "apple-onlineservice.com": "2020-08-25",
      "applyinfo.org": "2015-03-18",
      "auto2115.icr38.net": "2015-03-18",
      "auto2116.phpnet.us": "2015-03-18",
      "auto24col.info": "2015-03-18",
      "autobaba.net84.net": "2015-03-18",
      "autoban.phpnet.us": "2015-03-18",
      "autobicy.yaahosting.info": "2015-03-18",
      "autobicycle.20x.cc": "2015-03-18",
      "autobicycle.freehostking.com": "2015-03-18",
      "autobicyyyyyy.50gigs.net": "2015-03-18",
      "autoblank.oni.cc": "2015-03-18",
      "autobrown.gofreeserve.com": "2015-03-18",
      "autocargo.100gbfreehost.com": "2015-03-18",
      "autocash.000php.com": "2015-03-18",
      "autocashhh.hostmefree.org": "2015-03-18",
      "autocaze.crabdance.com": "2015-03-18",
      "autocheck.000page.com": "2015-03-18",
      "autochecker.myftp.biz": "2015-03-18",
      "autocracy.phpnet.us": "2015-03-18",
      "autocrat.comuf.com": "2015-03-18",
      "autodoor.freebyte.us": "2015-03-18",
      "autof888com.20x.cc": "2015-03-18",
      "autofseven.freei.me": "2015-03-18",
      "autogeremys.com": "2015-03-18",
      "autoinsurance.000space.com": "2015-03-18",
      "autojob.whostas.com": "2015-03-18",
      "autoken.scienceontheweb.net": "2015-03-18",
      "autolace.twilightparadox.com": "2015-03-18",
      "automachine.servequake.com": "2015-03-18",
      "automatic.waldennetworks.com": "2015-03-18",
      "automation.000a.biz": "2015-03-18",
      "automation.icr38.net": "2015-03-18",
      "automobile.000a.biz": "2015-03-18",
      "automobile.200gigs.com": "2015-03-18",
      "automobile.freei.me": "2015-03-18",
      "automobile.it.cx": "2015-03-18",
      "automobile.megabyet.net": "2015-03-18",
      "automobile.x4host.eu": "2015-03-18",
      "automobiles.strangled.net": "2015-03-18",
      "automotive.20x.cc": "2015-03-18",
      "autonomy.host22.com": "2015-03-18",
      "autopapa.noads.biz": "2015-03-18",
      "autopara.oliwy.net": "2015-03-18",
      "autoparts.phpnet.us": "2015-03-18",
      "autopatch.createandhost.com": "2015-03-18",
      "autopatch.verwalten.ch": "2015-03-18",
      "autophile.00free.net": "2015-03-18",
      "autopilot.verwalten.ch": "2015-03-18",
      "autoplant.byethost11.com": "2015-03-18",
      "autopsy.createandhost.com": "2015-03-18",
      "autoreviews.dyndns.info": "2015-03-18",
      "autorico.ignorelist.com": "2015-03-18",
      "autosadeo.000php.com": "2015-03-18",
      "autosail.ns01.biz": "2015-03-18",
      "autoshop.hostmefree.org": "2015-03-18",
      "autostart.waldennetworks.com": "2015-03-18",
      "autotest.byethost4.com": "2015-03-18",
      "autotree.freebyte.us": "2015-03-18",
      "autoup.eu.pn": "2015-03-18",
      "autoupdafree.my5gigs.com": "2015-03-18",
      "autoupdate.eg.vg": "2015-03-18",
      "autoupdate.freehostia.com": "2015-03-18",
      "autoupdate.megabyet.net": "2015-03-18",
      "autoupdate.zoka.cc": "2015-03-18",
      "autoupdatefree.freehostia.com": "2015-03-18",
      "autoupdatefree.verwalten.ch": "2015-03-18",
      "autoupdatefree.waldennetworks.com": "2015-03-18",
      "autoupdatefree.zoka.cc": "2015-03-18",
      "autoupdatefreee.my5gigs.com": "2015-03-18",
      "autoupdates.5gigs.net": "2015-03-18",
      "autoupdatfreeee.coolwwweb.com": "2015-03-18",
      "autoupgrade.awardspace.biz": "2015-03-18",
      "autovita.xtreemhost.com": "2015-03-18",
      "autovonmanstein.x10.mx": "2015-03-18",
      "autoworld.serveblog.net": "2015-03-18",
      "autozone.000space.com": "2015-03-18",
      "banilasky.com": "2019-06-24",
      "begatrendsone.com": "2015-03-18",
      "begatrials.com": "2015-03-18",
      "behindcorona.com": "2019-11-01",
      "bigfile-download.net": "2020-09-13",
      "bizannounce.com": "2015-03-18",
      "blonze.createandhost.com": "2015-03-18",
      "bluecat.biz.nf": "2015-03-18",
      "bluemagazines.servegame.com": "2015-03-18",
      "bokselpa.dasfree.com": "2015-03-18",
      "checkingvirusscan.com": "2015-03-18",
      "clus89.crabdance.com": "2015-03-18",
      "cnnmedia.servepics.com": "2020-04-02",
      "codec.servepics.com": "2015-03-18",
      "control.wrizx.net": "2015-03-18",
      "cranseme.ignorelist.com": "2015-03-18",
      "crazymand.twilightparadox.com": "2015-03-18",
      "crendesting.strangled.net": "2015-03-18",
      "dailybread.waldennetworks.com": "2015-03-18",
      "dailyissue.net": "2015-03-18",
      "dailynews.000page.com": "2015-03-18",
      "dailypatch-rnr2008.net": "2015-03-18",
      "dailysummary.net": "2015-03-18",
      "dailyupdate.110mb.com": "2015-03-18",
      "differentfor.com": "2022-05-11",
      "digitalimagestudy.com": "2016-02-23",
      "disknxt.com": "2022-05-11",
      "domainmanagemenet.com": "2015-03-18",
      "donatewa.phpnet.us": "2015-03-18",
      "downsw.onlinewebshop.net": "2015-03-18",
      "dpc.servegame.com": "2015-03-18",
      "ds505cam.com": "2015-03-18",
      "ebizcentres.com": "2015-03-18",
      "elibrarycentre.com": "2015-03-18",
      "email-126.net": "2020-05-22",
      "err.cloins.com": "2015-03-18",
      "eztwt.com": "2015-03-18",
      "fame.mooo.com": "2015-03-18",
      "fashions.0fees.net": "2015-03-18",
      "fenraw.northgeremy.info": "2015-03-18",
      "fenrix.yaahosting.info": "2015-03-18",
      "fenrmi.eu.pn": "2015-03-18",
      "find-image.com": "2020-05-22",
      "foreignaffair.org": "2015-03-18",
      "fsm-gov.com": "2022-03-18",
      "game-service.org": "2019-06-24",
      "gamepia008.my5gigs.com": "2015-03-18",
      "genelousmanis.phpnet.us": "2015-03-18",
      "generalemountina.com": "2015-03-18",
      "genuinsman.phpnet.us": "2015-03-18",
      "gigahermes.com": "2015-03-18",
      "gigamiros.zyns.com": "2015-03-18",
      "gigathread.itemdb.com": "2015-03-18",
      "gigatrend.org": "2015-03-18",
      "giveaway.6te.net": "2015-03-18",
      "goathoney.biz": "2015-03-18",
      "goizmi.ignorelist.com": "2015-03-18",
      "goizmi.phpnet.us": "2015-03-18",
      "goldblacktree.waldennetworks.com": "2015-03-18",
      "gphpnet.phpnet.us": "2015-03-18",
      "greatechangemind.com": "2015-03-18",
      "greenlabelstud.000space.com": "2015-03-18",
      "gurunichi.createandhost.com": "2015-03-18",
      "halemdus.000space.com": "2015-03-18",
      "heinzmarket.com": "2015-03-18",
      "hotemup.icr38.net": "2015-03-18",
      "humanforum.net": "2015-03-18",
      "hummfoundation.org": "2015-03-18",
      "individuals.sytes.net": "2015-03-18",
      "infonetworks.biz": "2015-03-18",
      "innewsmessenger.com": "2015-03-18",
      "jackie311.byethost16.com": "2015-03-18",
      "jandas.byethost7.com": "2015-03-18",
      "javaupdate.flashserv.net": "2015-03-18",
      "jonejokoss.byethost6.com": "2015-03-18",
      "jonemaccane1.byethost7.com": "2015-03-18",
      "jpnspts.biz": "2015-03-18",
      "jpqueen.biz": "2015-03-18",
      "kaoal.chickenkiller.com": "2015-03-18",
      "laborsforum.org": "2015-03-18",
      "lakers.jumpingcrab.com": "2015-03-18",
      "limited.000space.com": "2015-03-18",
      "lookasjames.000space.com": "2015-03-18",
      "mansgepitostraig.com": "2015-03-18",
      "mbusabc.com": "2022-05-11",
      "mechanicalcomfort.net": "2015-03-18",
      "microalba.serveftp.com": "2015-03-18",
      "microblo5.mooo.com": "2015-03-18",
      "microbrownys.strangled.net": "2015-03-18",
      "microchiefs.twilightparadox.com": "2015-03-18",
      "microchisk.mooo.com": "2015-03-18",
      "microchsse.strangled.net": "2015-03-18",
      "microdelta.crabdance.com": "2015-03-18",
      "microgenuinsman.servebeer.com": "2015-03-18",
      "microjonjokoss.jumpingcrab.com": "2015-03-18",
      "microlilics.000space.com": "2015-03-18",
      "microlilics.crabdance.com": "2015-03-18",
      "micromacrarusn.com": "2015-03-18",
      "micromacs.org": "2015-03-18",
      "micromichi.ezua.com": "2015-03-18",
      "micromps1.net": "2015-03-18",
      "micronames.jumpingcrab.com": "2015-03-18",
      "micronao.hopto.org": "2015-03-18",
      "micronaoko.jumpingcrab.com": "2015-03-18",
      "microos.jumpingcrab.com": "2015-03-18",
      "microplants.strangled.net": "2015-03-18",
      "microsoft-xpupdate.com": "2015-03-18",
      "microyours.ignorelist.com": "2015-03-18",
      "minshatopas12.org": "2015-03-18",
      "msdn4updates.com": "2015-03-18",
      "mshotfix.com": "2015-03-18",
      "msupdates.com": "2015-03-18",
      "myboxofficebox.com": "2022-03-18",
      "myhome.serveuser.com": "2015-03-18",
      "myphone.freei.me": "2015-03-18",
      "nanogalsman.org": "2015-03-18",
      "nanomicsoft.com": "2015-03-18",
      "nanoocspos.com": "2015-03-18",
      "nanosleepss.net": "2015-03-18",
      "ncnbroadcasting.reportinside.net": "2015-03-18",
      "neao.biz": "2015-03-18",
      "neosilba.com": "2015-03-18",
      "new.freecinemaworld.net": "2015-03-18",
      "new.islamicawaken.com": "2015-03-18",
      "newsagencypool.com": "2015-03-18",
      "newsdailyinhk.com": "2015-03-18",
      "newsups.000a.biz": "2015-03-18",
      "nokasblog.agilityhoster.com": "2015-03-18",
      "office-revision.com": "2015-03-18",
      "office-update-checker.com": "2019-06-24",
      "officehoster.com": "2022-05-11",
      "offices-support.com": "2019-06-24",
      "online.usean.biz": "2015-03-18",
      "onlineservice.bounceme.net": "2020-08-25",
      "outlookz.com": "2015-03-18",
      "pb.enewslive.org": "2015-03-18",
      "pb.qocp.net": "2015-03-18",
      "pb.upinfo.biz": "2015-03-18",
      "photo.eonlineworld.com": "2015-03-18",
      "popin.0fees.net": "2015-03-18",
      "private.neao.biz": "2015-03-18",
      "proteingainer.biz": "2015-03-18",
      "pwsmbx.com": "2019-05-30",
      "rainbowbbs.mywebcommunity.org": "2015-03-18",
      "rayp.biz": "2015-03-18",
      "re.policyforums.org": "2015-03-18",
      "redblacksleep.createandhost.com": "2015-03-18",
      "redlooksman.servehttp.com": "2015-03-18",
      "reportinshop.com": "2015-03-18",
      "reportinside.net": "2015-03-18",
      "reuqest-userauth.com": "2019-05-30",
      "rootca.000space.com": "2015-03-18",
      "sales.eu5.org": "2015-03-18",
      "secureonline.net": "2015-03-18",
      "self-makeups.com": "2015-03-18",
      "self-makingups.com": "2015-03-18",
      "sellingconnection.org": "2015-03-18",
      "sens.humanforum.net": "2015-03-18",
      "service-security-manager.com": "2020-05-22",
      "shndia.com": "2015-03-18",
      "silverbell.000space.com": "2015-03-18",
      "sipapals.servehalflife.com": "2015-03-18",
      "smartappactiv.com": "2015-03-18",
      "smartnewup.crabdance.com": "2015-03-18",
      "sourcecodecenter.org": "2015-03-18",
      "spffusa.org": "2022-05-11",
      "spotnews.com": "2015-03-18",
      "sseekk.xyz": "2022-05-11",
      "st.cloins.com": "2015-03-18",
      "star--co.net": "2019-06-24",
      "static-cdn1.com": "2020-08-12",
      "stloelementry.200gigs.com": "2015-03-18",
      "students.serveblog.net": "2015-03-18",
      "tax-lab.net": "2020-05-22",
      "terryblog.110MB.com": "2015-03-18",
      "thenewesthta.mypressonline.com": "2015-03-18",
      "thirdbase.bugs3.com": "2015-03-18",
      "todaynewscentre.net": "2015-03-18",
      "trade-inf.com": "2015-03-18",
      "unknown12.ignorelist.com": "2015-03-18",
      "updaairpush.ignorelist.com": "2015-03-18",
      "updaily.biz.nf": "2015-03-18",
      "updaily.phpnet.us": "2015-03-18",
      "updaisin.net16.net": "2015-03-18",
      "updalsim.freehostee.com": "2015-03-18",
      "updarling.000a.biz": "2015-03-18",
      "updatable.20x.cc": "2015-03-18",
      "updateall.000a.biz": "2015-03-18",
      "updatecache.net": "2015-03-18",
      "updatefast.000a.biz": "2015-03-18",
      "updateiphone.20x.cc": "2015-03-18",
      "updateitunes.waldennetworks.com": "2015-03-18",
      "updatejava.megabyet.net": "2015-03-18",
      "updatepatch.icr38.net": "2015-03-18",
      "updateschedule.verwalten.ch": "2015-03-18",
      "updatesw.110mb.com": "2015-03-18",
      "updatesw.zoka.cc": "2015-03-18",
      "updatewell.freebyte.us": "2015-03-18",
      "updatewifis.dyndns-wiki.com": "2015-03-18",
      "updauganda.waldennetworks.com": "2015-03-18",
      "updawn4you.net84.net": "2015-03-18",
      "upgrade77.steadywebs.com": "2015-03-18",
      "vgmtx.com": "2019-05-30",
      "video.humorme.info": "2015-03-18",
      "voicemailz.net": "2015-03-18",
      "wein.isgreat.org": "2015-03-18",
      "win-api-essentials.com": "2020-05-22",
      "windows-updater.net": "2018-09-07",
      "windowservices.net": "2015-03-18",
      "world.issuetoday.net": "2015-03-18",
      "world.uktimesnews.com": "2015-03-18",
      "wowhome.byethost8.com": "2015-03-18",
      "ww42.200gigs.com": "2015-03-18",
      "yellowleos.phpnet.us": "2015-03-18",
      "youmiuri.com": "2022-05-11",
      "ypiz.net": "2015-03-18"
    },
    "ipv4": {
      "193.29.187.178:51217": "2019-06-24",
      "193.29.187.178:51218": "2019-06-24",
      "91.235.116.147:9782": "2019-06-24"
    },
    "url": {
      "http://134.119.220.118": "2020-08-25",
      "http://185.198.56.191": "2020-08-25"
    },
    "url_path": {
      "/584e3411-14a7-41f4-ba1d-e203609b0471/6126.php": "2019-06-24",
      "/7cdeb7fe-6efd-4459-be2f-1eb0e0088a60/21147.php": "2019-06-24",
      "/banila/config.php": "2019-06-24",
      "/html/docu.php": "2020-09-13",
      "/maro7/article//000C29014444/article_service.html": "2020-09-13",
      "/maro7/live1.php": "2020-09-13",
      "/recommend/ascfree.php": "2020-08-25"
    }
  },
  "first_seen_precision": {
    "domain": {},
    "ipv4": {},
    "url": {},
    "url_path": {}
  },
  "first_seen_range": {
    "earliest": "2015-03-18",
    "latest": "2024-06-17"
  },
  "generated_at": "2026-08-08T03:26:30+00:00",
  "indicators": {
    "domain": [
      "100100011100.com",
      "163pics.net",
      "163services.com",
      "42world.net",
      "779999977.com",
      "88dafa.biz",
      "academyhouse.us",
      "account163-mail.com",
      "ackr.myvnc.com",
      "acrobatup.com",
      "adobearm.com",
      "adobeplugs.net",
      "adoberegister.flashserv.net",
      "adobeupdates.com",
      "albasrostga.com",
      "alexa97.com",
      "alphacranes.com",
      "alphastros.com",
      "amanity50.biz",
      "anti-wars.org",
      "appfreetools.com",
      "apple-onlineservice.com",
      "applyinfo.org",
      "auto2115.icr38.net",
      "auto2116.phpnet.us",
      "auto24col.info",
      "autobaba.net84.net",
      "autoban.phpnet.us",
      "autobicy.yaahosting.info",
      "autobicycle.20x.cc",
      "autobicycle.freehostking.com",
      "autobicyyyyyy.50gigs.net",
      "autoblank.oni.cc",
      "autobrown.gofreeserve.com",
      "autocargo.100gbfreehost.com",
      "autocash.000php.com",
      "autocashhh.hostmefree.org",
      "autocaze.crabdance.com",
      "autocheck.000page.com",
      "autochecker.myftp.biz",
      "autocracy.phpnet.us",
      "autocrat.comuf.com",
      "autodoor.freebyte.us",
      "autof888com.20x.cc",
      "autofseven.freei.me",
      "autogeremys.com",
      "autoinsurance.000space.com",
      "autojob.whostas.com",
      "autoken.scienceontheweb.net",
      "autolace.twilightparadox.com",
      "automachine.servequake.com",
      "automatic.waldennetworks.com",
      "automation.000a.biz",
      "automation.icr38.net",
      "automobile.000a.biz",
      "automobile.200gigs.com",
      "automobile.freei.me",
      "automobile.it.cx",
      "automobile.megabyet.net",
      "automobile.x4host.eu",
      "automobiles.strangled.net",
      "automotive.20x.cc",
      "autonomy.host22.com",
      "autopapa.noads.biz",
      "autopara.oliwy.net",
      "autoparts.phpnet.us",
      "autopatch.createandhost.com",
      "autopatch.verwalten.ch",
      "autophile.00free.net",
      "autopilot.verwalten.ch",
      "autoplant.byethost11.com",
      "autopsy.createandhost.com",
      "autoreviews.dyndns.info",
      "autorico.ignorelist.com",
      "autosadeo.000php.com",
      "autosail.ns01.biz",
      "autoshop.hostmefree.org",
      "autostart.waldennetworks.com",
      "autotest.byethost4.com",
      "autotree.freebyte.us",
      "autoup.eu.pn",
      "autoupdafree.my5gigs.com",
      "autoupdate.eg.vg",
      "autoupdate.freehostia.com",
      "autoupdate.megabyet.net",
      "autoupdate.zoka.cc",
      "autoupdatefree.freehostia.com",
      "autoupdatefree.verwalten.ch",
      "autoupdatefree.waldennetworks.com",
      "autoupdatefree.zoka.cc",
      "autoupdatefreee.my5gigs.com",
      "autoupdates.5gigs.net",
      "autoupdatfreeee.coolwwweb.com",
      "autoupgrade.awardspace.biz",
      "autovita.xtreemhost.com",
      "autovonmanstein.x10.mx",
      "autoworld.serveblog.net",
      "autozone.000space.com",
      "banilasky.com",
      "begatrendsone.com",
      "begatrials.com",
      "behindcorona.com",
      "bigfile-download.net",
      "bizannounce.com",
      "blonze.createandhost.com",
      "bluecat.biz.nf",
      "bluemagazines.servegame.com",
      "bokselpa.dasfree.com",
      "checkingvirusscan.com",
      "clus89.crabdance.com",
      "cnnmedia.servepics.com",
      "codec.servepics.com",
      "control.wrizx.net",
      "cranseme.ignorelist.com",
      "crazymand.twilightparadox.com",
      "crendesting.strangled.net",
      "dailybread.waldennetworks.com",
      "dailyissue.net",
      "dailynews.000page.com",
      "dailypatch-rnr2008.net",
      "dailysummary.net",
      "dailyupdate.110mb.com",
      "differentfor.com",
      "digitalimagestudy.com",
      "disknxt.com",
      "domainmanagemenet.com",
      "donatewa.phpnet.us",
      "downsw.onlinewebshop.net",
      "dpc.servegame.com",
      "ds505cam.com",
      "ebizcentres.com",
      "elibrarycentre.com",
      "email-126.net",
      "err.cloins.com",
      "eztwt.com",
      "fame.mooo.com",
      "fashions.0fees.net",
      "fenraw.northgeremy.info",
      "fenrix.yaahosting.info",
      "fenrmi.eu.pn",
      "find-image.com",
      "foreignaffair.org",
      "fsm-gov.com",
      "game-service.org",
      "gamepia008.my5gigs.com",
      "genelousmanis.phpnet.us",
      "generalemountina.com",
      "genuinsman.phpnet.us",
      "gigahermes.com",
      "gigamiros.zyns.com",
      "gigathread.itemdb.com",
      "gigatrend.org",
      "giveaway.6te.net",
      "goathoney.biz",
      "goizmi.ignorelist.com",
      "goizmi.phpnet.us",
      "goldblacktree.waldennetworks.com",
      "gphpnet.phpnet.us",
      "greatechangemind.com",
      "greenlabelstud.000space.com",
      "gurunichi.createandhost.com",
      "halemdus.000space.com",
      "heinzmarket.com",
      "hotemup.icr38.net",
      "humanforum.net",
      "hummfoundation.org",
      "individuals.sytes.net",
      "infonetworks.biz",
      "innewsmessenger.com",
      "jackie311.byethost16.com",
      "jandas.byethost7.com",
      "javaupdate.flashserv.net",
      "jonejokoss.byethost6.com",
      "jonemaccane1.byethost7.com",
      "jpnspts.biz",
      "jpqueen.biz",
      "kaoal.chickenkiller.com",
      "laborsforum.org",
      "lakers.jumpingcrab.com",
      "limited.000space.com",
      "lookasjames.000space.com",
      "mansgepitostraig.com",
      "mbusabc.com",
      "mechanicalcomfort.net",
      "microalba.serveftp.com",
      "microblo5.mooo.com",
      "microbrownys.strangled.net",
      "microchiefs.twilightparadox.com",
      "microchisk.mooo.com",
      "microchsse.strangled.net",
      "microdelta.crabdance.com",
      "microgenuinsman.servebeer.com",
      "microjonjokoss.jumpingcrab.com",
      "microlilics.000space.com",
      "microlilics.crabdance.com",
      "micromacrarusn.com",
      "micromacs.org",
      "micromichi.ezua.com",
      "micromps1.net",
      "micronames.jumpingcrab.com",
      "micronao.hopto.org",
      "micronaoko.jumpingcrab.com",
      "microos.jumpingcrab.com",
      "microplants.strangled.net",
      "microsoft-xpupdate.com",
      "microyours.ignorelist.com",
      "minshatopas12.org",
      "msdn4updates.com",
      "mshotfix.com",
      "msupdates.com",
      "myboxofficebox.com",
      "myhome.serveuser.com",
      "myphone.freei.me",
      "nanogalsman.org",
      "nanomicsoft.com",
      "nanoocspos.com",
      "nanosleepss.net",
      "ncnbroadcasting.reportinside.net",
      "neao.biz",
      "neosilba.com",
      "new.freecinemaworld.net",
      "new.islamicawaken.com",
      "newsagencypool.com",
      "newsdailyinhk.com",
      "newsups.000a.biz",
      "nokasblog.agilityhoster.com",
      "office-revision.com",
      "office-update-checker.com",
      "officehoster.com",
      "offices-support.com",
      "online.usean.biz",
      "onlineservice.bounceme.net",
      "outlookz.com",
      "pb.enewslive.org",
      "pb.qocp.net",
      "pb.upinfo.biz",
      "photo.eonlineworld.com",
      "popin.0fees.net",
      "private.neao.biz",
      "proteingainer.biz",
      "pwsmbx.com",
      "rainbowbbs.mywebcommunity.org",
      "rayp.biz",
      "re.policyforums.org",
      "redblacksleep.createandhost.com",
      "redlooksman.servehttp.com",
      "reportinshop.com",
      "reportinside.net",
      "reuqest-userauth.com",
      "rootca.000space.com",
      "sales.eu5.org",
      "secureonline.net",
      "self-makeups.com",
      "self-makingups.com",
      "sellingconnection.org",
      "sens.humanforum.net",
      "service-security-manager.com",
      "shndia.com",
      "silverbell.000space.com",
      "sipapals.servehalflife.com",
      "smartappactiv.com",
      "smartnewup.crabdance.com",
      "sourcecodecenter.org",
      "spffusa.org",
      "spotnews.com",
      "sseekk.xyz",
      "st.cloins.com",
      "star--co.net",
      "static-cdn1.com",
      "stloelementry.200gigs.com",
      "students.serveblog.net",
      "tax-lab.net",
      "terryblog.110MB.com",
      "thenewesthta.mypressonline.com",
      "thirdbase.bugs3.com",
      "todaynewscentre.net",
      "trade-inf.com",
      "unknown12.ignorelist.com",
      "updaairpush.ignorelist.com",
      "updaily.biz.nf",
      "updaily.phpnet.us",
      "updaisin.net16.net",
      "updalsim.freehostee.com",
      "updarling.000a.biz",
      "updatable.20x.cc",
      "updateall.000a.biz",
      "updatecache.net",
      "updatefast.000a.biz",
      "updateiphone.20x.cc",
      "updateitunes.waldennetworks.com",
      "updatejava.megabyet.net",
      "updatepatch.icr38.net",
      "updateschedule.verwalten.ch",
      "updatesw.110mb.com",
      "updatesw.zoka.cc",
      "updatewell.freebyte.us",
      "updatewifis.dyndns-wiki.com",
      "updauganda.waldennetworks.com",
      "updawn4you.net84.net",
      "upgrade77.steadywebs.com",
      "vgmtx.com",
      "video.humorme.info",
      "voicemailz.net",
      "wein.isgreat.org",
      "win-api-essentials.com",
      "windows-updater.net",
      "windowservices.net",
      "world.issuetoday.net",
      "world.uktimesnews.com",
      "wowhome.byethost8.com",
      "ww42.200gigs.com",
      "yellowleos.phpnet.us",
      "youmiuri.com",
      "ypiz.net"
    ],
    "ipv4": [
      "193.29.187.178:51217",
      "193.29.187.178:51218",
      "91.235.116.147:9782"
    ],
    "url": [
      "http://134.119.220.118",
      "http://185.198.56.191"
    ],
    "url_path": [
      "/584e3411-14a7-41f4-ba1d-e203609b0471/6126.php",
      "/7cdeb7fe-6efd-4459-be2f-1eb0e0088a60/21147.php",
      "/banila/config.php",
      "/html/docu.php",
      "/maro7/article//000C29014444/article_service.html",
      "/maro7/live1.php",
      "/recommend/ascfree.php"
    ]
  },
  "last_modified": "2026-01-02T23:10:15+00:00",
  "maltrail_groups": [
    "DARKHOTEL"
  ],
  "references": [
    "http://blog.nsfocus.net/darkhotel-3-0908/",
    "http://securelist.com/blog/research/66779/the-darkhotel-apt/",
    "https://blogs.jpcert.or.jp/ja/2019/05/darkhotel_lnk.html (Japanese)",
    "https://insight-jp.nttsecurity.com/post/102ho8o/operation-restylink (Japanese)",
    "https://mp.weixin.qq.com/s/nyxZFXgrtm2-tBiV3-wiMg",
    "https://otx.alienvault.com/pulse/5cee9ffe72473a4c259773b7",
    "https://otx.alienvault.com/pulse/5dbc5ca2e4310e29af9612e3",
    "https://otx.alienvault.com/pulse/5f34088f58d80664ae9fbd1c",
    "https://otx.alienvault.com/pulse/627b9aa3b3842d989f57bfe6",
    "https://researchcenter.paloaltonetworks.com/2018/09/unit42-traps-prevents-wild-vbscript-zero-day-exploit-internet-explorer/",
    "https://s.tencent.com/research/report/741.html (Chinese)",
    "https://securelist.com/chrome-0-day-exploit-cve-2019-13720-used-in-operation-wizardopium/94866/",
    "https://securelist.com/ie-and-windows-zero-day-operation-powerfall/97976/",
    "https://ti.360.net/blog/articles/analyzing-attack-of-cve-2018-8373-and-darkhotel/",
    "https://twitter.com/blackorbird/status/1178491520518770688",
    "https://twitter.com/blackorbird/status/1245597745403969544",
    "https://twitter.com/blackorbird/status/1263843202311663616",
    "https://twitter.com/ximo2006/status/1142983148893954048",
    "https://www.antiy.cn/research/notice&report/research_report/20200522.html (Chinese)",
    "https://www.trellix.com/en-us/about/newsroom/stories/threat-labs/suspected-darkhotel-apt-activity-update.html",
    "https://www.virustotal.com/gui/file/6048f17c1271c0f946225ec6a3d1f4b84c4df098f854dbce139b858795485836/detection",
    "https://www.virustotal.com/gui/file/da0c905ab56f598c50573495085657b80b76557d12f9416fd4a4a96632a000e1/detection",
    "https://www.virustotal.com/gui/file/f699f5c8ea766afe9cffcff198d13550027e5a311f4a9618a804a585088ff8db/detection"
  ],
  "related": [],
  "slug": "G0012",
  "timeline": [
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2024-06-17",
      "indicators": {
        "domain": [
          "alexa97.com"
        ]
      },
      "precision": "exact",
      "references": [
        "http://securelist.com/blog/research/66779/the-darkhotel-apt/"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 7
      },
      "first_seen": "2022-05-11",
      "indicators": {
        "domain": [
          "differentfor.com",
          "disknxt.com",
          "mbusabc.com",
          "officehoster.com",
          "spffusa.org",
          "sseekk.xyz",
          "youmiuri.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://insight-jp.nttsecurity.com/post/102ho8o/operation-restylink (Japanese)",
        "https://otx.alienvault.com/pulse/627b9aa3b3842d989f57bfe6"
      ],
      "total": 7
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2022-03-18",
      "indicators": {
        "domain": [
          "myboxofficebox.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://www.virustotal.com/gui/file/da0c905ab56f598c50573495085657b80b76557d12f9416fd4a4a96632a000e1/detection"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2022-03-18",
      "indicators": {
        "domain": [
          "fsm-gov.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://www.trellix.com/en-us/about/newsroom/stories/threat-labs/suspected-darkhotel-apt-activity-update.html",
        "https://www.virustotal.com/gui/file/f699f5c8ea766afe9cffcff198d13550027e5a311f4a9618a804a585088ff8db/detection"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 1,
        "url_path": 3
      },
      "first_seen": "2020-09-13",
      "indicators": {
        "domain": [
          "bigfile-download.net"
        ],
        "url_path": [
          "/html/docu.php",
          "/maro7/article//000C29014444/article_service.html",
          "/maro7/live1.php"
        ]
      },
      "precision": "exact",
      "references": [
        "http://blog.nsfocus.net/darkhotel-3-0908/",
        "https://www.virustotal.com/gui/file/6048f17c1271c0f946225ec6a3d1f4b84c4df098f854dbce139b858795485836/detection"
      ],
      "total": 4
    },
    {
      "counts": {
        "domain": 3,
        "url": 2,
        "url_path": 1
      },
      "first_seen": "2020-08-25",
      "indicators": {
        "domain": [
          "account163-mail.com",
          "apple-onlineservice.com",
          "onlineservice.bounceme.net"
        ],
        "url": [
          "http://134.119.220.118",
          "http://185.198.56.191"
        ],
        "url_path": [
          "/recommend/ascfree.php"
        ]
      },
      "precision": "exact",
      "references": [
        "https://mp.weixin.qq.com/s/nyxZFXgrtm2-tBiV3-wiMg"
      ],
      "total": 6
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2020-08-12",
      "indicators": {
        "domain": [
          "static-cdn1.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://securelist.com/ie-and-windows-zero-day-operation-powerfall/97976/",
        "https://otx.alienvault.com/pulse/5f34088f58d80664ae9fbd1c"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 4
      },
      "first_seen": "2020-05-22",
      "indicators": {
        "domain": [
          "email-126.net",
          "find-image.com",
          "service-security-manager.com",
          "win-api-essentials.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/blackorbird/status/1263843202311663616",
        "https://www.antiy.cn/research/notice&report/research_report/20200522.html (Chinese)"
      ],
      "total": 4
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2020-05-22",
      "indicators": {
        "domain": [
          "tax-lab.net"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/blackorbird/status/1245597745403969544"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2020-04-02",
      "indicators": {
        "domain": [
          "cnnmedia.servepics.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/blackorbird/status/1245597745403969544"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2019-11-01",
      "indicators": {
        "domain": [
          "behindcorona.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://securelist.com/chrome-0-day-exploit-cve-2019-13720-used-in-operation-wizardopium/94866/",
        "https://otx.alienvault.com/pulse/5dbc5ca2e4310e29af9612e3"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 7,
        "ipv4": 3,
        "url_path": 3
      },
      "first_seen": "2019-06-24",
      "indicators": {
        "domain": [
          "100100011100.com",
          "779999977.com",
          "banilasky.com",
          "game-service.org",
          "office-update-checker.com",
          "offices-support.com",
          "star--co.net"
        ],
        "ipv4": [
          "193.29.187.178:51217",
          "193.29.187.178:51218",
          "91.235.116.147:9782"
        ],
        "url_path": [
          "/584e3411-14a7-41f4-ba1d-e203609b0471/6126.php",
          "/7cdeb7fe-6efd-4459-be2f-1eb0e0088a60/21147.php",
          "/banila/config.php"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/ximo2006/status/1142983148893954048",
        "https://s.tencent.com/research/report/741.html (Chinese)"
      ],
      "total": 13
    },
    {
      "counts": {
        "domain": 3
      },
      "first_seen": "2019-05-30",
      "indicators": {
        "domain": [
          "pwsmbx.com",
          "reuqest-userauth.com",
          "vgmtx.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://blogs.jpcert.or.jp/ja/2019/05/darkhotel_lnk.html (Japanese)",
        "https://otx.alienvault.com/pulse/5cee9ffe72473a4c259773b7"
      ],
      "total": 3
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2018-09-07",
      "indicators": {
        "domain": [
          "windows-updater.net"
        ]
      },
      "precision": "exact",
      "references": [
        "https://ti.360.net/blog/articles/analyzing-attack-of-cve-2018-8373-and-darkhotel/",
        "https://researchcenter.paloaltonetworks.com/2018/09/unit42-traps-prevents-wild-vbscript-zero-day-exploit-internet-explorer/"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 2
      },
      "first_seen": "2016-02-23",
      "indicators": {
        "domain": [
          "appfreetools.com",
          "digitalimagestudy.com"
        ]
      },
      "precision": "exact",
      "references": [
        "http://securelist.com/blog/research/66779/the-darkhotel-apt/"
      ],
      "total": 2
    },
    {
      "counts": {
        "domain": 273
      },
      "first_seen": "2015-03-18",
      "indicators": {
        "domain": [
          "163pics.net",
          "163services.com",
          "42world.net",
          "88dafa.biz",
          "academyhouse.us",
          "ackr.myvnc.com",
          "acrobatup.com",
          "adobearm.com",
          "adobeplugs.net",
          "adoberegister.flashserv.net",
          "adobeupdates.com",
          "albasrostga.com",
          "alphacranes.com",
          "alphastros.com",
          "amanity50.biz",
          "anti-wars.org",
          "applyinfo.org",
          "auto2115.icr38.net",
          "auto2116.phpnet.us",
          "auto24col.info",
          "autobaba.net84.net",
          "autoban.phpnet.us",
          "autobicy.yaahosting.info",
          "autobicycle.20x.cc",
          "autobicycle.freehostking.com",
          "autobicyyyyyy.50gigs.net",
          "autoblank.oni.cc",
          "autobrown.gofreeserve.com",
          "autocash.000php.com",
          "autocashhh.hostmefree.org",
          "autocaze.crabdance.com",
          "autochecker.myftp.biz",
          "autocracy.phpnet.us",
          "autocrat.comuf.com",
          "autodoor.freebyte.us",
          "autof888com.20x.cc",
          "autofseven.freei.me",
          "autogeremys.com",
          "autoinsurance.000space.com",
          "autojob.whostas.com",
          "autoken.scienceontheweb.net",
          "autolace.twilightparadox.com",
          "automachine.servequake.com",
          "automatic.waldennetworks.com",
          "automation.000a.biz",
          "automation.icr38.net",
          "automobile.000a.biz",
          "automobile.200gigs.com",
          "automobile.it.cx",
          "automobile.megabyet.net",
          "automobile.x4host.eu",
          "automobiles.strangled.net",
          "automotive.20x.cc",
          "autonomy.host22.com",
          "autopapa.noads.biz",
          "autopara.oliwy.net",
          "autoparts.phpnet.us",
          "autopatch.createandhost.com",
          "autopatch.verwalten.ch",
          "autophile.00free.net",
          "autopilot.verwalten.ch",
          "autoplant.byethost11.com",
          "autopsy.createandhost.com",
          "autoreviews.dyndns.info",
          "autorico.ignorelist.com",
          "autosadeo.000php.com",
          "autosail.ns01.biz",
          "autoshop.hostmefree.org",
          "autostart.waldennetworks.com",
          "autotest.byethost4.com",
          "autotree.freebyte.us",
          "autoup.eu.pn",
          "autoupdafree.my5gigs.com",
          "autoupdate.eg.vg",
          "autoupdate.freehostia.com",
          "autoupdate.megabyet.net",
          "autoupdate.zoka.cc",
          "autoupdatefree.freehostia.com",
          "autoupdatefree.verwalten.ch",
          "autoupdatefree.waldennetworks.com",
          "autoupdatefree.zoka.cc",
          "autoupdatefreee.my5gigs.com",
          "autoupdates.5gigs.net",
          "autoupdatfreeee.coolwwweb.com",
          "autoupgrade.awardspace.biz",
          "autovita.xtreemhost.com",
          "autovonmanstein.x10.mx",
          "autoworld.serveblog.net",
          "autozone.000space.com",
          "begatrendsone.com",
          "begatrials.com",
          "bizannounce.com",
          "blonze.createandhost.com",
          "bluecat.biz.nf",
          "bluemagazines.servegame.com",
          "bokselpa.dasfree.com",
          "checkingvirusscan.com",
          "clus89.crabdance.com",
          "codec.servepics.com",
          "control.wrizx.net",
          "cranseme.ignorelist.com",
          "crazymand.twilightparadox.com",
          "crendesting.strangled.net",
          "dailybread.waldennetworks.com",
          "dailyissue.net",
          "dailynews.000page.com",
          "dailypatch-rnr2008.net",
          "dailysummary.net",
          "dailyupdate.110mb.com",
          "domainmanagemenet.com",
          "donatewa.phpnet.us",
          "downsw.onlinewebshop.net",
          "dpc.servegame.com",
          "ds505cam.com",
          "ebizcentres.com",
          "elibrarycentre.com",
          "err.cloins.com",
          "eztwt.com",
          "fame.mooo.com",
          "fashions.0fees.net",
          "foreignaffair.org",
          "gamepia008.my5gigs.com",
          "genelousmanis.phpnet.us",
          "generalemountina.com",
          "genuinsman.phpnet.us",
          "gigahermes.com",
          "gigamiros.zyns.com",
          "gigathread.itemdb.com",
          "gigatrend.org",
          "giveaway.6te.net",
          "goathoney.biz",
          "goizmi.ignorelist.com",
          "goizmi.phpnet.us",
          "goldblacktree.waldennetworks.com",
          "gphpnet.phpnet.us",
          "greatechangemind.com",
          "greenlabelstud.000space.com",
          "gurunichi.createandhost.com",
          "halemdus.000space.com",
          "heinzmarket.com",
          "hotemup.icr38.net",
          "humanforum.net",
          "hummfoundation.org",
          "individuals.sytes.net",
          "infonetworks.biz",
          "innewsmessenger.com",
          "jackie311.byethost16.com",
          "jandas.byethost7.com",
          "javaupdate.flashserv.net",
          "jonejokoss.byethost6.com",
          "jonemaccane1.byethost7.com",
          "jpnspts.biz",
          "jpqueen.biz",
          "kaoal.chickenkiller.com",
          "laborsforum.org",
          "lakers.jumpingcrab.com",
          "limited.000space.com",
          "lookasjames.000space.com",
          "mansgepitostraig.com",
          "mechanicalcomfort.net",
          "microalba.serveftp.com",
          "microblo5.mooo.com",
          "microbrownys.strangled.net",
          "microchiefs.twilightparadox.com",
          "microchisk.mooo.com",
          "microchsse.strangled.net",
          "microdelta.crabdance.com",
          "microgenuinsman.servebeer.com",
          "microjonjokoss.jumpingcrab.com",
          "microlilics.000space.com",
          "microlilics.crabdance.com",
          "micromacrarusn.com",
          "micromacs.org",
          "micromichi.ezua.com",
          "micromps1.net",
          "micronames.jumpingcrab.com",
          "micronao.hopto.org",
          "micronaoko.jumpingcrab.com",
          "microos.jumpingcrab.com",
          "microplants.strangled.net",
          "microsoft-xpupdate.com",
          "microyours.ignorelist.com",
          "minshatopas12.org",
          "msdn4updates.com",
          "mshotfix.com",
          "msupdates.com",
          "myhome.serveuser.com",
          "myphone.freei.me",
          "nanogalsman.org",
          "nanomicsoft.com",
          "nanoocspos.com",
          "nanosleepss.net",
          "ncnbroadcasting.reportinside.net",
          "neao.biz",
          "neosilba.com",
          "new.freecinemaworld.net",
          "new.islamicawaken.com",
          "newsagencypool.com",
          "newsdailyinhk.com",
          "newsups.000a.biz",
          "nokasblog.agilityhoster.com",
          "office-revision.com",
          "online.usean.biz",
          "outlookz.com",
          "pb.enewslive.org",
          "pb.qocp.net",
          "pb.upinfo.biz",
          "photo.eonlineworld.com",
          "popin.0fees.net",
          "private.neao.biz",
          "proteingainer.biz",
          "rainbowbbs.mywebcommunity.org",
          "rayp.biz",
          "re.policyforums.org",
          "redblacksleep.createandhost.com",
          "redlooksman.servehttp.com",
          "reportinshop.com",
          "reportinside.net",
          "rootca.000space.com",
          "sales.eu5.org",
          "secureonline.net",
          "self-makeups.com",
          "self-makingups.com",
          "sellingconnection.org",
          "sens.humanforum.net",
          "shndia.com",
          "silverbell.000space.com",
          "sipapals.servehalflife.com",
          "smartappactiv.com",
          "smartnewup.crabdance.com",
          "sourcecodecenter.org",
          "spotnews.com",
          "st.cloins.com",
          "stloelementry.200gigs.com",
          "students.serveblog.net",
          "terryblog.110MB.com",
          "thenewesthta.mypressonline.com",
          "thirdbase.bugs3.com",
          "todaynewscentre.net",
          "trade-inf.com",
          "unknown12.ignorelist.com",
          "updaairpush.ignorelist.com",
          "updaily.biz.nf",
          "updaily.phpnet.us",
          "updaisin.net16.net",
          "updalsim.freehostee.com",
          "updarling.000a.biz",
          "updatable.20x.cc",
          "updateall.000a.biz",
          "updatecache.net",
          "updatefast.000a.biz",
          "updateiphone.20x.cc",
          "updateitunes.waldennetworks.com",
          "updatejava.megabyet.net",
          "updatepatch.icr38.net",
          "updateschedule.verwalten.ch",
          "updatesw.110mb.com",
          "updatesw.zoka.cc",
          "updatewell.freebyte.us",
          "updatewifis.dyndns-wiki.com",
          "updauganda.waldennetworks.com",
          "updawn4you.net84.net",
          "upgrade77.steadywebs.com",
          "video.humorme.info",
          "voicemailz.net",
          "wein.isgreat.org",
          "windowservices.net",
          "world.issuetoday.net",
          "world.uktimesnews.com",
          "wowhome.byethost8.com",
          "ww42.200gigs.com",
          "yellowleos.phpnet.us",
          "ypiz.net"
        ]
      },
      "precision": "exact",
      "references": [
        "http://securelist.com/blog/research/66779/the-darkhotel-apt/"
      ],
      "total": 273
    },
    {
      "counts": {
        "domain": 3
      },
      "first_seen": "2015-03-18",
      "indicators": {
        "domain": [
          "autocargo.100gbfreehost.com",
          "autocheck.000page.com",
          "automobile.freei.me"
        ]
      },
      "precision": "exact",
      "references": [
        "http://securelist.com/blog/research/66779/the-darkhotel-apt/",
        "https://twitter.com/blackorbird/status/1178491520518770688"
      ],
      "total": 3
    },
    {
      "counts": {
        "domain": 3
      },
      "first_seen": "2015-03-18",
      "indicators": {
        "domain": [
          "fenraw.northgeremy.info",
          "fenrix.yaahosting.info",
          "fenrmi.eu.pn"
        ]
      },
      "precision": "exact",
      "references": [
        "http://securelist.com/blog/research/66779/the-darkhotel-apt/",
        "http://blog.nsfocus.net/darkhotel-3-0908/",
        "https://www.virustotal.com/gui/file/6048f17c1271c0f946225ec6a3d1f4b84c4df098f854dbce139b858795485836/detection"
      ],
      "total": 3
    }
  ]
}